NSE7 Practice Test 9 — 10 Questions

Question 1

A FortiGate admin is configuring a multi-peer IPsec VPN where the remote site has two ISPs for redundancy. The admin wants to ensure that if the primary ISP fails, the VPN automatically fails over to the secondary ISP without manual intervention. Which feature should be enabled?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Dead Peer Detection (DPD) with retry and failover. DPD (Dead Peer Detection) with auto-negotiation allows the FortiGate to detect peer unreachability and automatically re-establish the tunnel using an alternate path if configured.

Answer

IPsec interface mode with DHCP

Answer

IKEv2 with mobility extension

Answer

Auto-negotiate phase 1 settings

Question 2

Which TWO features are required to implement an always-on SSL VPN tunnel with FortiGate that automatically reconnects when the user's network changes?

Accepted Answer

Tunnel mode enabled. Tunnel mode is required for an always-on SSL VPN tunnel, as it encapsulates all traffic at the network layer (TUN) and maintains a persistent virtual interface on the client. This allows the VPN to stay active and automatically reconnect when the user's network changes, such as switching from Wi-Fi to cellular, without manual intervention.

Answer

DTLS enabled

Answer

Web mode portal

Answer

Split tunneling configured

Question 3

A FortiManager administrator wants to push a policy package that includes both global header/footer policies and VDOM-specific policies. Which statement about header/footer policies is correct?

Accepted Answer

Header policies are inserted before the VDOM's own policies; footer policies are appended after. In FortiManager, when a policy package includes both global header/footer policies and VDOM-specific policies, the header policies are inserted before the VDOM's own policies in the policy table, while footer policies are appended after them. This ensures that header policies are evaluated first for traffic matching, and footer policies serve as a catch-all or default set of rules at the end of the VDOM policy list.

Answer

Header/footer policies are only available when using per-device mapping

Answer

Header/footer policies can only be configured directly on the FortiGate, not via FortiManager

Answer

Header/footer policies are automatically generated and cannot be manually edited

Question 4

An administrator wants to load-balance traffic across two WAN links using ECMP. The routes have equal distances and metrics. However, traffic is only using one of the links. What could be the cause?

Accepted Answer

The routes are learned via different routing protocols with different administrative distances.. ECMP (Equal-Cost Multi-Path) requires routes to have identical administrative distances (AD) to be considered equal-cost. If routes are learned via different routing protocols (e.g., OSPF with AD 110 and static with AD 1), the FortiGate will prefer the route with the lower AD, even if metrics are equal. This causes traffic to use only the preferred link, as the other route is not installed in the routing table for ECMP selection.

Answer

ECMP is not enabled globally under config system settings.

Answer

The firewall policy is configured to use a specific egress interface.

Answer

The traffic is session-based and ECMP uses per-packet load balancing.

Question 5

An administrator wants to add custom fields to device objects in FortiManager to track location and contact info. Which feature should be used?

Accepted Answer

Meta fields. Meta fields in FortiManager allow administrators to define custom attributes (e.g., location, contact info) that can be attached to device objects. These fields are stored in the FortiManager database and can be used for filtering, reporting, and policy mapping, providing a flexible way to enrich device metadata without modifying the device configuration itself.

Answer

System templates

Answer

Custom reports

Answer

Dynamic mapping

Question 6

During a ZTNA deployment, an administrator notices that traffic from a specific internal application is being routed through the ZTNA gateway but is not reaching the destination server. The FortiGate policy allows the traffic, and the client has a valid ZTNA connection. What is the most likely cause of the issue?

Accepted Answer

The ZTNA proxy rule on the FortiGate is misconfigured, pointing to the wrong destination IP or port.. In a ZTNA deployment, the FortiGate acts as a reverse proxy for internal applications. If the ZTNA proxy rule is misconfigured with an incorrect destination IP or port, the FortiGate will forward the traffic to the wrong backend server or service, causing the connection to fail even though the client has a valid ZTNA connection and the firewall policy permits the traffic.

Answer

The client's FortiClient agent is not connected to the EMS server.

Answer

The destination server does not have internet connectivity.

Answer

The FortiGate policy is set to deny traffic from the client's subnet.

Question 7

An administrator configured a firewall policy to inspect SMTP traffic using an antivirus profile. However, email attachments are not being scanned. The FortiGate is operating in proxy-based inspection mode. What is the most likely cause?

Accepted Answer

The SMTP session helper is not enabled. In proxy-based inspection mode, the FortiGate must reassemble the SMTP session to scan attachments. The SMTP session helper is required to parse the SMTP commands and data stream so the antivirus engine can access the attachments. Without the helper enabled, the FortiGate treats the traffic as raw TCP and cannot extract MIME parts for scanning.

Answer

The policy is set to 'accept' instead of 'deny'

Answer

The email is sent over TLS encryption

Answer

The antivirus profile is set to flow-based inspection

Question 8

A network administrator is troubleshooting a BGP session between a FortiGate and an ISP router. The administrator runs 'get router info bgp summary' and sees that the BGP state is 'Active'. What does this state indicate?

Accepted Answer

The BGP speaker is trying to establish a TCP connection with the peer. The 'Active' state in BGP indicates that the router is actively trying to initiate a TCP connection to the configured peer. This means the BGP process has moved past the 'Connect' state (where it passively waits) and is now actively sending TCP SYN packets to the peer's port 179, but the three-way handshake has not yet completed. This state is normal during initial session establishment but becomes problematic if it persists, as it typically points to a Layer 3 reachability issue or a firewall blocking TCP/179.

Answer

The BGP session is administratively down due to a configuration error

Answer

The BGP speaker is waiting for a routing update from the peer

Answer

The BGP session is fully established and exchanging routes

Question 9

A FortiGate running FortiOS 7.2 has multiple WAN interfaces. The administrator is configuring SD-WAN load balancing with the 'volume' algorithm. The requirement is that each interface carries a percentage of total traffic based on its bandwidth capacity. The administrator sets the 'weight' of each interface accordingly. However, traffic distribution is not as expected. Which TWO factors could cause this discrepancy?

Accepted Answer

The interface bandwidth settings (speed) do not reflect actual link capacity. The 'volume' algorithm in FortiOS SD-WAN distributes traffic proportionally based on the configured interface weights, but these weights are derived from the interface bandwidth settings (speed). If the configured bandwidth does not match the actual link capacity, the weight ratios will be incorrect, leading to unexpected traffic distribution. The administrator must ensure that the 'speed' setting under each interface accurately reflects the real bandwidth to achieve the desired load balancing.

Answer

The weight values are not in the range 1-100

Answer

The load balancing algorithm is set to 'per-packet' instead of 'volume'

Answer

The performance SLA is set to 'disable' on some interfaces, causing them to be excluded

Question 10

An administrator configures BFD on a FortiGate to improve convergence time for OSPF. What is the primary purpose of BFD in this context?

Accepted Answer

To detect link failures faster than OSPF hello timers. BFD (Bidirectional Forwarding Detection) provides sub-second link failure detection, typically in the range of 50-300 milliseconds, which is significantly faster than OSPF's default hello/dead intervals (e.g., 10/40 seconds for broadcast networks). By integrating BFD with OSPF, the FortiGate can trigger OSPF neighbor state changes and route convergence almost immediately upon a link failure, without waiting for OSPF's own hello timer expiration.

Answer

To reduce the number of OSPF neighbors

Answer

To encrypt OSPF packets

Answer

To load balance OSPF traffic across multiple links