NSE7 Hard Questions — 25 Difficult Questions

Question 1

A FortiGate is configured with multiple IPsec VPNs to remote branches. One of the branch VPN tunnels goes down frequently. The administrator runs 'diagnose vpn ike log' and sees repeated INITIAL_CONTACT notifications from the remote peer. What does this indicate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The remote peer has rebooted or restarted its VPN service. An INITIAL_CONTACT notification is sent by an IKE peer when it establishes a new IKE SA and wants the remote peer to delete any existing IKE SAs associated with the same identity. This is standard behavior after a reboot, VPN service restart, or when the peer loses its state and re-initiates from scratch. Repeated INITIAL_CONTACT messages therefore indicate the remote branch device is repeatedly restarting or flapping its VPN daemon, not a normal rekey or DPD event.

Answer

The remote peer is rekeying the VPN tunnel

Answer

The local FortiGate has a mismatched pre-shared key

Answer

A dead peer detection timeout occurred

Question 2

Refer to the exhibit. A FortiGate is connected to the Security Fabric and registered with FortiManager. However, the administrator notices that the FortiGate is not receiving policy updates from FortiManager. What is the most likely cause?

Accepted Answer

The policy package on FortiManager is not assigned to the correct device group or policy target. FortiManager uses policy packages that must be explicitly assigned to a device group or specific FortiGate. Even if the FortiGate is registered and part of the Security Fabric, if the policy package is not assigned to the correct device group or policy target, the FortiGate will not receive policy updates. This is a common misconfiguration where the policy package exists but is not linked to the device.

Answer

The Fabric Root serial number is incorrect

Answer

The FortiGate is not registered with FortiManager

Answer

The Security Fabric is not fully connected

Question 3

A FortiGate administrator is configuring a ZTNA rule that uses a proxy-based policy to inspect traffic to a web application. The administrator wants to ensure that only users who have a valid certificate installed on their endpoint are allowed access. The certificate is issued by the corporate PKI and is stored in the user's certificate store. Which ZTNA configuration element should the administrator use to enforce this requirement?

Accepted Answer

Client certificate authentication in the ZTNA proxy rule. Client certificate authentication in the ZTNA proxy rule is the correct choice because it enforces certificate validation during the TLS handshake. The FortiGate acts as a proxy and can request a client certificate, verify it against a trusted CA, and check revocation. This provides strong authentication that the user possesses a valid certificate from the corporate PKI. Other options either rely on endpoint compliance reporting or are for different access methods, and they do not provide the same cryptographic assurance.

Answer

ZTNA tagging with a dynamic firewall address

Answer

FortiClient EMS compliance rule with certificate check

Answer

SSL VPN with certificate authentication

Question 4

You run 'diagnose vpn ike gateway list' on a FortiGate hub and see the following output for a spoke connection: IKE SA state: ESTABLISHED, IPsec SA state: UP, but the spoke cannot route traffic to other spokes. The ADVPN shortcut tunnel is not being established. What is the MOST likely cause?

Accepted Answer

The hub has a static route for the spoke subnet pointing to the tunnel interface. ADVPN shortcut tunnels are established when a spoke receives a shortcut offer from the hub and the hub does not already have a route that forces inter-spoke traffic through itself. If the hub has a static route for the spoke subnet pointing to the tunnel interface, the hub advertises that route and the spoke never triggers a shortcut, so inter-spoke traffic keeps traversing the hub.

Answer

DPD is not configured on the hub

Answer

The spoke's phase2 proposal does not match the hub's proposal

Answer

The spoke is using a different IKE version than the hub

Question 5

A large enterprise operates two FortiGate 600E firewalls in an HA active-passive cluster. They have enabled VDOMs to isolate traffic for different business units: Finance, HR, and Engineering. Each VDOM has its own internet connection through separate ISPs. The cluster has been running smoothly for months. Recently, the IT team noticed that users in the Finance VDOM experience intermittent connectivity drops to their cloud-based ERP system. The drops last 30-60 seconds and occur several times a day. During these drops, ping to the ERP IP address fails. The HA cluster status shows 'synchronized' and no failover events are logged. The Finance VDOM uses a static default route pointing to the primary ISP gateway. The other VDOMs are unaffected. What is the most likely cause of the issue?

Accepted Answer

The VDOM link configuration is not synchronized between the two units, causing asymmetric routing for the Finance VDOM.. VDOM link configurations are stored per-VDOM and must be synchronized independently. If the VDOM link configuration is not synchronized between the HA units, the passive unit may have a different or missing VDOM link, causing asymmetric routing when traffic is processed by the passive unit during a transient state (e.g., session ownership change or link flap). This leads to intermittent connectivity drops for the Finance VDOM only, as its traffic is isolated and uses a static default route.

