Fortinet NSE 7 Advanced Security NSE7 (NSE7) — Questions 76–150

To verify a custom IPS signature, the administrator should test it with matching traffic and check the IPS log to confirm detection. Also, ensuring the IPS sensor includes the signature and is applied to a policy is necessary.

Even if the tag exists, the FortiGate may not have updated tag information from EMS or the session may have been established before the tag was applied. Option A is correct because the FortiGate must re-evaluate tags for new connections; if the EMS connector is not syncing or the session is cached with old tags, it may deny.

Redistribution of static routes into OSPF is done under the OSPF process configuration using 'redistribute static' with optional metric and metric-type. The command 'config router ospf' then 'redistribute static' enables redistribution.

Content Disarm and Reconstruction (CDR) sanitizes attachments by removing active content. It is part of the antivirus profile feature set on FortiGate.

The FortiExtender must be registered and configured as an SD-WAN member, typically by enabling it as an interface and adding it to the SD-WAN zone.

As an SP, FortiGate must be configured with the correct IdP entity ID and SSO URL. If the IdP entity ID is incorrect, the IdP rejects the SAML request.

Option A is correct because session synchronization ensures that stateful firewall sessions (e.g., TCP/UDP connections) are replicated from the active FortiGate to the standby unit. In HA active-passive mode, this allows the standby to seamlessly take over active sessions upon failover, minimizing disruption. Without session synchronization, all existing connections would be dropped and must be re-established.

The source-destination IP algorithm uses a hash of source and destination IP to consistently select the same member for the same pair, which is useful for stateful applications or to avoid asymmetric routing.

FortiView in FortiAnalyzer provides real-time traffic monitoring with drill-down capabilities into top talkers, applications, and threats. It aggregates data from FortiGate logs and presents it in an interactive dashboard, allowing administrators to identify and investigate network anomalies instantly without generating reports.

ZTNA requires FortiClient for endpoint posture, EMS for policy/tag management, and FortiGate with ZTNA proxy to enforce access control.

The 'duration=3600' shows the session has been active for 3600 seconds (1 hour). 'expire=3599' indicates the session will expire in 3599 seconds, which is typical for a long-lived HTTPS session that is about to age out.

To enable PFS with DH group 14 on the phase 2 proposal, the correct CLI command is 'set pfs enable' and 'set dhgrp 14'. The command 'set proposal aes256-sha256' defines encryption/integrity, not PFS. The other options do not set PFS correctly.

The 'no suitable certificate found' error in IPsec phase1 debug indicates that the FortiGate cannot locate a local certificate that matches the peer's expected certificate name (often the peer's ID or the configured local certificate name). This typically occurs when the local certificate is not imported or the certificate's Common Name (CN) or Subject Alternative Name (SAN) does not match the configured local ID or peer's expected identifier. Without a matching local certificate, the IKE exchange cannot proceed to authenticate the FortiGate to the remote peer.

Options A and D are correct. Current session count shows how many sessions exist, and session fail rate indicates if new sessions are being dropped.

FortiGate's External Threat Intelligence feature allows administrators to import and consume threat intelligence feeds (e.g., STIX/TAXII, CSV, or custom URLs) to block known malicious IP addresses. This is the correct feature because it is specifically designed to ingest external threat data and apply it to firewall policies for dynamic blocking, unlike the other options which serve different purposes.

ZTNA rules restrict access based on user groups. Even if the user authenticates via SAML, they must be a member of a group that is explicitly allowed in the ZTNA rule. Tags are for client posture, not authentication groups.

Even if phase 1 succeeds, phase 2 can fail due to mismatched proxy IDs (local/remote subnets) or mismatched PFS settings. Authentication method and encryption algorithm are phase 1 parameters.

If the VDOM link is configured with the same VLAN ID and IP subnet, traffic may be bridged at Layer 2, bypassing Layer 3 policies. Alternatively, a policy might be implicitly allowing traffic.

Common performance metrics include CPU usage, memory usage, and session count. Disk usage is not a direct performance metric for firewall throughput, and interface speed is a capacity metric rather than load.

Options B and D are correct. Phase 2 proposal mismatch is usually due to incompatible encryption/authentication algorithms (B) or mismatched proxy IDs (local/remote subnets) (D). Options A and C would not cause a proposal mismatch.

Virtual domains (VDOMs) allow a single FortiGate to be partitioned into multiple independent virtual firewalls, each with its own administrators, security policies, routing tables, and interfaces. This is the correct feature for isolating customer traffic at a service provider because it provides complete administrative and policy separation per customer, which VLAN interfaces alone cannot achieve.

Automation stitches require a valid mail server configuration in the FortiGate's email settings. Without it, the email action cannot be executed.

Option A is correct because the machine learning engine for advanced antivirus detection is a dedicated feature within the antivirus profile that must be explicitly enabled. This engine uses behavioral analysis and heuristics to detect unknown or zero-day malware without relying solely on signature-based detection. Enabling this setting allows FortiGate to leverage on-device ML models to identify malicious files based on patterns and anomalies.

