NSE7 Practice Exam 58 — 20 Questions

Question 1

A FortiGate has two VDOMs: VDOM-A and VDOM-B. The administrator wants VDOM-A to have administrative access to VDOM-B for troubleshooting. The administrator configures a management VDOM. Which THREE steps are required to allow administrative access from VDOM-A to VDOM-B? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Designate VDOM-A as the management VDOM. Designating VDOM-A as the management VDOM is the first required step because it establishes VDOM-A as the administrative container that can access other VDOMs. In FortiOS, a management VDOM is a special VDOM that has visibility and control over other VDOMs for management purposes. Without this designation, VDOM-A would not have the inherent privilege to initiate administrative sessions into VDOM-B.

Answer

Enable 'inter-vdom-routing' globally

Answer

Disable 'admin-sport' to allow HTTP access

Question 2

A FortiGate is configured with an antivirus profile that has the machine learning engine enabled. An administrator notices that some files are being detected by the ML engine but the verdict is 'probably clean'. What does this verdict indicate?

Accepted Answer

The ML engine has low confidence that the file is malicious; it may be a false positive.. The ML engine in FortiGate's antivirus profile assigns a verdict of 'probably clean' when its confidence level is low that the file is malicious. This indicates a potential false positive, meaning the file is likely benign but the engine cannot be certain. The correct action is to allow the file to pass while logging the event for further analysis, not to block it outright.

Answer

The file is clean and safe to pass.

Answer

The file is definitely malicious and should be blocked.

Answer

The ML engine has detected an outbreak but needs FortiGuard to confirm.

Question 3

An organization wants to implement email authentication to prevent spoofing. Which TWO standards should they configure? (Choose two.)

Accepted Answer

SPF. SPF (Sender Policy Framework) is correct because it allows the domain owner to publish a list of authorized sending IP addresses in a DNS TXT record, enabling receiving mail servers to verify that the email originated from an approved source. DKIM (DomainKeys Identified Mail) is correct because it adds a digital signature to email headers, which the receiving server validates against a public key published in DNS, ensuring the message was not tampered with and truly came from the claimed domain. Together, SPF and DKIM form the foundational layers of email authentication that DMARC builds upon.

Answer

DMARC

Answer

TLS

Answer

STARTTLS

Question 4

An administrator needs to integrate a FortiSwitch with a FortiGate for LAN edge management. The FortiSwitch will be used to provide access ports for end users. Which THREE configuration steps are required on the FortiGate?

Accepted Answer

Create a port profile that defines VLAN and security settings for the access ports. A port profile on the FortiGate defines the VLAN membership, allowed VLANs, and security policies (e.g., 802.1X, MAC authentication bypass) that are pushed to the FortiSwitch for its access ports. This is the primary mechanism for centrally managing access port configuration in a FortiSwitch deployment.

Answer

Configure a DHCP server on the FortiGate to assign IP addresses to FortiSwitch management

Answer

Enable STP on the FortiGate interface

Question 5

A FortiGate administrator wants to generate customized reports in FortiAnalyzer for different departments. The administrator needs to ensure that each department can only see its own logs. Which TWO configurations are necessary?

Accepted Answer

Create separate ADOMs for each department. ADOMs (Administrative Domains) in FortiAnalyzer provide administrative isolation, allowing each department to have its own segregated management domain. This ensures that administrators assigned to a specific ADOM can only view and generate reports from logs belonging to that ADOM, enforcing strict data separation.

Answer

Configure meta fields on FortiGate objects

Answer

Enable per-device logging on FortiGate

Answer

Assign each administrator the 'super_admin' profile

Question 6

An administrator wants to integrate a FortiSwitch with a FortiGate for LAN edge management. Which TWO steps are required for initial setup? (Choose two.)

Accepted Answer

Connect the FortiSwitch to the FortiGate's managed switch port. A FortiSwitch must be physically connected to a FortiGate port that has been configured as a managed switch port (via config system interface and set type switch). This dedicated port enables the FortiGate to discover and manage the FortiSwitch using the FortiLink protocol, which encapsulates control and data traffic over a single link. Without this physical connection to a managed switch port, the FortiGate cannot establish the FortiLink adjacency required for LAN edge management.

Answer

Configure OSPF on the FortiSwitch

Answer

Set the FortiSwitch to 'transparent' mode

Answer

Create a firewall policy allowing traffic between FortiSwitch and FortiGate

Question 7

An administrator configures inter-VDOM routing between VDOMs A and B. Both VDOMs are on the same FortiGate. The admin creates a policy allowing traffic from VDOM A to VDOM B. Traffic from VDOM A to VDOM B fails. What is the most likely cause?

