Fortinet NSE 7 Advanced Security NSE7 (NSE7) — Questions 1–75

Option D is correct. Inline scanning requires the file to be forwarded to FortiSandbox; if the file type is not included in the scanning profile (e.g., by file extension, MIME type, or size), it will bypass scanning.

Option B is correct because FortiSandbox only supports analysis for specific file types (e.g., PE, PDF, Office documents). If the file type is not in the supported list, the FortiGate will not submit it, even if all other conditions are met. This is a fundamental filtering step in the FortiGate-FortiSandbox integration.

An automation stitch in FortiManager requires three core components: a Trigger (the event that starts the stitch), a Route (a conditional path that determines which actions to execute based on the trigger's output), and an Action (the actual response, such as a CLI script or object change). Without these three, the stitch cannot function as a complete automation workflow.

Option C is correct because the 'Submit Files to FortiSandbox' setting in the antivirus profile, when set to 'Block', directly instructs FortiGate to quarantine files that receive a 'High Risk' verdict from FortiSandbox. This action is part of the antivirus profile's sandbox integration, not a separate automation or IPS feature, and it automatically handles the quarantine without requiring additional configuration.

BFD provides fast failure detection for routing protocols like OSPF and BGP, enabling sub-second convergence by detecting link failures faster than protocol hello timers.

Performance SLA probes may fail due to firewall rules blocking ICMP or the probe port, or the server not responding to the probe type.

FortiDeceptor is a deception technology that uses decoys to detect attackers moving laterally within the network.

A TCP echo probe expects a TCP connection to the specified port, but the server must be configured to respond to TCP echo requests (RFC 862), which typically uses port 7. Using port 443 (HTTPS) would not result in a TCP echo response; the server would not send back the same data. The probe would fail, causing the SLA to show as dead.

FortiAnalyzer is the correct tool because it aggregates logs and traffic data from multiple FortiGate devices within a Security Fabric, providing a unified view of all traffic, including inter-device flows. It uses the FortiTelemetry protocol to collect logs and supports the Security Fabric's topology mapping, allowing administrators to monitor cross-device traffic from a single pane of glass.

Multi-peer VPN requires configuring 'peer-options' with multiple peer IPs and priorities, and enabling 'failover' on the phase1 interface to allow automatic switching to the backup peer if the primary goes down.

In an HA active-passive setup with multiple VDOMs, a management VDOM is dedicated to administrative access (e.g., SSH, HTTPS, SNMP) and is logically separated from data VDOMs that handle production traffic. This separation ensures that management traffic does not interfere with data plane operations and that administrative access remains available even if data VDOMs experience issues. The management VDOM can be any VDOM, not necessarily the root, and its configuration is not automatically synchronized to other VDOMs.

Options A and D are correct. 'diagnose vpn ike config' shows the IKE configuration including phase 2 proposals and selectors. 'diagnose debug application ike 255' enables detailed IKE debug, which will show the negotiation details including phase 2 failure reasons.

Option B is correct. 'connected=no' indicates that the FortiGate is not successfully establishing a connection to the FortiAnalyzer. This is commonly due to network connectivity issues between the two devices or incorrect IP/port configuration.

FortiGate is the enforcement point in a ZTNA solution, acting as the ZTNA gateway that verifies device posture and user identity before granting access to protected applications. It terminates ZTNA tunnels from FortiClient and applies identity-based policies, making it a required component for traffic inspection and access control.

Asymmetric routing occurs when traffic from the same source IP takes different paths through the network, causing packets to arrive on different FortiGate interfaces for different sessions. This breaks stateful inspection because the firewall expects all packets of a session to traverse the same interface; when they don't, it can lead to session timeouts or dropped packets, manifesting as high latency.

DNS Filter with botnet C2 domain blocking is the most effective because it proactively prevents the initial DNS resolution of the botnet's command-and-control domain, stopping the TLS handshake before it even begins. Since the traffic is encrypted with TLS, other security mechanisms like application control or IPS would require decryption to inspect the payload, which may not be feasible or configured. DNS Filter operates at Layer 7 without needing to decrypt the traffic, directly blocking the domain lookup based on FortiGuard's real-time threat intelligence.

Option A is correct. Loss of heartbeat communication is the typical cause of split-brain.

Option C is correct because to restrict a VDOM administrator to manage only their own VDOM, you must create a new administrator account and explicitly set the 'VDOM' field to that VDOM (e.g., 'CustomerA') and assign a profile with the necessary permissions. This ensures the admin's scope is limited to that VDOM, preventing access to the management VDOM or other VDOMs.

Rate limiting sessions and increasing session TTL can reduce CPU load by controlling session creation and expiration. Option A and D are correct.

