NSE7 Practice Exam 65 — 20 Questions

Question 1

An administrator wants to prevent users from downloading known malicious files from the internet. The administrator has enabled FortiGuard Outbreak Prevention and applied an antivirus profile to the outbound policy. However, some malicious files are still reaching users. What configuration step is most likely missing?

Accepted Answer

The antivirus profile does not have 'FortiGuard Outbreak Prevention' enabled. Option C is correct because FortiGuard Outbreak Prevention is a separate toggle within the antivirus profile that must be explicitly enabled to leverage real-time outbreak intelligence. Even if the administrator believes they have enabled it, the profile may have the feature disabled by default or inadvertently left off, allowing known malicious files to bypass detection. Without this toggle, the antivirus engine relies only on static signatures and cannot block files flagged by FortiGuard's outbreak database.

Answer

The antivirus profile has 'FortiGuard Outbreak Prevention' enabled

Answer

The FortiGuard subscription has expired

Answer

The security policy is not configured for proxy-based inspection

Question 2

A FortiGate administrator notices that traffic classified as 'unknown' by the antivirus is being allowed. The administrator wants to ensure that such files are submitted to FortiSandbox for analysis and blocked until a verdict is received. Which configuration is required?

Accepted Answer

Enable FortiSandbox in the antivirus profile and set 'Action for unknown files' to 'Block'. Option B is correct because when FortiSandbox is enabled in the antivirus profile and 'Action for unknown files' is set to 'Block', the FortiGate will submit files that cannot be identified by the local antivirus engine to FortiSandbox for analysis. While the file is being analyzed, it is blocked from reaching the client, ensuring that no potentially malicious content is delivered until a verdict (clean or malicious) is received. This directly addresses the administrator's requirement to block unknown files pending sandbox analysis.

Answer

Create a custom IPS signature for unknown files

Answer

Enable outbreak prevention in the antivirus profile

Answer

Enable FortiSandbox in the antivirus profile and set 'Action for known files' to 'Block'

Question 3

Which FortiMail advanced feature allows the administrator to rewrite URLs in email bodies to redirect users to a safe scanning service when they click on a link?

Accepted Answer

URL Rewriting. URL Rewriting is the correct answer because it is a FortiMail advanced feature specifically designed to replace URLs in email bodies with rewritten links that redirect users through FortiMail's scanning service. When a user clicks the rewritten URL, FortiMail inspects the destination in real time for malicious content, such as phishing or malware sites, before allowing the redirect. This provides proactive protection against zero-hour threats by leveraging FortiGuard's web filtering and threat intelligence.

Answer

Attachment Filtering

Answer

Bounce Verification

Answer

Anti-Spam

Question 4

A company uses FortiGate as a web application firewall (WAF) to protect a public web server. The security team wants to block SQL injection attacks. Which WAF signature category should the administrator enable?

Accepted Answer

SQL Injection. The correct answer is C because SQL injection attacks specifically target database queries by injecting malicious SQL statements through input fields. FortiGate's WAF signature category for SQL Injection is designed to detect and block these patterns, such as 'OR 1=1' or UNION-based injections, by matching against known attack signatures in the HTTP request payload.

Answer

Server-Side Request Forgery

Answer

Command Injection

Answer

Cross-Site Scripting

Question 5

An admin wants to create a custom IPS signature to detect a specific exploit that sends a string 'EXPLOIT' in the HTTP Host header. Which signature syntax is correct?

Accepted Answer

F-SBID( --name "HTTP_EXPLOIT" --protocol http --header Host --content "EXPLOIT" ). Option D is correct because the FortiGate custom IPS signature syntax requires the `--protocol http` flag to specify the application-layer protocol for HTTP inspection, and `--header Host` to target the HTTP Host header field. The `--content` parameter then defines the string 'EXPLOIT' to match within that header, enabling precise detection of the exploit.

