Fortinet NSE 7 Advanced Security NSE7 (NSE7) — Questions 151–225

FortiGuard Outbreak Prevention uses outbreak alerts and hashes from FortiSandbox and other sources to quickly block files.

When both units claim to be primary, it indicates a split-brain scenario. This is typically caused by HA heartbeat failure, often due to a faulty or disconnected HA heartbeat interface.

Threat feeds can be used to create dynamic address objects (via external connectors) or automation stitches can parse the feed and update a blocked IP list.

Header and footer policies in FortiManager policy packages allow administrators to define policies that are automatically placed at the very top (header) and very bottom (footer) of the policy list when the package is installed on a FortiGate. This ensures that critical policies, such as default deny rules or inter-VDOM links, remain in a fixed position regardless of other policy changes. This mechanism is essential for maintaining a consistent security posture across managed FortiGates.

VRF (Virtual Routing and Forwarding) allows multiple routing table instances within a single VDOM or global. It is ideal for network segmentation with overlapping IP spaces without the overhead of full VDOMs.

An administrative VDOM on a FortiGate provides independent management and administrative access for different tenants or departments. Each administrative VDOM has its own administrator accounts, authentication settings, and management interfaces (HTTPS, SSH, SNMP), allowing multi-tenant isolation without requiring separate physical firewalls. This is distinct from traffic-forwarding VDOMs, which handle data plane operations.

To diagnose BGP neighbor establishment issues, the administrator should check both the BGP configuration (including neighbor settings) and the network connectivity (e.g., TCP port 179) between peers.

Playbooks in FortiAnalyzer define automated workflows triggered by events, enabling actions like blocking IPs via FortiGate API calls.

Content Disarm and Reconstruction (CDR) is designed to remove active or potentially malicious content—such as macros, scripts, embedded objects, and OLE links—from documents (e.g., Office files, PDFs) and then reconstruct them as sanitized, safe versions. This approach prevents threats like macro-based malware or exploit-laden attachments from reaching users, even if the file contains previously unknown (zero-day) payloads, by stripping the dangerous components rather than relying solely on signature-based detection.

BFD requires that the interface has BFD enabled at the interface level and that the OSPF neighbor also supports BFD.

Option D is correct because the output shows a TCP session (proto=6) on port 443 with a duration of 3600 seconds (1 hour) and an expire value of 3599 seconds, meaning the session has been active for 1 hour and will expire in 3599 seconds. The 'proto=6' indicates TCP, and 'proto_state=01' is the TCP established state, confirming an active TCP session.

SD-WAN rules allow matching specific traffic patterns and forcing them to use particular members or strategies. The rule can match the voice traffic UDP port range and set the strategy to 'manual' or 'best quality' with preferred member as MPLS.

For ADVPN shortcut tunnels to be used for spoke-to-spoke traffic, the hub must have 'set auto-discovery-sender enable' and the spokes must have 'set auto-discovery-receiver enable'. Without these, traffic between spokes still goes through the hub, but if OSPF is not redistributing spoke routes properly, they may not be reachable.

Phase 1 negotiation fails when proposals do not match. Common causes include encryption algorithm, hash, DH group, or lifetime mismatch. Option A is correct because the encryption algorithm is a key part of the proposal.

Meta fields in FortiManager allow you to define custom variables that can be assigned to managed devices or VDOMs. When a policy package is installed, these meta fields are substituted with the per-VDOM values, enabling the reuse of a single policy package with different source and destination addresses for each VDOM. This avoids the need to create separate policy packages for each VDOM.

Option C is correct because inter-VDOM links are the native FortiGate mechanism for routing traffic between VDOMs without external hardware. Created via 'config system interface' with type 'vdom-link', they act as a direct Layer 3 connection between VDOMs, allowing traffic to flow internally through the FortiGate's backplane. This avoids the need for an external router or physical cabling.

When the measured jitter exceeds the threshold, the link is considered 'degraded' (or 'failed' depending on configuration) for that SLA. In SD-WAN, the member may still be used but with lower preference.

ZTNA access proxy policies combine a firewall policy with ZTNA rules. The tag condition is defined in the ZTNA policy, which specifies the required ZTNA tags to allow access.

To prevent accidental deployment, the administrator should use revision history to track changes, enable install preview to review changes before applying, and use ADOM locking to prevent multiple administrators from making concurrent changes. These features provide control and visibility.