Answer

The HA cluster is in active-active mode, causing routing loops for the Finance VDOM.

Answer

The heartbeat interface is oversubscribed, causing intermittent HA synchronization failures.

Answer

The 'set ha-mgmt-status enable' command is configured on the passive unit, preventing route synchronization.

Question 6

A FortiManager administrator wants to use automation stitches to respond to a specific security event on managed FortiGates. Which THREE components are required to build an automation stitch? (Select THREE.)

Accepted Answer

Trigger. An automation stitch in FortiManager requires three core components: a Trigger (the event that starts the stitch), a Route (a conditional path that determines which actions to execute based on the trigger's output), and an Action (the actual response, such as a CLI script or object change). Without these three, the stitch cannot function as a complete automation workflow.

Answer

FortiView dashboard

Answer

ADOM

Question 7

An administrator runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is a TCP connection that has been active for 3600 seconds and will expire in 3599 seconds. The output shows 'proto=6' which indicates TCP (protocol 6), 'duration=3600' means the session has been active for 3600 seconds (1 hour), and 'expire=3599' means the session will expire in 3599 seconds. The 'proto_state=01' is a TCP state code indicating an established connection. This is a standard FortiGate diagnostic session output.

Answer

The session is a UDP DNS request

Answer

The session is being blocked by a firewall policy

Answer

The session is an SSL VPN tunnel

Question 8

An administrator is configuring a hub-and-spoke ADVPN with FortiGates. The spoke sites use dynamic public IP addresses. The administrator has enabled auto-discovery on the spoke and hub. However, shortcut tunnels are not being established between spokes that communicate frequently. What is the most likely missing configuration?

Accepted Answer

Auto-discovery is not enabled on the spoke's phase1 configuration. In a hub-and-spoke ADVPN, auto-discovery must be enabled on both the phase1 configuration of the spoke and the hub. If auto-discovery is not enabled on the spoke's phase1, the spoke will not send or process IKE informational exchanges (ADVPN messages) to negotiate shortcut tunnels with other spokes. This prevents dynamic shortcut establishment even if the hub has auto-discovery enabled.

Answer

The spoke's phase2 proposal includes a different encryption algorithm than the hub

Answer

The hub does not have a route to the spoke's local subnets

Answer

The spoke's VPN interface is not in the same VDOM as the hub

Question 9

A FortiGate is running OSPF with multiple areas. The admin wants to redistribute a static route for 192.168.100.0/24 into OSPF. After configuring 'config router ospf' with 'redistribute static' enabled, the route appears in the OSPF database but is not being advertised to other areas. What is the most likely cause?

Accepted Answer

The router is an ABR and the static route is being redistributed as a type 5 LSA, which is not flooded into stub areas.. An ABR does not flood Type 5 LSAs (which are generated by redistribution) into stub areas or NSSAs. Since the route appears in the OSPF database on the ABR but is not advertised to other areas, the most likely cause is that the receiving area is a stub area, which by design blocks Type 5 LSAs. The redistribution of a static route into OSPF creates a Type 5 LSA, which is only flooded throughout the AS except into stub areas and NSSAs.

Answer

The 'redistribute static' command needs a route map to filter the route correctly.

Answer

The static route's administrative distance is too high for OSPF.

Answer

OSPF must be configured with 'default-information originate' to allow redistribution.

Question 10

An administrator runs 'diagnose ips anomaly http' and sees many entries with 'type=SQLi' and 'score=0'. What does a score of 0 indicate?

Accepted Answer

The traffic showed suspicious patterns but did not meet the threshold. In Fortinet's IPS anomaly detection, a score of 0 indicates that the traffic exhibited suspicious patterns (e.g., SQLi signatures) but did not accumulate enough anomaly points to meet the configured threshold for triggering an action. This means the traffic was flagged as potentially malicious but was not deemed severe enough to warrant logging or blocking, so it remains in a 'monitoring' state without enforcement.

Answer

The anomaly detection is disabled

Answer

The IPS sensor is not applied to any policy

Answer

The traffic is definitely an SQL injection attack

Question 11

An administrator wants to load-balance traffic across two WAN links using ECMP. The routes have equal distances and metrics. However, traffic is only using one of the links. What could be the cause?