Answer

F-SBID( --name "HTTP_EXPLOIT" --protocol http --header Host --content "EXPLOIT" )

Answer

F-SBID( --name "HTTP_EXPLOIT" --service HTTP --header Host --content "EXPLOIT" )

Answer

F-SBID( --name "HTTP_EXPLOIT" --protocol tcp --header Host --content "EXPLOIT" )

Question 6

An administrator wants to enforce that only devices with the latest antivirus signatures and a corporate disk encryption solution can access a sensitive application via ZTNA. Which two FortiClient EMS components must be configured? (Choose two.)

Accepted Answer

Device posture checks. ZTNA tags define compliance requirements, and device posture checks evaluate endpoint security state. Together they enable conditional access based on endpoint compliance.

Answer

VPN tunnels

Answer

SAML SSO

Question 7

A FortiGate is configured with two VPN tunnels to different remote sites. The administrator notices that traffic is not load-balanced across the tunnels; all traffic uses the first tunnel. The administrator wants to use ECMP (Equal Cost Multi-Path) routing. Which two actions are required? (Choose two.)

Accepted Answer

Set the same distance and priority for both static routes. ECMP requires that routes have the same distance and priority. Also, the administrator must enable ECMP in the routing settings. Option A and D are correct: set the same distance and priority for the static routes, and enable ECMP. Note: ECMP is enabled by default in policy-based routing? Actually, for static routes, ECMP is automatically used when multiple routes have the same distance and priority. Option D is correct: enable ECMP in the routing settings (if not already). But the question asks for two actions. So A and D.

Answer

Configure both tunnels to use the same IKE version

Answer

Set the same phase2 lifetime for both tunnels

Question 8

A company has deployed a Security Fabric with a root FortiGate 600E and two downstream FortiGate 200E devices. The network also includes a FortiAnalyzer and a FortiManager. The administrator notices that the Security Fabric topology in FortiGate is not showing the downstream devices. The root FortiGate can ping the management IPs of the downstream devices. Additionally, the administrator has configured the downstream devices with the correct root IP and authorization mode is set to 'none'. However, when running 'diagnose sys fabric list' on the root, it shows the downstream devices with status 'Pending'. The root FortiGate's firewall policy allows all traffic from the downstream subnets. What is the most likely cause of the issue?

Accepted Answer

The downstream devices are missing the root FortiGate's serial number in the 'downstream-authorization' configuration.. The 'Pending' status in the output of 'diagnose sys fabric list' indicates that the root FortiGate has discovered the downstream devices but they have not completed the authorization handshake. Even though the authorization mode is set to 'none', each downstream FortiGate must still have the root FortiGate's serial number explicitly listed in its 'downstream-authorization' configuration to be accepted into the Security Fabric. Without this entry, the root will not finalize the adjacency, leaving the downstream devices in a pending state.

Answer

The FortiAnalyzer is not configured to receive logs from the downstream devices.

Answer

The downstream devices are using a different management port than the root.

Answer

The root FortiGate's firewall policy is blocking the downstream devices' Fabric traffic.

Question 9

A network engineer is configuring a FortiGate HA cluster with two FortiGate 100F units in active-passive mode. The engineer wants to use VDOMs to separate guest and corporate traffic. After initial setup, the engineer configures two VDOMs: 'guest' and 'corp'. Both VDOMs have interfaces assigned. The HA status shows 'synchronized'. However, the engineer notices that traffic from the corporate network is not being forwarded correctly. Pings from the corporate LAN to the internet fail. The guest network works fine. The engineer checks the routing table on the active unit and sees that the default route is present in the 'corp' VDOM. What is the most likely cause of the issue?

Accepted Answer

The default route in the corp VDOM has an incorrect gateway IP address.. The most likely cause is an incorrect gateway IP address in the default route for the 'corp' VDOM. Since the guest VDOM works correctly, the HA cluster and VDOM configuration are functional, and the issue is isolated to the corporate VDOM's routing. A misconfigured next-hop IP would prevent traffic from reaching the internet, even though the route itself is present in the routing table.

Answer

The interface assigned to the corp VDOM is administratively down.

