NSE7 Multiple Select — 60 Questions

Question 1

A FortiGate administrator is troubleshooting an IKEv2 VPN tunnel that fails to establish. The remote peer logs show 'no acceptable proposal' error. Which TWO possible causes should the administrator check?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The phase1 encryption algorithm or integrity algorithm is mismatched. The 'no acceptable proposal' error occurs when the two peers cannot agree on a set of parameters. Common causes are mismatched encryption/integrity algorithms (phase1 proposal) or mismatched Diffie-Hellman groups.

Answer

The remote peer's IP address is unreachable

Answer

The local FortiGate has the wrong IKE version configured

Answer

The remote peer's pre-shared key is incorrect

Question 2

An administrator is configuring a new branch office VPN using IKEv2 with PKI certificates. Which TWO steps are essential to ensure the VPN tunnel establishes successfully?

Accepted Answer

Import the remote peer's certificate into the FortiGate's trusted CA list. For IKEv2 with PKI certificates, the remote peer's certificate must be validated against a trusted CA. Importing the CA certificate that signed the remote peer's certificate into the FortiGate's trusted CA list allows the FortiGate to build a valid certificate chain and authenticate the remote peer during IKEv2 phase 1. Without this, the certificate validation fails and the tunnel cannot establish.

Answer

Set the phase 1 proposal to use AES-256-GCM only

Answer

Enable DPD on the phase 1 interface

Answer

Configure the phase 2 selector to include all traffic (0.0.0.0/0)

Question 3

A network engineer is troubleshooting an ADVPN scenario where shortcut tunnels between spokes are not forming. The hub has IKEv2 configured and the spokes are behind NAT. Which THREE conditions must be met for shortcut tunnels to establish?

Accepted Answer

Spokes are configured with 'set auto-discovery' enabled. ADVPN shortcut tunnels require: IKEv2 (not IKEv1), auto-negotiate enabled on the hub phase2, and the hub's phase2 must have 'add-route' set to enable route injection. NAT traversal is automatically handled by IKEv2.

Answer

NAT traversal is enabled on all gateways

Answer

IKEv1 is used for the spoke-to-hub tunnels

Question 4

An administrator is configuring FortiClient EMS to enforce compliance for ZTNA. Which TWO settings are required on FortiGate to use compliance-based ZTNA tags?

Accepted Answer

FortiClient EMS is added as a security fabric connector. To use compliance tags, FortiGate must have EMS configured as a fabric connector and the ZTNA proxy rule must reference the tags.

Answer

SSL deep inspection is enabled on the firewall policy

Answer

A local user database is configured for authentication

Answer

FortiGate is configured as a SAML IdP

Question 5

A FortiGate is experiencing high CPU usage due to IPsec VPN traffic. The admin wants to offload cryptographic operations to the hardware. Which THREE conditions must be met for hardware acceleration to work? (Choose three.)

Accepted Answer

The FortiGate must have a compatible NP7 or CP9 processor. Hardware acceleration (CP8/CP9) requires specific conditions: supported encryption algorithms, no advanced features that disable offload, and the traffic must match a VPN policy that uses the hardware acceleration capable interface.

Answer

The VPN interface must be configured with 'set acceleration-mode ipsec'

Answer

The firewall policy using the VPN interface must not have NAT enabled

Question 6

An administrator configures ZTNA with FortiClient EMS. The goal is to restrict access to an internal application based on device posture. The administrator configures a ZTNA tag for 'Compliant' that checks antivirus and OS patch status. Which TWO additional steps are required on the FortiGate to enforce access based on this tag?

Accepted Answer

Create a ZTNA policy that includes the 'Compliant' tag as a required condition. To use ZTNA tags, the administrator must configure a ZTNA access proxy to publish the application and a ZTNA policy that references the tag to grant access.

Answer

Enable SSL deep inspection on the firewall policy

Answer

Import the FortiClient EMS certificate to FortiGate

Answer

Configure a firewall policy with source set to the EMS connector

Question 7

A FortiGate administrator is configuring OSPF over an IPsec VPN overlay in a hub-and-spoke topology. The spokes have dynamic IPs and use ADVPN. Which THREE conditions are necessary for OSPF to work correctly over the VPN tunnels?

Accepted Answer

The OSPF router ID must be unique across all spokes. OSPF requires stable network types and correct interface configuration. For ADVPN, OSPF should use point-to-point network type to avoid DR elections and ensure proper neighbor relationships.

Answer

The OSPF hello interval must be less than the DPD retry interval

Answer

The hub must have all spoke routes in its routing table before OSPF starts

Question 8

An administrator wants to implement ZTNA with FortiClient EMS to control access to an internal web application. Which TWO components are essential for the ZTNA proxy to function correctly?