Accepted Answer

The routes are learned via different routing protocols with different administrative distances.. ECMP (Equal-Cost Multi-Path) requires routes to have identical administrative distances (AD) to be considered equal-cost. If routes are learned via different routing protocols (e.g., OSPF with AD 110 and static with AD 1), the FortiGate will prefer the route with the lower AD, even if metrics are equal. This causes traffic to use only the preferred link, as the other route is not installed in the routing table for ECMP selection.

Answer

ECMP is not enabled globally under config system settings.

Answer

The firewall policy is configured to use a specific egress interface.

Answer

The traffic is session-based and ECMP uses per-packet load balancing.

Question 12

A FortiGate running FortiOS 7.2 has multiple WAN interfaces. The administrator is configuring SD-WAN load balancing with the 'volume' algorithm. The requirement is that each interface carries a percentage of total traffic based on its bandwidth capacity. The administrator sets the 'weight' of each interface accordingly. However, traffic distribution is not as expected. Which TWO factors could cause this discrepancy?

Accepted Answer

The interface bandwidth settings (speed) do not reflect actual link capacity. Option A is correct because the SD-WAN 'volume' algorithm calculates each member's share from its configured interface bandwidth (the 'speed' setting under the interface), so if those values do not match the real link capacity, the weighted distribution will be wrong. Option C is correct because 'volume' load balancing distributes traffic based on session volume, and a few high-volume sessions can skew the actual byte distribution away from the intended weighted percentages. Option B is incorrect because weight values are not restricted to 1-100 in a way that would cause this specific mismatch; weights are relative values used to compute proportions. Option D is incorrect because 'per-packet' is not a valid SD-WAN load-balancing algorithm setting in this context, and the scenario already specifies the 'volume' algorithm. Option E is incorrect because a disabled performance SLA does not by itself exclude an interface from volume-based load balancing; SLA state affects health checking and failover, not the weight computation.

Answer

The weight values are not in the range 1-100

Answer

The load balancing algorithm is set to 'per-packet' instead of 'volume'

Answer

The performance SLA is set to 'disable' on some interfaces, causing them to be excluded

Question 13

A FortiGate in transparent mode with multiple VDOMs is deployed at a customer site. The customer reports that traffic between two VLANs on the same physical segment is not being forwarded. The administrator verifies that the firewall policies are configured correctly. What is the most likely cause?

Accepted Answer

The FortiGate is in transparent mode and does not route between VLANs without a VLAN interface. In transparent mode, a FortiGate acts as a Layer 2 bridge and does not perform IP routing. To forward traffic between VLANs on the same physical segment, you must create VLAN subinterfaces on the FortiGate and assign them to the appropriate VDOMs. Without these VLAN interfaces, the FortiGate cannot distinguish or forward traffic between the VLANs, even if firewall policies are correctly configured.

Answer

The VDOMs are not configured with management IP addresses

Answer

The VDOM limit has been exceeded

Answer

Inter-VDOM routing is disabled between the VDOMs

Question 14

In FortiManager, what is the purpose of an automation stitch?

Accepted Answer

To trigger automated actions based on predefined events. An automation stitch in FortiManager is a sequence of automated actions triggered by a predefined event, such as a log message, SNMP trap, or schedule. It allows administrators to define a set of actions (e.g., run a script, send an alert, or change a policy) that execute in response to specific conditions, streamlining incident response and network management without manual intervention.

Answer

To combine multiple ADOMs into a single management domain

Answer

To automatically deploy configuration changes to devices

Answer

To stitch together multiple policy packages into one

Question 15

A FortiGate administrator is troubleshooting a ZTNA access proxy issue. The ZTNA rule is configured to require the tag 'AV_Installed' and 'OS_Updated'. Users with compliant devices are still denied access. The admin checks the ZTNA connection monitor and sees 'Tag mismatch'. What is the MOST likely cause?

Accepted Answer

The FortiClient EMS is not configured as an endpoint control source on the FortiGate. The 'Tag mismatch' error in the ZTNA connection monitor indicates that the FortiGate is not receiving the expected endpoint tags ('AV_Installed' and 'OS_Updated') from the endpoint. This occurs when FortiClient EMS is not configured as an endpoint control source on the FortiGate, so the FortiGate has no way to learn the endpoint's compliance tags. Without this integration, the ZTNA rule cannot evaluate the tags and denies access.

Answer

The FortiGate does not have a valid PKI certificate for the ZTNA proxy

Answer

The user is not authenticated via SAML

Answer

The ZTNA rule is using the wrong port number

Question 16

You are troubleshooting a BGP neighbor flapping. The neighbor state shows 'Active'. Which command will help you see the reason for the state change?