Answer

The HA cluster must be in active-active mode for VDOMs to work.

Answer

The VDOM link between the root VDOM and corp VDOM is not configured.

Question 10

A large enterprise uses FortiGate as their perimeter firewall with ATP features enabled. They have a mix of internal users and remote VPN users. Recently, several remote users reported that their machines became infected with ransomware after connecting to the VPN. The IT team suspects that the ransomware entered through the VPN tunnel. The FortiGate has an antivirus profile applied to the VPN policy with SSL inspection enabled for all traffic. However, the logs show that no malware was detected. Upon investigation, the team finds that the remote users' machines are not managed by the company and do not have any endpoint protection. The ransomware was delivered via a spear-phishing email that the users opened on their remote machines. The email traffic passed through the VPN tunnel to the corporate mail server first, then back to the user. The FortiGate antivirus profile is configured to scan SMTP traffic but the email was sent from an external source to the corporate mail server, and the mail server uses STARTTLS to receive emails. The FortiGate does not perform SSL inspection on the SMTP traffic because the SMTP service is not included in the SSL inspection profile. What action should the administrator take to prevent this in the future?

Accepted Answer

Add SMTP to the SSL inspection profile to decrypt and scan email traffic. Option B is correct because the FortiGate's antivirus profile is configured to scan SMTP traffic, but the email was encrypted via STARTTLS, and SMTP is not included in the SSL inspection profile. By adding SMTP to the SSL inspection profile, the FortiGate can decrypt the SMTP traffic, allowing the antivirus engine to inspect the email content for malware, including ransomware delivered via spear-phishing.

Answer

Disable STARTTLS on the corporate mail server to force plaintext SMTP

Answer

Require remote users to install endpoint protection with FortiClient

Answer

Block all SMTP traffic from remote VPN users

Question 11

A company runs a FortiGate 600E in NAT/Route mode. They have a site-to-site VPN to a partner using route-based VPN with BGP. Recently, they added a new subnet 192.168.50.0/24 behind the FortiGate. The BGP session is up, and the route is being advertised to the partner. However, traffic from the partner to the new subnet fails. The FortiGate's routing table shows the route to 192.168.50.0/24 is present via the VPN interface. Firewall policies allow the traffic. A packet capture on the FortiGate's internal interface shows the partner's traffic arriving but no SYN-ACK being sent back. The FortiGate's session table shows sessions in 'SYN_RECV' state for the new subnet. What is the most likely cause?

Accepted Answer

The Phase 2 selector for the VPN does not include the new subnet, so the FortiGate does not encrypt the reply traffic.. The correct answer is D. In a route-based VPN, the Phase 2 selectors define which traffic is allowed to be encrypted and decrypted. Even though BGP advertises the new subnet 192.168.50.0/24, if the Phase 2 selector on either side does not include this subnet, the FortiGate will not encrypt the reply traffic. The packet capture shows the SYN arriving, but no SYN-ACK is sent because the FortiGate cannot find a matching Phase 2 proposal to encrypt the response, causing the session to remain in SYN_RECV state.

Answer

The reverse path forwarding (RPF) check is dropping the incoming SYN.

Answer

The firewall policy is not configured with the correct source interface.

Answer

The BGP route advertisement is being filtered by a route map on the partner side.

Question 12

A FortiGate is deployed as the edge firewall for a medium-sized enterprise. The network has three internal zones: Trust (10.10.0.0/16), DMZ (172.16.0.0/24), and Guest (192.168.0.0/24). The FortiGate has an IPSec VPN to a branch office (10.20.0.0/16). Users in the Trust zone report intermittent connectivity to a web server in the DMZ (172.16.0.10, TCP port 443). The FortiGate logs show occasional 'session denied' messages for traffic from Trust to DMZ with reason 'denied by forward policy check'. The security policy has an explicit allow rule for Trust to DMZ HTTPS. The administrator has verified routing is correct and there are no address overlaps. When the issue occurs, the administrator runs 'diag debug flow' and sees that the packet matches the correct policy but still gets denied. The debug output also shows 'forward policy check: denied'. What is the most likely cause and recommended action?

