NSE7 Practice Exam 56 — 20 Questions

Question 1

An administrator wants to monitor CPU usage of specific processes on a FortiGate. Which command should be used?

Accepted Answer

diagnose sys top. The 'diagnose sys top' command is the correct tool for monitoring CPU usage of specific processes on a FortiGate because it provides a real-time, interactive view of process-level CPU and memory utilization, allowing the administrator to identify which processes are consuming resources. Unlike the other options, this diagnostic command is specifically designed for granular process monitoring in FortiOS.

Answer

get system performance status

Answer

get system performance

Answer

top

Question 2

A BGP peering between two FortiGates is not establishing. The admin runs 'get router info bgp summary' and sees the neighbor state as 'Idle'. What is the most common cause of a BGP session stuck in Idle?

Accepted Answer

The neighbor IP is not reachable or the TCP port 179 is blocked. The Idle state in BGP indicates that the session has not started or has been reset, often because the underlying TCP connection cannot be established. The most common cause is that the neighbor IP is unreachable or TCP port 179 is blocked by a firewall or ACL, preventing the three-way handshake. Without TCP connectivity, BGP cannot transition out of Idle, regardless of other configurations.

Answer

The BGP update timer is set too high

Answer

The remote AS number is misconfigured

Answer

The route advertisement is disabled

Question 3

A FortiGate admin runs 'diagnose debug application sslvpn -1' and sees repeated messages: 'SSL VPN tunnel establishment failed: no response from client.' The remote user reports that the FortiClient VPN connects but no traffic passes. What is the MOST likely cause?

Accepted Answer

A firewall on the remote user's network is blocking UDP port 4500 or TCP port 443. The 'no response from client' message indicates the FortiGate is not receiving the expected reply from the client during SSL VPN tunnel establishment. This typically occurs when a firewall on the remote user's network blocks UDP port 4500 (IPsec NAT traversal) or TCP port 443 (HTTPS control channel), preventing the FortiClient from completing the tunnel negotiation. The fact that the client 'connects' but no traffic passes suggests the initial SSL handshake succeeds, but the subsequent tunnel setup fails due to packet loss or filtering.

Answer

The SSL VPN realm is misconfigured

Answer

The SSL VPN certificate has expired

Answer

The remote user's FortiClient version is incompatible

Question 4

Which TWO email authentication mechanisms does FortiMail support to verify sender identity and reduce spoofing? (Choose two.)

Accepted Answer

SPF (Sender Policy Framework). FortiMail supports SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) as email authentication mechanisms to verify sender identity and reduce spoofing. SPF allows the domain owner to publish authorized sending IP addresses in DNS TXT records, while DKIM uses a digital signature added to the email header, verified against a public key in the sender's DNS. Both are core components of email authentication that FortiMail can enforce or validate.

Answer

DMARC (Domain-based Message Authentication, Reporting & Conformance)

Answer

STARTTLS

Answer

S/MIME

Question 5

What is the function of FortiAnalyzer in a Fortinet Security Fabric?

Accepted Answer

To collect logs and generate reports and incidents. FortiAnalyzer is the centralized logging and reporting appliance within the Fortinet Security Fabric. It collects logs from FortiGate and other Fabric components, correlates events, generates compliance reports, and creates incidents for security analysis. This aligns directly with option A, as its primary function is log aggregation and report generation, not real-time management or VPN termination.

Answer

To manage VDOM configurations

Answer

To act as a VPN concentrator

Answer

To provide real-time firewall management

Question 6

A FortiGate is running OSPF with multiple areas. The admin wants to redistribute a static route (192.168.100.0/24) into OSPF area 0. The route is configured as a static route on the FortiGate. Which configuration step is essential to ensure the static route is redistributed into OSPF?

Accepted Answer

Enable 'redistribute static' under the OSPF router configuration. The 'redistribute static' command under OSPF router configuration is the essential step to inject static routes into the OSPF domain. Without this explicit redistribution command, OSPF will not advertise any static routes, regardless of other filtering or metric settings. This is a fundamental requirement for route redistribution in OSPF.

Answer

Create a prefix list to allow the static route and apply it to the OSPF area

Answer

Set the administrative distance of the static route to 110

Answer

Configure a route map to match the static route and set OSPF type

Question 7

A FortiGate has two WAN interfaces (port1, port2) as SD-WAN members. The performance SLA monitor is configured for both with a latency threshold of 50 ms. The measured latency on port1 is 45 ms and on port2 is 55 ms. An SD-WAN rule uses 'lowest-cost' algorithm. Which interface will be selected for new sessions?