FortiView on FortiAnalyzer provides real-time traffic monitoring and visualization by aggregating logs from FortiGate devices and displaying them in graphical dashboards. It allows administrators to instantly view top talkers, applications, threats, and other network activity without needing to run manual queries, making it the primary function for live traffic analysis.

A trigger is essential because it defines the event or condition that initiates the playbook execution. Without a trigger, the playbook has no starting point and cannot automate responses to detected incidents. In FortiAnalyzer, triggers can be based on log events, alerts, or scheduled intervals.

NAC policies define rules for device classification and VLAN assignment based on posture assessment results.

If the SD-WAN rule has an 'input-device' match that excludes MPLS, or if the rule's 'set member' does not include MPLS, traffic will not use it even if the SLA is good. Another possibility is that the performance SLA is not associated with the rule, so the rule treats MPLS as unavailable. Options A and B are the most likely.

SD-WAN SLA health checks measure performance to a specific server (e.g., a public DNS or internet IP). If the actual application traffic goes to a different server, the measured SLA may not reflect the real path performance to that destination. The route selection logic uses SLA results only for the configured health-check server.

FortiClient Exploit Prevention is correct because it uses real-time behavioral monitoring of process activities—such as API calls, memory access patterns, and code injection attempts—to detect and block zero-day malware that has no known signature. Unlike signature-based detection, this feature identifies malicious behavior at runtime, making it effective against previously unseen threats.

Meta fields in FortiManager are defined at the ADOM level under Device Manager -> ADOM settings. This ensures that the custom fields are available for all devices within that specific ADOM, allowing consistent metadata assignment across managed FortiGates. Defining them elsewhere, such as in global database objects, would apply them globally rather than per-ADOM, which is not the administrator's intent.

Option D is correct because Automation Stitch in FortiOS allows you to create a trigger-action pair that automatically blocks an IP address when FortiSandbox detects malicious activity. The trigger can be a FortiSandbox IOC (Indicator of Compromise) event, and the action can be an IP block via a local or external block list, enabling real-time, automated threat response without manual intervention.

Option B is correct because inter-VDOM routing via a VDOM link requires each VDOM to have a static route pointing to the VDOM link interface as the next hop. Without these routes, traffic from VDOM-A destined for a server in VDOM-B would have no path to the VDOM link, and the FortiGate would drop the packets. The static route ensures the firewall can forward traffic between the two VDOMs across the VDOM link.

When the HA heartbeat link is down, the secondary unit cannot detect the primary and will operate as standalone. The serial number mismatch or priority settings would cause different behavior (e.g., split-brain or both primary).

ZTNA proxy is the FortiGate feature that acts as a reverse proxy, terminating the client connection and initiating a new connection to the internal application. It enforces access policies based on identity and device posture.

For routes to be advertised, they must be present in the BGP table, which requires either redistribution from another protocol or manual network statements. The most common causes are missing 'network' statements or redistribution configuration.

BGP state Active indicates the router is trying to initiate a TCP connection but has not received a response. Since ping works, the issue is likely a TCP port 179 issue, such as a firewall blocking the port or BGP misconfiguration (e.g., wrong remote AS).

A VDOM does not default to transparent mode; it must be explicitly configured. The command 'config system settings' with 'set vdom-type transparent' changes the VDOM's operational mode from the default NAT/route mode to transparent mode, which is required for the VDOM to function as a Layer 2 bridge.

Option D is correct because FortiGate allows you to create a local user with an admin profile that has permissions scoped to a specific VDOM. By assigning the junior administrator to that VDOM-only profile, they can modify firewall policies and objects within that VDOM but cannot change system settings or access other VDOMs. This is the standard method for delegating VDOM-specific administrative access without granting global or multi-VDOM privileges.

The debug flow output shows the packet matches the correct security policy but is still denied by 'forward policy check'. This indicates that a secondary policy component, such as a traffic shaping policy or application control profile, is blocking the traffic. These features can override the security policy action if they are configured to deny or drop matching traffic, even when the security policy itself is set to allow.

In an HA active-passive cluster, VDOM configurations must be identical on both units for synchronization to be complete. A missing VDOM link on the passive unit means the inter-VDOM routing path is not fully replicated, so even though HA status shows 'synchronized' (which may only reflect global or non-VDOM-specific settings), traffic for that VDOM cannot be forwarded correctly by the active unit because the passive unit's configuration is incomplete, breaking the expected redundancy and traffic flow.

FortiAnalyzer is the centralized logging and analytics platform within the Fortinet Security Fabric. It aggregates logs from FortiGate and other Fabric devices, correlates events, generates compliance reports, and provides a single-pane-of-glass view for security monitoring and forensic analysis. This directly supports visibility and reporting, not real-time threat prevention or configuration management.

Route redistribution is used to inject routes from one OSPF area into another or from other protocols. Without redistribution, routes stay within their own area.

