NSE7 Hard Questions — 25 Difficult Questions

Question 1

A FortiGate cluster (A-P) has a session that is not synchronizing to the secondary unit. The administrator runs 'diagnose sys ha session-sync status' and sees that the session count is different between primary and secondary. Which is the most likely cause?

Accepted Answer

The session was created by a local-in traffic (e.g., management traffic) which is not synchronized.. FortiGate A-P clusters synchronize sessions via the HA heartbeat interface, but local-in traffic (e.g., management sessions like HTTPS, SSH, or SNMP) is never synchronized because it is destined to the cluster IP itself and is inherently unit-specific. The 'diagnose sys ha session-sync status' command shows a session count mismatch because the primary unit has local-in sessions that the secondary does not replicate, making D the correct answer.

Answer

The session is using a custom application control profile that prevents synchronization.

Answer

The HA heartbeat interface is down.

Answer

The secondary unit has insufficient memory to accept new sessions.

Question 2

An administrator is troubleshooting a scenario where IPSec VPN tunnels between two FortiGates are flapping. The logs show Phase 1 is up but Phase 2 fails with 'no proposal chosen'. The remote FortiGate has multiple Phase 2 selectors configured. What is the most likely cause?

Accepted Answer

Mismatched Phase 2 proxy IDs (local/remote subnets).. The 'no proposal chosen' error during Phase 2, despite Phase 1 being up, indicates a mismatch in the IPsec security association (SA) parameters. Since the remote FortiGate has multiple Phase 2 selectors configured, the most likely cause is that the local and remote proxy IDs (local and remote subnets) do not match any of the configured selectors. Phase 2 negotiation uses these proxy IDs to define which traffic should be encrypted; if they don't align, the IKE SA cannot be established.

Answer

Mismatched pre-shared keys.

Answer

Dead Peer Detection (DPD) settings are too aggressive.

Answer

Certificate validation failure.

Question 3

A FortiGate is blocking HTTP traffic from 10.0.1.5 to 10.0.2.100, despite an explicit allow policy. The exhibit shows the configuration and debug flow output. What is the most likely cause?

Accepted Answer

TCP SYN flood protection is dropping the incomplete session.. The debug flow output shows the session is in a 'SYN_RECV' state and never transitions to 'ESTABLISHED', which is characteristic of TCP SYN flood protection. When the FortiGate's SYN flood protection threshold is exceeded, it drops incomplete sessions before they can be fully established, even if an explicit allow policy exists. This explains why HTTP traffic from 10.0.1.5 to 10.0.2.100 is blocked despite the policy being correctly configured.

Answer

The policy is applied to the wrong source interface.

Answer

The policy action is set to deny.

Answer

The source address object does not include 10.0.1.5.

Question 4

Which TWO configurations are required to enable SSL VPN authentication using a RADIUS server on a FortiGate?

Accepted Answer

Create a user group that includes the RADIUS server as an authentication method. Option A is correct because a user group must be created to reference the RADIUS server as an authentication method. This group is then applied to the SSL VPN portal or firewall policy, allowing FortiGate to forward authentication requests to the RADIUS server. Without the user group, the RADIUS server cannot be associated with SSL VPN authentication.

Answer

Configure an LDAP server to synchronize user accounts

Answer

Configure an SSL VPN portal with 'Require Authentication' enabled

Answer

Set a local password policy for SSL VPN users

Question 5

Refer to the exhibit. A FortiGate is connected to the Security Fabric and registered with FortiManager. However, the administrator notices that the FortiGate is not receiving policy updates from FortiManager. What is the most likely cause?

Accepted Answer

The policy package on FortiManager is not assigned to the correct device group or policy target. Option C is correct because FortiManager uses policy packages that must be explicitly assigned to a device group or specific FortiGate. Even if the FortiGate is registered and part of the Security Fabric, if the policy package is not assigned to the correct device group or policy target, the FortiGate will not receive policy updates. This is a common misconfiguration where the policy package exists but is not linked to the device.

Answer

The Fabric Root serial number is incorrect

Answer

The FortiGate is not registered with FortiManager

Answer

The Security Fabric is not fully connected

Question 6

Which TWO statements are true regarding BGP path selection in a FortiGate SD-WAN environment?

Accepted Answer

BGP best path selection is independent of SD-WAN rules unless explicitly overridden.. BGP best path selection operates independently of SD-WAN rules because BGP selects the best route based on its own path attributes (e.g., weight, local preference, AS path length, MED) as defined in RFC 4271. SD-WAN rules can only override this selection if explicitly configured to do so, typically by using route maps or policy-based routing to influence the decision. Without such an override, the BGP best path is installed in the routing table and SD-WAN rules then apply to traffic forwarding, not to the BGP path selection process itself.

Answer

SD-WAN cannot be applied to routes learned via BGP.

Answer

SD-WAN can modify BGP MED values to influence path selection.

Answer

SD-WAN rules always follow the BGP best path selection.

Question 7

A company uses SSL VPN with FortiGate for remote access. Users report that after connecting, they can access internal web servers but cannot ping them. Which configuration is most likely missing?