Accepted Answer

A traffic shaping policy or application control profile is blocking the traffic; review and adjust the traffic shaping policy or application control profile applied to the policy.. The debug flow output shows the packet matches the correct security policy but is still denied by 'forward policy check'. This indicates that a secondary policy component, such as a traffic shaping policy or application control profile, is blocking the traffic. These features can override the security policy action if they are configured to deny or drop matching traffic, even when the security policy itself is set to allow.

Answer

The route to the DMZ is intermittently flapping; add a static route with a higher distance.

Answer

The security profiles (AV, IPS) are blocking the traffic; temporarily disable all security profiles on the policy.

Answer

The session helper for HTTPS is interfering; disable the HTTPS session helper.

Question 13

A large enterprise operates two FortiGate 600E firewalls in an HA active-passive cluster. They have enabled VDOMs to isolate traffic for different business units: Finance, HR, and Engineering. Each VDOM has its own internet connection through separate ISPs. The cluster has been running smoothly for months. Recently, the IT team noticed that users in the Finance VDOM experience intermittent connectivity drops to their cloud-based ERP system. The drops last 30-60 seconds and occur several times a day. During these drops, ping to the ERP IP address fails. The HA cluster status shows 'synchronized' and no failover events are logged. The Finance VDOM uses a static default route pointing to the primary ISP gateway. The other VDOMs are unaffected. What is the most likely cause of the issue?

Accepted Answer

The VDOM link configuration is not synchronized between the two units, causing asymmetric routing for the Finance VDOM.. Option D is correct because VDOM link configurations are stored per-VDOM and must be synchronized independently. If the VDOM link configuration is not synchronized between the HA units, the passive unit may have a different or missing VDOM link, causing asymmetric routing when traffic is processed by the passive unit during a transient state (e.g., session ownership change or link flap). This leads to intermittent connectivity drops for the Finance VDOM only, as its traffic is isolated and uses a static default route.

Answer

The HA cluster is in active-active mode, causing routing loops for the Finance VDOM.

Answer

The heartbeat interface is oversubscribed, causing intermittent HA synchronization failures.

Answer

The 'set ha-mgmt-status enable' command is configured on the passive unit, preventing route synchronization.

Question 14

A company has deployed two FortiGate-600Es in an active-passive HA cluster. The cluster is configured with three VDOMs: VDOM-A (corporate LAN), VDOM-B (guest Wi-Fi), and VDOM-C (DMZ). Each VDOM has its own set of interfaces and policies. The cluster is also configured to use FGCP with session pickup enabled. Recently, the network team noticed that after a failover event, some user sessions in VDOM-B are not being picked up, causing disruption for guest users. The session pickup feature is enabled globally. The administrator checks the configuration and finds the following settings on the primary FortiGate:

- config system ha
  set session-pickup enable
  set session-pickup-connectionless enable
  end

- config vdom
  edit VDOM-A
    config system ha
      set session-pickup enable
    end
  next
  edit VDOM-B
    config system ha
      set session-pickup disable
    end
  next
  edit VDOM-C
    config system ha
      set session-pickup enable
    end
  next

Based on this configuration, what is the most likely reason that sessions in VDOM-B are not being picked up?

Accepted Answer

Session pickup is disabled specifically for VDOM-B in the per-VDOM HA configuration.. Option C is correct because the per-VDOM HA configuration for VDOM-B explicitly disables session pickup with 'set session-pickup disable'. Even though the global HA settings enable session pickup, the per-VDOM setting overrides the global setting for that VDOM. As a result, after a failover, sessions in VDOM-B are not synchronized to the standby FortiGate and are not picked up, causing disruption for guest users.

Answer

The HA priority of the cluster is set too low, causing session pickup to fail for VDOM-B.

Answer

Session pickup for connectionless protocols is not enabled, so UDP sessions in VDOM-B are not picked up.

