NSE7 Practice Exam 57 — 20 Questions

Question 1

A FortiGate has two WAN interfaces configured as SD-WAN members. The administrator wants traffic to specific destination IP addresses to use a particular member. Which SD-WAN configuration object should be used to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SD-WAN rule. SD-WAN rules are the correct configuration object because they allow you to define policy-based forwarding (PBF) criteria, such as source/destination IP addresses, to steer traffic to a specific SD-WAN member interface. Unlike static routes, SD-WAN rules evaluate traffic against match conditions and then apply an explicit action to use a designated member or strategy, making them the precise tool for this requirement.

Answer

Route map

Answer

Prefix list

Answer

Performance SLA

Question 2

An administrator is troubleshooting a scenario where FortiAnalyzer is not receiving logs from a FortiGate. The FortiGate shows 'log-fortianalyzer setting status: disconnected'. Which step should be taken first to resolve this?

Accepted Answer

Verify that the FortiGate can reach the FortiAnalyzer IP address and that the FortiAnalyzer service is running. The 'disconnected' status indicates that the FortiGate cannot establish a TCP connection to the FortiAnalyzer. The first step is to verify basic Layer 3 reachability (ping) and that the FortiAnalyzer service is listening on the default port (TCP 514 or 3000 for encrypted). Without confirming these, further troubleshooting is premature.

Answer

Check the FortiGate's DNS resolution for the FortiAnalyzer hostname

Answer

Restart the FortiGate's logging service

Answer

Disable and re-enable logging to FortiAnalyzer

Question 3

After upgrading FortiGate firmware, an admin notices that several sessions using SIP are failing. The SIP ALG was enabled before the upgrade. What is the MOST likely cause?

Accepted Answer

The SIP ALG configuration was reset to default, affecting session handling. Upgrading FortiGate firmware can reset the SIP ALG configuration to its default settings, which may alter session handling parameters such as timeouts, port ranges, or application-layer gateway (ALG) behavior. This default reset often causes previously working SIP sessions to fail, especially if custom SIP ALG settings were used to accommodate specific VoIP environments. The SIP ALG remains enabled after the upgrade, but its default configuration may not match the pre-upgrade customizations, leading to session failures.

Answer

The SIP session helper is now deprecated

Answer

The SIP service port changed

Answer

The FortiGate's SIP inspection profile was removed

Question 4

A large enterprise uses FortiGate as their perimeter firewall with ATP features enabled. They have a mix of internal users and remote VPN users. Recently, several remote users reported that their machines became infected with ransomware after connecting to the VPN. The IT team suspects that the ransomware entered through the VPN tunnel. The FortiGate has an antivirus profile applied to the VPN policy with SSL inspection enabled for all traffic. However, the logs show that no malware was detected. Upon investigation, the team finds that the remote users' machines are not managed by the company and do not have any endpoint protection. The ransomware was delivered via a spear-phishing email that the users opened on their remote machines. The email traffic passed through the VPN tunnel to the corporate mail server first, then back to the user. The FortiGate antivirus profile is configured to scan SMTP traffic but the email was sent from an external source to the corporate mail server, and the mail server uses STARTTLS to receive emails. The FortiGate does not perform SSL inspection on the SMTP traffic because the SMTP service is not included in the SSL inspection profile. What action should the administrator take to prevent this in the future?

Accepted Answer

Add SMTP to the SSL inspection profile to decrypt and scan email traffic. The FortiGate's antivirus profile is configured to scan SMTP traffic, but the email was encrypted via STARTTLS, and SMTP is not included in the SSL inspection profile. By adding SMTP to the SSL inspection profile, the FortiGate can decrypt the SMTP traffic, allowing the antivirus engine to inspect the email content for malware, including ransomware delivered via spear-phishing.

Answer

Disable STARTTLS on the corporate mail server to force plaintext SMTP

Answer

Require remote users to install endpoint protection with FortiClient

Answer

Block all SMTP traffic from remote VPN users

Question 5

Which THREE statements are true about FortiGate SD-WAN health-check configuration?

Accepted Answer

Health-check can be configured with multiple thresholds for jitter, latency, and packet loss.. FortiGate SD-WAN health-check allows configuring multiple thresholds for jitter, latency, and packet loss. These thresholds are used to determine the quality of a link; if any threshold is exceeded, the link is considered failed. This enables granular control over link health assessment beyond simple reachability.

Answer

Health-check probes can be sent from any interface, including loopback.

Answer

Health-check can only be configured on physical interfaces, not VLANs or subinterfaces.

Question 6

You receive an alert that FortiAnalyzer log disk usage is at 95%. Which action should you take to immediately free up space without losing important logs?

Accepted Answer

Configure log archiving to an external storage. Configuring log archiving to an external storage immediately offloads logs from the FortiAnalyzer local disk to a remote location (e.g., NFS, FTP, or SCP), freeing up disk space without deleting any logs. This preserves all historical log data for compliance and forensic analysis while resolving the high disk usage alert.

