NSE7 Practice Test 9 — 10 Questions

Question 1

An administrator configures a FortiGate with VDOMs and notices that the 'config vdom' command lists multiple VDOMs, but only one VDOM is shown in the 'show full-configuration' output. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The administrator is in the context of a specific VDOM. The 'config vdom' command lists all VDOMs configured on the FortiGate because it operates in the global context. However, 'show full-configuration' only displays the configuration of the current VDOM context. If the administrator is inside a specific VDOM (e.g., after executing 'config vdom' and 'edit <vdom-name>'), the output is scoped to that VDOM, not the global configuration. This is a fundamental behavior of VDOM-based CLI navigation in FortiOS.

Answer

The VDOMs are not properly synchronized

Answer

The VDOMs are not assigned any interfaces

Answer

The FortiGate is in transparent mode

Question 2

Which technology uses DMARC reports to help administrators identify unauthorized use of their email domain?

Accepted Answer

DMARC. DMARC (Domain-based Message Authentication, Reporting, and Conformance) is the correct answer because it specifically uses aggregate and forensic reports (DMARC reports) to provide administrators with visibility into how their email domain is being used, including unauthorized or spoofed emails. These reports are generated by receiving mail servers and sent back to the domain owner, detailing authentication results from SPF and DKIM checks, which helps identify and mitigate domain abuse.

Answer

SPF

Answer

DKIM

Answer

FortiMail

Question 3

When troubleshooting an IPsec VPN phase 1 negotiation failure, which debug command should the administrator run to see detailed IKE negotiation messages?

Accepted Answer

diagnose debug application ike -1. The command 'diagnose debug application ike -1' enables detailed IKE (Internet Key Exchange) debug messages in FortiOS, which are essential for troubleshooting Phase 1 negotiation failures. This command captures the full IKE negotiation exchange, including proposals, authentication, and Diffie-Hellman group selection, allowing the administrator to identify where the failure occurs.

Answer

diagnose vpn ike log

Answer

get vpn ipsec tunnel details

Answer

diagnose debug application ipsec -1

Question 4

Which SD-WAN load balancing algorithm is best for ensuring that all traffic from a specific source-destination pair uses the same WAN link?

Accepted Answer

Source-dest IP. Source-dest IP (B) is the correct algorithm because it uses a hash of both the source and destination IP addresses to deterministically select a WAN link. This ensures that all packets belonging to the same flow (same source-destination pair) are consistently forwarded over the same link, preserving packet order and avoiding reordering issues.

Answer

Spillover

Answer

Volume

Answer

Lowest-cost

Question 5

An administrator is planning a multi-VDOM deployment with a management VDOM. Which TWO statements about management VDOMs are correct? (Choose two.)

Accepted Answer

The management VDOM can be used for FortiGuard updates. Option A is correct because in a multi-VDOM FortiGate deployment the management VDOM is specifically designed to carry out-of-band management functions, including FortiGuard update traffic (FortiGuard services such as AV/IPS signature and web-filter database downloads), which is why it is often given its own dedicated management interface and route. Option D is correct because the management VDOM is intended to host administrative access services such as HTTPS GUI and SSH, allowing administrators to log in and manage the device independently of the production VDOMs. The remaining options are incorrect: the management VDOM can still contain firewall policies (so B is false), it does not require a separate license since VDOMs are a built-in feature of the FortiGate platform (so C is false), and user traffic is not required to traverse the management VDOM—it is reserved for management-plane traffic, not data-plane forwarding (so E is false).

Answer

The management VDOM cannot have firewall policies

Answer

The management VDOM requires a separate license

Answer

All user traffic must pass through the management VDOM

Question 6

A FortiGate administrator is configuring a multi-VDOM deployment. The administrator wants to use a single physical interface for multiple VDOMs. Which TWO methods allow this?

Accepted Answer

Use NP6 virtual interfaces (e.g., virtual wire) on supported models. Option C is correct because a physical interface can be partitioned into VLAN subinterfaces (e.g., port1.10, port1.20), and each subinterface can be assigned to a different VDOM, allowing one physical port to serve multiple VDOMs. Option B is correct because on NP6-accelerated FortiGate models, NP6 virtual interfaces such as virtual wire pairs (and NP6 vlinks) can be created and mapped into different VDOMs, letting a single physical NP6 interface be shared across VDOMs. Option A is incorrect because a physical interface can belong to only one VDOM at a time; it cannot be directly assigned to multiple VDOMs. Option D is incorrect because a software switch is a single interface object that resides in one VDOM and cannot be assigned to multiple VDOMs simultaneously. Option E is incorrect because inter-VDOM routing is used to pass traffic between VDOMs and does not allow sharing the same physical interface or the same IP subnet across VDOMs.

Answer

Use the same physical interface in multiple VDOMs directly

Answer

Create a software switch interface and assign it to multiple VDOMs

Answer

Configure inter-VDOM routing to share the same IP subnet

Question 7

What is the purpose of using a prefix list in route redistribution?

Accepted Answer

To match routes based on IP prefix and prefix length. A prefix list is used in route redistribution to match routes based on their IP prefix and prefix length (e.g., 192.168.0.0/16). This allows granular control over which routes are redistributed from one routing protocol to another, such as from OSPF to BGP, by filtering based on the network address and subnet mask.

Answer

To define a list of allowed source IPs for management access

Answer

To specify the next-hop for a set of routes

Answer

To set BGP community values on matched prefixes

Question 8

Which FortiManager feature allows an administrator to roll back a policy package to a previous version?

Accepted Answer

Revision history. FortiManager's Revision History feature automatically creates a versioned snapshot of policy packages each time they are installed or modified. Administrators can browse prior revisions and revert to any previous version, restoring the exact policy state. This is the built-in rollback mechanism for policy packages.

Answer

Install preview

Answer

Device manager

Answer

Automation stitch

Question 9

Which Fortinet product is specifically designed to deploy decoys and lures to detect lateral movement and early-stage attacks inside the network?

Accepted Answer

FortiDeceptor. FortiDeceptor is specifically designed to deploy decoys and lures that mimic real assets (e.g., servers, endpoints, IoT devices) to attract and detect lateral movement and early-stage attacks inside the network. It uses deception technology to create a realistic attack surface, triggering alerts when an attacker interacts with a decoy, without relying on signatures or behavioral analysis.

Answer

FortiSandbox

Answer

FortiEDR

Answer

FortiClient

Question 10

A FortiGate in HA active-passive mode has two VDOMs. VDOM-1 is configured for management (management VDOM). The administrator connects to the management VDOM IP to manage the device. What is a characteristic of the management VDOM?

Accepted Answer

It provides administrative access and is separate from data VDOMs. In an HA active-passive setup with multiple VDOMs, a management VDOM is dedicated to administrative access (e.g., SSH, HTTPS, SNMP) and is logically separated from data VDOMs that handle production traffic. This separation ensures that management traffic does not interfere with data plane operations and that administrative access remains available even if data VDOMs experience issues. The management VDOM can be any VDOM, not necessarily the root, and its configuration is not automatically synchronized to other VDOMs.

Answer

It automatically synchronizes configuration to other VDOMs

Answer

It must be the root VDOM

Answer

It can only be accessed via the console port