Answer

The interfaces assigned to VDOM-B do not have session pickup enabled.

Question 15

A multinational company uses FortiGate devices as VPN gateways to connect its headquarters (HQ) and branch offices via IPsec VPN tunnels. The company is migrating its remote access solution from IPsec VPN to SSL VPN using FortiClient. Currently, 500 remote users connect via IPsec VPN with pre-shared keys and XAuth authentication. The migration must be seamless with minimal downtime, and users must continue to authenticate using their existing Active Directory credentials. The SSL VPN portal must provide access to internal web applications and some legacy TCP-based applications that do not support HTTP. The security team requires that all traffic between remote users and the internal network be encrypted and that the SSL VPN use a certificate from a public CA to avoid certificate warnings on client devices. The IT team wants to use FortiToken for two-factor authentication (2FA) for all VPN users. Which of the following is the most appropriate course of action to meet all requirements?

Accepted Answer

Deploy SSL VPN with a public CA certificate, configure LDAP authentication against Active Directory, enable FortiToken for 2FA, and create a split-tunneling policy that uses both SSL VPN web mode and tunnel mode via FortiClient.. Option B is correct because it meets all requirements: a public CA certificate avoids client certificate warnings, LDAP authentication against Active Directory allows seamless credential reuse, FortiToken provides the required 2FA, and combining SSL VPN web mode (for web apps) with tunnel mode via FortiClient (for legacy TCP applications) ensures full coverage. This approach minimizes downtime by migrating users gradually without changing their authentication backend.

Answer

Configure SSL VPN with a self-signed certificate and use the local password database for authentication. Enable FortiToken and configure the portal to provide both web and TCP forwarding applications.

Answer

Set up SSL VPN with a public CA certificate, use LDAP for authentication, but do not enable FortiToken because it would require a separate token per user.

Answer

Create a new IPsec VPN configuration using certificate-based authentication and FortiToken, and gradually move users to the new IPsec VPN.

Question 16

A company has two internet connections: a primary fiber link (port1, 100 Mbps) and a backup DSL link (port2, 20 Mbps). They are using SD-WAN to load balance traffic based on volume, with a rule that sends 70% of traffic to port1 and 30% to port2. Recently, users report that video conferencing applications are experiencing high latency and jitter. The network team finds that the SD-WAN performance SLA for the fiber link shows 80% packet loss and high latency. The SD-WAN rule action is set to 'best quality' with a latency threshold of 150 ms. The current latency on port1 is 200 ms, and on port2 is 40 ms. What should the administrator do to ensure that video conferencing traffic uses the DSL link while the fiber link is degraded?

Accepted Answer

No changes are needed; the SD-WAN rule with 'best quality' will automatically use port2 for new sessions because port1 does not meet the SLA.. Option D is correct because the SD-WAN rule action is set to 'best quality', which means the FortiGate will automatically steer new sessions away from any interface that fails the performance SLA. Since port1 has 80% packet loss and 200 ms latency (exceeding the 150 ms threshold), it is considered degraded, and new video conferencing traffic will be directed to port2 (40 ms latency) without manual intervention.

Answer

Increase the SLA latency threshold to 250 ms so that the fiber link is considered acceptable.

Answer

Change the SD-WAN rule action to 'lowest cost' to favor the DSL link.

Answer

Adjust the volume ratio to send 100% of traffic to port2 until the fiber link recovers.

Question 17

A company with a hub-and-spoke SD-WAN topology uses FortiGates at each site. The hub has two WAN links: MPLS (10 Mbps) and broadband (100 Mbps). The spokes connect only via MPLS. The company deploys a new real-time application that requires low latency and low jitter. The network administrator creates an SD-WAN rule for this application with 'best quality' strategy and both MPLS and broadband as members. The SLA for MPLS is configured with latency < 10 ms and jitter < 5 ms. The SLA for broadband is configured with latency < 50 ms and jitter < 20 ms. The actual measured latency on MPLS is 12 ms, and jitter is 4 ms. The broadband latency is 25 ms, jitter 10 ms. Which path will the application traffic take?