Accepted Answer

There is no firewall policy in VDOM B to allow the return traffic. In a FortiGate inter-VDOM routing setup, traffic initiated from VDOM A to VDOM B requires a firewall policy in VDOM B to permit the return traffic. Without this policy, the FortiGate's stateful inspection engine drops the return packets because no session exists in VDOM B's session table. This is a common misconfiguration where administrators only create a policy in the source VDOM.

Answer

VDOM A and VDOM B must be in the same administrative VDOM

Answer

The VDOMs are in transparent mode

Answer

The inter-VDOM link is not configured

Question 8

A FortiGate has ECMP configured with two equal-cost routes to a destination. The administrator wants to ensure that all packets from a given source IP use the same next-hop. Which ECMP load balancing method should be configured?

Accepted Answer

Source IP. Source IP-based ECMP load balancing uses the source IP address to select the next-hop for all packets in a flow. This ensures that packets from a given source IP always take the same path, maintaining session consistency without requiring stateful inspection.

Answer

Destination IP

Answer

Source-destination IP

Answer

Round robin

Question 9

Which Fortinet product is designed to deploy decoy systems to lure attackers and detect lateral movement within the network?

Accepted Answer

FortiDeceptor. FortiDeceptor is specifically designed to deploy decoy systems (honeypots) that mimic real assets, such as servers or endpoints, to lure attackers. It detects lateral movement by monitoring decoy interactions and generating alerts when an attacker probes or compromises these fake targets, providing early warning of network intrusion.

Answer

FortiSandbox

Answer

FortiSOAR

Answer

FortiEDR

Question 10

A FortiGate administrator uses FortiAnalyzer for log analysis and wants to identify all sessions that were blocked by a specific firewall policy ID 10. Which log filter should be applied?

Accepted Answer

Filter by 'policyid eq 10'. The correct filter to identify sessions from a specific policy in FortiAnalyzer is 'policyid eq 10'. This uses the proper field name 'policyid' and the 'eq' operator. Option B uses '==' which is invalid, and option C uses the incorrect field name 'policy_id'.

Answer

Filter by 'action eq block' and then manually look for policy 10

Answer

Filter by 'policyid == 10'

Answer

Filter by 'devid contains 10'

Question 11

An administrator is configuring FortiMail to improve email security. Which three of the following features are part of FortiMail's advanced threat protection? (Choose three.)

Accepted Answer

Email Authentication (SPF, DKIM, DMARC). Email Authentication (SPF, DKIM, DMARC) is part of FortiMail's advanced threat protection because it verifies sender identity and prevents email spoofing and phishing. SPF checks the sending server's IP against authorized records, DKIM uses cryptographic signatures to ensure message integrity, and DMARC provides policy enforcement for alignment. These mechanisms collectively reduce the risk of domain impersonation and are integral to FortiMail's anti-phishing capabilities.

Answer

Web Filtering

Answer

Application Control

Question 12

Which SD-WAN load balancing algorithm distributes new sessions based on the number of active sessions on each link?

Accepted Answer

Sessions. The Sessions algorithm distributes new sessions based on the current number of active sessions on each SD-WAN link. When a new session is initiated, the SD-WAN controller selects the link with the fewest active sessions, ensuring a balanced load across all available transport interfaces. This is distinct from algorithms that consider source/destination IP pairs, traffic volume, or bandwidth thresholds.

Answer

Source-dest IP

Answer

Spillover

Answer

Volume

Question 13

You are troubleshooting BGP route advertisement issues. Which THREE debug commands would be useful to identify why a route is not being advertised to a neighbor? (Choose three.)

Accepted Answer

diagnose debug router bgp . The 'diagnose debug router bgp ' command enables real-time debugging of BGP events for a specific neighbor, allowing you to see why a route is being filtered or not advertised (e.g., due to prefix-list, AS-path, or next-hop unreachable issues). This is a Fortinet-specific debug command that provides granular insight into the BGP decision process for that neighbor.

Answer

get router info bgp neighbors <neighbor> received-routes

Answer

get router info bgp summary

Question 14

An administrator needs to configure a FortiGate to allow inter-VDOM routing between VDOM-1 and VDOM-2. Which TWO actions are required? (Choose two.)

