NSE7 Practice Exam 62 — 20 Questions

Question 1

Match each FortiGate authentication method to its protocol.

Accepted Answer

LDAP: Lightweight Directory Access Protocol. FortiGate supports multiple authentication methods, each using a specific protocol. LDAP uses LDAP, RADIUS uses RADIUS, TACACS+ uses TACACS+, and SAML uses SAML. Common confusions include swapping LDAP and RADIUS definitions.

Answer

LDAP: Remote Authentication Dial-In User Service

Answer

RADIUS: Lightweight Directory Access Protocol

Question 2

Match each Fortinet component to its description.

Accepted Answer

FortiGate: Next-generation firewall (NGFW) with integrated security features. FortiGate is the NGFW, FortiManager manages devices, FortiAnalyzer handles logging/analytics, and FortiClient is an endpoint agent. Common confusions involve swapping these roles.

Answer

FortiGate: Centralized management for Fortinet devices

Answer

FortiManager: Next-generation firewall (NGFW) with integrated security features

Question 3

An administrator runs the following CLI output: 'diagnose sys session filter dport 443' and sees 'proto=6 proto_state=01 duration=3600 expire=3599'. Which statement BEST describes the session?

Accepted Answer

The session is established and has been active for one hour. The session shows 'proto=6' (TCP), 'proto_state=01' (TCP_ESTABLISHED), and 'duration=3600' seconds, which equals one hour. The 'expire=3599' indicates the session has 3599 seconds left before timeout, confirming it is active and established. Option B correctly identifies this as an established session that has been active for one hour.

Answer

The session is in the process of being torn down

Answer

The session is a UDP session incorrectly classified as TCP

Answer

The TCP session is still in the SYN-SENT state

Question 4

A FortiGate is configured with SD-WAN using BGP. The administrator wants to influence outbound traffic to prefer one SD-WAN member over another based on BGP attributes. Which BGP attribute, when modified on the FortiGate, can achieve this for outbound traffic?

Accepted Answer

Local-preference. Local-preference is a well-known mandatory BGP attribute that is propagated within an AS to influence outbound traffic by indicating the preferred exit point. When modified on the FortiGate, a higher local-preference value makes the route more preferred for outbound traffic, allowing the administrator to steer traffic toward a specific SD-WAN member without affecting inbound routing.

Answer

Weight

Answer

AS-Path prepending

Answer

MED

Question 5

An administrator is troubleshooting a FortiGate in transparent mode where clients cannot reach the internet. The FortiGate has two interfaces in the same VLAN. Which two items must be checked? (Choose two.)

Accepted Answer

The two interfaces are members of the same software switch or VDOM. In transparent mode, FortiGate acts as a Layer 2 bridge, so traffic must flow through a single broadcast domain. If the two interfaces are not in the same software switch or VDOM, they are isolated, breaking the Layer 2 path between clients and the upstream router. Option C is correct because both interfaces must be logically bridged to forward traffic within the same VLAN.

Answer

SSL inspection is enabled on the policy

Answer

The default gateway is configured on the FortiGate's management IP

Answer

The management IP is on a different subnet from the bridged network

Question 6

Which BFD mode is used to detect forwarding path failures between two FortiGates that are directly connected?

Accepted Answer

Asynchronous mode. Asynchronous mode is the default BFD mode used between two directly connected FortiGates to detect forwarding path failures. In this mode, both peers periodically send control packets at negotiated intervals, and if a peer stops receiving these packets within the detection multiplier, the session is declared down. This allows rapid detection of link or forwarding failures without relying on echo packets or on-demand triggers.

Answer

Synchronous mode

Answer

Echo mode

Answer

Demand mode

Question 7

An administrator is troubleshooting an IPsec VPN tunnel that fails to establish. The administrator runs 'diagnose vpn ike log' and sees the message 'no matching proposal found'. What is the MOST likely cause?

Accepted Answer

The Phase 1 parameters (encryption, authentication, DH group) do not match between peers. The 'no matching proposal found' message in the IKE log indicates that the FortiGate received a proposal from the remote peer during Phase 1 negotiation, but none of the offered combinations of encryption, authentication, and Diffie-Hellman group matched its own configured Phase 1 parameters. Since IKE uses a proposal/response exchange, a mismatch in any of these attributes causes the negotiation to fail before any further steps, such as authentication or policy lookup, can occur.

Answer

The remote gateway's IP address is unreachable

Answer

The firewall policy allowing the VPN traffic is missing or has the wrong interface

Answer

The pre-shared key is incorrect on one side

Question 8

An administrator is troubleshooting an SD-WAN rule that is not matching expected traffic. The SD-WAN rule uses a custom application category and has a performance SLA attached. Which two conditions must be true for the traffic to be matched by the SD-WAN rule? (Select TWO.)

Accepted Answer

The traffic must be identified by the application control sensor as the configured application category. SD-WAN rules in FortiOS rely on application control sensors to classify traffic into custom application categories. If the traffic is not identified by the application control sensor as belonging to the configured category, the SD-WAN rule cannot match it, regardless of other conditions.

