Courseiva

Fortinet NSE 7 Advanced Security NSE7 (NSE7) — Questions 901–940

940 questions total · 13pages · All types, answers revealed

Take a mock examExam hub
Page 12

Page 13 of 13

901
Multi-Selectmedium

A network engineer wants to deploy a FortiGate in transparent mode and have it managed by FortiManager. The FortiGate should not participate in routing, but must be able to send logs to FortiAnalyzer. Which two settings must be configured on the FortiGate to achieve this?

Select 2 answers
A.Enable DHCP client on the management interface
B.Configure a management IP address on the FortiGate
C.Enable NAT on the management interface
D.Add a static route to reach FortiManager and FortiAnalyzer
E.Set the interface IP address in the same subnet as the upstream router
AnswersB, D

In transparent mode, the management IP is used for management and logging.

Why this answer

In transparent mode, the FortiGate operates as a Layer 2 bridge and does not participate in routing. However, to be managed by FortiManager and send logs to FortiAnalyzer, the FortiGate must have a management IP address (option B) so that it can be reached as a management endpoint. Additionally, a static route (option D) is required to direct traffic to the management and logging servers, since the FortiGate cannot rely on dynamic routing protocols in transparent mode.

Exam trap

The trap here is that candidates assume transparent mode requires no IP configuration at all, but FortiManager and FortiAnalyzer communication still needs a management IP and a static route to function correctly.

Full explanation →
902
MCQhard

A large enterprise operates two FortiGate 600E firewalls in an HA active-passive cluster. They have enabled VDOMs to isolate traffic for different business units: Finance, HR, and Engineering. Each VDOM has its own internet connection through separate ISPs. The cluster has been running smoothly for months. Recently, the IT team noticed that users in the Finance VDOM experience intermittent connectivity drops to their cloud-based ERP system. The drops last 30-60 seconds and occur several times a day. During these drops, ping to the ERP IP address fails. The HA cluster status shows 'synchronized' and no failover events are logged. The Finance VDOM uses a static default route pointing to the primary ISP gateway. The other VDOMs are unaffected. What is the most likely cause of the issue?

A.The HA cluster is in active-active mode, causing routing loops for the Finance VDOM.
B.The heartbeat interface is oversubscribed, causing intermittent HA synchronization failures.
C.The 'set ha-mgmt-status enable' command is configured on the passive unit, preventing route synchronization.
D.The VDOM link configuration is not synchronized between the two units, causing asymmetric routing for the Finance VDOM.
AnswerD

VDOM links must be identical on both HA units; a mismatch can cause intermittent traffic drops.

Why this answer

VDOM link configurations are stored per-VDOM and must be synchronized independently. If the VDOM link configuration is not synchronized between the HA units, the passive unit may have a different or missing VDOM link, causing asymmetric routing when traffic is processed by the passive unit during a transient state (e.g., session ownership change or link flap). This leads to intermittent connectivity drops for the Finance VDOM only, as its traffic is isolated and uses a static default route.

Exam trap

The trap here is that candidates often assume HA synchronization covers all configurations uniformly, but VDOM-specific objects like VDOM links require explicit synchronization and can cause asymmetric routing issues when mismatched between HA peers.

How to eliminate wrong answers

Option A is wrong because the cluster is explicitly described as active-passive, not active-active, so routing loops due to active-active mode are impossible. Option B is wrong because heartbeat interface oversubscription would cause HA synchronization failures or split-brain scenarios, but the cluster status shows 'synchronized' and no failover events are logged, ruling out heartbeat issues. Option C is wrong because 'set ha-mgmt-status enable' only allows management access to the passive unit via dedicated management interfaces; it does not affect route synchronization or cause connectivity drops for a specific VDOM.

Full explanation →
903
MCQmedium

A FortiGate administrator wants to use SAML SSO to authenticate VPN users. The FortiGate will act as the service provider (SP) and an external identity provider (IdP) will be used. Which of the following must be configured on the FortiGate to enable SAML authentication for SSL VPN?

A.A RADIUS server pointing to the IdP and an authentication rule.
B.An LDAP server with the IdP's certificate and a matching policy.
C.A user group with SAML authentication method and an SSL VPN portal referencing that group.
D.A local user with SAML attributes and a firewall policy referencing that user.
AnswerC

Why this answer

For SAML SSO on SSL VPN, you must configure a user group with SAML authentication, then assign an SSL VPN portal that uses that group. The FortiGate acts as SP. RADIUS/LDAP are not required.

Full explanation →
904
MCQeasy

Which Fortinet product provides endpoint detection and response (EDR) capabilities, including automated threat containment?

A.FortiClient
B.FortiEDR
C.FortiSandbox
D.FortiGuard
AnswerB

FortiEDR provides EDR functionality.

Why this answer

FortiEDR is the correct answer because it is Fortinet's dedicated endpoint detection and response solution that provides real-time behavioral analysis, automated threat containment, and forensic investigation capabilities. Unlike traditional antivirus, FortiEDR uses machine learning and pre-execution analysis to detect and block advanced threats, and it can automatically isolate compromised endpoints from the network to prevent lateral movement.

Exam trap

The trap here is that candidates often confuse FortiClient's basic endpoint protection features (like antivirus and web filtering) with the advanced EDR capabilities that are exclusive to FortiEDR, especially since FortiClient can be managed by FortiEDR but does not itself provide automated threat containment.

How to eliminate wrong answers

Option A (FortiClient) is wrong because FortiClient is a unified endpoint agent that provides VPN, web filtering, and basic antivirus, but it does not include full EDR capabilities such as automated threat containment or deep forensic analysis; it relies on FortiEDR or FortiSandbox for advanced detection. Option C (FortiSandbox) is wrong because FortiSandbox is a network-based sandboxing appliance that detonates suspicious files and URLs in a virtual environment to identify zero-day threats, but it does not run on endpoints or provide endpoint-level automated containment. Option D (FortiGuard) is wrong because FortiGuard is Fortinet's global threat intelligence and security services subscription (including antivirus signatures, web filtering categories, and IP reputation), not a product that performs endpoint detection or response actions.

Full explanation →
905
MCQmedium

A network administrator is configuring inter-VDOM routing between two VDOMs: VDOM-A and VDOM-B. The administrator creates a inter-VDOM link and adds routes pointing to the link. However, traffic from VDOM-A to VDOM-B fails. What is the most likely missing configuration?

A.Both VDOMs must be in transparent mode
B.A firewall policy must be created in each VDOM to permit traffic across the inter-VDOM link
C.The inter-VDOM link must be in the same VDOM
D.The management VDOM must be enabled
AnswerB

Why this answer

In FortiGate, inter-VDOM routing requires firewall policies in each VDOM to explicitly permit traffic across the inter-VDOM link. Without these policies, the FortiGate drops the traffic even if routes are correctly configured, because the inter-VDOM link behaves like a virtual interface that requires policy-based access control.

Exam trap

The trap here is that candidates assume routing alone is sufficient for inter-VDOM communication, overlooking FortiGate's requirement for explicit firewall policies to permit traffic across VDOM boundaries, similar to how policies are needed between physical interfaces.

