NSE7 Practice Exam 61 — 20 Questions

Question 1

Match each Fortinet command to its function.

Accepted Answer

get system performance: Display real-time system performance statistics. Correct matches: 'get system performance' shows real-time performance statistics; 'diagnose debug application httpd' enables HTTP daemon debugging; 'execute ping' tests network connectivity; 'show system status' displays system summary. Common confusions include swapping the functions of 'get system performance' and 'execute ping'.

Answer

get system performance: Ping a network host

Answer

execute ping: Display real-time system performance statistics

Question 2

An administrator is configuring SSL VPN on FortiGate and wants to allow users to access internal applications via a web portal without installing any client software. Which SSL VPN mode should be used?

Accepted Answer

Web mode. Web mode (option C) is correct because it enables users to access internal web applications through a FortiGate SSL VPN web portal using only a standard browser, with no client software installation required. The portal acts as a reverse proxy, translating HTTPS requests from the client to the internal application servers, making it ideal for clientless remote access.

Answer

DTLS

Answer

Tunnel mode

Answer

Split tunneling

Question 3

A FortiGate is configured with two static routes to the same destination 0.0.0.0/0 with equal distance but different priorities. The priority values are 10 and 20. Which route will be used for traffic matching the default route?

Accepted Answer

The route with priority 10 will be used.. In FortiGate, when multiple static routes have the same distance (administrative distance) to the same destination, the route with the lowest priority value is selected. Priority is a FortiGate-specific metric that breaks ties among routes with equal distance. Since priority 10 is lower than 20, the route with priority 10 will be installed in the routing table and used for traffic matching 0.0.0.0/0.

Answer

The route with priority 20 will be used.

Answer

The route with lower distance will be used.

Answer

Both routes will be used for load balancing.

Question 4

A FortiGate HA cluster is configured with VDOMs. Each VDOM is assigned to different physical interfaces. The cluster is in active-passive mode. Which TWO statements about VDOM synchronization in HA are correct?

Accepted Answer

VDOM configuration, including interfaces and policies, is synchronized between cluster members.. In a FortiGate HA cluster, VDOM configuration—including interfaces, policies, and other settings—is fully synchronized between cluster members. This ensures that both the active and passive units have identical VDOM configurations, enabling seamless failover without manual reconfiguration.

Answer

In active-passive HA, traffic for each VDOM can be distributed across cluster members.

Answer

Each VDOM can have its own HA mode (active-passive or active-active) independent of the global HA mode.

Answer

If one VDOM fails, the entire HA cluster fails over to the standby unit.

Question 5

A FortiGate administrator needs to inspect traffic between two VLANs in the same VDOM. The administrator has configured a firewall policy that applies an antivirus profile, but traffic is passing without inspection. What should the administrator check first?

Accepted Answer

That the firewall policy's source and destination interfaces match the VLAN interfaces. The most common reason for traffic passing without inspection in a VDOM is a misconfiguration in the firewall policy's interface matching. Since the traffic is between two VLANs, the policy must explicitly specify the correct source and destination VLAN interfaces. If the policy uses the wrong interfaces (e.g., a physical interface instead of the VLAN subinterface), the traffic will bypass the policy and its associated security profiles entirely.

Answer

The FortiGuard subscription status

Answer

Whether the antivirus profile is configured to use flow-based inspection

Answer

The antivirus profile's scan mode

Question 6

A FortiGate administrator needs to identify which process is consuming the most memory. Which command should be used?

Accepted Answer

diagnose sys top. The 'diagnose sys top' command displays a real-time list of running processes sorted by CPU and memory usage, allowing the administrator to identify which process is consuming the most memory. This is the standard FortiGate CLI command for process-level resource monitoring, similar to 'top' on Linux systems.

Answer

show system resource usage

Answer

diagnose hardware sysinfo memory

Answer

get system performance status

Question 7

An administrator is troubleshooting an IPsec VPN tunnel that uses PKI certificates for authentication. The tunnel fails to establish. The administrator checks the certificates and finds that the local certificate is valid and the CA certificate is trusted. Which two additional checks should the administrator perform? (Choose TWO)

Accepted Answer

Verify that the certificate's CN matches the peer's IP address. Common certificate issues include: the certificate's Common Name (CN) does not match the peer's IP address, or the certificate has expired. Also, the certificate must have the 'IPsec tunnel' extended key usage (EKU) and the subject alternate name (SAN) must include the peer's IP.

Answer

Verify that the certificate is installed in the local certificate store on the FortiGate

Answer

Ensure that the certificate is using RSA 2048-bit keys

Answer

Confirm that the certificate's private key is exportable

Question 8

An administrator wants to protect against zero-day malware that has not yet been discovered by signature-based detection. Which TWO technologies can help mitigate such threats?