Accepted Answer

A firewall policy allowing traffic from the ZTNA gateway to the application server. A ZTNA proxy requires a configured application mapping (defining the internal server) and a firewall policy that permits traffic from the ZTNA gateway to the internal server.

Answer

A static route on FortiGate pointing to the application server's network

Answer

SSL certificate installed on the application server

Answer

A public DNS record for the ZTNA gateway's FQDN

Question 9

A network admin is troubleshooting why FortiGate's antivirus is not detecting a known malware sample. The sample is detected by other scanners. Which two checks should the admin perform? (Choose two.)

Accepted Answer

Verify that the FortiGuard Antivirus subscription is active. FortiGate's antivirus engine relies on a valid FortiGuard Antivirus subscription to download and update the virus signature database. If the subscription has expired, the engine cannot receive new signatures, causing it to miss recently discovered malware samples that other scanners with active subscriptions detect.

Answer

Check that the file is not excluded by a file filter

Answer

Ensure the firewall policy is configured for proxy-based inspection

Answer

Confirm that the antivirus profile has 'Scan on Delivery' enabled

Question 10

A FortiGate is experiencing asymmetric routing due to route leaking between VRFs. The administrator wants to ensure that traffic using a specific VRF returns via the same path. Which THREE actions should be taken? (Choose three.)

Accepted Answer

Enable 'set pbr-enforce-symmetric' on the VRF interfaces. Enabling 'set pbr-enforce-symmetric' on VRF interfaces forces the FortiGate to use policy-based routing (PBR) rules bidirectionally, ensuring that return traffic for a session follows the same path as the forward traffic. This is critical in asymmetric routing scenarios caused by route leaking between VRFs, as it overrides the default per-packet forwarding behavior and enforces symmetry at the session level.

Answer

Disable route leaking between VRFs

Answer

Increase the administrative distance of the leaked routes

Question 11

A FortiGate administrator needs to use FortiManager to deploy a new security policy to all firewalls in a specific ADOM. Which two steps are part of the installation process? (Choose two.)

Accepted Answer

Run the install preview to see the changes that will be applied. The install preview in FortiManager allows the administrator to review the exact configuration changes (adds, deletes, modifications) that will be pushed to the target devices before committing the installation. This step is critical to avoid unintended policy disruptions, as it shows a diff of the policy package against the current device configuration. Option C is correct because selecting target devices and clicking 'Install' is the final manual step that triggers the actual deployment of the policy package to the chosen firewalls within the ADOM.

Answer

Configure revision history to track changes

Answer

Create a new ADOM for the policy package

Answer

Enable automation stitches to push the policy

Question 12

An administrator needs to ensure that traffic between two VDOMs (VDOM_A and VDOM_B) is inspected by an IPS profile. Which TWO configuration elements are required? (Choose TWO.)

Accepted Answer

An inter-VDOM link with IP addresses in the same subnet. An inter-VDOM link is required to route traffic between VDOMs, and placing IP addresses in the same subnet on both ends ensures direct Layer 2 connectivity without routing overhead. This allows the firewall policies in each VDOM to control traffic flow, and applying an IPS profile on the policy in VDOM_A (with the inter-VDOM link as the destination interface) ensures that all traffic leaving VDOM_A toward VDOM_B is inspected by IPS.

Answer

NAT enabled on the inter-VDOM link

Answer

A firewall policy on VDOM_B with the source as the inter-VDOM link

Answer

An IPsec VPN between the VDOMs

Question 13

A FortiGate administrator is deploying a multi-VDOM setup for a service provider. The provider wants each customer VDOM to have its own administrative access, yet the overall device management (including firmware upgrades) should be centralized from the management VDOM. Which TWO statements are true regarding administrative VDOMs?

Accepted Answer

The management VDOM can be used to manage all other VDOMs. The management VDOM in a multi-VDOM FortiGate setup is specifically designed to provide centralized management. Administrators logged into the management VDOM can use the `execute` commands or the GUI to manage all other VDOMs, including configuration changes and monitoring, without needing to log into each VDOM individually.

Answer

Traffic VDOMs cannot have any administrative access

Answer

Each VDOM must have a separate management IP address

Answer

An administrator assigned to one VDOM can automatically view configurations of other VDOMs

Question 14

A FortiGate administrator is planning to use policy packages in FortiManager to manage firewall policies for multiple devices. Which TWO statements about policy packages are true?

