NSE7 Enterprise Firewall and VDOMs Practice Question
A FortiGate administrator wants to use FortiManager automation stitches to automatically block IP addresses that trigger multiple intrusion prevention events. Which two components are required to configure an automation stitch? (Choose two.)
⚠ Common exam trap
Watch out — candidates often confuse 'Playbook' (an optional grouping of actions) with a required component, or mistakenly think 'Destination' or 'Schedule' are needed for event-driven automation, when in fact only Trigger and Action are mandatory.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Trigger
An automation stitch in FortiManager requires a Trigger to define the event that initiates the stitch (e.g., an intrusion prevention event) and an Action to specify the response (e.g., blocking an IP address via a firewall address object). The Trigger monitors for specific log messages or system events, while the Action executes the configured remediation step. Without both, the stitch cannot be created or function.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Trigger
Why this is correct
A trigger defines the event that initiates the automation stitch, such as an IPS log or event handler. Without a trigger, FortiManager has no condition to evaluate, so it is a required component for automatically blocking offending IP addresses.
- ✗
Playbook
Why it's wrong here
FortiManager playbooks are a distinct orchestration feature for multi-step workflows across devices; automation stitches instead require a trigger and a response action, so a playbook is not a stitch component. It is tempting because both automate FortiGate responses, but playbooks orchestrate sequences, whereas a stitch is a single trigger-action pair.
- ✗
Destination
Why it's wrong here
A stitch's action specifies what runs — CLI script, webhook, email or quarantine — and its target is the device or group executing it; a bare destination is not a stitch component. It is tempting because forwarding events to an external system needs an address, but that address is configured inside the action, not as a separate stitch element.
- ✗
Schedule
Why it's wrong here
An automation stitch pairs a trigger with an action; a schedule is a separate FortiGate object used for recurring tasks such as script execution or reports, and cannot initiate a stitch. It is tempting because scheduled automation exists elsewhere in FortiOS, but stitch triggering here comes from the IPS event itself, not a timer.
- ✓
Action
Why this is correct
An automation stitch pairs a trigger with an action; the action defines what FortiManager does once the intrusion prevention trigger fires, such as pushing a block-IP command to the managed FortiGate. Without a configured action, the stitch cannot enforce the automatic blocking the administrator requires.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 718 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.