Accepted Answer

get router info bgp neighbors. The 'get router info bgp neighbors ' command displays detailed information about a BGP neighbor, including its current state (e.g., Active, Established) and a history of state changes. This helps identify why the session is flapping, as it shows the last few state transitions and the associated reasons (e.g., timeouts, resets). The 'Active' state indicates the router is trying to establish a TCP connection, and the neighbor details can reveal issues like misconfigured IP addresses, AS numbers, or authentication. Option B is incorrect because 'get router info bgp neighbors rejected-routes' shows routes that were rejected by policy, not the reason for state changes. Option C shows routes received from the neighbor, and Option D provides a summary, neither of which directly reveals why the state changed.

Answer

get router info bgp neighbors <neighbor> rejected-routes

Answer

get router info bgp neighbors <neighbor> received-routes

Answer

get router info bgp summary

Question 17

An administrator has a FortiGate hub with multiple spoke FortiGates in an ADVPN topology. The spokes are behind NAT and have dynamic public IPs. The hub is configured with a static IP. Which THREE steps are necessary for the spokes to establish a shortcut tunnel between each other?

Answer

Enable 'auto-discovery-receiver' on the hub's phase1.

Answer

Set the phase1 authentication method to 'signature' on all devices.

Answer

Configure the spokes with the hub's public IP as the remote gateway.

Answer

Enable 'auto-discovery-sender' on the spokes' phase1.

Answer

Enable NAT traversal on the hub's phase1 configuration.

Question 18

An administrator configures a multi-peer IPsec VPN on FortiGate for redundancy. The primary peer is 10.1.1.1 and secondary is 10.1.1.2. The administrator notices that when the primary peer goes down, the FortiGate does not fail over to the secondary peer until the IKE SA times out (about 60 seconds). Which setting can reduce this failover time?

Accepted Answer

Set 'dpd-retryinterval' to 5 and 'dpd-retrycount' to 3.. DPD retry interval and count control how quickly FortiGate detects a dead peer. With retryinterval=5 and retrycount=3, the peer is declared dead after 15 seconds of no response, triggering failover to the secondary.

Answer

Configure 'idle-timeout' to 30 seconds.

Answer

Use aggressive mode for IKE negotiation.

Answer

Enable 'auto-negotiate' on the phase1 interface.

Question 19

A security analyst notices that an automation stitch in FortiManager did not trigger when a specific event occurred on a managed FortiGate. Which three possible reasons could explain why the stitch did not fire? (Choose three.)

Accepted Answer

The trigger event type does not match the actual event. Option A is correct because a stitch only fires when the configured trigger event type exactly matches the event generated on the managed FortiGate; a mismatch (for example, configuring an IOC event trigger when the actual event is a log-based or fabric event) means the trigger never activates. Option C is correct because automation stitches can include conditions (such as matching a specific log field, severity, or value), and if that condition evaluates to false the stitch is suppressed even when the trigger event occurs. Option D is correct because a disabled automation stitch is administratively turned off and will not execute regardless of matching triggers or conditions. Option B is not correct because FortiGate automation stitches are a built-in feature and are not gated by a per-stitch license limit. Option E is not correct because the scenario states the event occurred on the managed FortiGate and the stitch failed to fire; a FortiManager-to-FortiGate connectivity issue would affect communication of the event to FortiManager, but the question asks for reasons the stitch itself did not trigger, and connectivity is not a listed stitch-level cause in this context.

Answer

The FortiGate has reached its license limit for automation stitches

Answer

The automation stitch was configured with a condition that was not met

Question 20

A FortiGate administrator is configuring an ADVPN with a hub-and-spoke topology. The administrator wants to ensure that spoke-to-spoke traffic can be dynamically established without traversing the hub for every packet. The administrator also wants to ensure that the shortcut tunnels are only established when necessary and are torn down when no longer used. Which two statements about ADVPN shortcut tunnels on FortiGate are correct? (Choose two.)

Accepted Answer

Shortcut tunnels are established when a spoke receives a shortcut offer from the hub and the spoke has a route to the destination spoke's public IP.. ADVPN shortcut tunnels are established on demand when the hub sends a shortcut offer and the originating spoke can reach the destination spoke's public IP. They are torn down after an idle timeout when no traffic matches, reverting traffic to the hub path. This dynamic creation and teardown optimizes spoke-to-spoke communication while preserving the hub as a fallback and control point.

Answer

Shortcut tunnels are always established between all spokes at initial VPN bring-up, regardless of traffic patterns.

Answer

Shortcut tunnels can only be established between spokes that are in the same IP subnet.

Answer

Shortcut tunnels require the hub to be removed from the routing path permanently once established.