Answer

The performance SLA must be marked as 'up' for at least one member in the SD-WAN zone

Answer

The destination port must be 80 or 443

Answer

The source IP must be in the same subnet as the SD-WAN member's IP

Question 9

A FortiGate with multiple VDOMs is experiencing inter-VDOM routing issues. The admin has created inter-VDOM links between VDOMs and configured firewall policies allowing traffic. However, traffic from VDOM_A to VDOM_B is not reaching the destination. What is the most likely cause?

Accepted Answer

The routing table in VDOM_A does not have a route to VDOM_B's subnet via the inter-VDOM link. Inter-VDOM routing requires explicit routes in each VDOM's routing table pointing to the destination subnet via the inter-VDOM link interface. Even with inter-VDOM links and firewall policies configured, if VDOM_A lacks a route to VDOM_B's subnet through that link, traffic will be dropped or forwarded incorrectly. The routing table must contain a static or dynamic route for the destination network with the next-hop set to the inter-VDOM link's IP address on the VDOM_A side.

Answer

The inter-VDOM link's administrative status is down

Answer

VDOM_B does not have an interface in the same subnet as the inter-VDOM link

Answer

The traffic is blocked by an implicit deny policy in VDOM_B

Question 10

A network admin is configuring SD-WAN on a FortiGate with two WAN members (port1, port2). The requirement is that traffic for Office 365 (source IP 10.1.1.0/24, destination IP 132.245.0.0/16) should use port1 primarily unless it fails the performance SLA, in which case it should use port2. Which SD-WAN rule configuration should the admin use?

Accepted Answer

Configure the rule with 'strategy = best quality', and enable 'set match-vip enable'. Use performance SLA to monitor port1. 'best quality' strategy allows SD-WAN to use performance SLA to monitor port1 and automatically fail over to port2 when port1 fails the SLA. This matches the requirement of using port1 primarily unless it fails the performance SLA. The 'set match-vip enable' is not directly relevant here but does not invalidate the rule; the core mechanism is the performance SLA-driven failover.

Answer

Configure the rule with 'strategy = spillover' and set spillover thresholds

Answer

Configure the rule with 'strategy = source-dest-ip' and include port1 and port2

Answer

Configure the rule with 'strategy = manual' and set the preferred member to port1

Question 11

A FortiGate administrator wants to use automation stitches to respond to a detected threat. The trigger is 'event' and the action is to quarantine the source IP. Which TWO actions can be used in FortiGate automation stitches to achieve IP quarantine?

Accepted Answer

CLI script that runs 'diagnose user quarantine add'. The 'diagnose user quarantine add' command is the native FortiGate CLI command to add an IP address to the quarantine list, which is a valid action in an automation stitch. Option C is also correct because executing a CLI script that creates a firewall address object and a corresponding policy to block the IP effectively achieves IP quarantine by preventing traffic from that source, which is a common alternative method.

Answer

Send an email to the administrator

Answer

Use the 'execute fortishield' command in a CLI script

Answer

Log the event to FortiAnalyzer

Question 12

Which FortiGate feature is used to detect link failures within milliseconds, allowing rapid convergence for routing protocols like OSPF and BGP?

Accepted Answer

BFD. Bidirectional Forwarding Detection (BFD) is the correct answer because it provides sub-second (millisecond) link failure detection independent of routing protocols. Unlike OSPF or BGP's own keepalive mechanisms, BFD can detect failures in as little as 50-100 ms, enabling rapid convergence for protocols like OSPF and BGP by immediately notifying them of a neighbor loss.

Answer

ECMP

Answer

OSPF Fast Hello

Answer

Route tagging

Question 13

A company's FortiGate is configured with multiple IPsec VPN tunnels to branch offices. One tunnel keeps dropping and re-establishing every few minutes. The logs show 'IPsec SA negotiation failed' with error 'proposal mismatch'. What is the most likely cause?

Accepted Answer

Mismatched encryption or authentication algorithms between the two VPN peers. The error 'proposal mismatch' directly indicates that the two IPsec peers cannot agree on the security parameters for the IKE or IPsec SA. This occurs when the encryption algorithm (e.g., AES256 vs. AES128), authentication algorithm (e.g., SHA256 vs. SHA1), Diffie-Hellman group, or lifetime values do not match between the FortiGate and the remote peer. The tunnel drops and re-establishes because the negotiation fails, and the FortiGate retries with the same mismatched proposal, leading to repeated failures.

Answer

Dead Peer Detection (DPD) configured too aggressively

Answer

NAT-Traversal (NAT-T) not enabled

Answer

Pre-shared key mismatch

Question 14

An administrator observes that after a failover in an HA cluster, some established sessions are dropped. The cluster is configured with session pickup enabled. What is the most likely reason for the dropped sessions?

Accepted Answer

Session pickup only synchronizes TCP sessions, and the dropped sessions are UDP. Session pickup in FortiGate HA synchronizes state information for TCP sessions by default, but UDP sessions are not synchronized because they are connectionless and do not have a stateful handshake. When a failover occurs, the new primary unit does not have the UDP session state, causing those sessions to be dropped. This is a known limitation of session pickup, which only covers TCP sessions unless specifically configured for UDP via session-ttl or other mechanisms.

