NSE7 Practice Test 8 — 10 Questions

Question 1

A company's FortiGate is configured with multiple IPsec VPN tunnels to branch offices. One tunnel keeps dropping and re-establishing every few minutes. The logs show 'IPsec SA negotiation failed' with error 'proposal mismatch'. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Mismatched encryption or authentication algorithms between the two VPN peers. The error 'proposal mismatch' directly indicates that the two IPsec peers cannot agree on the security parameters for the IKE or IPsec SA. This occurs when the encryption algorithm (e.g., AES256 vs. AES128), authentication algorithm (e.g., SHA256 vs. SHA1), Diffie-Hellman group, or lifetime values do not match between the FortiGate and the remote peer. The tunnel drops and re-establishes because the negotiation fails, and the FortiGate retries with the same mismatched proposal, leading to repeated failures.

Answer

Dead Peer Detection (DPD) configured too aggressively

Answer

NAT-Traversal (NAT-T) not enabled

Answer

Pre-shared key mismatch

Question 2

An administrator sees the following error when trying to commit changes from FortiManager to a FortiGate: 'Policy check failed: Policy ID 5 uses a zone that does not exist on the device.' What is the most likely cause?

Accepted Answer

The zone referenced in the policy is not yet created on the FortiGate. The error 'Policy check failed: Policy ID 5 uses a zone that does not exist on the device' indicates that the FortiGate does not have the zone object referenced in the policy. When FortiManager pushes a policy that references a zone, the zone must already exist on the managed FortiGate; otherwise, the commit fails. Option B correctly identifies that the zone is missing on the FortiGate.

Answer

The policy package is locked by another administrator

Answer

The FortiGate is not running the same firmware version as FortiManager

Answer

The administrator has insufficient permissions

Question 3

An administrator wants to secure email traffic by ensuring that incoming emails are verified against the sender's domain SPF record. Which email authentication method provides this verification?

Accepted Answer

SPF. SPF (Sender Policy Framework) is the email authentication method that verifies incoming emails against the sender's domain SPF record. It works by checking whether the sending mail server's IP address is authorized by the domain owner's DNS TXT record. This directly matches the administrator's requirement to verify incoming emails against the sender's domain SPF record.

Answer

DKIM

Answer

DMARC

Answer

S/MIME

Question 4

A FortiGate admin configures inter-VDOM routing between VDOM-A and VDOM-B using a VDOM link. The admin wants traffic from VDOM-A to reach a server in VDOM-B. Which three configuration steps are required? (Choose three.)

Accepted Answer

Configure static routes pointing to the VDOM link interface on both VDOMs. Option E is correct because a VDOM link must first be created and its two ends (interfaces) assigned to VDOM-A and VDOM-B, which provides the physical/logical path for inter-VDOM traffic. Option B is correct because each VDOM needs a static route whose destination is the remote subnet and whose gateway/interface is the local VDOM link interface, so traffic is forwarded across the link. Option C is correct because FortiGate security policies are required to permit traffic between interfaces, so VDOM-A needs a policy allowing traffic from its source interface to the VDOM link interface. Option A is not required because NAT is not needed for inter-VDOM routing when addressing is preserved; NAT could even break return-path routing. Option D is not required because ARP must remain enabled on the VDOM link interfaces for next-hop resolution.

Answer

Enable NAT on the VDOM link interface

Answer

Disable ARP on the VDOM link interfaces

Question 5

What is the purpose of a management VDOM on a FortiGate?

Accepted Answer

To provide a dedicated environment for administrative access and management protocols. A management VDOM is a dedicated virtual domain that isolates administrative traffic (e.g., HTTPS, SSH, SNMP, syslog) from data-plane traffic. This ensures that management access and protocols like RADIUS or TACACS+ authentication are processed in a separate context, preventing interference with production VDOMs and allowing granular administrative access control.

Answer

To log all administrative actions

Answer

To route traffic between different VDOMs

Answer

To increase the number of available firewall policies

Question 6

Which FortiManager feature allows administrators to view the exact configuration changes that would be applied to a managed FortiGate before committing them?

Accepted Answer

Install preview. Install preview is the correct answer because it allows administrators to see the exact CLI commands that will be pushed to a managed FortiGate during the next install operation, without actually applying them. This feature provides a diff-like view of the configuration changes, enabling validation before committing changes to production devices.

Answer

Revision history

Answer

Device manager

Answer

Policy checker

Question 7

A FortiGate is configured with SD-WAN using load balancing algorithm 'source-dest-ip'. What is the primary characteristic of this algorithm?

Accepted Answer

All traffic from the same source IP to the same destination IP uses the same SD-WAN member.. The 'source-dest-ip' load balancing algorithm in SD-WAN uses a hash of both the source IP and destination IP to deterministically select an SD-WAN member. This ensures that all packets belonging to the same flow (same source-destination pair) are consistently forwarded over the same member, preserving per-flow stickiness and avoiding out-of-order delivery.

Answer

Traffic is sent to the member with the highest bandwidth.

Answer

Traffic is sent to the member with the lowest cost metric.

Answer

Traffic is distributed evenly across all SD-WAN members regardless of source or destination.

Question 8

A network administrator runs 'get system ha status' on a FortiGate HA cluster and sees that only one unit shows as primary. The secondary unit shows as 'standalone' with no HA peer detected. What is the MOST likely cause of this issue?

Accepted Answer

The heartbeat interface is down or misconfigured. When a secondary unit shows as 'standalone' with no HA peer detected, it indicates that the heartbeat communication between the two FortiGate units has failed. The most common cause is that the heartbeat interface is down, misconfigured, or not physically connected, preventing the units from discovering each other as HA peers. Without a functioning heartbeat link, the secondary unit cannot join the cluster and remains in standalone mode.

Answer

The cluster serial numbers do not match

Answer

The HA group ID is different on each unit

Answer

The HA priority on the secondary unit is set to 0

Question 9

A network administrator wants to delegate management of a specific VDOM to a junior administrator. The junior should be able to modify firewall policies and objects within that VDOM but not change system settings or other VDOMs. Which administrative access configuration meets this requirement?

Accepted Answer

Create a local user with an admin profile that has permissions for that VDOM only. FortiGate allows you to create a local user with an admin profile that has permissions scoped to a specific VDOM. By assigning the junior administrator to that VDOM-only profile, they can modify firewall policies and objects within that VDOM but cannot change system settings or access other VDOMs. This is the standard method for delegating VDOM-specific administrative access without granting global or multi-VDOM privileges.

Answer

Place the VDOM in transparent mode to allow full access

Answer

Create a RADIUS user that is assigned to the VDOM group

Answer

Use the management VDOM feature to assign the junior admin to the VDOM

Question 10

What is the purpose of FortiAnalyzer in a Fortinet security fabric?

Accepted Answer

To collect and analyze logs, generate reports, and provide visibility into security events. FortiAnalyzer is the centralized logging and analytics platform within the Fortinet Security Fabric. It aggregates logs from FortiGate and other Fabric devices, correlates events, generates compliance reports, and provides a single-pane-of-glass view for security monitoring and forensic analysis. This directly supports visibility and reporting, not real-time threat prevention or configuration management.

Answer

To provide sandboxing and advanced threat protection

Answer

To act as a network firewall and IPS

Answer

To manage and deploy configurations to FortiGates