1000 questions total · 14pages · All types, answers revealed
Page 14 of 14
Which command displays the current session count on a FortiGate?
This command shows session count under 'Session number'.
Why this answer
The 'get system performance status' command shows the number of current sessions among other performance statistics.
A FortiGate administrator is configuring ZTNA to provide secure access to an internal application. The application is hosted on a server with IP 10.0.1.100 and port 8080. The administrator creates a ZTNA rule on the FortiGate as an access proxy. What is the correct configuration for the ZTNA rule's 'Application Access' entry?
The client connects to the FortiGate on port 443, and the FortiGate forwards to the internal server on port 8080.
Why this answer
For ZTNA access proxy, the destination virtual IP maps the external address and port to the internal server. Option A is correct: the external port is the port that the client connects to (e.g., 443) and the mapped port is the internal server port (8080).
You run 'diagnose sys session filter dport 443' and see the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate about the traffic?
proto=6 indicates TCP, and state 01 means established. The session is active and expected to continue.
Why this answer
The output shows a TCP session (proto=6), with proto_state=01 indicating the session is in the 'listen' or 'established' state? Actually, in FortiGate session diagnostics, proto_state=01 means the session is in the 'established' state (TCP state ESTABLISHED). The session has been up for 3600 seconds and will expire in 3599 seconds. Option A is correct because it's an established TCP session.
Match each FortiGate interface type to its usage.
Drag a concept onto its matching description — or click a concept then click the description.
Hardware network port
Virtual LAN subinterface
Virtual interface for management or routing
Combines multiple physical links for redundancy
Link aggregation (LAG) for increased bandwidth
Why these pairings
These interface types are configurable on FortiGate.
An organization wants to protect a public-facing web application against SQL injection and cross-site scripting (XSS) attacks. They have a FortiGate and a FortiWeb. What is the BEST deployment approach?
FortiWeb provides comprehensive WAF features like signature-based detection, anomaly detection, and bot mitigation.
Why this answer
Option C is correct because FortiWeb is purpose-built for web application security and provides deep inspection and protection against OWASP Top 10 threats like SQLi and XSS.
An administrator is troubleshooting a VPN tunnel that is not coming up. The remote peer is a third-party device. Which THREE actions should be taken to diagnose the issue?
Mismatched PSK is a common cause of tunnel failure.
Why this answer
Option A is correct because IPsec IKE (Internet Key Exchange) uses the pre-shared key (PSK) during authentication phase 1 (Main Mode or Aggressive Mode). If the PSK does not match on both peers, the IKE SA will fail to establish, and the VPN tunnel will not come up. This is a fundamental prerequisite for any IPsec VPN, and mismatched PSKs are a common misconfiguration.
Exam trap
The trap here is that candidates often confuse post-tunnel routing checks (Option E) with pre-tunnel connectivity checks, or they assume firewall port blocking (Option B) is a direct diagnostic step rather than a prerequisite to verify after other checks fail.
Which TWO statements correctly describe the behavior of SD-WAN rules when using the 'maximize-bandwidth' strategy?
Weights can be set per member to control the load-balancing ratio.
Why this answer
Option B is correct because the 'maximize-bandwidth' strategy in SD-WAN rules uses weighted load balancing, where the administrator assigns weights to each member link. The proportion of traffic each member handles is directly proportional to its assigned weight, allowing fine-grained control over bandwidth utilization across multiple WAN links.
Exam trap
The trap here is that candidates often confuse 'maximize-bandwidth' with simple 'load balancing' or assume it splits individual sessions, when in fact it uses weighted distribution while maintaining per-session stickiness and relying on health checks for member eligibility.
Even if the tunnel is up, a firewall policy must explicitly permit traffic to use the tunnel. Without it, traffic is dropped.
Why this answer
The error indicates that the IKE SA exists but no firewall policy matches the traffic to use the tunnel. The tunnel interface is likely configured but the policy to allow traffic through the tunnel is missing or incorrect.
An administrator needs to ensure that traffic between two VDOMs (VDOM_A and VDOM_B) is inspected by an IPS profile. Which TWO configuration elements are required? (Choose TWO.)
Inter-VDOM links are necessary to route traffic between VDOMs.
Why this answer
An inter-VDOM link is required to route traffic between VDOMs, and placing IP addresses in the same subnet on both ends ensures direct Layer 2 connectivity without routing overhead. This allows the firewall policies in each VDOM to control traffic flow, and applying an IPS profile on the policy in VDOM_A (with the inter-VDOM link as the destination interface) ensures that all traffic leaving VDOM_A toward VDOM_B is inspected by IPS.
A network administrator is deploying a FortiGate in transparent mode to replace an existing layer 2 switch. Which statement about transparent mode is true?
Correct. The device behaves like a firewall bridge.
Why this answer
In transparent mode, the FortiGate operates as a layer 2 bridge, forwarding traffic based on MAC addresses without performing routing. All interfaces are in the same broadcast domain, and the FortiGate inspects traffic at layers 3–7 while remaining transparent to the network. This allows it to replace a layer 2 switch while adding firewall functionality.