ZTNA inline CASB requires FortiGate as an inline proxy, FortiClient EMS for device posture and identity, and a ZTNA rule that proxies traffic to the SaaS application. Additionally, SSL deep inspection is required to decrypt and inspect traffic.

Option D is correct because the SD-WAN rule action is set to 'best quality', which means the FortiGate will automatically steer new sessions away from any interface that fails the performance SLA. Since port1 has 80% packet loss and 200 ms latency (exceeding the 150 ms threshold), it is considered degraded, and new video conferencing traffic will be directed to port2 (40 ms latency) without manual intervention.

Option C is correct. 'diagnose sys top' displays a top-like process list with CPU and memory usage.

In recent FortiOS versions, a security hardening setting may require minimum RSA key size of 3072 bits. RSA 2048 is considered weak by some compliance standards and may be blocked by the 'weak key' validation check. The admin can adjust the setting or use a stronger key.

Option A is correct because an automation stitch in FortiManager requires a trigger condition to define when the stitch should be activated. The trigger can be based on specific events, such as a log matching a predefined pattern or a FortiGate incident, which initiates the automated response workflow.

Option D is correct because in a multi-VDOM FortiGate deployment, each VDOM operates as an independent virtual firewall with its own log settings. To centralize logging to a FortiAnalyzer, you must configure the log settings individually under each VDOM, specifying the FortiAnalyzer as the log destination. This ensures that logs from all VDOMs are forwarded to the central FortiAnalyzer, as global log settings do not apply across VDOMs.

First enable VDOM mode globally, then create and assign interfaces, then configure each VDOM, then resource allocation.

The WAF profile contains signature sets that detect and block common attack patterns, including SQL injection. If the SQL injection signature set is disabled within the profile, the WAF will not inspect traffic for those patterns, allowing attacks to pass through. This is the most direct and likely reason why SQL injection attacks are reaching the server despite the WAF being enabled.

A VDOM link is required to enable Layer-2 or Layer-3 connectivity between two VDOMs on the same FortiGate. Without a VDOM link, the VDOMs are isolated from each other, even if policies exist. The VDOM link acts as a virtual interface pair that forwards traffic between CustomerA and CustomerB, allowing the HTTP server access.

The 'diagnose sys top' command shows processes sorted by CPU usage by default; pressing 'm' changes sort to memory usage.

Options A and B are correct. 'get router info bgp neighbor' shows session state, and 'diagnose ip router bgp all enable' provides debug output for negotiation.

The output shows the IKE gateway is up but the IPsec tunnel has zero traffic. This often indicates a policy or routing misconfiguration. The most common cause is missing firewall policies to allow traffic through the tunnel.

To enforce device compliance during SAML authentication, the FortiGate IdP must have device compliance enabled, integrate with FortiClient EMS to receive posture data, and use ZTNA tags to define compliance requirements.

To redistribute connected routes into OSPF, you need to enable redistribution, optionally filter with a route map, and set the metric and metric-type to ensure proper route advertisement.

The Global ADOM in FortiManager is specifically designed to create and manage global objects (such as address objects, services, and schedules) that can be shared across all regular ADOMs. When an object is created in the Global ADOM, it is automatically available in all ADOMs that are linked to it, eliminating the need for duplication. This is the only native, supported method for sharing objects across multiple ADOMs in FortiManager.

Option B is correct because FortiAnalyzer must have the FortiGate added as a managed device in order to receive and process logs from it. This registration establishes the trust relationship and log-receiving configuration between the two systems.

DKIM (DomainKeys Identified Mail) is the correct answer because it provides email authentication by allowing the sender to cryptographically sign an email with a private key. The receiving mail server then retrieves the sender's public key from a DNS TXT record and verifies the signature, confirming that the email was not tampered with and originates from a domain the sender is authorized to use.

Option A is correct because for traffic to traverse between VDOMs via an inter-VDOM link, proper routing must be configured in each VDOM to forward traffic through the inter-VDOM link interface. Without correct routing entries (static or dynamic), packets will not be directed to the inter-VDOM link, and the next-generation firewall profile cannot be applied.

The Machine Learning (ML) Engine in FortiGate's antivirus uses ML to detect unknown malware.

The 'Device not reachable' error during an Install Preview operation indicates that FortiManager cannot establish or maintain the FGFM (FortiGate-to-FortiManager) tunnel with the remote FortiGate. When the FortiGate is behind a NAT device, the NAT may alter the source IP or port of FGFM traffic, causing the tunnel to break or preventing the FortiManager from reaching the FortiGate's management IP. This is the most common cause of such reachability failures in remote deployments.

