Fortinet NSE 7 Advanced Security NSE7 (NSE7) — Questions 751–825

FortiAnalyzer is the centralized logging and reporting appliance within the Fortinet Security Fabric. It collects logs from FortiGate and other Fabric components, correlates events, generates compliance reports, and creates incidents for security analysis. This aligns directly with option A, as its primary function is log aggregation and report generation, not real-time management or VPN termination.

Options C and D are correct. FortiGuard Outbreak Prevention and third-party threat feeds provide external threat intelligence about indicators of compromise.

Lowest-cost algorithm selects the member with the lowest cost, where cost is based on the performance SLA metric. Port1 has lower latency (45 ms < 55 ms) and is within threshold, so it has lower cost.

Option B is correct because OSPF does not redistribute static routes by default. The 'redistribute static' command must be configured under the OSPF process, and optionally route maps can filter, but redistribution must be enabled.

The warning 'Policy ID 10 will be deleted on device XYZ' indicates that the policy package on FortiManager does not contain Policy ID 10, but the device currently has it. During an install, FortiManager synchronizes the device's policy set with the policy package, so any policy present on the device but absent from the package is flagged for deletion. This is a standard consistency check to prevent unintended policy loss.

In inter-VDOM routing, traffic traverses a VDOM link, which consists of two interfaces—one in each VDOM. A policy in VDOM-A permits traffic to the VDOM link interface, but the packet must also be allowed by a policy in VDOM-B from the VDOM link interface to the destination. Without this second policy, VDOM-B will drop the traffic, even if VDOM-A's policy is correct.

Option D is correct because 'diagnose sys bfd session list' is the FortiGate CLI command used to display the current state of Bidirectional Forwarding Detection (BFD) sessions, including session state, local/remote discriminators, and timers. This command is part of the 'diagnose' utility, which provides detailed operational and diagnostic information for troubleshooting BFD in SD-WAN or routing contexts.

Option A is correct. IPS engine restarts often indicate memory exhaustion or a crash. High memory usage can force the engine to restart to reclaim resources.

Options A, B, and D are correct. Source IP identifies the device, username identifies the authenticated user, and timestamp correlates events. Destination IP (C) is known, and event type (E) might not show user association.

Option D is correct because a Traffic VDOM is a lightweight VDOM type designed specifically to handle user traffic, such as guest network traffic, without the overhead of management-plane functions. It allows the administrator to separate guest traffic into its own firewall policy domain while keeping management traffic (e.g., SSH, HTTPS, SNMP) in the main Root VDOM, ensuring that guest users cannot access the management interface or configuration.

If IKE is up but IPsec is down, the Phase2 parameters are not matching between peers. Common causes include mismatched encryption algorithms, proxy IDs, or lifetimes.

Option A is correct because per-VDOM traffic shaping policies allow the administrator to apply bandwidth limits and QoS policies specifically to traffic within a particular VDOM, preventing that VDOM from monopolizing the FortiGate's CPU resources. This is achieved by configuring shaping policies under the VDOM's firewall policy that match traffic and apply a traffic shaper, which can limit bandwidth and prioritize traffic, thereby reducing CPU load from that VDOM.

To distribute HTTP sessions evenly, the load balancing algorithm should be 'session', and the SD-WAN rule must match HTTP traffic using appropriate criteria (e.g., destination port 80).

Option A is correct because route leaking between VRFs on a FortiGate is achieved by configuring route maps with the `set vrf` command under the source VRF's routing process. This allows specific routes from VRF1 to be imported into VRF2, enabling controlled inter-VRF communication without requiring a VDOM or static route workaround.

The httpsd process handles HTTPS administrative access. High CPU could be due to brute-force attacks or excessive GUI logins. The best action is to change the administrative access port or limit access via trusted hosts.

Hardware acceleration (CP8/CP9) requires specific conditions: supported encryption algorithms, no advanced features that disable offload, and the traffic must match a VPN policy that uses the hardware acceleration capable interface.

To use jitter as the selection metric, the performance SLA must include jitter measurement, and the SD-WAN rule strategy should be 'best quality' with jitter as the highest priority metric.