Accepted Answer

Machine Learning Engine. The Machine Learning Engine (A) is correct because it uses behavioral analysis and static file analysis to detect previously unknown malware based on patterns and anomalies, without relying on signatures. This allows it to identify zero-day threats by analyzing file characteristics and runtime behavior in real time.

Answer

Signature-based antivirus

Answer

Web filtering

Answer

Application control

Question 9

You have configured VRF on a FortiGate with two VRFs: VRF 1 for guest traffic and VRF 2 for corporate traffic. You want to allow limited communication from guests to a corporate DNS server. What is the correct configuration step?

Accepted Answer

Configure route leaking between VRF 1 and VRF 2 for the DNS server's IP. VRF isolation by default prevents traffic from crossing between VRFs. To allow a guest in VRF 1 to reach a corporate DNS server in VRF 2, you must leak the DNS server's route from VRF 2 into VRF 1. This is achieved by configuring route leaking (e.g., using route maps or VRF route leaking on FortiGate), which installs the DNS server's IP prefix into the guest VRF's routing table, enabling reachability without breaking VRF separation for other traffic.

Answer

Create a firewall policy from VRF 1 to VRF 2 allowing DNS traffic

Answer

Enable 'set allow-vrf' on the DNS server's interface

Answer

Place the DNS server in a management VDOM and use inter-VDOM links

Question 10

A FortiGate has two WAN links and uses ECMP load balancing for default routes. The administrator wants to ensure that all packets belonging to the same TCP session go out the same interface. Which setting should be enabled?

Accepted Answer

ECMP with 'session-based' algorithm. The 'session-based' algorithm (also known as 'source-ip-based' or 'ECMP with session-based' in FortiOS) ensures that all packets belonging to the same TCP session are forwarded out the same interface by hashing the 5-tuple (source IP, destination IP, source port, destination port, protocol). This guarantees session stickiness across ECMP paths, preventing out-of-order delivery and TCP retransmissions. Option D is correct because it directly addresses the requirement for per-session interface consistency.

Answer

Persistent NAT

Answer

ECMP source-destination-ip hash

Answer

ECMP with source-ip hash

Question 11

An administrator wants to use FortiManager to push a new firewall policy to a managed FortiGate. Before installing, the administrator wants to review what changes will be applied. Which FortiManager feature should be used?

Accepted Answer

Install Preview. Install Preview (Option A) is the correct feature because it allows the administrator to see a detailed, side-by-side comparison of the current configuration on the managed FortiGate versus the pending changes that FortiManager will push. This preview is generated by FortiManager's policy compilation engine, which calculates the exact CLI commands and object modifications required to synchronize the device database (ADOM) with the managed FortiGate. It provides a safe, non-disruptive way to validate changes before committing them, reducing the risk of misconfiguration.

Answer

Policy & Objects - Install Wizard

Answer

Configuration Rollback

Answer

Revision History

Question 12

A company with a hub-and-spoke SD-WAN topology uses FortiGates at each site. The hub has two WAN links: MPLS (10 Mbps) and broadband (100 Mbps). The spokes connect only via MPLS. The company deploys a new real-time application that requires low latency and low jitter. The network administrator creates an SD-WAN rule for this application with 'best quality' strategy and both MPLS and broadband as members. The SLA for MPLS is configured with latency < 10 ms and jitter < 5 ms. The SLA for broadband is configured with latency < 50 ms and jitter < 20 ms. The actual measured latency on MPLS is 12 ms, and jitter is 4 ms. The broadband latency is 25 ms, jitter 10 ms. Which path will the application traffic take?

Accepted Answer

The traffic will use the broadband link because MPLS SLA fails and broadband SLA is met.. The SD-WAN rule uses the 'best quality' strategy, which selects the member with the best SLA performance. The MPLS link fails its SLA because its measured latency of 12 ms exceeds the configured threshold of 10 ms, even though jitter is within limits. The broadband link meets both its latency (25 ms < 50 ms) and jitter (10 ms < 20 ms) thresholds, so it becomes the active path for the application traffic.

Answer

The traffic will be load-balanced between MPLS and broadband.

Answer

The traffic will use the MPLS link because it is the preferred member.

Answer

The traffic will be dropped because no link meets the SLA.

Question 13

A network administrator is troubleshooting a scenario where remote users can connect via FortiClient VPN but cannot access internal resources. The FortiGate has a valid IPsec VPN configuration. Which THREE checks should the administrator perform to resolve the issue?

Accepted Answer

Check if there is a route on the internal network pointing back to the VPN subnet. If the internal network lacks a route back to the VPN subnet (e.g., 10.10.10.0/24), return traffic from internal resources will be dropped or misrouted, preventing remote users from accessing those resources even though the IPsec tunnel is established. This is a classic asymmetric routing issue where the FortiGate sends traffic to the internal network, but the internal router has no path back to the VPN client IPs.

Answer

Increase the MTU on the VPN interface

Answer

Disable DPD on the VPN phase 1

Question 14

A FortiGate administrator wants to use FortiAnalyzer to view traffic logs from multiple VDOMs. Which TWO steps must the administrator perform on FortiAnalyzer?

