NSE7 Practice Exam 60 — 20 Questions

Question 1

A FortiGate is operating in transparent mode for a VDOM. Which statement about transparent mode is TRUE?

Accepted Answer

The FortiGate operates as a Layer 2 bridge, forwarding frames without modifying source/destination MAC addresses. In transparent mode, a FortiGate VDOM acts as a Layer 2 bridge, forwarding Ethernet frames based on MAC addresses without modifying the source or destination MAC addresses. This allows the FortiGate to inspect traffic between hosts on the same subnet without requiring IP address changes or routing, functioning as a security appliance that is transparent to the network.

Answer

Virtual IP (VIP) objects are supported in transparent mode to map public to private IPs

Answer

Each interface in the VDOM must have an IP address in the same subnet

Answer

The VDOM can have multiple IP subnets on the same broadcast domain, and the FortiGate inspects traffic between them

Question 2

What is the maximum number of VDOMs supported on a FortiGate 600F (assuming license)?

Accepted Answer

500. The FortiGate 600F, when properly licensed, supports up to 500 VDOMs. This is because the 600F is a mid-range enterprise appliance designed for large-scale multi-tenant environments, and its hardware resources (CPU, memory, and NP7 processors) are provisioned to handle the control-plane and data-plane overhead of up to 500 virtual domains. The license unlocks the VDOM feature, but the maximum count is a hardware-imposed limit, not a software cap.

Answer

10

Answer

50

Answer

100

Question 3

Drag and drop the steps to configure an HA cluster on FortiGate into the correct order.

Accepted Answer

1. Set HA mode and priority, 2. Connect heartbeat interfaces, 3. Configure management IP and VIP, 4. Verify. First set HA mode and priority, then connect heartbeat, then configure management IP and VIP, and finally verify.

Answer

1. Connect heartbeat interfaces, 2. Set HA mode and priority, 3. Configure management IP and VIP, 4. Verify

Answer

1. Set HA mode and priority, 2. Configure management IP and VIP, 3. Connect heartbeat interfaces, 4. Verify

Answer

1. Configure management IP and VIP, 2. Set HA mode and priority, 3. Connect heartbeat interfaces, 4. Verify

Question 4

A network administrator configures an SD-WAN zone with two members (port1 and port2) and sets the load balancing algorithm to 'spillover'. The spillover threshold is set to 100 Mbps on port1. If traffic reaches 120 Mbps on port1, what happens to new sessions?

Accepted Answer

New sessions are sent to port2 until port1 drops below the threshold. When the spillover algorithm is configured with a threshold of 100 Mbps on port1 and traffic reaches 120 Mbps, port1 is considered saturated. The SD-WAN zone then directs all new sessions to port2 until the traffic on port1 drops below the threshold. This is the defined behavior of spillover load balancing in Fortinet SD-WAN, where traffic is shifted away from an overloaded member to maintain performance.

Answer

All traffic is dropped because the threshold exceeded

Answer

Port1 continues to receive all new sessions but packets are queued

Answer

New sessions are distributed equally between port1 and port2

Question 5

An administrator is troubleshooting a scenario where traffic from VLAN 100 to a server at 10.1.2.100 is being blocked. The FortiGate has an active security policy allowing the traffic and the routing table shows a correct route. Which TWO diagnostic commands should the administrator run to identify the cause of the blockage?

Accepted Answer

diagnose sniffer packet any 'host 10.1.2.100' 4. 'diagnose sniffer packet any host 10.1.2.100 4' captures packets to/from the server at the interface level, allowing the administrator to see if traffic from VLAN 100 is actually arriving at the FortiGate and whether it is being dropped or forwarded. This command helps identify if the issue is at Layer 2 (e.g., VLAN misconfiguration) or Layer 3 (e.g., routing or firewall drops).

Answer

get system performance status

Answer

diagnose ip arp list

Answer

diagnose sys session list

Question 6

A network administrator is troubleshooting an ADVPN deployment. Spoke FortiGates can communicate with the hub, but shortcut tunnels between spokes are not being established. The administrator verifies that IKE and IPsec settings are correct on all devices. What is the MOST likely cause?

Accepted Answer

The hub's phase2 configuration has 'auto-negotiate' disabled. In ADVPN, shortcut tunnels require IKEv2 with the 'add-route' option and auto-negotiate. If the hub's phase2 configuration does not have 'auto-negotiate' enabled, it will not initiate shortcut tunnels.

Answer

Dead Peer Detection (DPD) is disabled on the hub

Answer

The hub's phase1 configuration has 'auto-negotiate' disabled

Answer

The spokes have different IKE versions configured

Question 7

Refer to the exhibit. An administrator runs the 'diagnose vpn ike stats' command on a FortiGate. What does the output indicate?