How to eliminate wrong answers

Option A is wrong because inter-VDOM routing works in both transparent and NAT/route modes; both VDOMs do not need to be in transparent mode. Option C is wrong because the inter-VDOM link is a cross-VDOM connection, not a single-VDOM interface; placing it in the same VDOM would defeat the purpose of inter-VDOM routing. Option D is wrong because the management VDOM is only required for administrative access and has no bearing on inter-VDOM traffic forwarding.

Full explanation →
906
MCQmedium

A company is deploying FortiClient ATP to protect endpoints. They want to block ransomware behavior in real time. Which FortiClient feature should be enabled?

A.Real-Time Protection
B.Vulnerability Scan
C.Web Filtering
D.Application Firewall
AnswerA

This feature monitors processes and file operations for malicious behavior.

Why this answer

Real-Time Protection is the FortiClient feature that uses behavioral analysis and machine learning to detect and block ransomware-like activities, such as mass file encryption or unauthorized file modifications, as they occur. This feature monitors process behavior in real time, leveraging FortiSandbox threat intelligence and local heuristics to stop ransomware before it can cause damage.

Exam trap

The trap here is that candidates often confuse Real-Time Protection with Web Filtering or Application Firewall, assuming that blocking the ransomware download or controlling app traffic is sufficient, but Fortinet specifically tests that behavioral blocking at the endpoint level is required for real-time ransomware defense.

How to eliminate wrong answers

Option B (Vulnerability Scan) is wrong because it only identifies missing patches and security misconfigurations on endpoints, but does not actively monitor or block ransomware behavior in real time. Option C (Web Filtering) is wrong because it controls access to malicious URLs and categories, preventing downloads of ransomware payloads, but it does not detect or stop ransomware behavior once it is executing on the endpoint. Option D (Application Firewall) is wrong because it controls network traffic based on application signatures and policies, but it does not analyze process behavior or file system changes to block ransomware encryption actions.

Full explanation →
907
MCQeasy

A FortiGate administrator is troubleshooting why a new firewall policy is not being applied to traffic. The policy has been created and installed via FortiManager. What is the quickest way to verify the current state of the policy on the FortiGate?

A.Use 'diagnose debug flow'
B.Run 'execute fortimanager reindex'
C.Check FortiManager revision history
D.Run 'show firewall policy'
AnswerD

This shows the current policy configuration on the FortiGate.

Why this answer

Running 'show firewall policy' on the FortiGate CLI displays the currently active policy set in the kernel, including the policy ID and its enabled/disabled status. This is the quickest way to confirm whether the policy installed via FortiManager is actually present and active on the FortiGate, without generating debug logs or querying the management plane.

Exam trap

The trap here is that candidates confuse the management plane (FortiManager revision history) with the data plane (FortiGate kernel policy table), leading them to choose an option that checks the manager instead of the actual device state.

How to eliminate wrong answers

Option A is wrong because 'diagnose debug flow' is a packet-level debugging tool used to trace traffic matching and policy decisions in real time, not a method to verify the static state of a policy. Option B is wrong because 'execute fortimanager reindex' forces FortiManager to rebuild its database indexes, which does not affect or verify the policy state on the FortiGate. Option C is wrong because checking FortiManager revision history shows past configuration changes stored on the manager, not the current runtime state of the policy on the managed FortiGate.

Full explanation →
908
MCQeasy

A FortiGate is configured with SD-WAN using load balancing algorithm 'source-dest-ip'. What is the primary characteristic of this algorithm?

A.Traffic is sent to the member with the highest bandwidth.
B.Traffic is sent to the member with the lowest cost metric.
C.Traffic is distributed evenly across all SD-WAN members regardless of source or destination.
D.All traffic from the same source IP to the same destination IP uses the same SD-WAN member.
AnswerD

Source-dest-ip hashing ensures that traffic belonging to the same source-destination pair is consistently sent over the same link, preserving session affinity.

Why this answer

The 'source-dest-ip' load balancing algorithm in SD-WAN uses a hash of both the source IP and destination IP to deterministically select an SD-WAN member. This ensures that all packets belonging to the same flow (same source-destination pair) are consistently forwarded over the same member, preserving per-flow stickiness and avoiding out-of-order delivery.

Exam trap

The trap here is that candidates often confuse 'source-dest-ip' with 'round-robin' or 'bandwidth-based' algorithms, assuming it distributes traffic evenly, when in fact it prioritizes per-flow stickiness over load distribution.

How to eliminate wrong answers

Option A is wrong because the 'source-dest-ip' algorithm does not consider bandwidth; bandwidth-based load balancing is a separate feature (e.g., 'spillover' or 'max-bandwidth' settings). Option B is wrong because cost metric is used in route selection (e.g., via SD-WAN rules or static routes), not in the load balancing algorithm itself; 'source-dest-ip' hashes IPs, not cost. Option C is wrong because it describes round-robin or session-based load balancing, not 'source-dest-ip'; the latter is not evenly distributed across members but rather per-flow consistent.

Full explanation →
909
MCQmedium

A network administrator is configuring FortiManager to manage multiple FortiGates with different VDOMs. The admin needs to ensure that each FortiGate's VDOMs can be independently managed. What is the correct configuration step?

A.Enable per-VDOM ADOM mode in FortiManager to manage each VDOM as a separate ADOM
B.Use a single ADOM for all FortiGates
C.Configure each FortiGate as a separate device in the Global ADOM
D.Use the same policy package for all VDOMs
AnswerA

Per-VDOM ADOM mode allows each VDOM on a FortiGate to be managed as an independent ADOM, enabling granular control.

Why this answer

FortiManager's per-VDOM ADOM mode allows each VDOM on a FortiGate to be treated as an independent ADOM, enabling separate management of policies, objects, and settings per VDOM. This is essential when different VDOMs serve distinct tenants or departments and must not share configuration contexts.

Exam trap

The trap here is that candidates often confuse per-VDOM ADOM mode with simply adding multiple FortiGates to a single ADOM, failing to realize that independent VDOM management requires a separate ADOM per VDOM, not just per device.

How to eliminate wrong answers

Option B is wrong because using a single ADOM for all FortiGates would merge all VDOMs into one management domain, preventing independent per-VDOM control and violating the requirement. Option C is wrong because configuring each FortiGate as a separate device in the Global ADOM still treats the entire FortiGate as one unit, not allowing per-VDOM separation; the Global ADOM is intended for system-level settings, not VDOM-level management. Option D is wrong because using the same policy package for all VDOMs would force identical firewall policies across VDOMs, contradicting the need for independent management.

Full explanation →
910
MCQhard

A FortiGate is configured as a SAML IdP for a partner's cloud application. After configuring the application as a service provider, users report that they are prompted for credentials every time they access the application, even though they already authenticated to FortiGate. What is the MOST likely cause?

A.The SAML single logout URL is misconfigured
B.The SAML assertion is not signed
C.The IdP session timeout is set to a lower value than the SP session timeout
D.The FortiGate is not configured to generate a Name ID
AnswerC

If the IdP session expires, FortiGate will require re-authentication even if the SP session is still active.

Why this answer

When the IdP session timeout is shorter than the SP session timeout, the SP will consider the user's session expired and force re-authentication even though the FortiGate still has a valid local session. This mismatch causes the SP to initiate a new SAML authentication flow, prompting the user for credentials again. The SAML single logout URL (A) affects logout behavior, not re-authentication triggers, and an unsigned assertion (B) would cause a different error, not repeated credential prompts.

