NSE7 Practice Exam 59 — 20 Questions

Question 1

An admin receives an email from FortiMail regarding a message that was rejected due to SPF failure. What does this indicate about the email?

Accepted Answer

The email's From address domain does not match the sending server's IP per the domain's SPF record. SPF (Sender Policy Framework) validation checks whether the sending mail server's IP address is authorized to send mail for the domain in the envelope 'From' (RFC 5321.MailFrom) or the header 'From' address. When FortiMail rejects a message due to SPF failure, it means the IP of the connecting server does not match any of the authorized IPs listed in the domain's SPF TXT record (as defined in RFC 7208). This is a direct authentication failure, not a content-based or signature-based issue.

Answer

The email's DKIM signature is invalid

Answer

The email contains a virus

Answer

The email is missing a Message-ID header

Question 2

An administrator wants to prevent users from downloading known malicious files from the internet. The administrator has enabled FortiGuard Outbreak Prevention and applied an antivirus profile to the outbound policy. However, some malicious files are still reaching users. What configuration step is most likely missing?

Accepted Answer

The antivirus profile does not have 'FortiGuard Outbreak Prevention' enabled. FortiGuard Outbreak Prevention is a separate toggle within the antivirus profile that must be explicitly enabled to leverage real-time outbreak intelligence. Even if the administrator believes they have enabled it, the profile may have the feature disabled by default or inadvertently left off, allowing known malicious files to bypass detection. Without this toggle, the antivirus engine relies only on static signatures and cannot block files flagged by FortiGuard's outbreak database.

Answer

The antivirus profile has 'FortiGuard Outbreak Prevention' enabled

Answer

The FortiGuard subscription has expired

Answer

The security policy is not configured for proxy-based inspection

Question 3

A company wants to detect and block phishing emails that contain malicious links. Which FortiGate security profile should be used?

Accepted Answer

Email Filtering profile. FortiGate's Email Filtering profile is specifically designed to inspect SMTP, POP3, and IMAP traffic for phishing indicators, including malicious URLs in email bodies and attachments. It can block or quarantine emails based on URL reputation, sender authentication (SPF/DKIM/DMARC), and content analysis, directly addressing the requirement to detect and block phishing emails with malicious links.

Answer

Antivirus profile

Answer

Web Filtering profile

Answer

Data Leak Prevention profile

Question 4

What is the primary benefit of using FortiClient with ATP features in conjunction with FortiGate?

Accepted Answer

It enables endpoint detection and response with automated quarantine through FortiGate. FortiClient with ATP (Advanced Threat Protection) features, such as Antivirus, Web Filtering, and Vulnerability Scan, integrates with FortiGate via the FortiTelemetry protocol. This integration enables endpoint detection and response (EDR) capabilities, allowing FortiGate to automatically quarantine compromised endpoints based on telemetry and threat intelligence from FortiClient, thereby containing threats at the network edge.

Answer

It allows users to bypass security policies

Answer

It replaces the need for a firewall

Answer

It provides a single sign-on portal for all users

Question 5

A network engineer is troubleshooting a Security Fabric where a downstream FortiGate (model 60F) is not appearing in the Fabric topology of the root FortiGate (model 600E). Both devices are running FortiOS 7.4. The root FortiGate shows the downstream device as 'Unreachable' in the Security Fabric widget. The engineer has verified that the downstream FortiGate can ping the root FortiGate's management IP. What is the most likely cause of this issue?

Accepted Answer

The downstream FortiGate has insufficient memory to support Security Fabric features.. The FortiGate 60F has limited memory (typically 512 MB or less), and FortiOS 7.4 enforces a minimum memory requirement for downstream devices to participate in the Security Fabric. When the downstream device has insufficient memory, the root FortiGate marks it as 'Unreachable' even though basic IP connectivity (ping) works. This is a known hardware limitation for lower-end models like the 60F when running newer FortiOS versions.

Answer

The root FortiGate does not have HTTPS access to the downstream FortiGate.

Answer

The downstream FortiGate's management interface is configured on a different VLAN.

Answer

The administrator account on the downstream FortiGate does not have 'super_admin' privileges.

Question 6

A FortiGate is configured with policy-based routing (PBR) to route certain traffic through a specific next hop. However, some traffic that should match the PBR rule is not being affected. What is a likely reason?

Accepted Answer

The PBR rule is applied on the wrong interface or direction.. Policy-based routing (PBR) in FortiOS is applied per interface and per direction (incoming or outgoing). If the PBR rule is applied on the wrong interface or in the wrong direction, traffic will never be evaluated against the route map, causing the rule to have no effect. This is the most common misconfiguration when PBR does not work as expected.

Answer

The PBR rule uses a route map that references an incorrect prefix list.

Answer

The PBR rule has a higher priority than the SD-WAN rule, but the traffic is hitting the SD-WAN rule first because of firewall policy order.

Answer

The traffic is generated locally from the FortiGate and PBR does not affect locally generated traffic.

