NSE7 Practice Test 6 — 10 Questions

Question 1

A FortiGate administrator notices that after installing a new policy package from FortiManager, the firewall policies on the managed FortiGate do not match what was configured in FortiManager. What feature should the administrator use to review the exact changes before committing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Install preview. Install preview, is correct because it allows the administrator to review the exact configuration changes that FortiManager will push to the managed FortiGate before the changes are committed. This feature compares the current running configuration on the FortiGate with the intended policy package in FortiManager and displays a detailed diff of additions, deletions, and modifications. It is specifically designed to prevent unexpected policy mismatches by providing a pre-commit review step.

Answer

Revision history

Answer

Device manager log

Answer

Policy consistency check

Question 2

A FortiGate with SD-WAN configured has a Performance SLA monitoring Google DNS (8.8.8.8). The SLA is configured with latency threshold 100 ms and jitter threshold 20 ms. The link is currently meeting both thresholds. The administrator wants to ensure that if the SLA fails, traffic moves to another link. Which SD-WAN rule strategy should be used?

Accepted Answer

Failover (SLA). The Failover (SLA) strategy is correct because it ensures that traffic is moved to another link only when the Performance SLA fails, while the primary link is used as long as it meets the configured latency (100 ms) and jitter (20 ms) thresholds. This strategy provides deterministic failover behavior, matching the administrator's requirement to switch traffic only upon SLA failure.

Answer

Best quality

Answer

Manual selection

Answer

Maximize bandwidth (SLA)

Question 3

A network administrator runs 'diagnose sys top' and sees that the 'ipsengine' process is consistently using 99% CPU. What is the BEST immediate action to reduce CPU load?

Accepted Answer

Disable IPS inspection on policies that don't require it. The 'ipsengine' process consuming 99% CPU indicates that IPS inspection is being applied to traffic that may not require it, causing excessive processing overhead. Disabling IPS on policies that do not need it (Option C) directly reduces the workload on the IPS engine without affecting other security functions or requiring a reboot. This is the most immediate and targeted action to alleviate CPU pressure.

Answer

Reboot the FortiGate

Answer

Increase the session limit

Answer

Change IPS engine to flow-based mode

Question 4

An administrator wants to block a zero-day malware outbreak detected by FortiGuard. Which feature should be configured to automatically block the threat across all enabled FortiGate devices?

Accepted Answer

FortiGuard Outbreak Prevention. FortiGuard Outbreak Prevention (option C) is the correct feature because it automatically pushes signatures to all FortiGate devices enrolled in the same FortiGuard network when a new zero-day malware outbreak is detected. This enables immediate, coordinated blocking without manual intervention, which is exactly what the administrator needs for a fast-spreading threat.

Answer

FortiSandbox Cloud

Answer

IPS Custom Signatures

Answer

Application Control

Question 5

A company uses FortiMail and wants to ensure that incoming emails are authenticated using SPF, DKIM, and DMARC. Which profile should the administrator configure to enforce these checks?

Accepted Answer

Authentication Profile. The Authentication Profile in FortiMail is specifically designed to enforce email authentication checks such as SPF, DKIM, and DMARC. This profile defines the actions to take when an email fails these authentication checks, such as quarantining or rejecting the message, and is applied to incoming email flows to ensure compliance with authentication standards.

Answer

Session Profile

Answer

Antispam Profile

Answer

IP Policy

Question 6

In FortiManager, what is the purpose of header and footer policies in a policy package?

Accepted Answer

To ensure specific policies are always placed at the top (header) or bottom (footer) of the policy list. Header and footer policies in FortiManager are special policy types that enforce a fixed position within the policy list. Header policies are always placed at the top (before all other policies), and footer policies are always placed at the bottom (after all other policies). This ensures that critical security rules, such as default-deny or global allow rules, remain in their intended position regardless of policy package changes or reordering operations.

Answer

To create policy groups for better organization

Answer

To apply policies only during specific times of the day

Answer

To separate IPv4 and IPv6 policies

Question 7

An administrator runs the CLI command 'diagnose vpn ike gateway list' and sees that a phase1 gateway is in 'UP' state, but the 'DPD' field shows 'disabled'. The tunnel is working. What is the implication?

Accepted Answer

The tunnel will never detect if the remote peer goes down.. When DPD is disabled, the FortiGate does not send DPD probes to verify the remote peer's liveliness. Without DPD or any other keepalive mechanism (such as IKE keepalives, which are not used in standard IPsec VPNs), the tunnel will remain in the 'UP' state indefinitely even if the remote peer goes down. This means the tunnel will never detect peer failure, leading to blackholed traffic until the administrator manually intervenes or the tunnel is re-established by other means.

Answer

DPD is only used for phase2, so phase1 is unaffected.

Answer

DPD is disabled but the tunnel will still detect peer failure via IKE keepalives.

Answer

The FortiGate is using NAT-T, which disables DPD automatically.

Question 8

A FortiGate in HA active-passive mode has two VDOMs. VDOM-1 is configured for management (management VDOM). The administrator connects to the management VDOM IP to manage the device. What is a characteristic of the management VDOM?

Accepted Answer

It provides administrative access and is separate from data VDOMs. In an HA active-passive setup with multiple VDOMs, a management VDOM is dedicated to administrative access (e.g., SSH, HTTPS, SNMP) and is logically separated from data VDOMs that handle production traffic. This separation ensures that management traffic does not interfere with data plane operations and that administrative access remains available even if data VDOMs experience issues. The management VDOM can be any VDOM, not necessarily the root, and its configuration is not automatically synchronized to other VDOMs.

Answer

It automatically synchronizes configuration to other VDOMs

Answer

It must be the root VDOM

Answer

It can only be accessed via the console port

Question 9

A network admin is troubleshooting why FortiGate's antivirus is not detecting a known malware sample. The sample is detected by other scanners. Which two checks should the admin perform? (Choose two.)

Accepted Answer

Verify that the FortiGuard Antivirus subscription is active. FortiGate's antivirus engine relies on a valid FortiGuard Antivirus subscription to download and update the virus signature database. If the subscription has expired, the engine cannot receive new signatures, causing it to miss recently discovered malware samples that other scanners with active subscriptions detect.

Answer

Check that the file is not excluded by a file filter

Answer

Ensure the firewall policy is configured for proxy-based inspection

Answer

Confirm that the antivirus profile has 'Scan on Delivery' enabled

Question 10

An administrator runs 'diagnose debug application sslvpn -1' and sees repeated 'SSL_ERROR_SSL: error:1417C0C7:SSL routines:tls_process_client_certificate:peer did not return a certificate'. The SSL-VPN is configured to require client certificates. What is the cause?

Accepted Answer

The client is not sending a client certificate. The error 'SSL_ERROR_SSL: error:1417C0C7:SSL routines:tls_process_client_certificate:peer did not return a certificate' occurs during the TLS handshake when the server requests a client certificate and the client fails to provide one. Since the SSL-VPN is configured to require client certificates, the FortiGate expects the client to present a valid certificate; if none is sent, the handshake fails with this specific OpenSSL error. This directly indicates that the client is not sending a client certificate, making option A correct.

Answer

The SSL-VPN server certificate is expired

Answer

The SSL-VPN tunnel mode is misconfigured

Answer

The CA certificate is not imported on FortiGate