Exam trap

The trap here is that candidates confuse session timeout mismatch with logout URL misconfiguration, assuming that a misconfigured SLO URL causes re-authentication, when in fact SLO only handles logout, not session persistence.

How to eliminate wrong answers

Option A is wrong because the SAML single logout URL is only used during logout operations; a misconfigured SLO URL would cause logout failures or errors, not repeated credential prompts on each access. Option B is wrong because an unsigned SAML assertion would typically result in an SP-side validation failure or error message, not a silent re-prompt for credentials; signing is about integrity, not session persistence. Option D is wrong because the FortiGate automatically generates a Name ID from the user's identity attributes (e.g., username or email) when acting as an IdP; omitting a Name ID would cause a different error (e.g., missing required attribute), not a repeated login prompt.

Full explanation →
911
MCQmedium

In FortiManager, what is the purpose of header and footer policies in a policy package?

A.To create policy groups for better organization
B.To apply policies only during specific times of the day
C.To ensure specific policies are always placed at the top (header) or bottom (footer) of the policy list
D.To separate IPv4 and IPv6 policies
AnswerC

Header/footer policies provide a way to enforce mandatory policies.

Why this answer

Header and footer policies in FortiManager are special policy types that enforce a fixed position within the policy list. Header policies are always placed at the top (before all other policies), and footer policies are always placed at the bottom (after all other policies). This ensures that critical security rules, such as default-deny or global allow rules, remain in their intended position regardless of policy package changes or reordering operations.

Exam trap

The trap here is that candidates confuse header/footer policies with policy ordering or scheduling, assuming they are just a way to organize or time-limit policies, rather than understanding they enforce a fixed position in the policy list.

How to eliminate wrong answers

Option A is wrong because header and footer policies are not used for organizational grouping; policy groups (or policy sections) are created using policy packages or policy folders, not header/footer policies. Option B is wrong because time-based policy enforcement is handled by schedule objects within individual policy rules, not by the header/footer policy mechanism. Option D is wrong because IPv4 and IPv6 policies are separated by policy type (IPv4 vs IPv6) within the policy package, not by header/footer policies.

Full explanation →
912
MCQmedium

An administrator needs to apply different routing policies for traffic based on source IP address, overriding the normal routing table. Which feature should be configured?

A.Prefix list
B.SD-WAN rule
C.Route map
D.Policy-based routing
AnswerD

PBR enables routing based on policies.

Why this answer

Policy-based routing (PBR) is the correct feature because it allows an administrator to override the normal routing table lookup based on criteria such as source IP address. Unlike static or dynamic routing, PBR uses route maps to match traffic (e.g., source IP) and apply a specific next-hop or interface, enabling granular traffic steering independent of the destination-based routing table.

Exam trap

The trap here is that candidates often confuse route maps (a policy tool) with policy-based routing (the feature that uses route maps to override forwarding), leading them to select 'Route map' instead of 'Policy-based routing' as the feature name.

How to eliminate wrong answers

Option A is wrong because a prefix list is used to match IP prefixes in routing protocols (e.g., BGP) or route redistribution, not to override routing decisions based on source IP. Option B is wrong because SD-WAN rules are designed for application-aware traffic steering and link load balancing in an SD-WAN fabric, not for overriding the routing table based solely on source IP in a traditional routing context. Option C is wrong because a route map is a tool used to manipulate routing information (e.g., set attributes, filter routes) during redistribution or policy application, but it does not itself override the routing table; it must be applied with PBR to achieve source-based forwarding.

Full explanation →
913
MCQeasy

A network administrator runs 'diagnose sys top' and sees that the 'ipsengine' process is consistently using 99% CPU. What is the BEST immediate action to reduce CPU load?

A.Reboot the FortiGate
B.Increase the session limit
C.Disable IPS inspection on policies that don't require it
D.Change IPS engine to flow-based mode
AnswerC

Disabling IPS reduces CPU usage by the ipsengine process.

Why this answer

The 'ipsengine' process consuming 99% CPU indicates that IPS inspection is being applied to traffic that may not require it, causing excessive processing overhead. Disabling IPS on policies that do not need it (Option C) directly reduces the workload on the IPS engine without affecting other security functions or requiring a reboot. This is the most immediate and targeted action to alleviate CPU pressure.

Exam trap

The trap here is that candidates often assume a reboot or mode change (flow-based) will immediately solve high CPU, but the NSE7 exam tests the understanding that unnecessary inspection is the primary culprit and that targeted policy adjustment is the best immediate action.

How to eliminate wrong answers

Option A is wrong because rebooting the FortiGate is a disruptive, temporary fix that does not address the root cause; the IPS engine will resume high CPU usage once traffic flows again. Option B is wrong because increasing the session limit does not reduce CPU load from IPS processing; it may actually worsen the problem by allowing more sessions to be inspected. Option D is wrong because changing to flow-based mode alters the inspection method but does not eliminate unnecessary IPS scanning; if IPS is still enabled on policies with high traffic, CPU usage may remain high or even increase due to different processing characteristics.

Full explanation →
914
MCQmedium

An administrator runs the CLI command 'diagnose vpn ike gateway list' and sees that a phase1 gateway is in 'UP' state, but the 'DPD' field shows 'disabled'. The tunnel is working. What is the implication?

A.DPD is only used for phase2, so phase1 is unaffected.
B.DPD is disabled but the tunnel will still detect peer failure via IKE keepalives.
C.The FortiGate is using NAT-T, which disables DPD automatically.
D.The tunnel will never detect if the remote peer goes down.
AnswerD

Why this answer

When DPD is disabled, the FortiGate does not send DPD probes to verify the remote peer's liveliness. Without DPD or any other keepalive mechanism (such as IKE keepalives, which are not used in standard IPsec VPNs), the tunnel will remain in the 'UP' state indefinitely even if the remote peer goes down. This means the tunnel will never detect peer failure, leading to blackholed traffic until the administrator manually intervenes or the tunnel is re-established by other means.

Exam trap

The trap here is that candidates often assume IKE keepalives are enabled by default or that NAT-T automatically handles peer detection, but in FortiGate, DPD is the sole mechanism for detecting peer failure, and disabling it leaves the tunnel blind to remote peer outages.

How to eliminate wrong answers

Option A is wrong because DPD is a phase1 mechanism that monitors the liveliness of the IKE SA (phase1) and can also trigger phase2 rekey; it is not limited to phase2. Option B is wrong because IKE keepalives are not a standard or default feature in FortiGate IPsec VPNs; DPD is the primary mechanism for peer failure detection, and disabling it leaves no automatic detection. Option C is wrong because NAT-T does not disable DPD; in fact, DPD is often used in conjunction with NAT-T to maintain the NAT binding and detect peer failure.

Full explanation →
915
MCQmedium

An administrator has configured FortiGate as a SAML service provider (SP) for VPN authentication. Users are prompted for credentials but authentication fails even though they can authenticate directly at the IdP portal. What is the most likely misconfiguration?

A.The IdP is using HTTP-POST binding while FortiGate expects HTTP-Redirect
B.The IdP certificate is not imported on FortiGate
C.The FortiGate's entity ID or ACS URL registered at the IdP is incorrect
D.SAML authentication is not enabled in the VPN portal
AnswerC

Mismatched endpoints prevent the IdP from sending the SAML assertion to the correct location.