Question 7

An administrator is configuring FortiDeceptor to detect threats within the network. Which TWO statements about FortiDeceptor are correct?

Accepted Answer

It sends alerts to FortiSIEM or FortiSOAR for automated response. FortiDeceptor integrates with FortiSIEM and FortiSOAR to automatically trigger incident response workflows when a threat is detected. This integration allows security teams to quickly contain and remediate attacks without manual intervention, leveraging the Fortinet Security Fabric's automation capabilities.

Answer

It requires a separate hardware appliance for each network segment

Answer

It uses signature-based detection to identify malware

Answer

It can replace firewall functionality

Question 8

A FortiGate is configured with OSPF multi-area. The administrator wants to ensure that routes from area 0 are redistributed into area 1. Which OSPF configuration is required?

Accepted Answer

No additional configuration is needed; ABRs automatically advertise inter-area routes. OSPF ABRs (Area Border Routers) automatically advertise inter-area routes between areas by default. In a multi-area OSPF setup, the ABR learns Type 3 LSAs from area 0 and floods them into other areas (like area 1) without any additional redistribution configuration. No explicit redistribution policy is needed for inter-area route advertisement.

Answer

Enable 'redistribute connected' on the ABR

Answer

Set the 'area type' to 'nssa' on area 1

Answer

Configure a route redistribution policy under OSPF

Question 9

A FortiGate is configured as a SAML SP for user authentication. When a user attempts to access a protected resource, the FortiGate redirects the user to the IdP login page, but after successful authentication, the user is not redirected back to the original resource. What is the MOST likely cause?

Accepted Answer

The SAML assertion consumer service URL on the IdP does not include a trailing slash. The SAML assertion consumer service (ACS) URL must exactly match the endpoint configured on the FortiGate. If the IdP's ACS URL lacks a trailing slash that the FortiGate expects, the SAML response will be sent to an incorrect or mismatched endpoint, causing the redirect to fail. This is a common misconfiguration in SAML SP setups where URL normalization differs between the SP and IdP.

Answer

The user's browser has cookies disabled

Answer

The IdP certificate is not trusted by the FortiGate

Answer

The FortiGate is configured as a SAML IdP instead of SP

Question 10

A FortiGate administrator wants to detect and block protocol anomalies as part of advanced IPS. Which three options are available in FortiGate's custom IPS signatures? (Choose three.)

Accepted Answer

Protocol-specific fields. Custom IPS signatures in FortiGate allow matching on protocol-specific fields such as TCP flags, ICMP type/code, or DNS query types. This enables detection of anomalies like invalid flag combinations or malformed protocol headers, which is a core part of advanced IPS.

Answer

Application signatures

Answer

URL filtering

Question 11

An administrator configures a route map to control redistribution of connected routes into OSPF. The route map uses a prefix list to match routes. After applying the redistribution, no routes are redistributed. What is the most likely oversight?

Accepted Answer

The route map is missing a 'permit' action, so it denies all routes. The route map used for redistribution into OSPF must have at least one 'permit' statement to allow routes. If only a prefix list is referenced in the route map without an explicit 'permit' action, the implicit deny at the end of the route map blocks all routes. The common mistake is to assume that simply matching with a prefix list is sufficient; however, an explicit 'permit' action is required.

Answer

The prefix list is configured with the wrong sequence number

Answer

OSPF process ID is incorrect

Answer

The connected routes are not in the routing table

Question 12

An administrator is deploying a FortiGate in transparent mode to seamlessly integrate into an existing network. The administrator needs to manage the FortiGate remotely over the network. Which configuration is required?

Accepted Answer

Configure a management IP address under the VDOM settings. In transparent mode, FortiGate operates as a Layer 2 bridge and does not route traffic, so physical interfaces cannot have IP addresses. To enable remote management, a dedicated management IP must be configured under the VDOM settings, which allows the FortiGate to be reachable via protocols like HTTPS, SSH, or SNMP without participating in Layer 3 forwarding.

Answer

Create a VLAN interface and assign an IP

Answer

Assign an IP address to the physical interfaces

Answer

Enable DHCP client on the interfaces

Question 13

A FortiGate is configured with SD-WAN and multiple members. The administrator notices that traffic to a critical application is consistently routed over a low-quality link, even though a better link is available. The SD-WAN rule uses the 'Best Quality' strategy with a performance SLA. What is the most likely reason?

Accepted Answer

The better link is failing its SLA probes. When an SD-WAN rule uses the 'Best Quality' strategy with a performance SLA, the FortiGate selects the member link that best meets the SLA targets (e.g., jitter, latency, packet loss). If the better link is failing its SLA probes, it is considered out of compliance and will not be selected, even if it is physically available and has higher bandwidth. This causes traffic to be routed over the lower-quality link that still passes the SLA.

Answer

The better link is in 'standby' mode

Answer

The SD-WAN rule is using source-based routing

Answer

The application traffic is not matching the SD-WAN rule

Question 14

In a Zero Trust Network Access architecture, which component acts as the policy enforcement point for access decisions?