The command 'diagnose sys top' displays real-time CPU and memory usage for FortiGate processes, similar to 'top' on Linux. It's the standard CLI tool for performance monitoring.

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is the correct answer because it specifically uses aggregate and forensic reports (DMARC reports) to provide administrators with visibility into how their email domain is being used, including unauthorized or spoofed emails. These reports are generated by receiving mail servers and sent back to the domain owner, detailing authentication results from SPF and DKIM checks, which helps identify and mitigate domain abuse.

DPD on-idle sends probes only when there is no traffic. With DPD on-idle, failure detection can be slow. Changing to DPD on-demand (active probing) or reducing retry intervals speeds up failure detection.

Meta fields in FortiManager allow administrators to define custom attributes (e.g., Department) for firewall objects. These fields can then be used to group and filter objects within policy packages, enabling efficient management by department without requiring separate ADOMs or VDOMs.

If FortiSandbox is not reachable or the file is too large, verdicts may not be returned. Other options like expiry or incorrect scan mode do not prevent verdict return.

The 'diag sniffer packet any "host 10.0.1.0/24" 4' command captures packets at the kernel level before firewall processing, allowing you to see if traffic is reaching the FortiGate and where it is being dropped (e.g., due to reverse-path forwarding, session helper, or DoS policies). This is the most efficient first step because it provides immediate, low-level visibility into packet drops without requiring configuration changes or waiting for logs.

A split-brain occurs when heartbeat communication is lost. If the heartbeat interfaces show link down, it indicates a physical or layer-1 issue, such as a faulty cable or switch port.

FortiGate uses ZTNA device posture checks via FortiClient EMS to enforce endpoint compliance, such as antivirus status.

'get router info bgp table' displays the BGP routing table, showing learned and advertised routes.

External Threat Intelligence Feeds in FortiGate are configured under Security Fabric > External Threat Intelligence, and they can be used in policies as source/destination.

Option D is correct because administrative profiles with restricted VDOM access allow a FortiGate administrator to assign specific VDOMs to different admin accounts. By creating separate VDOMs for each department and granting admin accounts access only to their respective VDOMs, each team can fully manage firewall policies within their VDOM without seeing or modifying policies in other VDOMs. This leverages FortiGate's VDOM-based multi-tenancy and role-based access control (RBAC) to enforce strict policy isolation.

Install Preview is the correct answer because it allows an administrator to review the exact CLI commands that FortiManager will push to a managed FortiGate during the next installation. This feature provides a pre-installation view of the configuration changes, enabling verification before committing changes to the device.

When an IPsec VPN tunnel is established but traffic does not pass, the most common cause is missing or misconfigured firewall policies. Even with correct Phase 1 and Phase 2 settings, the FortiGate will not forward traffic between the tunnel interface and the destination network unless an explicit firewall policy permits it. This is because FortiGate uses a stateful inspection model where all traffic must be allowed by a policy, regardless of the VPN being up.

Route-map statements require 'match' conditions; if no match is specified, the route map may not match any routes. Also, the route map must have a sequence number with 'match ip address' or similar.

Global ADOM policies are pushed to all devices in all ADOMs unless a per-ADOM policy overrides them. The global policy is installed before per-ADOM policies.

Option C is correct because a policy that is disabled in FortiManager will be installed to the managed FortiGate in a disabled state, meaning it will not process any traffic. The administrator must verify that the policy is enabled in FortiManager before or after installation, as a disabled policy is effectively inactive regardless of installation success.

These profiles are applied in firewall policies.

Option A is correct. 'diagnose sys virtual-wan-link health-check' displays current health check status.

Option D is correct because the FortiGate custom IPS signature syntax requires the `--protocol http` flag to specify the application-layer protocol for HTTP inspection, and `--header Host` to target the HTTP Host header field. The `--content` parameter then defines the string 'EXPLOIT' to match within that header, enabling precise detection of the exploit.

The FortiGate ML engine relies on FortiGuard for model updates that enable it to detect new and unknown malware. If the FortiGuard antivirus subscription is expired, the ML engine cannot receive these updates, rendering it unable to identify novel threats. This is the most likely reason the ML engine is not detecting any threats despite the presence of new unknown malware.

Option A is correct because DKIM verification must be explicitly enabled in the anti-spam policy to allow FortiMail to validate the DKIM signature on incoming emails. Without this setting, DKIM authentication is not performed, and the email's DKIM status will not be evaluated.

ZTNA uses tags to determine which users or devices can access which applications. If the necessary tags are missing, access is denied even if the client is connected.

Option A is correct because an automation stitch in FortiManager requires a trigger to define the event that initiates the stitch. Without a trigger, the stitch has no starting condition and cannot execute. The trigger specifies the log event that, when matched, causes the stitch to run.