Accepted Answer

The tunnel has one IKE SA and two IPsec SAs, which is normal for a single VPN tunnel.. The 'diagnose vpn ike stats' output shows one IKE SA (phase 1) and two IPsec SAs (phase 2). This is normal for a single VPN tunnel when using IPsec with both inbound and outbound SAs, or when the tunnel is configured with separate SAs for different traffic selectors. The presence of two IPsec SAs under one IKE SA does not indicate an error or vulnerability; it is the expected behavior for a standard IPsec VPN tunnel.

Answer

The tunnel is vulnerable to a man-in-the-middle attack because the IPsec SAs are using the same encryption algorithm.

Answer

The tunnel configuration is incorrect because there are two IPsec SAs under one IKE SA.

Answer

The tunnel is using two IKE SAs for redundancy.

Question 8

A company is deploying ZTNA to protect an internal application. They want to ensure that only users with devices that have disk encryption enabled and the latest OS patches can access the application. Which THREE components must be configured to achieve this?

Accepted Answer

FortiClient on the endpoint device. To enforce device posture requirements like disk encryption and OS patch level, you need FortiClient on the device to report posture, FortiClient EMS to define compliance policies and generate tags, and FortiGate ZTNA proxy to check those tags before granting access.

Answer

FortiNAC for network admission control

Answer

IPsec VPN to encrypt traffic between client and FortiGate

Question 9

An administrator wants to implement ZTNA inline CASB to control access to a SaaS application (e.g., Office 365). Which three components are required for this setup? (Choose THREE)

Accepted Answer

FortiClient EMS for device posture and tag assignment. ZTNA inline CASB requires FortiGate as an inline proxy, FortiClient EMS for device posture and identity, and a ZTNA rule that proxies traffic to the SaaS application. Additionally, SSL deep inspection is required to decrypt and inspect traffic.

Answer

FortiNAC for network access control

Answer

A VPN tunnel between FortiGate and the SaaS provider

Question 10

In a Fortinet ZTNA deployment, which component is responsible for forwarding decrypted traffic to the internal application server after the FortiGate proxy has performed SSL inspection?

Accepted Answer

ZTNA proxy on FortiGate. ZTNA proxy receives client requests, performs SSL inspection, and forwards the decrypted traffic to the internal server.

Answer

FortiClient EMS

Answer

IPsec VPN tunnel

Answer

FortiNAC

Question 11

A FortiGate has multiple IPsec VPNs to different branch offices. The administrator notices that one VPN tunnel is flapping (going up and down repeatedly). From the CLI, 'diagnose vpn ike gateway list' shows the gateway state as 'up' but then quickly goes to 'down'. What is the MOST likely cause?

Accepted Answer

Dead Peer Detection (DPD) retry interval is too short. Tunnel flapping with IKEv2 is often due to DPD mismatches or aggressive DPD retry intervals. If DPD is configured with very short intervals, the tunnel may drop due to transient delays.

Answer

The remote gateway's certificate is expired

Answer

The phase2 proposal is mismatched

Answer

The pre-shared key is incorrect

Question 12

An administrator wants to use FortiGate as a SAML identity provider (IdP) for a third-party service. Which configuration is required on FortiGate?

Accepted Answer

Configure a SAML identity provider user and export FortiGate's metadata. FortiGate can act as an IdP by creating a SAML IdP user and configuring the service provider metadata.

Answer

Enable SAML authentication in the firewall policy

Answer

Configure FortiAuthenticator as an external IdP

Answer

Configure a SAML service provider user and import the SP metadata

Question 13

A FortiGate in transparent mode is deployed in a data center. The admin notices that ARP requests from a downstream switch for the default gateway are not being answered. The FortiGate's management IP is configured on the same subnet as the switch. What is the most likely cause?

Accepted Answer

The management IP is configured on the same VLAN as the downstream switch, causing a conflict. In transparent mode, the FortiGate acts as a Layer 2 bridge and does not participate in ARP for traffic passing through it. However, the management IP is used for administrative access and must be unique on the network. If the management IP is configured on the same VLAN as the downstream switch, it creates an IP address conflict with the switch's own interface or the default gateway, causing the switch to either ignore or not forward ARP requests for that IP. The FortiGate will not respond to ARP requests for the management IP if it detects a duplicate IP on the same broadcast domain, as per RFC 5227.

Answer

The downstream switch has port security enabled

Answer

The FortiGate has a firewall policy blocking ARP

Answer

The FortiGate's ARP table is full

Question 14

A FortiGate is configured with SD-WAN and uses performance SLA to monitor link quality. The administrator sets the SLA threshold to jitter < 30ms. If a link has average jitter of 35ms, what is the status of that link in the SD-WAN health check?