Answer

Delete all logs older than 30 days

Answer

Enable log compression

Answer

Increase log disk quota

Question 7

A network administrator is configuring SD-WAN on a FortiGate with three WAN links: MPLS (10 Mbps), Broadband (50 Mbps), and LTE (20 Mbps). They want to load balance traffic based on link bandwidth, with the option to manually steer critical traffic to the MPLS link. Which TWO steps must be taken to achieve this?

Accepted Answer

Set the SD-WAN rule strategy to 'Maximize Bandwidth' with volume algorithm for general traffic.. Setting the SD-WAN rule strategy to 'Maximize Bandwidth' with the volume algorithm distributes traffic proportionally based on link bandwidth (10:50:20 ratio), achieving load balancing. Option B is correct because creating a separate SD-WAN rule with strategy 'Manual' and selecting MPLS as the preferred member allows manual steering of critical traffic to the MPLS link, overriding the load-balancing behavior for that traffic.

Answer

Set the load balancing algorithm to 'Spillover' on all rules.

Answer

Enable ECMP on the FortiGate.

Answer

Configure a performance SLA for each link.

Question 8

A network admin runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session was established 1 hour ago and will expire in about 1 hour. The output shows `duration=3600`, meaning the session has been active for 3600 seconds (1 hour), and `expire=3599`, meaning the session will expire in 3599 seconds (approximately 1 hour). The `proto=6` indicates TCP (protocol 6), and `proto_state=01` corresponds to TCP state ESTABLISHED. Therefore, the session was established 1 hour ago and will expire in about 1 hour, making option A correct.

Answer

The session is using UDP port 443

Answer

The session is for HTTP traffic and has 3599 seconds left

Answer

The session is for HTTPS traffic and is halfway through its expected lifetime

Question 9

A network engineer is deploying a FortiGate in transparent mode at a branch office. The goal is to insert the firewall without changing the existing IP subnet scheme. Which statement about transparent mode is TRUE?

Accepted Answer

The FortiGate acts as a Layer 2 bridge and forwards traffic based on MAC addresses. In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses without modifying the IP subnet scheme. This allows the firewall to be inserted into an existing network segment without requiring IP reconfiguration of connected devices.

Answer

The FortiGate must have a unique IP subnet for each interface

Answer

Transparent mode supports all routing protocols like OSPF and BGP

Answer

NAT is required for traffic to pass through the FortiGate

Question 10

An administrator configures a WAF profile on FortiGate to protect a web application. However, the administrator notices that SQL injection attacks are not being blocked. What should the administrator check first?

Accepted Answer

The SQL injection signatures are enabled in the WAF profile. SQL injection attacks are blocked by specific signatures within the WAF profile. If these signatures are not enabled, the WAF will not inspect HTTP requests for SQL injection patterns, allowing attacks to pass through. The administrator must verify that the SQL injection signatures are toggled on under the WAF profile's signature configuration.

Answer

The WAF profile is attached to the correct firewall policy

Answer

The FortiGate has a valid Advanced Web Protection subscription

Answer

The web application is using HTTPS and SSL inspection is configured

Question 11

An administrator is configuring FortiMail to be more secure against advanced email threats. Which THREE features should they enable to protect against email-based phishing attacks?

Accepted Answer

DKIM signing/verification. DKIM (DomainKeys Identified Mail) signing and verification allow the receiving mail server to cryptographically verify that an email was not tampered with during transit and that it originated from an authorized domain. This prevents attackers from spoofing the sender domain in phishing emails, as the DKIM signature will fail validation if the message body or headers are altered.

Answer

CDR (Content Disarm and Reconstruction)

Answer

FortiSandbox inline scanning

Question 12

An administrator wants to verify that a BGP route is being advertised to a neighbor. Which command displays the routes that FortiGate is advertising to a specific BGP neighbor?

Accepted Answer

get router info bgp neighbor advertised-routes. The command 'get router info bgp neighbor advertised-routes' is the specific FortiOS CLI command that displays the BGP routes that the FortiGate has advertised to a particular BGP neighbor. This command queries the BGP table for routes that have been sent to the neighbor and are in the Adj-RIB-Out, which is exactly what the administrator needs to verify outbound route advertisement.

Answer

get router info bgp network

Answer

diagnose ip router bgp routes

Answer

show ip bgp summary

Question 13

An administrator wants to enforce that only devices with the latest antivirus signatures and a corporate disk encryption solution can access a sensitive application via ZTNA. Which two FortiClient EMS components must be configured? (Choose two.)

Accepted Answer

Device posture checks. ZTNA tags define compliance requirements, and device posture checks evaluate endpoint security state. Together they enable conditional access based on endpoint compliance.

Answer

VPN tunnels

Answer

SAML SSO

Question 14

Which load balancing algorithm in SD-WAN sends new sessions to the member interface with the least number of active sessions?