Exam trap
The trap here is that candidates assume transparent mode disables all routing capabilities, but it actually supports routing when VDOMs are enabled, and the key distinction is that traffic forwarding is MAC-based, not IP-based.
How to eliminate wrong answers
Option B is wrong because transparent mode supports both static and dynamic routing (e.g., OSPF, BGP) when VDOMs are enabled, though it is often used without routing. Option C is wrong because VDOMs are not required for transparent mode; they are an optional feature for multi-tenancy or administrative separation. Option D is wrong because the FortiGate in transparent mode does not act as a router; its management IP is used for administrative access only, and traffic forwarding is based on MAC addresses, not IP addresses.
A FortiGate administrator notices that files submitted to FortiSandbox are receiving verdicts but the firewall is not automatically blocking the detected malware. The FortiSandbox integration is configured under Security Fabric > External Connectors. What additional configuration is required to enforce blocking based on FortiSandbox verdicts?
The antivirus profile with 'fortisandbox' enabled will use FortiSandbox verdicts to block malicious files.
Why this answer
Option A is correct because the FortiSandbox verdict integration requires the antivirus profile applied to the firewall policy to have the 'fortisandbox' option enabled. This option allows the FortiGate to query FortiSandbox for verdicts and automatically block files that are determined to be malicious. Without this setting in the antivirus profile, the FortiGate will receive verdicts but will not enforce blocking actions on the traffic.
Exam trap
The trap here is that candidates often confuse the FortiSandbox connector settings (like 'Block malicious files') with the actual enforcement mechanism, which is the antivirus profile's 'fortisandbox' option that must be explicitly enabled in the policy's security profile.
How to eliminate wrong answers
Option B is wrong because 'Inline Scan' is a feature for FortiGate's local inline scanning of files, not for enforcing blocking based on FortiSandbox verdicts; it controls how files are scanned, not the action taken on verdicts. Option C is wrong because automation stitches can be used to trigger actions like quarantine, but they are not the primary or required configuration to enforce blocking based on FortiSandbox verdicts; the verdict-based blocking is handled directly by the antivirus profile. Option D is wrong because the 'Block malicious files' setting in the FortiSandbox connector settings controls whether the FortiGate sends files to FortiSandbox for analysis, not whether it blocks files based on received verdicts; blocking is enforced at the antivirus profile level.
A FortiGate administrator wants to ensure that only devices with an up-to-date antivirus and OS patch level can access a sensitive application published via ZTNA. Which ZTNA component should the administrator configure to enforce this requirement?
ZTNA tags can include posture attributes. Policies reference these tags to control access based on device compliance.
Why this answer
ZTNA tags are used to define conditions based on device posture (e.g., antivirus status, OS patch level). Tags are assigned via FortiClient EMS and referenced in ZTNA policies to grant or deny access.
DPD detects when the peer is unreachable and can trigger failover to a secondary path or peer.
Why this answer
DPD (Dead Peer Detection) with auto-negotiation allows the FortiGate to detect peer unreachability and automatically re-establish the tunnel using an alternate path if configured.
A FortiGate is configured with ECMP routing to balance traffic across two default routes via two ISPs. The administrator wants to ensure that traffic from the same source-destination pair always uses the same ISP. Which ECMP load balancing method should be configured?
Why this answer
ECMP in FortiGate supports several load balancing methods, including source-destination IP hash. To keep traffic from the same source-destination pair consistent, use source-dest-ip hashing. Option A is correct.
Option B is for source-only. Option C is session-based. Option D is per-packet (not typical).
Which feature allows a FortiGate to use multiple VRFs to separate routing tables for different customers or departments on the same physical device?
VRF creates separate routing tables.
Why this answer
VRF (Virtual Routing and Forwarding) enables multiple independent routing table instances on a single FortiGate, allowing traffic separation without additional hardware.
A FortiManager administrator wants to push a policy package that includes both global header/footer policies and VDOM-specific policies. Which statement about header/footer policies is correct?
Correct. This ensures consistent enforcement.
Why this answer
Option D is correct because in FortiManager, when a policy package includes both global header/footer policies and VDOM-specific policies, the header policies are inserted before the VDOM's own policies in the policy table, while footer policies are appended after them. This ensures that header policies are evaluated first for traffic matching, and footer policies serve as a catch-all or default set of rules at the end of the VDOM policy list.
Exam trap
The trap here is that candidates often assume header/footer policies are only for per-device mapping or must be configured locally on the FortiGate, but FortiManager fully supports creating and managing them centrally for consistent policy enforcement across VDOMs.
How to eliminate wrong answers
Option A is wrong because header/footer policies are available with both per-device mapping and policy package installation, not exclusively with per-device mapping. Option B is wrong because header/footer policies can be configured directly on FortiManager under the global policy package and then pushed to managed FortiGates, not only on the FortiGate itself. Option C is wrong because header/footer policies are manually created and edited by the administrator in FortiManager, not automatically generated; they are user-defined policies that provide a consistent set of rules across multiple VDOMs.