Accepted Answer

port1 because its latency is within threshold and lower than port2. The SD-WAN rule uses the 'lowest-cost' algorithm, which selects the interface with the lowest cost among those that meet the performance SLA threshold. Here, port1 has a measured latency of 45 ms, which is below the 50 ms threshold, while port2's latency of 55 ms exceeds the threshold, making port2 ineligible. Therefore, port1 is the only qualifying interface and is selected for new sessions.

Answer

port2 because port1's latency is close to threshold

Answer

The session is dropped

Answer

Both interfaces are used equally

Question 8

A FortiGate administrator configures inter-VDOM routing. Traffic from VDOM-A to VDOM-B is blocked. The administrator checks the policy in VDOM-A allowing traffic to the VDOM link interface. What else must be verified?

Accepted Answer

That there is a corresponding policy in VDOM-B allowing traffic from the VDOM link to the destination. In inter-VDOM routing, traffic traverses a VDOM link, which consists of two interfaces—one in each VDOM. A policy in VDOM-A permits traffic to the VDOM link interface, but the packet must also be allowed by a policy in VDOM-B from the VDOM link interface to the destination. Without this second policy, VDOM-B will drop the traffic, even if VDOM-A's policy is correct.

Answer

That the VDOM link uses a different interface type

Answer

That the VDOM link interface is in the same subnet

Answer

That inter-VDOM routing is enabled in system settings

Question 9

An administrator is configuring SD-WAN rules to steer traffic based on application performance. The requirement is to use VoIP traffic over the WAN link that has the lowest latency, but if latency exceeds 100ms, fail over to a backup link. The administrator has already created performance SLAs for both links. Which THREE configuration steps are required?

Accepted Answer

Configure the SLA metric to 'latency' in the performance SLA. The performance SLA must be configured to monitor latency as the metric to measure link quality. Without setting the SLA metric to 'latency', the SD-WAN rule cannot evaluate which link has the lowest latency for VoIP traffic, which is the core requirement.

Answer

Set the 'failover-threshold' on each SD-WAN member to 100

Answer

Add both WAN interfaces to the rule as members and set weight based on latency

Question 10

Which command is used on a FortiGate to view the current state of BFD sessions?

Accepted Answer

diagnose sys bfd session list. 'diagnose sys bfd session list' is the FortiGate CLI command used to display the current state of Bidirectional Forwarding Detection (BFD) sessions, including session state, local/remote discriminators, and timers. This command is part of the 'diagnose' utility, which provides detailed operational and diagnostic information for troubleshooting BFD in SD-WAN or routing contexts.

Answer

get router info bfd

Answer

show bfd sessions

Answer

execute bfd show

Question 11

An administrator runs 'diagnose debug application ipsmonitor -1' and sees repeated messages: 'IPS engine restarting'. What is the MOST likely cause of this behavior?

Accepted Answer

The IPS engine is running out of memory. The 'IPS engine restarting' message in the output of 'diagnose debug application ipsmonitor -1' indicates that the IPS engine process is crashing and being automatically restarted by the FortiGate's watchdog. The most common cause of IPS engine crashes is memory exhaustion, as the engine requires a dedicated memory heap to process signatures and sessions; when this heap is depleted, the engine terminates to prevent system instability.

Answer

The FortiGate is overloaded with too many concurrent sessions

Answer

The firewall policy is configured for flow-based inspection

Answer

The IPS signatures are outdated and need updating

Question 12

A network administrator needs to create a separate firewall policy for the guest network while keeping management traffic in the main VDOM. Which VDOM type should be configured for the guest network?

Accepted Answer

Traffic VDOM. A Traffic VDOM is a lightweight VDOM type designed specifically to handle user traffic, such as guest network traffic, without the overhead of management-plane functions. It allows the administrator to separate guest traffic into its own firewall policy domain while keeping management traffic (e.g., SSH, HTTPS, SNMP) in the main Root VDOM, ensuring that guest users cannot access the management interface or configuration.

Answer

Root VDOM

Answer

Administrative VDOM

Answer

Management VDOM

Question 13

A network administrator is configuring SD-WAN rules and wants to ensure that voice traffic is sent over the link with the lowest jitter. Which TWO configurations should the administrator apply? (Choose two.)

Accepted Answer

Set the SD-WAN rule strategy to 'best quality'. Setting the SD-WAN rule strategy to 'best quality' instructs FortiGate to select the link with the best performance metrics, such as lowest jitter, based on the configured performance SLA. This strategy dynamically routes traffic to the interface that meets the SLA targets, ensuring voice traffic uses the link with the lowest jitter.