Accepted Answer

Configure firewall policies on each VDOM to permit traffic across the VDOM link. Inter-VDOM routing requires explicit firewall policies on each VDOM to control and permit traffic traversing the VDOM link. Without these policies, the FortiGate will drop the traffic at the VDOM boundary, even if the VDOM link is up and IP addresses are configured.

Answer

Disable NAT on all policies

Answer

Enable inter-VDOM routing under system settings

Answer

Assign an IP address to the VDOM link in only one VDOM

Question 15

You run 'diagnose sys session filter dport 443' and see sessions with a duration of 7200 seconds and expire time of 3600 seconds. What does this indicate?

Accepted Answer

The session has been alive for 7200 seconds and will expire in 3600 seconds. The 'duration' field in the 'diagnose sys session filter' output shows how long the session has been active (7200 seconds), while the 'expire' field indicates the remaining time before the session times out (3600 seconds). Option C correctly interprets both values. This is standard FortiGate session table behavior, where each session has a configurable timeout (e.g., default TCP timeout is 3600 seconds for established sessions).

Answer

The session has been idle for 7200 seconds

Answer

The session helper is interfering with the session

Answer

The session has already expired

Question 16

Which Fortinet product is designed specifically to detect and deceive attackers by creating decoy systems and luring them away from real assets?

Accepted Answer

FortiDeceptor. FortiDeceptor is Fortinet's dedicated deception-based threat detection solution. It creates realistic decoy systems (honeypots) and lures attackers away from real assets, providing early detection and threat intelligence without relying on signatures. This aligns with the question's specific requirement for a product designed to detect and deceive attackers using decoys.

Answer

FortiSandbox

Answer

FortiEDR

Answer

FortiWeb

Question 17

An administrator wants to enforce that only devices with antivirus software installed and up-to-date can access the corporate network. Which FortiGate feature should be used?

Accepted Answer

ZTNA tags and posture checks. FortiGate uses ZTNA device posture checks via FortiClient EMS to enforce endpoint compliance, such as antivirus status.

Answer

Application control profile

Answer

IPsec VPN with pre-shared key

Answer

Web filtering profile

Question 18

A user reports that they cannot connect to a remote office via IPsec VPN. Phase 1 is up, but Phase 2 fails to establish. The administrator runs 'diagnose vpn ike log' and sees 'no matching phase2 proposal'. What should be checked?

Accepted Answer

The Phase 2 proposal settings (encryption, authentication, PFS) match on both peers. The error 'no matching phase2 proposal' indicates that the IPsec peers cannot agree on the Phase 2 parameters (encryption, authentication, PFS group, lifetime). Since Phase 1 is up, IKE negotiation for the secure channel succeeded, but the subsequent IPsec SA negotiation fails because the proposed transforms do not match. Option D directly addresses this mismatch by requiring verification of the Phase 2 proposal settings on both peers.

Answer

The firewall policies allow IKE traffic

Answer

The local and remote subnet definitions are correct

Answer

The pre-shared key is correct

Question 19

What is the purpose of FortiDeceptor in an enterprise security architecture?

Accepted Answer

To simulate real assets and detect attackers attempting to interact with decoys. FortiDeceptor is a deception-based threat detection solution that deploys decoys (simulated real assets like servers, databases, or IoT devices) across the network. When an attacker probes or interacts with these decoys, FortiDeceptor generates high-fidelity alerts, enabling early detection of lateral movement or reconnaissance without relying on signatures. This aligns with the Advanced Threat Protection domain by shifting from reactive blocking to proactive deception.

Answer

To provide VPN access for remote users

Answer

To encrypt all data at rest on endpoints

Answer

To block all inbound traffic from suspicious IP addresses

Question 20

An administrator configures SD-WAN with two members (wan1, wan2) and a performance SLA for ICMP to 1.1.1.1. The SD-WAN rule is set to 'Best Quality' with 'latency' metric. The admin notices that traffic sometimes switches to the other link even when the current link has acceptable latency. Which action can reduce unnecessary flapping?

Accepted Answer

Configure a hysteresis value for the SLA. Configuring a hysteresis value for the SLA introduces a buffer or deadband around the latency threshold. This prevents the SD-WAN from switching links when latency fluctuates slightly above and below the threshold, which is the root cause of flapping. Without hysteresis, even a minor transient spike in latency can trigger a switch, even if the link's overall performance is acceptable.

Answer

Increase the SLA probe interval

Answer

Use 'manual' strategy instead

Answer

Increase the 'update-cascade-interface' setting