Accepted Answer

Add the FortiGate as a device in FortiAnalyzer. FortiAnalyzer must have the FortiGate added as a managed device in order to receive and process logs from it. This registration establishes the trust relationship and log-receiving configuration between the two systems.

Answer

Install a security profile on FortiAnalyzer

Answer

Create a separate ADOM for each VDOM

Answer

Enable FortiAnalyzer's built-in firewall

Question 15

An administrator uses FortiManager to deploy a new security policy to a remote FortiGate. The administrator selects 'Install Preview' and sees that the policy will be created. After confirming, the installation fails with 'Device not reachable'. What is the most likely reason?

Accepted Answer

The FortiGate is behind a NAT device that blocks FGFM traffic. The 'Device not reachable' error during an Install Preview operation indicates that FortiManager cannot establish or maintain the FGFM (FortiGate-to-FortiManager) tunnel with the remote FortiGate. When the FortiGate is behind a NAT device, the NAT may alter the source IP or port of FGFM traffic, causing the tunnel to break or preventing the FortiManager from reaching the FortiGate's management IP. This is the most common cause of such reachability failures in remote deployments.

Answer

The FortiGate has insufficient memory

Answer

The policy package is locked by another administrator

Answer

The FortiGate's configuration revision has changed since the last sync

Question 16

A FortiGate administrator wants to use FortiManager automation stitches to automatically block IP addresses that trigger multiple intrusion prevention events. Which two components are required to configure an automation stitch? (Choose two.)

Accepted Answer

Trigger. An automation stitch in FortiManager requires a Trigger to define the event that initiates the stitch (e.g., an intrusion prevention event) and an Action to specify the response (e.g., blocking an IP address via a firewall address object). The Trigger monitors for specific log messages or system events, while the Action executes the configured remediation step. Without both, the stitch cannot be created or function.

Answer

Playbook

Answer

Destination

Answer

Schedule

Question 17

A FortiGate is configured with an IPS sensor that has protocol anomaly detection enabled. The admin notices that legitimate VoIP traffic (SIP) is being blocked. Which action should the admin take to reduce false positives?

Accepted Answer

Tune the protocol anomaly thresholds to be more lenient for SIP. Protocol anomaly detection in IPS sensors uses predefined thresholds to identify abnormal traffic patterns. When legitimate SIP traffic is being blocked, tuning the protocol anomaly thresholds to be more lenient for SIP allows the sensor to accommodate normal variations in SIP behavior without triggering false positives, while still maintaining protection against actual anomalies.

Answer

Change the IPS action from block to monitor

Answer

Add the VoIP servers to an IP exemption list in the IPS sensor

Answer

Disable protocol anomaly detection entirely

Question 18

What is the primary difference between using a Web Application Firewall (WAF) on FortiGate versus using FortiWeb?

Accepted Answer

FortiWeb provides dedicated, advanced WAF features and higher performance for web traffic, while FortiGate WAF is a basic protection feature.. FortiWeb is a dedicated web application firewall appliance that provides advanced, specialized WAF features such as machine learning-based bot detection, API discovery, and granular signature tuning, along with higher throughput for web traffic. In contrast, the WAF feature on FortiGate is a basic, integrated protection module that offers essential HTTP/HTTPS inspection and signature-based filtering, but lacks the depth and performance optimization of FortiWeb.

Answer

There is no difference; they are the same.

Answer

FortiGate WAF is cloud-based, while FortiWeb is on-premises.

Answer

FortiGate WAF can protect multiple web servers simultaneously, while FortiWeb protects only one.

Question 19

An administrator has configured two VDOMs on a FortiGate. One VDOM is in NAT mode and the other in transparent mode. The administrator wants traffic from the transparent mode VDOM to be routed through the NAT mode VDOM. What must be configured to allow inter-VDOM routing?

Accepted Answer

Create an inter-VDOM link. Inter-VDOM routing between VDOMs in different modes (NAT and transparent) requires a dedicated inter-VDOM link (IVL), which is a virtual internal connection that allows traffic to pass between VDOMs without consuming physical ports. The IVL creates a pair of virtual interfaces, one in each VDOM, and firewall policies must be configured to permit traffic across them. This is the only method that supports routing between VDOMs of different modes on the same FortiGate.

Answer

Use a physical interface to connect the VDOMs

Answer

Enable NPU offloading

Answer

Configure firewall policies between the VDOMs

Question 20

Match each Fortinet security feature to its primary function.

Accepted Answer

IPS: Inspects traffic for malicious patterns and exploits. Fortinet security features have distinct functions: IPS inspects network traffic for exploits, Application Control identifies applications, Web Filtering controls web access, and Antivirus scans for malware. Common confusions involve swapping these roles.

Answer

IPS: Scans files and content for malware

Answer

Application Control: Blocks access to malicious websites