Inter-VDOM routing allows traffic to be forwarded between different VDOMs on the same FortiGate unit. This is achieved by configuring inter-VDOM links (IVL) or using VDOM peering, and then applying firewall policies to control and secure the traffic flow between VDOMs. Option C correctly identifies that firewall policies are the mechanism used to permit or deny inter-VDOM traffic.

Active state means BGP is trying to initiate a TCP connection but hasn't succeeded. Common causes include incorrect neighbor IP, ASN mismatch, or TCP port blocking.

SD-WAN rules are used to match traffic based on criteria and direct it to specific members. The rule would match source 192.168.10.0/24 and set the destination interface to wan1.

Option B is correct because an automation stitch in FortiManager requires a trigger to define the event that initiates the stitch, such as a high CPU usage event. The trigger specifies the event type (e.g., 'CPU Usage High') that the FortiGate reports, which then activates the stitch. Without a trigger, the automation stitch has no starting point to respond to the condition.

Option A is correct. 'diagnose sys session filter' followed by 'diagnose sys session list' shows session details including offload status (NPU flag).

VRF (Virtual Routing and Forwarding) partitions the routing table into multiple instances, each with its own routing table and forwarding decisions.

Option C is correct because VDOM support on FortiGate is a licensed feature. Without a valid FortiGate license (e.g., an Advanced or Enterprise license bundle), the VDOM functionality is disabled, and the device operates in a single-VDOM (split-task) mode. This licensing requirement ensures that only authorized models and configurations can utilize VDOM isolation.

To achieve this, the administrator must create SD-WAN rules that match traffic types and assign appropriate strategies (best quality for VoIP, lowest cost for bulk).

BGP routes are not advertised unless they pass outbound filtering (prefix lists, route maps) or are not the best path. Additionally, if synchronization is enabled, routes must be in the IGP routing table. The most common cause is a missing or restrictive outbound route map.

Proxy-based ZTNA (Option D) is correct because it uses a forward proxy architecture that intercepts traffic at Layer 7, allowing the FortiGate to enforce ZTNA access policies without modifying existing firewall rules. The proxy terminates the client connection and initiates a new connection to the internal server, so no inbound port forwarding or firewall rule changes are needed for the internal servers.

The ZTNA proxy component acts as an intermediary, hiding the application server's IP address and providing secure access based on identity and posture.

Session-pickup is the correct setting because it enables the secondary FortiGate to synchronize UDP session state information from the primary, allowing seamless failover of voice traffic without requiring new session establishment. UDP is connectionless, so without session-pickup, the secondary would drop the traffic as unknown, causing noticeable interruption in real-time voice streams.

SD-WAN rules allow matching traffic based on criteria such as source/destination IP, and then forward it to a specific SD-WAN member or strategy.

Add server, configure details, create group, assign to admin, then test.

Multi-peer VPN requires each remote site to have its own phase1 and phase2 configuration. The hub must have separate phase1 interfaces or separate phase1 configs for each peer. Option D is correct: configure separate phase1 for each remote site.

FortiSandbox submission is controlled by file size limits. If the PDF exceeds the maximum file size configured for submission, it will not be sent. The default limit is often around 10 MB, but can be configured.

Firmware upgrades can reset or change default settings. Option B is correct because the SIP ALG might have been disabled or its settings changed, breaking SIP session helpers. Checking the ALG configuration is the first step.

Option C is correct because FortiGate SD-WAN health-check allows configuring multiple thresholds for jitter, latency, and packet loss. These thresholds are used to determine the quality of a link; if any threshold is exceeded, the link is considered failed. This enables granular control over link health assessment beyond simple reachability.

Option B is correct. In FortiGate session table, proto_state values: 01 means the session is in the 'init' state (SYN sent, SYN-ACK not yet received). For TCP, this indicates the connection is being established.

In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding frames based on MAC addresses without modifying them. It does not require IP addresses on its interfaces for traffic forwarding, though management IP addresses can be assigned. This allows the FortiGate to be inserted into an existing network segment without reconfiguring IP subnets.