Why this answer

If users can authenticate at the IdP but not via FortiGate SP, the problem is likely that the FortiGate entity ID or ACS URL does not match what is registered at the IdP.

Full explanation →
916
MCQhard

An administrator runs 'diagnose debug application sslvpn -1' and sees repeated 'SSL_ERROR_SSL: error:1417C0C7:SSL routines:tls_process_client_certificate:peer did not return a certificate'. The SSL-VPN is configured to require client certificates. What is the cause?

A.The client is not sending a client certificate
B.The SSL-VPN server certificate is expired
C.The SSL-VPN tunnel mode is misconfigured
D.The CA certificate is not imported on FortiGate
AnswerA

Correct. The error 'peer did not return a certificate' means the client did not provide the required certificate.

Why this answer

The error 'SSL_ERROR_SSL: error:1417C0C7:SSL routines:tls_process_client_certificate:peer did not return a certificate' occurs during the TLS handshake when the server requests a client certificate and the client fails to provide one. Since the SSL-VPN is configured to require client certificates, the FortiGate expects the client to present a valid certificate; if none is sent, the handshake fails with this specific OpenSSL error. This directly indicates that the client is not sending a client certificate, making option A correct.

Exam trap

The trap here is that candidates may confuse a client certificate not being sent with a CA certificate not being imported on the FortiGate, but the error message explicitly points to the absence of a certificate from the client, not a validation failure after receipt.

How to eliminate wrong answers

Option B is wrong because an expired SSL-VPN server certificate would produce a different error, such as 'certificate expired' or 'certificate verify failed', not a 'peer did not return a certificate' message. Option C is wrong because tunnel mode misconfiguration (e.g., using tunnel mode instead of web mode) affects how traffic is encapsulated, not the TLS client certificate exchange; the error is specific to the SSL handshake layer. Option D is wrong because the CA certificate not being imported on the FortiGate would prevent validation of the client certificate if one were sent, but the error clearly states the peer did not return a certificate at all, indicating the client failed to send one, not that validation failed.

Full explanation →
917
MCQhard

An organization has two FortiGate firewalls in an HA active-passive cluster. They notice that after a failover event, some users cannot access external resources. The administrator checks the HA configuration and finds that failover occurred correctly. What is the most likely cause of the connectivity issue?

A.VDOM links are not synchronized
B.session-pickup is disabled
C.HA override is enabled
D.Gratuitous ARP is disabled
AnswerA

If VDOM links are not synchronized, the backup unit may have incorrect link status, causing routing issues.

Why this answer

In an HA active-passive cluster, VDOM links are not automatically synchronized between peers. After a failover, the new primary FortiGate may lack the VDOM link configurations required to route traffic between VDOMs, causing connectivity loss for users relying on inter-VDOM routing. This is a common misconfiguration because VDOM links are treated as local objects and must be explicitly replicated or re-created on the peer.

Exam trap

The trap here is that candidates assume all HA configurations are fully synchronized, but FortiGate explicitly excludes VDOM links from HA sync, requiring manual replication or use of a configuration-only sync method.

How to eliminate wrong answers

Option B is wrong because session-pickup, when enabled, synchronizes existing sessions to the standby unit, but it does not affect the ability to establish new sessions after failover; the issue described is about persistent connectivity, not session state loss. Option C is wrong because HA override controls which unit becomes primary after a failure (e.g., preempting based on priority), but it does not impact connectivity after failover; the administrator confirmed failover occurred correctly. Option D is wrong because gratuitous ARP (GARP) is sent by the new primary to update switch MAC tables; disabling it would cause temporary traffic blackholing until ARP caches time out, but the question states users cannot access external resources persistently, not just transiently.

Full explanation →
918
MCQeasy

Which two commands display the current session count on a FortiGate?

A.get system performance status
B.diagnose sys session stat
C.show system session
D.diagnose hardware sysinfo session
AnswerA, B

Correct: 'get system performance status' displays the current session count as part of the performance overview.

Why this answer

Both 'get system performance status' and 'diagnose sys session stat' display the current session count on a FortiGate. 'get system performance status' provides a real-time snapshot including active sessions, while 'diagnose sys session stat' shows session table statistics such as total and used sessions. Therefore, both commands are valid answers to the question.

Exam trap

Candidates often think only 'get system performance status' shows session count, but 'diagnose sys session stat' also provides session statistics including count. The trap is that both commands are valid, making this a multi-select question.

How to eliminate wrong answers

Option B is wrong because 'diagnose sys session stat' displays detailed statistics about session table usage (e.g., total sessions, hash table collisions) but does not directly show the current active session count in a single line; it requires parsing of output. Option C is wrong because 'show system session' is not a valid FortiGate CLI command; the correct syntax for viewing session details is 'diagnose sys session list' or 'get system session' (though the latter is not standard). Option D is wrong because 'diagnose hardware sysinfo session' is not a valid command; the correct command for hardware-related session info is 'diagnose hardware sysinfo' (which shows CPU/memory info) but does not include session count.

Full explanation →
919
MCQmedium

A FortiGate administrator is configuring ZTNA to provide secure access to an internal application. The application is hosted on a server with IP 10.0.1.100 and port 8080. The administrator creates a ZTNA rule on the FortiGate as an access proxy. What is the correct configuration for the ZTNA rule's 'Application Access' entry?

A.External port: 0, Mapped port: 8080, Destination: 10.0.1.100
B.External port: 8080, Mapped port: 443, Destination: 10.0.1.100
C.External port: 443, Mapped port: 443, Destination: 10.0.1.100
D.External port: 443, Mapped port: 8080, Destination: 10.0.1.100
AnswerD

The client connects to the FortiGate on port 443, and the FortiGate forwards to the internal server on port 8080.

Why this answer

For ZTNA access proxy, the external port is the port clients connect to (typically 443 for HTTPS), and the mapped port is the internal server port (8080). The destination is the internal server IP. Therefore, option D is correct: external port 443, mapped port 8080, destination 10.0.1.100.

Full explanation →
920
Matchingmedium

Match each FortiGate interface type to its usage.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Hardware network port

Virtual LAN subinterface

Virtual interface for management or routing

Combines multiple physical links for redundancy

Link aggregation (LAG) for increased bandwidth

Why these pairings

The correct matches: Physical Interface → hardware port; VLAN Interface → logical interface for 802.1Q tagging; Loopback Interface → always-up virtual interface; Aggregate Interface → combines multiple physical interfaces. Common confusions include mixing the definitions of loopback and VLAN, or confusing physical interfaces with aggregate interfaces.

Full explanation →
921
MCQmedium

An organization wants to protect a public-facing web application against SQL injection and cross-site scripting (XSS) attacks. They have a FortiGate and a FortiWeb. What is the BEST deployment approach?

A.Place the web server in a DMZ and rely on firewall policies
B.Use FortiGate WAF profile only
C.Deploy FortiWeb in reverse proxy mode in front of the web server
D.Use FortiGate IPS signatures for SQL injection and XSS
AnswerC

FortiWeb provides comprehensive WAF features like signature-based detection, anomaly detection, and bot mitigation.