FortiGate integrates with FortiNAC via RADIUS (B) to query device compliance and NAC policies (A) on the interface to enforce access. 802.1x is typically handled by the switch, not FortiGate directly. SGT and nac-mode are not standard for this integration.

In a multi-tenant VDOM environment where each tenant requires its own routing table and firewall policies, NAT mode VDOM (option D) is the correct choice because it operates as a Layer 3 routing entity with its own independent routing table, interfaces, and firewall policies. This mode allows each tenant VDOM to perform NAT, route between subnets, and enforce security policies autonomously, which is essential for tenant isolation and policy control.

Add log device, set IP and auth, choose log types, apply filters, then test.

To diagnose ZTNA connection issues, the administrator should verify network connectivity to the ZTNA gateway, check the ZTNA proxy rule configuration, and verify the application server is reachable from the FortiGate. Option A, C, and D are correct.

Option B is correct because setting a memory quota on a VDOM limits the amount of physical memory (RAM) the VDOM can consume, preventing it from starving other VDOMs or the root system. Option C is correct because setting a CPU quota caps the percentage of CPU time the VDOM can use, ensuring fair scheduling across VDOMs. Together, these two settings enforce resource isolation at the system level, which is required for multi-tenant or segmented environments.

Phase 2 uses different proposals than phase 1. The correct proposals are encryption algorithm (ESP), authentication algorithm, and perfect forward secrecy (PFS). Option A and B are correct because they are part of the phase 2 proposal.

SD-WAN rules allow matching traffic based on source/destination, and can set the 'strategy' to 'manual' or explicitly select a member, overriding SLA-based choices.

These are key products in the Fortinet Security Fabric.

After SAML authentication, the FortiGate must have a matching user group and firewall policy that allows traffic from authenticated users. If the IdP sends the correct attributes but the FortiGate does not have a group mapping or policy, access will be denied.

The web filtering profile currently has the Malware category set to 'monitor all', which logs but does not block traffic. To block the URL, the action must be changed from 'monitor' to 'block' within the same web filter profile. This directly enforces the blocking action for all URLs categorized as Malware, including the known malicious URL.

Option C is correct because the per-VDOM HA configuration for VDOM-B explicitly disables session pickup with 'set session-pickup disable'. Even though the global HA settings enable session pickup, the per-VDOM setting overrides the global setting for that VDOM. As a result, after a failover, sessions in VDOM-B are not synchronized to the standby FortiGate and are not picked up, causing disruption for guest users.

An automation stitch requires a trigger (e.g., IPS event) and an action (e.g., add to block list). The trigger defines when the stitch fires, and the action defines what to do.

Option A is correct. Missing or incorrect firewall policies are a common cause of traffic not passing through an established VPN.

Option B is correct because the FortiAnalyzer must be able to reach the FortiGate's management IP to establish the logging connection. In multi-VDOM mode, the management VDOM handles all management traffic, including FortiAnalyzer communication, so reachability to that specific IP is essential for centralized logging.

For ADVPN shortcut tunnels, the hub must enable auto-discovery sender and must also advertise the spoke routes to other spokes. Without route advertisement, spokes cannot know about each other's networks.

FortiSandbox provides advanced threat detection, FortiEDR provides endpoint detection and response, and FortiDeceptor provides deception-based threat detection. Together they cover multiple attack stages.

The proposal mismatch occurs because the FortiGate's IKE proposal includes aes256-sha256 but not aes256-sha1, and the remote gateway expects aes256-sha1. The correct action is to add aes256-sha1 to the proposal list.

Inter-VDOM routing requires a VDOM link, which is a pair of logical interfaces (one in each VDOM) that are directly connected. Without this link, the VDOMs cannot exchange traffic even if firewall policies and routes exist, because they operate as separate virtual firewalls with isolated forwarding tables.

Option A is correct. 'diagnose sys session stat' shows session statistics.

The FortiGate VDOM policy limit includes all policy types—IPv4, IPv6, and others (e.g., local-in policies, authentication policies). Even if the administrator has only 200 IPv4 policies, the total count of all policy types combined may already reach the 250 limit, preventing the addition of a new policy. This is why the error occurs despite the VDOM appearing to have room under the configured limit.

VRF leaking is the process of sharing routes between VRFs. This is done by configuring route maps that match specific routes and setting the target VRF, or by using policy routes that override the VRF lookup.

Option D is correct because it follows the recommended upgrade procedure for an active-passive FGCP cluster with session synchronization. By upgrading the passive unit first, then performing a graceful failover (which preserves existing sessions via FGCP session sync), and finally upgrading the new passive unit, the administrator ensures that the cluster remains operational throughout the process with minimal traffic disruption. This method avoids a full cluster outage and maintains session continuity.

The policy allows HTTP traffic (port 80), but the web servers are likely using HTTPS (port 443). Since the service object 'HTTP' in FortiGate typically only includes TCP/80, HTTPS traffic is denied by default. The administrator can ping the servers because ICMP is permitted by an implicit or explicit policy, confirming that routing and connectivity are functional.