Accepted Answer

The traffic will use the broadband link because MPLS SLA fails and broadband SLA is met.. The SD-WAN rule uses the 'best quality' strategy, which selects the member with the best SLA performance. The MPLS link fails its SLA because its measured latency of 12 ms exceeds the configured threshold of 10 ms, even though jitter is within limits. The broadband link meets both its latency (25 ms < 50 ms) and jitter (10 ms < 20 ms) thresholds, so it becomes the active path for the application traffic.

Answer

The traffic will be load-balanced between MPLS and broadband.

Answer

The traffic will use the MPLS link because it is the preferred member.

Answer

The traffic will be dropped because no link meets the SLA.

Question 18

A multinational corporation is implementing ZTNA for remote access to a critical internal application hosted on a server with IP 10.0.1.200:8443. The FortiGate is deployed at the edge with WAN IP 203.0.113.50. The administrator configures a ZTNA rule with proxy destination 10.0.1.200:8443, a firewall policy allowing traffic from the ZTNA gateway to the internal server, and a VIP for port forwarding for testing. However, remote users report that they can establish a ZTNA connection to the gateway but the application page fails to load, showing a blank page after a long delay. The FortiGate logs show no errors, and the debug output indicates that the proxy successfully forwarded the request to 10.0.1.200:8443 and received a response. The internal server team confirms the application is working correctly for on-site users. What is the most likely cause?

Accepted Answer

The application uses hardcoded IP addresses or internal hostnames that are not resolvable externally.. Option D is correct because the application uses hardcoded IP addresses or internal hostnames that are not resolvable externally. When the ZTNA proxy forwards the request to the internal server, the server responds with HTML content that references internal resources (e.g., images, scripts, or links) using private IP addresses (like 10.0.1.200) or internal DNS names. The remote client cannot resolve or reach these internal addresses, causing the page to load partially or display a blank page after a delay, even though the initial proxy connection and response are successful.

Answer

The ZTNA proxy is not configured to support HTTPS.

Answer

The internal server is not reachable from the FortiGate.

Answer

The client's ZTNA tags are expired.

Question 19

A healthcare provider is deploying ZTNA to secure access to an internal electronic health records (EHR) system. The EHR system is composed of multiple web services running on different ports behind a load balancer with IP 10.0.10.100. The load balancer listens on ports 443, 8443, and 9090. The administrator configures a single ZTNA rule with proxy destination 10.0.10.100:443, expecting that the other ports will be accessed via the same rule. However, users report that they can only access the service on port 443; connections to ports 8443 and 9090 fail. The FortiGate logs show that requests to other ports are being dropped. What should the administrator do to resolve this?

Accepted Answer

Create separate ZTNA rules for each port (8443 and 9090).. Option C is correct because each ZTNA rule maps to a single proxy destination port. The rule configured with proxy destination 10.0.10.100:443 only forwards traffic for that specific port. To access services on ports 8443 and 9090, separate ZTNA rules must be created for each port, each with its own proxy destination and access proxy configuration.

Answer

Configure the load balancer to redirect all traffic to port 443.

Answer

Configure the ZTNA gateway to allow all ports to the load balancer.

Answer

Ask users to change the port in their browser to 443.

Question 20

An organization uses FortiMail and wants to validate that incoming emails are from legitimate senders by checking the sender's domain against a published policy. Which two email authentication mechanisms can FortiMail use? (Choose two.)

Accepted Answer

SPF and DKIM. FortiMail can use SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) to validate that incoming emails originate from legitimate senders by checking the sender's domain against a published policy. SPF verifies that the sending IP address is authorized by the domain's DNS TXT record, while DKIM uses a digital signature in the email header that can be validated against a public key published in the sender's DNS. Both mechanisms allow FortiMail to authenticate the sender's domain before accepting the message.

Answer

DKIM and DMARC

Answer

STARTTLS and SPF

Answer

DMARC and SPF