Accepted Answer

Firewall policy allowing ICMP. The correct answer is C. SSL VPN tunnels typically allow TCP-based traffic like HTTP/HTTPS to internal web servers, but ICMP (ping) is a separate protocol that requires explicit permission in the firewall policy. Without a firewall policy rule permitting ICMP from the SSL VPN interface to the internal network, the FortiGate will drop the ping requests, even though the tunnel is established and other traffic flows.

Answer

Split tunneling settings

Answer

SSL VPN web portal settings

Answer

DNS server configuration

Question 8

A network engineer is designing a FortiGate HA cluster with two units operating in active-active mode. The cluster will be placed in a VDOM-enabled environment. The engineer wants to ensure that traffic from a specific VDOM is load-balanced across both units based on source IP address. Which setting must be configured on the cluster to achieve this?

Accepted Answer

Configure a virtual cluster with load-balance method source IP. In a VDOM-enabled active-active HA cluster, per-VDOM load balancing is achieved by configuring a virtual cluster and setting the load-balance method to source IP. This allows the cluster to distribute traffic for that specific VDOM across both units based on the source IP hash, ensuring session persistence while balancing the load.

Answer

Configure randomize-vip under config system ha

Answer

Configure vdom-load-balance under config system ha

Answer

Enable session pickup and set session-pickup-delay to 0

Question 9

A FortiGate with multiple VDOMs is experiencing high CPU usage. The administrator suspects that one VDOM is consuming excessive resources. Which THREE methods can be used to limit resource usage per VDOM?

Accepted Answer

Apply per-VDOM traffic shaping policies. Option A is correct because per-VDOM traffic shaping policies allow the administrator to apply bandwidth limits and QoS policies specifically to traffic within a particular VDOM, preventing that VDOM from monopolizing the FortiGate's CPU resources. This is achieved by configuring shaping policies under the VDOM's firewall policy that match traffic and apply a traffic shaper, which can limit bandwidth and prioritize traffic, thereby reducing CPU load from that VDOM.

Answer

Enable HA resource reservation

Answer

Enable VDOM logging

Question 10

An administrator is troubleshooting a ZTNA connection issue where a user can access the ZTNA gateway but the connection to the internal application fails after a few seconds. The FortiGate logs show 'ZTNA session timeout' but the timeout value is set to 30 minutes. What could be the reason?

Accepted Answer

The ZTNA proxy idle timeout is set to a lower value than the global timeout.. The ZTNA proxy has its own idle timeout setting that operates independently of the global timeout. Even though the global timeout is set to 30 minutes, if the per-proxy idle timeout is configured to a lower value (e.g., 30 seconds), the proxy will terminate the session after that idle period, logging 'ZTNA session timeout'. This explains why the connection fails after a few seconds despite the long global timeout.

Answer

The internal application is not responding to the proxy request.

Answer

The internal application has a 5-second timeout.

Answer

The client's FortiClient is not receiving the ZTNA tags.

Question 11

During a ZTNA implementation, the administrator configures a ZTNA rule for an internal application but users cannot connect. The FortiGate policy is correct and the application is reachable from the FortiGate. What is the most likely misconfiguration?

Accepted Answer

The ZTNA rule's proxy destination IP or port is wrong.. Option D is correct because the ZTNA rule defines the mapping between the external proxy address and the internal application's actual IP and port. If the proxy destination IP or port is misconfigured, the FortiGate's ZTNA proxy cannot forward traffic to the correct internal server, even though the firewall policy and network connectivity are otherwise valid. This is a common misconfiguration when the internal application's IP or service port differs from what is specified in the ZTNA rule.

Answer

The firewall policy is set to deny traffic from the ZTNA gateway.

Answer

The client does not have a route to the internal application.

Answer

The client's FortiClient agent is not authenticated.

Question 12

Which THREE of the following are valid methods to deliver ZTNA tags to FortiClient? (Select three.)

Accepted Answer

FortiClient configuration profiles. FortiClient configuration profiles allow administrators to define and push ZTNA tags directly to FortiClient endpoints via the EMS-managed policy framework. This is a core method because tags are applied based on device posture and user identity, enabling granular access control without relying on network-layer attributes.

Answer

SNMP

Answer

DHCP options

Question 13

A FortiGate in transparent mode is deployed in a data center. The admin notices that ARP requests from a downstream switch for the default gateway are not being answered. The FortiGate's management IP is configured on the same subnet as the switch. What is the most likely cause?

Accepted Answer

The management IP is configured on the same VLAN as the downstream switch, causing a conflict. In transparent mode, the FortiGate acts as a Layer 2 bridge and does not participate in ARP for traffic passing through it. However, the management IP is used for administrative access and must be unique on the network. If the management IP is configured on the same VLAN as the downstream switch, it creates an IP address conflict with the switch's own interface or the default gateway, causing the switch to either ignore or not forward ARP requests for that IP. The FortiGate will not respond to ARP requests for the management IP if it detects a duplicate IP on the same broadcast domain, as per RFC 5227.