The tunnel fails because the Phase 2 proposal (aes256-sha1) is not compatible with the Phase 1 proposal (aes256-sha256). In IPsec VPN, Phase 1 establishes the ISAKMP SA using a set of encryption and authentication algorithms, while Phase 2 negotiates the IPsec SA for data traffic. The authentication algorithm must match between Phase 1 and Phase 2; here, Phase 1 uses SHA-256 but Phase 2 uses SHA-1, causing a mismatch that prevents the tunnel from establishing.

Virtual Domains (VDOMs) allow a single FortiGate to be partitioned into multiple independent virtual firewalls, each with its own firewall policies, routing table, and administrative access. This meets the requirement for logical separation of departments with isolated policy and routing domains.

Option C is correct. Log View provides access to raw logs without aggregation.

State 11 (TCP_CLOSE_WAIT) indicates that the FortiGate has received a FIN from the server (WAN side) and is waiting for a FIN from the client (internal side) to complete the TCP connection closure. When the HTTP server does not properly close connections, the FortiGate holds these sessions open, consuming session table resources and causing performance degradation. The antivirus profile is not the direct cause; the issue is the accumulation of sessions stuck in CLOSE_WAIT due to incomplete TCP teardown.

IKE_INIT state indicates phase 1 has not completed. Certificate trust issues (A), proposal mismatch (B), and expired certificate (D) can all cause phase 1 failure.

The output shows a TCP session in established state (proto_state=01) that has been alive for 3600 seconds and the idle timeout will expire in 3599 seconds if no packets are sent.

In transparent mode, a FortiGate acts as a Layer 2 bridge, and traffic passing through the device is controlled by firewall policies, not by routing. Even though the management IP is reachable (because it is a separate IP on the bridge interface), no traffic inspection occurs unless an explicit firewall policy is configured to allow and inspect the traffic between the bridge interfaces. Option B correctly identifies that the missing firewall policy is the root cause.

Even though the routes are present in both VDOMs, inter-VDOM routing via a VDOM link requires explicit firewall policies on each VDOM to permit traffic between the VDOM link interface and the destination interface. Without these policies, the FortiGate drops the traffic at the firewall layer, even though the routing table is correct. This is a common misconfiguration because VDOM links behave like physical interfaces and are subject to firewall policy enforcement.

ECMP uses a hash algorithm based on source/destination IP and optionally ports to distribute sessions. The 'load-balance' setting in the routing configuration determines the method (e.g., source-dest-ip, source-dest-port).

Spillover algorithm sends traffic to the preferred member (lowest cost or first in order) until its bandwidth exceeds the threshold. When the threshold is exceeded, new sessions are sent to the next available member. Port2 will handle new sessions until port1 drops below the threshold.

Option A is correct because FortiAnalyzer organizes logs into datastores based on device groups or ADOMs. If the report is configured to query a datastore that does not contain the relevant logs, the report will not display the expected data, even if the logs exist elsewhere on the same FortiAnalyzer.

NAT traversal must be enabled on the hub's phase1 to allow spoke-to-spoke shortcut negotiations through NAT devices. Without it, the short-cut tunnel cannot be established because the public IP and port mappings are not properly exchanged.

A 403 error on ZTNA typically indicates that the user's device does not have the required ZTNA tags. The administrator must ensure the FortiClient has the correct tags assigned based on compliance.

ZTNA (Zero Trust Network Access) uses device posture checks to evaluate endpoint security before granting access to applications.

Option A is correct because automation stitches on FortiManager rely on event handler filters to match specific log IDs or patterns. If the filter does not match the incoming event log (e.g., wrong log ID, incorrect field value, or mismatched severity), the trigger condition is never met, and the script will not execute. This is the most common misconfiguration when setting up event-driven automation.

The custom signature is missing the 'protocol' parameter, which is mandatory for FortiGate custom IPS signatures. Without specifying the protocol (e.g., TCP, UDP, HTTP), the IPS engine cannot match the pattern against any traffic flow, so no alerts are generated even if the signature is enabled and applied to a policy.

Option D is correct because FortiGate's Email Filtering profile is specifically designed to inspect SMTP, POP3, and IMAP traffic for phishing indicators, including malicious URLs in email bodies and attachments. It can block or quarantine emails based on URL reputation, sender authentication (SPF/DKIM/DMARC), and content analysis, directly addressing the requirement to detect and block phishing emails with malicious links.

Option B is correct because when FortiSandbox is enabled in the antivirus profile and 'Action for unknown files' is set to 'Block', the FortiGate will submit files that cannot be identified by the local antivirus engine to FortiSandbox for analysis. While the file is being analyzed, it is blocked from reaching the client, ensuring that no potentially malicious content is delivered until a verdict (clean or malicious) is received. This directly addresses the administrator's requirement to block unknown files pending sandbox analysis.