Accepted Answer

FortiGate ZTNA gateway. In a Zero Trust Network Access (ZTNA) architecture, the FortiGate ZTNA gateway acts as the policy enforcement point (PEP). It terminates encrypted ZTNA tunnels from FortiClient agents, inspects traffic against configured access policies, and enforces decisions based on identity, device posture, and context. This is distinct from the control plane (FortiClient EMS) or logging (FortiAnalyzer).

Answer

FortiClient agent

Answer

FortiAnalyzer

Answer

FortiClient EMS

Question 15

An administrator is troubleshooting an HA cluster (active-passive) where both units show 'primary' in 'get system ha status'. The cluster is not synchronizing configurations. What is the MOST likely cause?

Accepted Answer

The HA heartbeat interface is disconnected or misconfigured. In an active-passive HA cluster, both units showing 'primary' indicates a failure in heartbeat communication. The HA heartbeat interface is used to exchange cluster state and session information; if it is disconnected or misconfigured, each unit assumes the other is down and transitions to primary, leading to a split-brain scenario. This prevents configuration synchronization because the units cannot agree on a primary-secondary role.

Answer

The HA password is incorrect

Answer

The HA group ID is mismatched

Answer

The HA priority values are equal for both units

Question 16

An administrator configures inter-VDOM routing between VDOMs A and B using a VDOM link. The administrator can ping from VDOM A to an interface in VDOM B, but traffic from VDOM B to VDOM A times out. What is the most likely cause?

Accepted Answer

The route back to the source subnet is missing in VDOM A. Inter-VDOM routing requires a route in both directions. Since the administrator can ping from VDOM A to VDOM B, the forward path works, but the return traffic from VDOM B to VDOM A fails due to a missing route back to the source subnet in VDOM A. This is a classic asymmetric routing issue where the destination VDOM (A) does not know how to reach the source subnet of VDOM B.

Answer

VDOM B has no traffic VDOM capability

Answer

The firewall policy in VDOM B is blocking traffic

Answer

The VDOM link's MTU is set too high

Question 17

A FortiGate administrator is configuring automation stitches in FortiManager to trigger a script when a specific log event occurs. The automation stitch includes a trigger, a set of conditions, and an action. The administrator wants the script to run only if the event is generated by devices in a specific ADOM. Which element should be configured in the trigger condition?

Accepted Answer

Add a condition for the ADOM name in the trigger. Automation stitches in FortiManager can include conditions that filter on ADOM, device group, or device name. To restrict to a specific ADOM, the condition should specify the ADOM name. This ensures only events from that ADOM trigger the action.

Answer

Configure the script to check the ADOM at runtime

Answer

Use a meta field to tag the devices and filter by meta field

Answer

Assign the automation stitch to a specific ADOM in the settings

Question 18

A FortiGate administrator is troubleshooting a VPN tunnel that connects to a remote site. The tunnel is up, but traffic is not passing. The administrator checks the Phase 2 settings and sees that the local and remote subnets are correctly defined. What is the next step to diagnose the issue?

Accepted Answer

Check the firewall policies that reference the VPN interface. When the VPN tunnel is up (Phase 1 and Phase 2 are established) but traffic is not passing, the most common cause is that a firewall policy referencing the VPN interface is either missing or misconfigured. Even with correct Phase 2 selectors and routing, the FortiGate will drop traffic if no policy explicitly permits it from the source to the destination over the VPN interface. Therefore, checking the firewall policies is the logical next step.

Answer

Check the routing table for the remote subnet

Answer

Run 'diagnose vpn ike log' to check for Phase 1 errors

Answer

Restart the VPN tunnel

Question 19

An administrator is testing failover in an HA cluster. They unplug the primary FortiGate's port1 (the heartbeat interface) but the secondary does not take over. The heartbeat is configured on port1. What is the MOST likely cause?

Accepted Answer

The primary unit still has a heartbeat path through other interfaces. In a FortiGate HA cluster, the heartbeat interface is used to monitor the health of the primary unit. When the primary's port1 (heartbeat interface) is unplugged, the cluster can still maintain communication if the primary has an alternative heartbeat path through other interfaces (e.g., a dedicated HA management interface or a secondary heartbeat link). This prevents the secondary from detecting a complete failure, so it does not initiate a failover.

Answer

The HA uptime is less than the failover hold time

Answer

The secondary unit's priority is higher than the primary's

Answer

The secondary unit has a faulty power supply

Question 20

An administrator wants to load balance traffic across two ISP links using SD-WAN. The requirement is that sessions from the same source IP address must always use the same ISP link. Which SD-WAN load balancing algorithm should be used?

Accepted Answer

Source-destination IP. The Source-destination IP algorithm creates a hash based on both the source and destination IP addresses, ensuring that all packets belonging to sessions from the same source IP to the same destination IP are consistently forwarded over the same ISP link. This meets the requirement of session persistence for traffic from a given source IP without relying on stateful inspection or session tracking.

Answer

Sessions

Answer

Volume

Answer

Spillover