Answer

The downstream switch has port security enabled

Answer

The FortiGate has a firewall policy blocking ARP

Answer

The FortiGate's ARP table is full

Question 14

During a security audit, it is found that traffic between two VDOMs is allowed even though no inter-VDOM routing policy is configured. The VDOMs are connected via a VDOM link. What could explain this behavior?

Accepted Answer

The VDOM link is operating in transparent mode. If the VDOM link is configured with the same VLAN ID and IP subnet, traffic may be bridged at Layer 2, bypassing Layer 3 policies. Alternatively, a policy might be implicitly allowing traffic.

Answer

The FortiGate is in NAT mode

Answer

The VDOMs are in the same administrative domain

Answer

The VDOM link is using the same interface IP

Question 15

An organization has multiple ADOMs in FortiManager. The admin wants to share a set of firewall objects across all ADOMs. What is the best approach?

Accepted Answer

Use the Global ADOM to create global objects. The Global ADOM in FortiManager is specifically designed to create and manage global objects (such as address objects, services, and schedules) that can be shared across all regular ADOMs. When an object is created in the Global ADOM, it is automatically available in all ADOMs that are linked to it, eliminating the need for duplication. This is the only native, supported method for sharing objects across multiple ADOMs in FortiManager.

Answer

Create a meta field and assign objects

Answer

Manually recreate the objects in each ADOM

Answer

Enable object sharing in the system settings

Question 16

A company has a FortiGate with multiple VDOMs. The security team wants to use FortiManager to manage policies centrally. Which three steps are necessary to set up VDOM management via FortiManager? (Choose three.)

Accepted Answer

Enable VDOMs on the FortiGate and configure them for FortiManager management. Option A is correct because VDOMs must be enabled on the FortiGate and each VDOM must be configured to allow FortiManager management. This is done by setting the 'set vdom mgmt' parameter within each VDOM or globally, which permits FortiManager to push policy and object changes to the specific VDOM context. Without this step, FortiManager cannot authenticate or communicate with the VDOMs, even if the device is added to the ADOM.

Answer

Configure a static route on FortiManager to reach the FortiGate's management IP

Answer

Disable VDOM configuration locking on FortiManager

Question 17

A FortiManager administrator wants to use automation stitches to respond to a specific security event on managed FortiGates. Which THREE components are required to build an automation stitch? (Select THREE.)

Accepted Answer

Trigger. An automation stitch in FortiManager requires three core components: a Trigger (the event that starts the stitch), a Route (a conditional path that determines which actions to execute based on the trigger's output), and an Action (the actual response, such as a CLI script or object change). Without these three, the stitch cannot function as a complete automation workflow.

Answer

FortiView dashboard

Answer

ADOM

Question 18

An administrator configures a firewall policy with an application control profile to block social media. The administrator observes that some social media traffic is still passing through. The traffic is HTTPS. What additional configuration is REQUIRED for application control to effectively block HTTPS-based social media?

Accepted Answer

Enable 'ssl-ssh-profile' with deep inspection on the policy. Application control requires visibility into the application layer to identify HTTPS-based traffic. Without SSL inspection, the firewall cannot decrypt the HTTPS payload to inspect the application signatures. Enabling an 'ssl-ssh-profile' with deep inspection on the policy allows the FortiGate to decrypt the traffic, apply the application control profile, and effectively block social media applications.

Answer

Set application control to proxy-based inspection

Answer

Enable 'allow-ssl-inspection' under system settings

Answer

Add a DNS filter to block social media domains

Question 19

A FortiGate in transparent mode is deployed between a router and a switch. The administrator needs to apply a deep inspection profile to HTTP traffic. What is the correct configuration for the interfaces?

Accepted Answer

Configure a management IP on the VDOM and apply the inspection profile to the policy. In transparent mode, FortiGate acts as a Layer 2 bridge, so interfaces do not require IP addresses. Deep inspection of HTTP traffic is applied via a firewall policy that references a deep inspection profile, and a management IP must be configured on the VDOM to allow the FortiGate to participate in management traffic (e.g., DNS, NTP, or proxy operations). Option A correctly identifies that the management IP is set on the VDOM and the inspection profile is applied to the policy.

Answer

Place both interfaces in the same VDOM and enable DHCP

Answer

Switch to NAT mode to enable deep inspection

Answer

Assign IPs to both interfaces and create a policy from LAN to WAN

Question 20

A FortiGate administrator wants to generate customized reports in FortiAnalyzer for different departments. The administrator needs to ensure that each department can only see its own logs. Which TWO configurations are necessary?

Accepted Answer

Create separate ADOMs for each department. Option B is correct because ADOMs (Administrative Domains) in FortiAnalyzer provide administrative isolation, allowing each department to have its own segregated management domain. This ensures that administrators assigned to a specific ADOM can only view and generate reports from logs belonging to that ADOM, enforcing strict data separation.

Answer

Configure meta fields on FortiGate objects

Answer

Enable per-device logging on FortiGate

Answer

Assign each administrator the 'super_admin' profile