Why this answer

FortiWeb in reverse proxy mode is the best deployment because it terminates the client connection and inspects all HTTP/HTTPS traffic at the application layer (Layer 7) using specialized web application firewall (WAF) signatures and machine learning to detect and block SQL injection and XSS payloads before they reach the web server. Unlike a network firewall or IPS, FortiWeb is purpose-built for web application security and can decode, normalize, and analyze complex attack patterns that might evade simpler inspection methods.

Exam trap

The trap here is that candidates often assume a next-generation firewall with IPS (like FortiGate) is sufficient for web application protection, underestimating the need for a dedicated WAF that operates at the application layer with full HTTP context and specialized attack detection algorithms.

How to eliminate wrong answers

Option A is wrong because placing the web server in a DMZ and relying solely on firewall policies only provides network-layer access control (Layer 3/4) and cannot inspect application-layer payloads for SQL injection or XSS. Option B is wrong because FortiGate WAF profiles offer only basic HTTP header and URL filtering, lacking the deep packet inspection, signature database, and positive security model that FortiWeb provides for comprehensive web attack prevention. Option D is wrong because FortiGate IPS signatures can detect some SQL injection and XSS patterns, but they operate on a limited set of signatures and cannot perform the full HTTP protocol decoding, parameter validation, and session-aware analysis that a dedicated WAF like FortiWeb offers.

Full explanation →
922
Multi-Selectmedium

An administrator is troubleshooting a VPN tunnel that is not coming up. The remote peer is a third-party device. Which THREE actions should be taken to diagnose the issue?

Select 3 answers
A.Ensure that the pre-shared key matches on both sides.
B.Confirm that UDP ports 500 and 4500 are not blocked by any firewall.
C.Verify that the remote peer's IP address is reachable via ping.
D.Check the IPSec VPN logs with 'diag debug application ike -1'.
E.Review the routing table to ensure the remote subnet is reachable through the tunnel interface.
AnswersA, C, D

Mismatched PSK is a common cause of tunnel failure.

Why this answer

IPsec IKE (Internet Key Exchange) uses the pre-shared key (PSK) during authentication phase 1 (Main Mode or Aggressive Mode). If the PSK does not match on both peers, the IKE SA will fail to establish, and the VPN tunnel will not come up. This is a fundamental prerequisite for any IPsec VPN, and mismatched PSKs are a common misconfiguration.

Exam trap

The trap here is that candidates often confuse post-tunnel routing checks (Option E) with pre-tunnel connectivity checks, or they assume firewall port blocking (Option B) is a direct diagnostic step rather than a prerequisite to verify after other checks fail.

Full explanation →
923
Multi-Selecthard

Which TWO statements correctly describe the behavior of SD-WAN rules when using the 'maximize-bandwidth' strategy?

Select 2 answers
A.The strategy ensures that all traffic uses the member with the highest bandwidth.
B.The administrator can assign different weights to members to influence the proportion of traffic each handles.
C.If a member fails its health-check, it is removed from the set of eligible members for the rule.
D.Traffic from a single session can be split across multiple members for better performance.
E.Traffic is distributed based on session count to keep each link equally utilized.
AnswersB, C

Weights can be set per member to control the load-balancing ratio.

Why this answer

The 'maximize-bandwidth' strategy in SD-WAN rules uses weighted load balancing, where the administrator assigns weights to each member link. The proportion of traffic each member handles is directly proportional to its assigned weight, allowing fine-grained control over bandwidth utilization across multiple WAN links.

Exam trap

The trap here is that candidates often confuse 'maximize-bandwidth' with simple 'load balancing' or assume it splits individual sessions, when in fact it uses weighted distribution while maintaining per-session stickiness and relying on health checks for member eligibility.

Full explanation →
924
MCQmedium

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. The tunnel is established but traffic is not passing. The administrator runs 'diagnose vpn ike log' and sees 'no matching policy for this IPsec SA'. What is the most likely cause?

A.The phase2 selectors do not match between peers
B.There is no firewall policy allowing traffic from the local network to the remote network via the VPN tunnel interface
C.The pre-shared key is mismatched
D.The tunnel interface is administratively down
AnswerB

Even if the tunnel is up, a firewall policy must explicitly permit traffic to use the tunnel. Without it, traffic is dropped.

Why this answer

The error indicates that the IKE SA exists but no firewall policy matches the traffic to use the tunnel. The tunnel interface is likely configured but the policy to allow traffic through the tunnel is missing or incorrect.

Full explanation →
925
Multi-Selectmedium

An administrator needs to ensure that traffic between two VDOMs (VDOM_A and VDOM_B) is inspected by an IPS profile. Which TWO configuration elements are required? (Choose TWO.)

Select 2 answers
A.An inter-VDOM link with IP addresses in the same subnet
B.NAT enabled on the inter-VDOM link
C.A firewall policy on VDOM_B with the source as the inter-VDOM link
D.An IPsec VPN between the VDOMs
E.A firewall policy on VDOM_A with the inter-VDOM link as the destination interface and an IPS profile applied
AnswersA, E

Inter-VDOM links are necessary to route traffic between VDOMs.

Why this answer

An inter-VDOM link is required to route traffic between VDOMs, and placing IP addresses in the same subnet on both ends ensures direct Layer 2 connectivity without routing overhead. This allows the firewall policies in each VDOM to control traffic flow, and applying an IPS profile on the policy in VDOM_A (with the inter-VDOM link as the destination interface) ensures that all traffic leaving VDOM_A toward VDOM_B is inspected by IPS.

Exam trap

The trap here is that candidates often assume an IPsec VPN or NAT is needed for inter-VDOM communication, but FortiGate uses inter-VDOM links with same-subnet IPs and firewall policies to enable direct, inspectable traffic flow.

Full explanation →
926
MCQeasy

A network administrator is deploying a FortiGate in transparent mode to replace an existing layer 2 switch. Which statement about transparent mode is true?

A.All interfaces operate at layer 2, and the FortiGate forwards traffic based on MAC addresses
B.Transparent mode only supports static routing
C.Transparent mode requires VDOMs to be enabled
D.The FortiGate acts as a router and requires IP addresses on its interfaces
AnswerA

Correct. The device behaves like a firewall bridge.

Why this answer

In transparent mode, the FortiGate operates as a layer 2 bridge, forwarding traffic based on MAC addresses without performing routing. All interfaces are in the same broadcast domain, and the FortiGate inspects traffic at layers 3–7 while remaining transparent to the network. This allows it to replace a layer 2 switch while adding firewall functionality.

Exam trap

The trap is that candidates assume transparent mode disables all firewall inspection, but FortiGate in transparent mode still performs full security inspection at layers 3–7 while forwarding based on MAC addresses. Additionally, some think no IP address is needed, but a management IP is required for administrative access.

How to eliminate wrong answers

Option B is wrong because transparent mode supports both static and dynamic routing (e.g., OSPF, BGP) when VDOMs are enabled, though it is often used without routing. Option C is wrong because VDOMs are not required for transparent mode; they are an optional feature for multi-tenancy or administrative separation. Option D is wrong because the FortiGate in transparent mode does not act as a router; its management IP is used for administrative access only, and traffic forwarding is based on MAC addresses, not IP addresses.

