NSE7 Practice Test 8 — 10 Questions

Question 1

A FortiGate administrator is planning to use policy packages in FortiManager to manage firewall policies for multiple devices. Which TWO statements about policy packages are true?

Accepted Answer

Header and footer policies can be used to enforce common rules across all policies. Header and footer policies in FortiManager allow administrators to enforce common rules across all policies in a policy package. Header policies are evaluated before the main policy set, and footer policies are evaluated after, ensuring consistent security controls such as logging or traffic shaping are applied universally without manual duplication.

Answer

Policy packages are automatically applied to the device upon creation

Answer

Policy packages cannot include NAT policies

Answer

A policy package can contain policies for different VDOMs

Question 2

An administrator runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is a TCP connection that has been active for 3600 seconds and will expire in 3599 seconds. The output shows 'proto=6' which indicates TCP (protocol 6), 'duration=3600' means the session has been active for 3600 seconds (1 hour), and 'expire=3599' means the session will expire in 3599 seconds. The 'proto_state=01' is a TCP state code indicating an established connection. This is a standard FortiGate diagnostic session output.

Answer

The session is a UDP DNS request

Answer

The session is being blocked by a firewall policy

Answer

The session is an SSL VPN tunnel

Question 3

An administrator runs 'diagnose sys top' and sees process 'httpsd' consuming 95% CPU. What is the best immediate action to alleviate the issue?

Accepted Answer

Change the administration HTTPS port and restrict access to trusted hosts. The 'httpsd' process handles HTTPS administration traffic. A CPU spike to 95% indicates a possible DoS attack or excessive management connections. Changing the HTTPS port and restricting access to trusted hosts immediately mitigates the attack surface without disrupting other services, as it limits the source of the malicious traffic.

Answer

Kill the httpsd process

Answer

Disable HTTPS administration access

Answer

Reboot the FortiGate

Question 4

An administrator is configuring a hub-and-spoke ADVPN with FortiGates. The spoke sites use dynamic public IP addresses. The administrator has enabled auto-discovery on the spoke and hub. However, shortcut tunnels are not being established between spokes that communicate frequently. What is the most likely missing configuration?

Accepted Answer

Auto-discovery is not enabled on the spoke's phase1 configuration. In a hub-and-spoke ADVPN, auto-discovery must be enabled on both the phase1 configuration of the spoke and the hub. If auto-discovery is not enabled on the spoke's phase1, the spoke will not send or process IKE informational exchanges (ADVPN messages) to negotiate shortcut tunnels with other spokes. This prevents dynamic shortcut establishment even if the hub has auto-discovery enabled.

Answer

The spoke's phase2 proposal includes a different encryption algorithm than the hub

Answer

The hub does not have a route to the spoke's local subnets

Answer

The spoke's VPN interface is not in the same VDOM as the hub

Question 5

A FortiGate administrator notices that files submitted to FortiSandbox are receiving verdicts but the firewall is not automatically blocking the detected malware. The FortiSandbox integration is configured under Security Fabric > External Connectors. What additional configuration is required to enforce blocking based on FortiSandbox verdicts?

Accepted Answer

Enable the 'fortisandbox' option in the antivirus profile applied to the firewall policy. The FortiSandbox verdict integration requires the antivirus profile applied to the firewall policy to have the 'fortisandbox' option enabled. This option allows the FortiGate to query FortiSandbox for verdicts and automatically block files that are determined to be malicious. Without this setting in the antivirus profile, the FortiGate will receive verdicts but will not enforce blocking actions on the traffic.

Answer

Enable 'Inline Scan' on the FortiSandbox connector

Answer

Configure an automation stitch to quarantine files based on verdict

Answer

Enable 'Block malicious files' in the FortiSandbox connector settings

Question 6

A FortiGate administrator wants to ensure that only devices with an up-to-date antivirus and OS patch level can access a sensitive application published via ZTNA. Which ZTNA component should the administrator configure to enforce this requirement?

Accepted Answer

ZTNA tags with posture checks. ZTNA tags with posture checks allow the FortiGate to verify endpoint compliance (e.g., antivirus version, OS patch level) before granting access to a ZTNA-published application. The FortiGate collects posture data from the FortiClient endpoint and compares it against configured compliance rules; only devices that meet the requirements receive the appropriate ZTNA tag and are allowed through the ZTNA proxy.

Answer

ZTNA proxy configuration

Answer

SSL VPN portal settings

Answer

Firewall policy with application control

Question 7

A FortiGate VPN tunnel shows 'phase1 negotiation failed' in the logs. The remote gateway is a third-party device. The debug command 'diagnose vpn ike config' shows mismatched proposals. Which setting is MOST likely incorrect on the FortiGate?

Accepted Answer

The encryption algorithm (e.g., AES256 vs 3DES). The 'diagnose vpn ike config' command displays the IKE proposal parameters (encryption, authentication, DH group) that the FortiGate is configured to offer. When the log shows 'phase1 negotiation failed' and the debug output indicates 'mismatched proposals', it means the FortiGate's configured encryption algorithm (e.g., AES256) does not match any algorithm supported by the remote third-party device (e.g., 3DES). This is the most direct cause of proposal mismatch, as IKE phase 1 requires both sides to agree on a common transform set.

Answer

The pre-shared key

Answer

The local ID type

Answer

The DPD configuration

Question 8

A FortiGate is configured with ECMP routing to balance traffic across two default routes via two ISPs. The administrator wants to ensure that traffic from the same source-destination pair always uses the same ISP. Which ECMP load balancing method should be configured?

Accepted Answer

source-dest-ip. The source-dest-ip method hashes the source and destination IP addresses to compute a consistent path for all packets in a given flow. This ensures that traffic from the same source-destination pair always uses the same ISP, meeting the requirement for flow-based persistence without per-packet load balancing.

Answer

source-ip

Answer

per-packet

Answer

session

Question 9

A customer reports intermittent connectivity issues between two internal subnets separated by a FortiGate firewall. The traffic is allowed by the policy, but users experience timeouts during peak hours. Which troubleshooting step should you take first?

Accepted Answer

Check the session table for session limits and session congestion.. Intermittent connectivity during peak hours strongly suggests session table exhaustion or session congestion. The FortiGate's session table has a finite capacity, and when it fills up, new sessions are dropped, causing timeouts. Checking the session table for limits and congestion is the fastest, least intrusive first step to confirm whether the firewall is running out of session resources before performing more complex diagnostics.

Answer

Run a packet sniffer on the FortiGate to capture traffic between the subnets.

Answer

Disable hardware acceleration on the FortiGate.

Answer

Configure SNAT on the policy to translate the source IP.

Question 10

An organization wants to implement Zero Trust Network Access (ZTNA) to secure access to an internal application. The application is accessed via HTTPS. Which component must be configured on the FortiGate to act as a reverse proxy for the application?

Accepted Answer

ZTNA proxy. ZTNA proxy is the FortiGate feature that acts as a reverse proxy, terminating the client connection and initiating a new connection to the internal application. It enforces access policies based on identity and device posture.

Answer

FortiClient EMS

Answer

SSL-VPN portal

Answer

ZTNA inline CASB