Accepted Answer

Sessions. The Sessions algorithm in Fortinet SD-WAN selects the member interface with the fewest active sessions when a new session is initiated. This is the default load-balancing method and ensures even distribution of session counts across WAN links, preventing any single interface from becoming overloaded with connections.

Answer

Volume

Answer

Spillover

Answer

Source-dest IP

Question 15

An administrator configures Multi-Peer VPN (MPVPN) on a FortiGate aggregator. The aggregator has two phase1 configurations for the same remote subnet but different peers. The aggregator's routing table shows both peers as next hops. The administrator notices that traffic between the aggregator and the remote subnet is load-balanced across both peers. What is the cause?

Accepted Answer

The aggregator has two static routes with equal cost to the remote subnet.. The administrator configured two static routes with equal administrative distance and cost to the remote subnet, each pointing to a different peer. This causes ECMP (Equal-Cost Multi-Path) routing, which load-balances traffic across both peers. MPVPN itself does not automatically load-balance; it relies on the underlying routing table to determine next-hop selection.

Answer

The MPVPN feature automatically load-balances traffic across all active peers.

Answer

The phase1 configurations have the same proposal settings, causing implicit load balancing.

Answer

The remote peers are both advertising the same subnet via BGP with equal metrics.

Question 16

A network administrator notices that several endpoints are infected with ransomware despite having FortiGate ATP enabled. The logs show that the files were downloaded over HTTPS, and the antivirus profile did not detect them. What is the most likely reason?

Accepted Answer

SSL inspection was not enabled on the antivirus profile. FortiGate ATP's antivirus engine cannot inspect encrypted HTTPS traffic unless SSL inspection is explicitly enabled on the antivirus profile. Without SSL inspection, the antivirus profile only sees encrypted payloads and cannot match file signatures or heuristics, allowing ransomware to pass undetected. The logs confirm files were downloaded over HTTPS, making this the most likely root cause.

Answer

Application control profile blocked the download

Answer

FortiSandbox was not configured to analyze the files

Answer

IPS signature database was outdated

Question 17

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is in SYN_SENT state, waiting for SYN-ACK. The output shows `proto=6` (TCP), `proto_state=01`, `duration=3600`, and `expire=3599`. In Fortinet's session table, `proto_state=01` for TCP indicates the session is in the SYN_SENT state, meaning the firewall has forwarded a SYN packet and is waiting for a SYN-ACK from the remote host. The session is not yet established, as the three-way handshake has not completed.

Answer

The session is timed out

Answer

The session is closing (FIN_WAIT)

Answer

The session is fully established (proto_state=01 means established)

Question 18

An administrator is configuring a FortiGate in transparent mode for a data center segment. Which of the following is true about transparent mode operation in an enterprise environment?

Accepted Answer

Transparent mode operates at Layer 2, so no IP configuration is needed on the FortiGate interfaces. In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses rather than IP addresses. This means the FortiGate interfaces do not require IP addresses for traffic forwarding; a management IP is configured on a VLAN interface or the root VDOM for administrative access only. Option B correctly identifies that transparent mode functions at Layer 2, so no IP configuration is needed on the physical interfaces for data plane operation.

Answer

The FortiGate requires an IP address on each interface to route between VLANs

Answer

Transparent mode is only available on specific hardware models

Answer

Transparent mode supports NAT and VPN termination

Question 19

A network administrator notices that FortiGate is not blocking a known malicious file that was submitted to FortiSandbox and received a 'malicious' verdict. The firewall policy includes a FortiSandbox inline scan profile. What is the MOST likely cause?

Accepted Answer

The FortiSandbox is not configured as an inline scanner in the antivirus profile. The FortiGate uses an antivirus profile to define how files are scanned, including whether to send files to FortiSandbox for inline analysis. Even if the firewall policy references a FortiSandbox inline scan profile, the antivirus profile must have the 'FortiSandbox inline scan' option enabled to actually forward files to the FortiSandbox appliance. Without this setting, the FortiGate will not submit files for sandboxing, so a malicious verdict from FortiSandbox is never applied to the traffic.

Answer

The antivirus signature database is outdated

Answer

The FortiSandbox license has expired

Answer

The file is larger than the maximum file size allowed for scanning

Question 20

An administrator is configuring a FortiGate as a SAML Identity Provider (IdP) for a third-party service provider. Which of the following is REQUIRED for the FortiGate IdP configuration?

Accepted Answer

A certificate for signing SAML assertions. When FortiGate acts as a SAML IdP, it must sign SAML assertions to prove their authenticity to the SP. A certificate is required for this signing, as the SP will validate the assertion using the IdP's public key. Without a signing certificate, the SAML response cannot be cryptographically verified, breaking the trust model defined in the SAML 2.0 specification.

Answer

The SP's metadata must be imported as a firewall address

Answer

User accounts must be synchronized with an LDAP server

Answer

A pre-shared key between FortiGate and the SP