Answer

Set the SD-WAN rule strategy to 'lowest cost'

Answer

Configure the SD-WAN rule to use 'volume' load balancing

Answer

Enable 'set jitter-threshold' on the SD-WAN rule

Question 14

In a multi-VDOM deployment, what is the purpose of inter-VDOM routing?

Accepted Answer

To allow traffic to pass between different VDOMs via firewall policies. Inter-VDOM routing allows traffic to be forwarded between different VDOMs on the same FortiGate unit. This is achieved by configuring inter-VDOM links (IVL) or using VDOM peering, and then applying firewall policies to control and secure the traffic flow between VDOMs. Option C correctly identifies that firewall policies are the mechanism used to permit or deny inter-VDOM traffic.

Answer

To route traffic between the management VDOM and data VDOMs

Answer

To provide redundancy for VDOMs in an HA setup

Answer

To connect VDOMs to external routers

Question 15

During a BGP troubleshooting session, an administrator sees that the BGP neighbor state is 'Active'. Which three conditions could cause this state? (Choose THREE.)

Accepted Answer

The remote AS number is misconfigured. A misconfigured remote AS number causes the BGP neighbor to remain in the 'Active' state. BGP uses the remote AS number to validate the OPEN message; if the AS number in the OPEN message does not match the configured remote AS, the session is rejected, and the neighbor stays in Active, repeatedly attempting to establish a TCP connection.

Answer

The BGP update timer is too short

Answer

The maximum-prefix limit has been exceeded

Question 16

A FortiGate has multiple equal-cost routes to the same destination via two different interfaces. ECMP load balancing is enabled. What determines how traffic is distributed among the routes?

Accepted Answer

A hash of source and destination IP addresses. When ECMP load balancing is enabled on a FortiGate, traffic distribution among equal-cost routes is determined by a hash algorithm that uses source and destination IP addresses (and optionally ports) to select the egress interface. This ensures that all packets belonging to the same flow are consistently forwarded via the same path, preserving packet order and avoiding reordering issues.

Answer

The interface speed

Answer

Round-robin per packet

Answer

The route metric

Question 17

What is the purpose of a Global ADOM in FortiManager?

Accepted Answer

To share common objects and policies across multiple ADOMs. A Global ADOM in FortiManager is a special administrative domain that stores objects and policies shared across multiple regular ADOMs. This allows administrators to define common objects (e.g., address groups, services, schedules) once in the Global ADOM and then reference them in per-ADOM policies, ensuring consistency and reducing duplication. It does not replace the root ADOM, nor is it limited to backups or single-VDOM management.

Answer

To store backup configurations only

Answer

To manage all FortiGates in a single VDOM

Answer

To replace the root ADOM for system settings

Question 18

A FortiGate is receiving BGP routes from a neighbor but not advertising them to other peers. The administrator runs 'get router info bgp network' and sees the routes are in the BGP table but not advertised. What is the most likely cause?

Accepted Answer

An outbound route map is applied that filters these routes. An outbound route map can explicitly filter which routes are advertised to BGP peers. Even though routes are present in the BGP table (as shown by 'get router info bgp network'), an outbound route map applied to the neighbor configuration can deny or modify those routes before they are sent, preventing their advertisement.

Answer

BGP synchronization is enabled and the routes are not in the IGP

Answer

The next hop is unreachable

Answer

The router-id is the same as the peer

Question 19

A company wants to deploy ZTNA to secure access to internal applications for remote employees. They have a FortiGate with a public IP and internal servers. Which deployment mode should they choose to minimize changes to existing firewall rules?

Accepted Answer

Proxy-based ZTNA. Proxy-based ZTNA (Option D) is correct because it uses a forward proxy architecture that intercepts traffic at Layer 7, allowing the FortiGate to enforce ZTNA access policies without modifying existing firewall rules. The proxy terminates the client connection and initiates a new connection to the internal server, so no inbound port forwarding or firewall rule changes are needed for the internal servers.

Answer

SSL VPN with ZTNA

Answer

IPsec VPN with ZTNA

Answer

Both proxy-based and IPsec VPN

Question 20

A network engineer is configuring an HA pair of FortiGate firewalls. They want to ensure that session failover occurs for UDP-based voice traffic with minimal interruption. Which HA configuration setting is most important for achieving this goal?

Accepted Answer

Enable session-pickup. Session-pickup is the correct setting because it enables the secondary FortiGate to synchronize UDP session state information from the primary, allowing seamless failover of voice traffic without requiring new session establishment. UDP is connectionless, so without session-pickup, the secondary would drop the traffic as unknown, causing noticeable interruption in real-time voice streams.

Answer

Enable session-pickup-delay

Answer

Set ha-pickup-delay to 0

Answer

Configure ha-mgmt-interfaces