To load balance based on bandwidth, the 'Maximize Bandwidth' strategy with volume algorithm should be used. To allow manual steering, the SD-WAN rule for critical traffic should be set to 'Manual' strategy with MPLS selected as the preferred member. Options B and D together satisfy both requirements.

Option B is correct because the FortiGate's antivirus profile is configured to scan SMTP traffic, but the email was encrypted via STARTTLS, and SMTP is not included in the SSL inspection profile. By adding SMTP to the SSL inspection profile, the FortiGate can decrypt the SMTP traffic, allowing the antivirus engine to inspect the email content for malware, including ransomware delivered via spear-phishing.

The IKE SA was recently created, suggesting a previous SA was deleted and a new one established. This often happens after configuration changes or a restart of IKE negotiation.

Content Disarm and Reconstruction (CDR) is the correct answer because it actively removes potentially malicious content—such as macros, scripts, or embedded objects—from files (e.g., Office documents, PDFs) and then reconstructs a clean, usable version. Unlike detection-based approaches, CDR eliminates threats by sanitizing the file structure itself, ensuring the file remains functional for the end user while blocking exploits.

In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses without modifying the IP subnet scheme. This allows the firewall to be inserted into an existing network segment without requiring IP reconfiguration of connected devices.

Options A, C, and D are correct. An automation stitch requires a trigger (event), a condition (optional but often used), and an action (response).

For compliance enforcement, the compliance rule must be applied to a configuration profile that is assigned to the users. Option B is correct because without assigning the compliance rule via a profile, the rule is not enforced on endpoints.

Options A, B, and E are correct. SPF, DKIM, and DMARC are email authentication standards that help verify sender identity and prevent spoofing/phishing.

A performance SLA monitors the MPLS link quality, and an SD-WAN rule is configured to match voice traffic with a strategy that prefers MPLS but falls back to Broadband if SLA fails. Without the SLA, the rule cannot detect failure.

To be an ABR, the FortiGate must have interfaces in area 0 (backbone) and at least one other area. If no interface is in area 0, it cannot be an ABR.

Option A is correct. 'get router info bgp neighbor <ip> advertised-routes' shows all routes that the FortiGate is advertising to that specific BGP neighbor. This is the standard command for verifying outbound route advertisement.

DPD timeout indicates that the remote peer is not responding to Dead Peer Detection probes. The most common cause is a misconfigured firewall on the path dropping UDP 500 or 4500 packets, or NAT keepalive issues if NAT is involved. Option C is correct because DPD relies on bidirectional IKE traffic; if the remote FortiGate is behind a NAT device without proper NAT-T configuration, the DPD packets may be dropped.

The 'sessions' algorithm balances by session count. Other algorithms use volume, spillover, source-dest IP hash, or lowest cost.

To filter traffic from a source IP and destination port, the administrator should use the source IP field and the destination port field. The service field may also show port but is less precise.

FortiGate ATP's antivirus engine cannot inspect encrypted HTTPS traffic unless SSL inspection is explicitly enabled on the antivirus profile. Without SSL inspection, the antivirus profile only sees encrypted payloads and cannot match file signatures or heuristics, allowing ransomware to pass undetected. The logs confirm files were downloaded over HTTPS, making this the most likely root cause.

FortiClient EMS sends posture data to FortiGate via telemetry. The admin must define ZTNA tags for conditions (e.g., antivirus running) and use those tags in firewall policies or SSL VPN permissions. There is no direct 'compliance check' setting in SSL VPN; it's done via ZTNA.

Option B is correct. The checksum mismatch indicates configuration drift. The first step should be to synchronize the configuration from the primary unit to the secondary using 'execute ha synchronize start'.

In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses rather than IP addresses. This means the FortiGate interfaces do not require IP addresses for traffic forwarding; a management IP is configured on a VLAN interface or the root VDOM for administrative access only. Option B correctly identifies that transparent mode functions at Layer 2, so no IP configuration is needed on the physical interfaces for data plane operation.

Option A is correct because inline scanning requires the FortiSandbox to be configured as the inline scanner in the antivirus profile. If only a scheduled scan or a separate FortiSandbox is used for analysis, the inline blocking will not occur.