Full explanation →
927
MCQmedium

A FortiGate administrator notices that files submitted to FortiSandbox are receiving verdicts but the firewall is not automatically blocking the detected malware. The FortiSandbox integration is configured under Security Fabric > External Connectors. What additional configuration is required to enforce blocking based on FortiSandbox verdicts?

A.Enable the 'fortisandbox' option in the antivirus profile applied to the firewall policy
B.Enable 'Inline Scan' on the FortiSandbox connector
C.Configure an automation stitch to quarantine files based on verdict
D.Enable 'Block malicious files' in the FortiSandbox connector settings
AnswerA

The antivirus profile with 'fortisandbox' enabled will use FortiSandbox verdicts to block malicious files.

Why this answer

The FortiSandbox verdict integration requires the antivirus profile applied to the firewall policy to have the 'fortisandbox' option enabled. This option allows the FortiGate to query FortiSandbox for verdicts and automatically block files that are determined to be malicious. Without this setting in the antivirus profile, the FortiGate will receive verdicts but will not enforce blocking actions on the traffic.

Exam trap

The trap here is that candidates often confuse the FortiSandbox connector settings (like 'Block malicious files') with the actual enforcement mechanism, which is the antivirus profile's 'fortisandbox' option that must be explicitly enabled in the policy's security profile.

How to eliminate wrong answers

Option B is wrong because 'Inline Scan' is a feature for FortiGate's local inline scanning of files, not for enforcing blocking based on FortiSandbox verdicts; it controls how files are scanned, not the action taken on verdicts. Option C is wrong because automation stitches can be used to trigger actions like quarantine, but they are not the primary or required configuration to enforce blocking based on FortiSandbox verdicts; the verdict-based blocking is handled directly by the antivirus profile. Option D is wrong because the 'Block malicious files' setting in the FortiSandbox connector settings controls whether the FortiGate sends files to FortiSandbox for analysis, not whether it blocks files based on received verdicts; blocking is enforced at the antivirus profile level.

Full explanation →
928
MCQeasy

A FortiGate administrator wants to ensure that only devices with an up-to-date antivirus and OS patch level can access a sensitive application published via ZTNA. Which ZTNA component should the administrator configure to enforce this requirement?

A.ZTNA proxy configuration
B.ZTNA tags with posture checks
C.SSL VPN portal settings
D.Firewall policy with application control
AnswerB

ZTNA tags can include posture attributes. Policies reference these tags to control access based on device compliance.

Why this answer

ZTNA tags with posture checks allow the FortiGate to verify endpoint compliance (e.g., antivirus version, OS patch level) before granting access to a ZTNA-published application. The FortiGate collects posture data from the FortiClient endpoint and compares it against configured compliance rules; only devices that meet the requirements receive the appropriate ZTNA tag and are allowed through the ZTNA proxy.

Exam trap

The trap here is that candidates often confuse the ZTNA proxy configuration (which handles traffic forwarding and authentication) with the tag-based posture enforcement mechanism, assuming that the proxy itself can enforce endpoint compliance without the separate tag and posture check system.

How to eliminate wrong answers

Option A is wrong because the ZTNA proxy configuration defines the access proxy settings (e.g., application mapping, authentication) but does not itself enforce endpoint posture checks; it relies on tags to determine access. Option C is wrong because SSL VPN portal settings are used for traditional SSL VPN access, not for ZTNA, and do not support posture-based tagging or endpoint compliance verification. Option D is wrong because a firewall policy with application control can inspect traffic and block applications, but it cannot perform endpoint posture checks (e.g., antivirus or OS patch level) required for ZTNA compliance enforcement.

Full explanation →
929
MCQmedium

A FortiGate admin is configuring a multi-peer IPsec VPN where the remote site has two ISPs for redundancy. The admin wants to ensure that if the primary ISP fails, the VPN automatically fails over to the secondary ISP without manual intervention. Which feature should be enabled?

A.IPsec interface mode with DHCP
B.IKEv2 with mobility extension
C.Auto-negotiate phase 1 settings
D.Dead Peer Detection (DPD) with retry and failover
AnswerD

DPD detects when the peer is unreachable and can trigger failover to a secondary path or peer.

Why this answer

DPD (Dead Peer Detection) with auto-negotiation allows the FortiGate to detect peer unreachability and automatically re-establish the tunnel using an alternate path if configured.

Full explanation →
930
MCQeasy

A FortiGate is configured with ECMP routing to balance traffic across two default routes via two ISPs. The administrator wants to ensure that traffic from the same source-destination pair always uses the same ISP. Which ECMP load balancing method should be configured?

A.source-dest-ip
B.source-ip
C.per-packet
D.session
AnswerA

Why this answer

The source-dest-ip method hashes the source and destination IP addresses to compute a consistent path for all packets in a given flow. This ensures that traffic from the same source-destination pair always uses the same ISP, meeting the requirement for flow-based persistence without per-packet load balancing.

Exam trap

The trap here is that candidates may confuse 'session' as a valid ECMP method, but FortiGate does not have a 'session' load balancing option; the correct flow-based method is 'source-dest-ip'.

How to eliminate wrong answers

Option B (source-ip) is wrong because it only hashes the source IP, so traffic from the same source to different destinations could use different ISPs, but traffic from the same source-destination pair might still be split if the source IP alone is used. Option C (per-packet) is wrong because it distributes each packet individually across links, breaking flow persistence and causing out-of-order delivery for TCP sessions. Option D (session) is wrong because it is not a valid ECMP load balancing method in FortiGate; the correct term is 'source-dest-ip' for session-based persistence.

Full explanation →
931
MCQmedium

Which feature allows a FortiGate to use multiple VRFs to separate routing tables for different customers or departments on the same physical device?

A.SD-WAN
B.VDOM
C.VRF
D.Policy-based routing
AnswerC

VRF creates separate routing tables.

Why this answer

C is correct because VRF (Virtual Routing and Forwarding) is the native feature that allows a FortiGate to maintain multiple independent routing tables within a single physical device. Each VRF instance has its own routing table, forwarding table, and interface associations, enabling traffic separation for different customers or departments without requiring separate hardware. This is distinct from VDOMs, which provide full virtualized security and management contexts, and from SD-WAN or policy-based routing, which do not create separate routing tables.

Exam trap

The trap here is that candidates often confuse VDOMs with VRFs, but VDOMs virtualize the entire device (including management and security policies), whereas VRFs specifically virtualize only the routing table, making VRF the correct answer for routing-table separation alone.

How to eliminate wrong answers

Option A is wrong because SD-WAN is a feature for intelligent path selection and load balancing across multiple WAN links, not for creating separate routing tables. Option B is wrong because VDOMs (Virtual Domains) provide full virtualized firewall and management contexts, including separate routing tables, but the question specifically asks about the feature that uses multiple VRFs to separate routing tables, and VRF is the direct routing-table separation mechanism within a VDOM or global context. Option D is wrong because policy-based routing (PBR) allows traffic to be forwarded based on policies (e.g., source/destination IP) rather than the routing table, but it does not create multiple independent routing tables.

Full explanation →
932
MCQmedium

A FortiManager administrator wants to push a policy package that includes both global header/footer policies and VDOM-specific policies. Which statement about header/footer policies is correct?