Accepted Answer

Header and footer policies can be used to enforce common rules across all policies. Header and footer policies in FortiManager allow administrators to enforce common rules across all policies in a policy package. Header policies are evaluated before the main policy set, and footer policies are evaluated after, ensuring consistent security controls such as logging or traffic shaping are applied universally without manual duplication.

Answer

Policy packages are automatically applied to the device upon creation

Answer

Policy packages cannot include NAT policies

Answer

A policy package can contain policies for different VDOMs

Question 15

Which TWO features are required to implement an always-on SSL VPN tunnel with FortiGate that automatically reconnects when the user's network changes?

Accepted Answer

Tunnel mode enabled. Tunnel mode is required for an always-on SSL VPN tunnel, as it encapsulates all traffic at the network layer (TUN) and maintains a persistent virtual interface on the client. This allows the VPN to stay active and automatically reconnect when the user's network changes, such as switching from Wi-Fi to cellular, without manual intervention.

Answer

DTLS enabled

Answer

Web mode portal

Answer

Split tunneling configured

Question 16

A FortiGate running FortiOS 7.2 has multiple WAN interfaces. The administrator is configuring SD-WAN load balancing with the 'volume' algorithm. The requirement is that each interface carries a percentage of total traffic based on its bandwidth capacity. The administrator sets the 'weight' of each interface accordingly. However, traffic distribution is not as expected. Which TWO factors could cause this discrepancy?

Accepted Answer

The interface bandwidth settings (speed) do not reflect actual link capacity. The 'volume' algorithm in FortiOS SD-WAN distributes traffic proportionally based on the configured interface weights, but these weights are derived from the interface bandwidth settings (speed). If the configured bandwidth does not match the actual link capacity, the weight ratios will be incorrect, leading to unexpected traffic distribution. The administrator must ensure that the 'speed' setting under each interface accurately reflects the real bandwidth to achieve the desired load balancing.

Answer

The weight values are not in the range 1-100

Answer

The load balancing algorithm is set to 'per-packet' instead of 'volume'

Answer

The performance SLA is set to 'disable' on some interfaces, causing them to be excluded

Question 17

An administrator wants to use FortiAnalyzer to generate reports for compliance. Which two data sources can be included in a FortiAnalyzer report? (Choose two.)

Accepted Answer

Log data from FortiGate. FortiAnalyzer reports are built from log data collected from FortiGate devices, which includes traffic logs, event logs, and security logs. This log data is the primary source for compliance reporting because it provides detailed records of network activity. FortiView traffic statistics are also a valid data source, as they aggregate real-time and historical traffic data from FortiGate logs, allowing reports to include graphical summaries and top-talker information.

Answer

Routing table information from routers

Answer

Configuration backups from FortiManager

Answer

User authentication logs from LDAP servers

Question 18

Which TWO statements correctly describe the behavior of SD-WAN rules when using the 'maximize-bandwidth' strategy?

Accepted Answer

The administrator can assign different weights to members to influence the proportion of traffic each handles.. The 'maximize-bandwidth' strategy in SD-WAN rules uses weighted load balancing, where the administrator assigns weights to each member link. The proportion of traffic each member handles is directly proportional to its assigned weight, allowing fine-grained control over bandwidth utilization across multiple WAN links.

Answer

The strategy ensures that all traffic uses the member with the highest bandwidth.

Answer

Traffic from a single session can be split across multiple members for better performance.

Answer

Traffic is distributed based on session count to keep each link equally utilized.

Question 19

A network engineer needs to collect logs from multiple FortiGates and generate compliance reports. Which TWO FortiAnalyzer features should be used?

Accepted Answer

Log analytics. Log analytics (option B) is correct because it provides the ability to search, filter, and visualize logs from multiple FortiGates, enabling the identification of trends and anomalies necessary for compliance reporting. Reports (option C) is correct because FortiAnalyzer includes a dedicated reporting engine that can generate scheduled or on-demand compliance reports based on collected logs, with pre-defined templates for standards like PCI DSS, HIPAA, and SOX.

Answer

ADOM configuration

Answer

Automation stitches

Answer

Policy packages

Question 20

A FortiGate administrator is planning a multi-VDOM deployment for a service provider. Which TWO statements are true about VDOM limitations and best practices?

Accepted Answer

It is recommended to use a dedicated management VDOM. Using a dedicated management VDOM is a best practice in multi-VDOM deployments. It isolates administrative traffic (e.g., HTTPS, SSH, SNMP) from data-plane VDOMs, ensuring that management access remains available even if a data VDOM fails or is misconfigured. This also simplifies auditing and RBAC by centralizing admin access without exposing production traffic.

Answer

There is no limit to the number of VDOMs supported

Answer

All VDOMs must share the same routing table

Answer

VDOMs cannot operate in transparent mode