Option B is correct because DMARC uses SPF and DKIM alignment to determine authenticity. When both SPF and DKIM pass and are aligned (i.e., the domain in the From header matches the domain used in SPF/DKIM), DMARC considers the email authentic and applies the policy accordingly. In this case, the DMARC policy was set to 'quarantine', but because alignment checks passed, DMARC treated the email as legitimate and allowed delivery to the inbox, rather than quarantining it.

FortiDeceptor is a deception-based threat detection solution that deploys decoys (fake assets) across the network to lure attackers. When an attacker interacts with a decoy, FortiDeceptor generates a high-fidelity alert, enabling early detection of lateral movement or reconnaissance without relying on signatures.

As a SAML IdP, FortiGate requires a digital certificate to sign SAML assertions. The service provider's public certificate is needed to encrypt assertions if required, but the IdP's own certificate is mandatory. Option B is correct.

SPF (Sender Policy Framework) is correct because it allows the domain owner to publish a list of authorized sending IP addresses in a DNS TXT record, enabling receiving mail servers to verify that the email originated from an approved source. DKIM (DomainKeys Identified Mail) is correct because it adds a digital signature to email headers, which the receiving server validates against a public key published in DNS, ensuring the message was not tampered with and truly came from the claimed domain. Together, SPF and DKIM form the foundational layers of email authentication that DMARC builds upon.

Designating VDOM-A as the management VDOM is the first required step because it establishes VDOM-A as the administrative container that can access other VDOMs. In FortiOS, a management VDOM is a special VDOM that has visibility and control over other VDOMs for management purposes. Without this designation, VDOM-A would not have the inherent privilege to initiate administrative sessions into VDOM-B.

The FortiGate acts as the controller for managed FortiSwitches. Key steps include enabling CAPWAP, creating a port profile, and authorizing the switch.

For OSPF to advertise routes, the interfaces must be in the correct area and not passive. Option D is correct because if the interface is set as passive, OSPF will not send or receive updates on that interface, preventing route advertisement.

Option B is correct because ADOMs (Administrative Domains) in FortiAnalyzer provide administrative isolation, allowing each department to have its own segregated management domain. This ensures that administrators assigned to a specific ADOM can only view and generate reports from logs belonging to that ADOM, enforcing strict data separation.

To use ZTNA tags, the administrator must configure a ZTNA access proxy to publish the application and a ZTNA policy that references the tag to grant access.

For certificate-based authentication, the FortiGate must be configured to verify the peer's certificate against the trusted CA. Option D is correct because the peer's certificate must be validated, and if the CA certificate is not properly referenced in the phase1 configuration (e.g., 'set certificate-peers' or 'set enforcesecrets'), validation fails.

SAML SSO requires the FortiGate to have a certificate that the IdP trusts for signing assertions. Option D is correct because the FortiGate needs to import a CA-signed certificate (or use a self-signed) to sign SAML requests and also to establish the trust relationship with the IdP.

In transparent mode, the FortiGate acts as a Layer 2 bridge and does not require a routing table for user traffic; forwarding decisions are based on firewall policies. Since the management IP is on the same subnet as users, the upstream router can ARP for it, but user traffic must be explicitly allowed by a firewall policy from the internal to external zone. Without such a policy, packets are dropped even if Layer 2 connectivity exists.

Source IP hash ensures that all traffic from a specific source IP goes to the same next-hop, providing session persistence without using source-destination IP pair.

Option B is correct because a FortiSwitch must be physically connected to a FortiGate port that has been configured as a managed switch port (via config system interface and set type switch). This dedicated port enables the FortiGate to discover and manage the FortiSwitch using the FortiLink protocol, which encapsulates control and data traffic over a single link. Without this physical connection to a managed switch port, the FortiGate cannot establish the FortiLink adjacency required for LAN edge management.

Protocol Anomaly Detection in the IPS sensor is designed to identify deviations from standard protocol behavior, such as malformed headers or null bytes in HTTP requests. This feature inspects traffic for known protocol violations without requiring custom signatures, making it the correct choice for blocking a null byte anomaly in HTTP headers.