NSE7 Practice Test 7 — 10 Questions

Question 1

An administrator wants to enforce that only devices with antivirus software installed and up-to-date can access the corporate network. Which FortiGate feature should be used?

Accepted Answer

ZTNA tags and posture checks. FortiGate uses ZTNA device posture checks via FortiClient EMS to enforce endpoint compliance, such as antivirus status.

Answer

Application control profile

Answer

IPsec VPN with pre-shared key

Answer

Web filtering profile

Question 2

An administrator configures a WAF profile on FortiGate to protect a web application. However, the administrator notices that SQL injection attacks are not being blocked. What should the administrator check first?

Accepted Answer

The SQL injection signatures are enabled in the WAF profile. SQL injection attacks are blocked by specific signatures within the WAF profile. If these signatures are not enabled, the WAF will not inspect HTTP requests for SQL injection patterns, allowing attacks to pass through. The administrator must verify that the SQL injection signatures are toggled on under the WAF profile's signature configuration.

Answer

The WAF profile is attached to the correct firewall policy

Answer

The FortiGate has a valid Advanced Web Protection subscription

Answer

The web application is using HTTPS and SSL inspection is configured

Question 3

Which FortiAnalyzer feature allows an administrator to create a sequence of automated response actions triggered by a specific log event?

Accepted Answer

Playbooks. Playbooks in FortiAnalyzer allow administrators to define a sequence of automated response actions that are triggered by specific log events. This feature enables event-driven automation, such as executing CLI scripts, sending alerts, or integrating with external systems via webhooks, directly from the FortiAnalyzer interface.

Answer

Reports

Answer

Incidents

Answer

FortiView

Question 4

What is the primary function of FortiAnalyzer's FortiView feature?

Accepted Answer

Real-time traffic monitoring and visualization. FortiView on FortiAnalyzer provides real-time traffic monitoring and visualization by aggregating logs from FortiGate devices and displaying them in graphical dashboards. It allows administrators to instantly view top talkers, applications, threats, and other network activity without needing to run manual queries, making it the primary function for live traffic analysis.

Answer

Centralized device configuration management

Answer

Scheduling and generating compliance reports

Answer

Automated remediation of security incidents

Question 5

An organization uses FortiAnalyzer for centralized logging. The security team wants to use playbooks to automate responses to detected incidents. Which THREE components are essential for a playbook to function?

Accepted Answer

Trigger. In FortiAnalyzer playbooks, the essential building blocks are the trigger, conditions, and actions. Option A (Trigger) is correct because a playbook must have an event source that initiates execution, such as a new log, incident, or event detected by FortiAnalyzer. Option C (Conditions) is correct because conditions define the matching logic or filters that determine whether the playbook should run and which path it follows. Option E (Actions) is correct because actions specify the automated response steps the playbook performs, such as sending notifications, running CLI scripts, or creating incidents. Option B (A report schedule) is not required, since reports are separate scheduled outputs and do not drive playbook execution. Option D (A dashboard visualization) is not required, because dashboards are for display and monitoring, not for the functional logic of a playbook.

Answer

A report schedule

Answer

A dashboard visualization

Question 6

An administrator needs to back up the configuration of a FortiGate managed by FortiManager before making major changes. Which feature in FortiManager should the administrator use?

Accepted Answer

Revision history. Revision History in FortiManager allows administrators to create, view, and restore previous configuration versions of managed FortiGate devices. This is the correct feature for backing up a configuration before making major changes, as it provides a point-in-time snapshot that can be rolled back if needed.

Answer

Policy package import/export

Answer

Automation stitch

Answer

Install preview

Question 7

A FortiGate admin configures a firewall policy with an antivirus profile in flow-based inspection mode. The admin notices that some large files are being scanned but others are allowed without scanning. What is the most likely cause?

Accepted Answer

The FortiGate's antivirus buffer size is exceeded, causing some files to bypass scanning. In flow-based inspection, FortiGate uses a buffer to reassemble files before scanning. When a file exceeds the configured antivirus buffer size (default 1 MB for flow-based), the FortiGate cannot buffer the entire file for scanning and allows it to pass without inspection. This explains why some large files bypass scanning while smaller ones are scanned.

Answer

The antivirus signatures are outdated

Answer

The antivirus profile has an exemption for certain file types

Answer

Flow-based inspection cannot scan files larger than 10 MB

Question 8

A company uses an advanced antivirus profile with machine learning engine enabled. After a recent outbreak, several files that were previously undetected are now flagged. How does the outbreak prevention feature help in this situation?

Accepted Answer

It downloads the latest ML models from FortiGuard to detect new threats. The outbreak prevention feature in FortiGate's advanced antivirus profile automatically downloads the latest machine learning (ML) models from FortiGuard when a new outbreak is detected. This allows the ML engine to identify and flag previously undetected files without requiring a traditional signature update, enabling proactive detection of zero-day threats.

Answer

It sends all files to FortiSandbox for analysis

Answer

It quarantines all files for 24 hours until a signature is released

Answer

It blocks all executable files from being downloaded

Question 9

Which feature allows a FortiGate to participate in multiple routing tables simultaneously, enabling network segmentation and overlapping IP address spaces?

Accepted Answer

VRF. C is correct because VRF (Virtual Routing and Forwarding) allows a FortiGate to maintain multiple separate routing tables (RIB) on the same physical device. Each VRF instance operates as an independent routing domain, enabling network segmentation and the use of overlapping IP address spaces without conflict, which is essential for MPLS L3VPN and multi-tenant environments.

Answer

VDOM

Answer

Policy-based routing

Answer

Route redistribution

Question 10

An administrator needs to view real-time traffic logs and top applications for a specific VDOM on FortiAnalyzer. Which tool should be used?

Accepted Answer

FortiView. FortiView is the correct tool because it provides real-time traffic logs and top applications per VDOM on FortiAnalyzer. It uses live data streams from FortiGate logs to display current network activity, allowing administrators to filter by VDOM and view metrics like top applications, sources, and destinations without running a report or script.

Answer

Playbooks

Answer

Incident Management

Answer

Reports