A.Header/footer policies are only available when using per-device mapping
B.Header/footer policies can only be configured directly on the FortiGate, not via FortiManager
C.Header/footer policies are automatically generated and cannot be manually edited
D.Header policies are inserted before the VDOM's own policies; footer policies are appended after
AnswerD

Correct. This ensures consistent enforcement.

Why this answer

In FortiManager, when a policy package includes both global header/footer policies and VDOM-specific policies, the header policies are inserted before the VDOM's own policies in the policy table, while footer policies are appended after them. This ensures that header policies are evaluated first for traffic matching, and footer policies serve as a catch-all or default set of rules at the end of the VDOM policy list.

Exam trap

The trap here is that candidates often assume header/footer policies are only for per-device mapping or must be configured locally on the FortiGate, but FortiManager fully supports creating and managing them centrally for consistent policy enforcement across VDOMs.

How to eliminate wrong answers

Option A is wrong because header/footer policies are available with both per-device mapping and policy package installation, not exclusively with per-device mapping. Option B is wrong because header/footer policies can be configured directly on FortiManager under the global policy package and then pushed to managed FortiGates, not only on the FortiGate itself. Option C is wrong because header/footer policies are manually created and edited by the administrator in FortiManager, not automatically generated; they are user-defined policies that provide a consistent set of rules across multiple VDOMs.

Full explanation →
933
MCQmedium

An administrator wants to add custom fields to device objects in FortiManager to track location and contact info. Which feature should be used?

A.Meta fields
B.System templates
C.Custom reports
D.Dynamic mapping
AnswerA

Correct.

Why this answer

Meta fields in FortiManager allow administrators to define custom attributes (e.g., location, contact info) that can be attached to device objects. These fields are stored in the FortiManager database and can be used for filtering, reporting, and policy mapping, providing a flexible way to enrich device metadata without modifying the device configuration itself.

Exam trap

The trap here is that candidates confuse 'meta fields' with 'system templates' because both involve customization, but system templates apply configuration settings to devices, whereas meta fields add descriptive metadata without altering device configurations.

How to eliminate wrong answers

Option B is wrong because system templates are used to standardize configuration settings (e.g., SNMP, admin profiles) across devices, not to add custom fields to device objects. Option C is wrong because custom reports are used to generate tailored views of log and event data, not to define metadata fields on device objects. Option D is wrong because dynamic mapping is a feature for automatically assigning devices to ADOMs or groups based on criteria like IP address or hostname, not for adding custom fields.

Full explanation →
934
MCQmedium

An administrator configured a firewall policy to inspect SMTP traffic using an antivirus profile. However, email attachments are not being scanned. The FortiGate is operating in proxy-based inspection mode. What is the most likely cause?

A.The policy is set to 'accept' instead of 'deny'
B.The email is sent over TLS encryption
C.The antivirus profile is set to flow-based inspection
D.The SMTP session helper is not enabled
AnswerD

Correct. The SMTP helper ensures FortiGate understands the SMTP protocol and can inspect email attachments.

Why this answer

In proxy-based inspection mode, the FortiGate must reassemble the SMTP session to scan attachments. The SMTP session helper is required to parse the SMTP commands and data stream so the antivirus engine can access the attachments. Without the helper enabled, the FortiGate treats the traffic as raw TCP and cannot extract MIME parts for scanning.

Exam trap

The trap here is that candidates often assume antivirus scanning fails due to encryption or policy action, but the NSE7 exam specifically tests the dependency on session helpers for protocol-level inspection in proxy mode.

How to eliminate wrong answers

Option A is wrong because the policy action (accept vs. deny) controls whether traffic is allowed or blocked, not whether scanning occurs; antivirus scanning is applied to accepted traffic. Option B is wrong because TLS encryption prevents inspection only if the antivirus profile does not have a decryption profile or deep inspection enabled; the question does not indicate decryption is configured, but the core issue is the missing session helper, not encryption. Option C is wrong because the antivirus profile's inspection mode (proxy vs. flow) must match the FortiGate's operating mode; the question states the FortiGate is in proxy-based mode, so the profile should also be proxy-based, but the missing session helper is the root cause regardless of profile setting.

Full explanation →
935
MCQmedium

A network administrator is troubleshooting a BGP session between a FortiGate and an ISP router. The administrator runs 'get router info bgp summary' and sees that the BGP state is 'Active'. What does this state indicate?

A.The BGP speaker is trying to establish a TCP connection with the peer
B.The BGP session is administratively down due to a configuration error
C.The BGP speaker is waiting for a routing update from the peer
D.The BGP session is fully established and exchanging routes
AnswerA

Why this answer

The 'Active' state in BGP indicates that the router is actively trying to initiate a TCP connection to the configured peer. This means the BGP process has moved past the 'Connect' state (where it passively waits) and is now actively sending TCP SYN packets to the peer's port 179, but the three-way handshake has not yet completed. This state is normal during initial session establishment but becomes problematic if it persists, as it typically points to a Layer 3 reachability issue or a firewall blocking TCP/179.

Exam trap

The trap here is that candidates confuse 'Active' with a session that is actively exchanging routes, but 'Active' specifically refers to the TCP connection phase, not the routing update phase, which only occurs after the session reaches the 'Established' state.

How to eliminate wrong answers

Option B is wrong because an administratively down session would show as 'Idle (Admin)' or 'Idle' in the BGP summary, not 'Active'. Option C is wrong because waiting for a routing update occurs in the 'Established' state, not 'Active'; the 'Active' state is about TCP connection setup, not routing information exchange. Option D is wrong because a fully established session is indicated by the 'Established' state with a number in the 'State/PfxRcd' column showing the count of received prefixes, not the 'Active' state.

Full explanation →
936
MCQmedium

An administrator notices that SD-WAN rule-based traffic is not failing over as expected when the primary link goes down. The SLA targets are configured correctly, and the interface health check is showing 'dead' for the primary link. What is the MOST likely reason for the failover not occurring?

A.The SD-WAN rule's 'set strategy' is 'manual' and the preferred member is still set to the primary interface
B.The SD-WAN rule's 'set status' is set to 'disable'
C.The secondary interface has a higher cost than the primary interface
D.The 'set update-static-route' is not enabled on the SD-WAN
AnswerA

When strategy is 'manual', the rule will not failover automatically; traffic continues to be sent to the preferred member even if the SLA is dead.

Why this answer

When an SD-WAN rule's strategy is set to 'manual', the rule uses a static preferred member list and will not automatically fail over to another member, even if the primary link's SLA health check status is 'dead'. The SLA targets are correctly configured and the health check is detecting the failure, but the manual strategy overrides dynamic path selection, so traffic continues to be sent to the dead primary interface. To enable failover, the strategy must be set to 'optimal' or 'maximize-bandwidth' (or similar dynamic strategy), or the preferred member must be manually updated.

Exam trap

The trap here is that candidates assume a 'dead' SLA health check will automatically trigger failover in all SD-WAN rules, but they overlook that the rule's strategy must be dynamic (e.g., 'optimal') for automatic failover to occur; a 'manual' strategy explicitly prevents this behavior.

How to eliminate wrong answers

Option B is wrong because setting 'set status' to 'disable' would completely disable the SD-WAN rule, preventing any traffic from being processed by it, not just preventing failover. Option C is wrong because interface cost influences route selection in routing tables, not SD-WAN rule-based traffic steering; SD-WAN rules use SLA and strategy, not cost, for failover decisions. Option D is wrong because 'set update-static-route' controls whether the SD-WAN zone updates static routes when the interface status changes, but it does not affect SD-WAN rule-based traffic failover, which is governed by the rule's strategy and SLA configuration.