Answer

The failover occurred during a configuration synchronization

Answer

The HA uptime is less than the session TTL

Answer

The session helper for the protocol is not enabled

Question 15

Which feature in FortiMail provides an additional layer of protection by analyzing the behavior of email attachments in a sandbox environment?

Accepted Answer

FortiSandbox integration. FortiSandbox integration allows FortiMail to forward email attachments to an external or internal FortiSandbox appliance for dynamic behavioral analysis. Unlike static signature-based detection, this sandboxing executes the attachment in a controlled environment to identify zero-day malware, ransomware, or advanced persistent threats based on runtime behavior, providing an additional layer of protection beyond traditional filtering.

Answer

Outbreak Prevention

Answer

Anti-spam

Answer

Content Disarm and Reconstruction

Question 16

A FortiGate administrator wants to implement Content Disarm and Reconstruction (CDR) for email attachments. Which security profile must be configured to enable CDR?

Accepted Answer

Antivirus profile. Content Disarm and Reconstruction (CDR) is a security feature that removes active content (e.g., macros, scripts, embedded objects) from files and reconstructs them into a safe version. In FortiOS, CDR is configured within the Antivirus profile because it operates as part of the antivirus scanning engine, specifically under the 'File Filter' or 'Content Disarm' tab, where you can enable CDR for supported file types like Office documents and PDFs.

Answer

Web Filter profile

Answer

IPS profile

Answer

Application Control profile

Question 17

An administrator is configuring BGP with SD-WAN on a FortiGate. Which TWO statements are true about BGP and SD-WAN integration? (Choose two.)

Accepted Answer

SD-WAN performance SLA can override BGP best path selection. SD-WAN performance SLA rules can override BGP best path selection by steering traffic over a different SD-WAN member interface, even if BGP would have chosen a different path. This is achieved through SD-WAN rules that match traffic and apply an action like 'best quality' or 'lowest cost', which takes precedence over the BGP routing table decision.

Answer

BGP must be disabled on interfaces used for SD-WAN

Answer

BGP learned routes cannot be used as SD-WAN members

Answer

BGP route redistribution is not supported with SD-WAN

Question 18

A network administrator is configuring SD-WAN on a FortiGate to control outbound internet traffic. The requirement is to load balance traffic across two WAN interfaces (port1 and port2) based on the number of new sessions, but only when both links are healthy. The administrator has added both interfaces to the SD-WAN zone and configured performance SLAs. Which TWO additional configuration steps are necessary to implement this requirement?

Accepted Answer

Configure the SD-WAN rule to use a performance SLA for health checking. Configuring a performance SLA for health checking in the SD-WAN rule ensures that the FortiGate monitors link quality (latency, jitter, packet loss) and only considers links that meet the SLA thresholds as active for traffic distribution. This satisfies the requirement that load balancing occurs only when both links are healthy. Option C is correct because setting the load balancing algorithm to 'sessions' in the SD-WAN rule ensures that traffic is distributed based on the number of new sessions, as required. Without Option C, the default algorithm (e.g., source-destination IP) would not meet the session-based requirement. Options A, D, and E are incorrect: ECMP load balancing (A) is a routing-level feature independent of SD-WAN rules; policy-based routing (D) is not needed when using SD-WAN rules; and the global 'sla-check' enable (E) activates SLA monitoring but does not apply the per-rule health check and algorithm configuration required here.

Answer

Enable 'ECMP load balancing' in the routing settings

Answer

Configure a policy-based routing rule to direct traffic to the SD-WAN zone

Answer

Set the 'sla-check' under config system sdwan to 'enable'

Question 19

A FortiGate administrator configures a custom IPS signature with the pattern 'attack' in the HTTP request URI. After applying the signature, no alerts are generated even though the traffic matches. What is the MOST likely cause?

Accepted Answer

The signature's protocol decoder is not set to 'HTTP'. The custom IPS signature pattern 'attack' will only be inspected against the HTTP request URI if the signature's protocol decoder is explicitly set to 'HTTP'. Without this decoder assignment, the IPS engine does not know which protocol layer to parse, and the pattern is never matched against the URI, resulting in no alerts despite matching traffic.

Answer

The signature's protocol decoder is set to 'HTTP'

Answer

The signature action is set to 'pass'

Answer

The signature severity is too low

Question 20

An administrator wants to configure FortiGate to automatically block a source IP when a high-severity IPS event is detected. Which TWO components must be configured? (Choose two.)

Accepted Answer

An automation stitch trigger set to 'IPS Event'. An automation stitch trigger set to 'IPS Event' is required to detect the high-severity IPS event and initiate the automated response. Option E is correct because the 'Quarantine' action within the automation stitch is the component that actually blocks the source IP by adding a dynamic block entry to the firewall policy.

Answer

A firewall policy with IPS enabled

Answer

A FortiGuard category subscription

Answer

A static route to the source IP