An administrator wants to add custom fields to device objects in FortiManager to track location and contact info. Which feature should be used?
Correct.
Why this answer
Meta fields in FortiManager allow administrators to define custom attributes (e.g., location, contact info) that can be attached to device objects. These fields are stored in the FortiManager database and can be used for filtering, reporting, and policy mapping, providing a flexible way to enrich device metadata without modifying the device configuration itself.
Exam trap
The trap here is that candidates confuse 'meta fields' with 'system templates' because both involve customization, but system templates apply configuration settings to devices, whereas meta fields add descriptive metadata without altering device configurations.
How to eliminate wrong answers
Option B is wrong because system templates are used to standardize configuration settings (e.g., SNMP, admin profiles) across devices, not to add custom fields to device objects. Option C is wrong because custom reports are used to generate tailored views of log and event data, not to define metadata fields on device objects. Option D is wrong because dynamic mapping is a feature for automatically assigning devices to ADOMs or groups based on criteria like IP address or hostname, not for adding custom fields.
Correct. The SMTP helper ensures FortiGate understands the SMTP protocol and can inspect email attachments.
Why this answer
SMTP traffic requires a specific session helper to be enabled for FortiGate to properly parse and scan email traffic. If the SMTP session helper is disabled, the antivirus profile may not scan the attachments correctly.
A network administrator is troubleshooting a BGP session between a FortiGate and an ISP router. The administrator runs 'get router info bgp summary' and sees that the BGP state is 'Active'. What does this state indicate?
Why this answer
In BGP, the 'Active' state means that the router is trying to initiate a TCP connection to the peer but has not yet established it. This usually indicates a connectivity issue between the peers, such as a firewall blocking port 179 or incorrect IP addressing. Option A is correct.
Option B describes 'Established' state. Option C describes 'Connect' state. Option D is not a BGP state.
An administrator notices that SD-WAN rule-based traffic is not failing over as expected when the primary link goes down. The SLA targets are configured correctly, and the interface health check is showing 'dead' for the primary link. What is the MOST likely reason for the failover not occurring?
When strategy is 'manual', the rule will not failover automatically; traffic continues to be sent to the preferred member even if the SLA is dead.
Why this answer
Option C is correct. Manual strategy does not automatically failover; the preferred member must be changed manually or via automation.
IPS profiles have protocol-specific settings; if the protocol is disabled, traffic is not inspected.
Why this answer
The most likely cause is that the protocol in the IPS profile is not enabled for the application being used. Even when an IPS profile is applied to a firewall policy and the IPS engine is running, the profile must have the specific protocol (e.g., HTTP, SMTP, FTP) enabled for inspection. If the protocol is disabled or not selected, the IPS engine will bypass traffic of that type, resulting in no intrusion detection or prevention for that traffic.
Exam trap
The trap here is that candidates often assume an IPS profile will inspect all traffic by default once applied, overlooking the need to enable specific protocol sensors within the profile for the traffic to be inspected.
How to eliminate wrong answers
Option A is wrong because encrypted traffic that is not decrypted by SSL inspection would simply be passed without deep inspection, but the question states traffic from a specific subnet is not inspected at all, which points to a protocol-level filtering issue rather than encryption. Option C is wrong because signature-based detection is the standard mode for IPS; if the profile were configured for signature-based detection only, it would still inspect traffic as long as the protocol is enabled. Option D is wrong because the firewall policy mode (accept vs. explicit proxy) affects how traffic is directed to the FortiGate, not whether IPS inspection is applied; IPS inspection is independent of the policy mode.
A FortiGate is configured with two WAN members in an SD-WAN zone. The performance SLA monitors latency to a probe server. The rule uses 'best quality' strategy. After some time, one member fails the SLA. Which action does the FortiGate take for existing sessions that were using that member?
Only new sessions are affected.
Why this answer
When a member fails the SLA, only new sessions are redirected to other members that meet the SLA. Existing sessions continue on the failed member until they expire or are terminated. The 'best quality' strategy does not preemptively move existing sessions.
This sets the remote gateway IP address.
Why this answer
Option A is correct because the peer IP is configured under the phase1-interface settings using the 'set remote-gw' command. Option B is for PSK. Option C is for certificate.
Option D is a diagnose command, not configuration.
A FortiGate administrator wants to use PKI certificates for IKEv2 authentication instead of pre-shared keys. Which phase1 configuration parameter must be changed to support certificate-based authentication?
Why this answer
For PKI authentication, the phase1 authentication method must be set to 'signature' (RSA signature). This tells FortiGate to use the certificate's private key for IKE authentication.
A FortiGate administrator is integrating a FortiSwitch managed by the FortiGate. They want to configure a VLAN interface on the FortiSwitch for user traffic. Which configuration is required on the FortiGate?
Under config switch-controller, you create a VLAN and assign it to switch ports.
Page 14 of 14
Practice NSE7 by domain
Target a specific domain to shore up weak areas.