Accepted Answer

Degraded. In FortiGate SD-WAN, when a link's measured jitter exceeds the configured Performance SLA threshold (30ms) but does not fail the SLA entirely, the link is marked as 'Degraded'. The SLA threshold defines the acceptable quality; exceeding it means the link is still alive but not meeting the desired performance, hence degraded.

Answer

Dead

Answer

Unavailable

Answer

Alive

Question 15

In FortiManager, what is the purpose of an automation stitch?

Accepted Answer

To trigger automated actions based on predefined events. An automation stitch in FortiManager is a sequence of automated actions triggered by a predefined event, such as a log message, SNMP trap, or schedule. It allows administrators to define a set of actions (e.g., run a script, send an alert, or change a policy) that execute in response to specific conditions, streamlining incident response and network management without manual intervention.

Answer

To combine multiple ADOMs into a single management domain

Answer

To automatically deploy configuration changes to devices

Answer

To stitch together multiple policy packages into one

Question 16

An administrator needs to deploy a honeypot solution to detect and deceive attackers inside the network. Which Fortinet product is BEST suited for this purpose?

Accepted Answer

FortiDeceptor. FortiDeceptor is a dedicated deception-based security solution that deploys decoys (honeypots) and lures across the network to detect and misdirect attackers. It integrates with FortiGate and FortiSIEM to provide automated threat isolation and forensic data collection, making it the best choice for a honeypot deployment.

Answer

FortiSandbox

Answer

FortiEDR

Answer

FortiNAC

Question 17

A security engineer is troubleshooting a scenario where FortiGate is not blocking a known malicious URL categorized as 'Malware'. The web filtering profile is configured with 'monitor all' for the Malware category. What change should be made to block the URL?

Accepted Answer

Change the action for Malware category from 'monitor' to 'block' in the web filter profile. The web filtering profile currently has the Malware category set to 'monitor all', which logs but does not block traffic. To block the URL, the action must be changed from 'monitor' to 'block' within the same web filter profile. This directly enforces the blocking action for all URLs categorized as Malware, including the known malicious URL.

Answer

Configure traffic shaping to rate limit the URL

Answer

Add a static URL filter with the exact URL and action 'block'

Answer

Enable DNS filter with botnet C2 domain blocking

Question 18

A FortiGate is experiencing high CPU usage. The administrator runs 'diagnose sys top' and sees that the process 'ipsengine' is using the most CPU. What is the most likely cause?

Accepted Answer

A large volume of traffic is being inspected by IPS, possibly due to a DoS attack.. The ipsengine process handles Intrusion Prevention System (IPS) inspection. High CPU usage by ipsengine typically indicates that the FortiGate is processing a large volume of traffic through IPS signatures, which is computationally intensive. This is often triggered by a DoS attack or a sudden surge in traffic that requires deep packet inspection, overwhelming the CPU.

Answer

The firewall is experiencing a memory leak.

Answer

The antivirus engine is scanning large files.

Answer

There is a routing loop causing packet bouncing.

Question 19

Refer to the exhibit. An administrator notices that some malware files are not being detected by FortiGate. The antivirus profile uses flow-based scanning with FortiSandbox disabled. What is the most likely reason for missed detections?

Accepted Answer

FortiSandbox inline-scan is disabled, so unknown malware is not analyzed. Flow-based scanning inspects files as they traverse the firewall, but it relies on signatures and heuristics for detection. Without FortiSandbox inline-scan enabled, unknown or zero-day malware that does not match existing signatures will not be sent to the sandbox for behavioral analysis, so it can pass undetected. Option B correctly identifies that disabling FortiSandbox removes the ability to analyze unknown threats, which is the most likely reason for missed detections.

Answer

Flow-based scanning is less thorough than proxy-based

Answer

Quarantine is enabled, which causes files to be dropped before scanning

Answer

The antivirus profile is not applied to the firewall policy

Question 20

A network engineer is troubleshooting an SD-WAN setup where traffic from a specific subnet is not being load-balanced as expected. The SD-WAN rule uses 'source IP' hashing. The engineer notices that the traffic originates from multiple hosts in the same /24 subnet. What is the most likely cause of poor load distribution?

Accepted Answer

The source IP hashing algorithm causes multiple hosts in the same subnet to map to the same member.. Source IP hashing in SD-WAN uses a hash of the source IP address to select a member for each flow. When multiple hosts reside in the same /24 subnet, their source IPs share the same first 24 bits, which can cause the hash algorithm to map them to the same SD-WAN member if the hash function is not sufficiently granular or if the number of members is small. This results in poor load distribution despite multiple sources.

Answer

The SD-WAN rule is not matching the traffic.

Answer

The SD-WAN members have different bandwidths.

Answer

Traffic is using a single destination IP and port.