Full explanation →
937
MCQmedium

A FortiGate administrator notices that traffic from a specific subnet is not being inspected by the Intrusion Prevention System (IPS) profile applied to the firewall policy. The policy is configured with the correct profile, and the IPS engine is enabled. What is the most likely cause?

A.The traffic is encrypted and SSL inspection is not enabled
B.The protocol in the IPS profile is not enabled for the application being used
C.The IPS profile is configured for signature-based detection only
D.The firewall policy is set to accept mode instead of explicit proxy
AnswerB

IPS profiles have protocol-specific settings; if the protocol is disabled, traffic is not inspected.

Why this answer

The most likely cause is that the protocol in the IPS profile is not enabled for the application being used. Even when an IPS profile is applied to a firewall policy and the IPS engine is running, the profile must have the specific protocol (e.g., HTTP, SMTP, FTP) enabled for inspection. If the protocol is disabled or not selected, the IPS engine will bypass traffic of that type, resulting in no intrusion detection or prevention for that traffic.

Exam trap

The trap here is that candidates often assume an IPS profile will inspect all traffic by default once applied, overlooking the need to enable specific protocol sensors within the profile for the traffic to be inspected.

How to eliminate wrong answers

Option A is wrong because encrypted traffic that is not decrypted by SSL inspection would simply be passed without deep inspection, but the question states traffic from a specific subnet is not inspected at all, which points to a protocol-level filtering issue rather than encryption. Option C is wrong because signature-based detection is the standard mode for IPS; if the profile were configured for signature-based detection only, it would still inspect traffic as long as the protocol is enabled. Option D is wrong because the firewall policy mode (accept vs. explicit proxy) affects how traffic is directed to the FortiGate, not whether IPS inspection is applied; IPS inspection is independent of the policy mode.

Full explanation →
938
MCQhard

A FortiGate is configured with two WAN members in an SD-WAN zone. The performance SLA monitors latency to a probe server. The rule uses 'best quality' strategy. After some time, one member fails the SLA. Which action does the FortiGate take for existing sessions that were using that member?

A.All sessions are dropped and the member is removed from the zone
B.Existing sessions are re-evaluated and may be moved based on policy
C.Existing sessions are immediately moved to another member
D.Existing sessions continue on the failed member until they timeout
AnswerD

Only new sessions are affected.

Why this answer

When a WAN member fails the performance SLA in an SD-WAN 'best quality' strategy, FortiGate does not disrupt existing sessions that were already using that member. Instead, those sessions continue on the failed member until they naturally timeout or are torn down, because the SD-WAN rule only influences the path selection for new sessions. This behavior is by design to avoid breaking active connections due to transient SLA fluctuations.

Exam trap

The trap here is that candidates often assume SD-WAN 'best quality' strategy dynamically re-routes all traffic, including existing sessions, when an SLA fails, but FortiGate only applies path selection changes to new sessions to maintain session stability.

How to eliminate wrong answers

Option A is wrong because FortiGate does not drop all sessions or remove the member from the zone solely due to SLA failure; the member remains available for new sessions if it is the only path or if other rules permit. Option B is wrong because existing sessions are not re-evaluated or moved based on policy; only new session path selection is affected by SLA status. Option C is wrong because immediate session movement would cause disruption and is not supported; FortiGate relies on session timeout or application-specific mechanisms (like DNS or TCP retransmission) to naturally migrate traffic.

Full explanation →
939
MCQmedium

When troubleshooting an IPsec VPN phase 1 failure, you run 'diagnose vpn ike config' and see that the remote gateway IP address is incorrect. Which command is used to correct the peer IP configuration?

A.set psksecret <secret>
B.execute vpn tunnel down <tunnel>
C.config vpn ipsec phase1-interface edit <name> set remote-gw <ip>
D.set certificate <name>
AnswerC

This sets the remote gateway IP address.

Why this answer

The 'config vpn ipsec phase1-interface' command allows you to edit the phase1 configuration, and the 'set remote-gw <ip>' command directly corrects the peer IP address. This is the standard FortiGate CLI method to update the remote gateway IP for an IPsec VPN phase1 interface, which is essential for establishing the IKE session.

Exam trap

The trap here is that candidates may confuse operational commands (like 'execute vpn tunnel down') with configuration commands, or mistake authentication settings (PSK or certificate) for peer addressing, leading them to select options that do not actually change the remote gateway IP.

How to eliminate wrong answers

Option A is wrong because 'set psksecret <secret>' configures the pre-shared key, not the remote gateway IP address; it addresses authentication, not peer reachability. Option B is wrong because 'execute vpn tunnel down <tunnel>' only tears down an existing tunnel, but does not modify the configuration; it is a troubleshooting command, not a correction command. Option D is wrong because 'set certificate <name>' assigns a certificate for authentication, which is unrelated to correcting the peer IP address.

Full explanation →
940
MCQmedium

A FortiGate administrator is integrating a FortiSwitch managed by the FortiGate. They want to configure a VLAN interface on the FortiSwitch for user traffic. Which configuration is required on the FortiGate?

A.Enable DHCP relay on the FortiSwitch VLAN
B.Configure a VLAN on the FortiSwitch under the switch controller and assign it to a port
C.Use the config system interface to create a VLAN on the FortiGate and tag it on the trunk
D.Create a VLAN subinterface on the FortiGate's port that connects to the FortiSwitch
AnswerB

Under config switch-controller, you create a VLAN and assign it to switch ports.

Why this answer

When integrating a FortiSwitch managed by a FortiGate, VLANs for user traffic must be created under the switch controller on the FortiGate. This allows the FortiGate to push the VLAN configuration to the FortiSwitch, including assigning the VLAN to a specific port or port group. Option B correctly describes this process, as the switch controller manages the FortiSwitch as an extension of the FortiGate, not as a standalone device.

Exam trap

The trap here is that candidates confuse creating a VLAN on the FortiGate's own interfaces (using 'config system interface') with configuring a VLAN on a managed FortiSwitch, which requires the switch controller context.

How to eliminate wrong answers

Option A is wrong because DHCP relay is a separate feature that can be enabled on a VLAN interface, but it is not a required configuration for creating a VLAN on a FortiSwitch; the question asks for the required configuration to set up the VLAN itself. Option C is wrong because 'config system interface' is used to create VLAN interfaces on the FortiGate itself, not on a managed FortiSwitch; FortiSwitch VLANs are managed through the switch controller, not system interfaces. Option D is wrong because creating a VLAN subinterface on the FortiGate's physical port is used for router-on-a-stick or inter-VLAN routing on the FortiGate, but it does not configure the VLAN on the FortiSwitch; the FortiSwitch must be explicitly configured via the switch controller to carry that VLAN.

Full explanation →
Page 12

Page 13 of 13

All pages

12345678910111213

Practice NSE7 by domain

Target a specific domain to shore up weak areas.

Advanced Networking and SD-WANAdvanced VPN and Zero TrustEnterprise Firewall and VDOMsAdvanced Threat ProtectionTroubleshooting and Diagnostics
See all domains with question counts →