ECMP requires that routes have the same distance and priority. Additionally, FortiGate uses source-destination IP hash by default; if sessions are sticky, one link may carry all traffic.

ZTNA requires a proxy policy to define access rules and a ZTNA proxy/gateway to terminate user connections. Tags and EMS are configured separately.

When FortiGate sends a file to FortiSandbox for inline scanning, it waits for a verdict before allowing the traffic to proceed. If the file scan timeout is too short, FortiGate will stop waiting for the verdict and pass the file anyway, causing the observed delay without a final verdict. This is the most likely cause because the administrator sees scanning occurring but no verdict returned, which aligns with a premature timeout rather than a failure to scan.

The command 'diagnose sys sdwan info' shows SD-WAN configuration and rule mapping, helping verify which rule is applied.

Inter-VDOM routing between VDOMs in different modes (NAT and transparent) requires a dedicated inter-VDOM link (IVL), which is a virtual internal connection that allows traffic to pass between VDOMs without consuming physical ports. The IVL creates a pair of virtual interfaces, one in each VDOM, and firewall policies must be configured to permit traffic across them. This is the only method that supports routing between VDOMs of different modes on the same FortiGate.

The 'No route to peer' message indicates FortiGate cannot find a route to the peer IP. Even though a static route exists, if the route's outgoing interface is down, it's not in the routing table. Option C is correct because a down interface invalidates the static route.

In transparent mode, FortiGate acts as a Layer 2 bridge, so interfaces do not require IP addresses. Deep inspection of HTTP traffic is applied via a firewall policy that references a deep inspection profile, and a management IP must be configured on the VDOM to allow the FortiGate to participate in management traffic (e.g., DNS, NTP, or proxy operations). Option A correctly identifies that the management IP is set on the VDOM and the inspection profile is applied to the policy.

Spillover algorithm will direct the new session to the secondary member because the primary's current load (80 Mbps) plus the new session (30 Mbps) would exceed the threshold (100 Mbps).

Option B is correct. Web Application Firewall (WAF) on FortiGate provides signature-based and anomaly-based detection for web application attacks like SQL injection and XSS.

When inter-VDOM traffic flows through a VDOM link, security profiles are applied only on the egress VDOM by default. This is because the VDOM link acts as a logical wire, and inspection occurs at the point where traffic exits the link. If the administrator has applied security profiles only on the ingress VDOM (VDOM-1), they will not be enforced on traffic leaving VDOM-1 toward VDOM-2, resulting in no inspection.

LAN edge management requires L2 connectivity between the FortiGate and devices, and proper interface configuration: FortiLink for switches and CAPWAP for APs.

FortiAnalyzer's Reports feature is specifically designed to generate scheduled, customizable compliance reports that aggregate data from multiple managed FortiGates. This allows administrators to produce weekly reports aligned with regulatory standards (e.g., PCI DSS, HIPAA) without manual effort, leveraging pre-defined or custom report templates.

Session helpers like SIP and FTP can alter sessions (e.g., opening dynamic ports) which can cause traffic to bypass security profiles if not handled correctly. TFTP and HTTP helpers are less likely to cause such issues; PPTP is less common.

For a FortiGate to appear in the Security Fabric topology on FortiManager, it must first be authorized in FortiManager. Even if the FortiGate is reachable via ping, without authorization, FortiManager will not accept its registration or include it in the topology view. This is a prerequisite step that must occur before any fabric communication can be established.

In transparent mode, FortiGate acts as a Layer 2 bridge, so traffic must flow through a single broadcast domain. If the two interfaces are not in the same software switch or VDOM, they are isolated, breaking the Layer 2 path between clients and the upstream router. Option C is correct because both interfaces must be logically bridged to forward traffic within the same VLAN.

Option A is correct. ECMP (Equal Cost Multi-Path) is the feature that allows a router to load balance traffic across multiple equal-cost paths. FortiGate supports ECMP by default for routing protocols like OSPF and BGP.

Inline CASB requires the traffic to be decrypted via SSL inspection; otherwise, the DLP engine cannot inspect the content of encrypted HTTPS traffic.

The 'diagnose ip router bgp routes' command provides detailed BGP route information, including the reason why a route is not best (e.g., weight, local preference, AS path, MED). Option A is correct.

FortiExtender connects via a WAN interface, typically configured as a 'wan' or 'vlan' interface. The FortiGate automatically detects the FortiExtender and creates a 'wwan' interface for the cellular link.

Option D is correct because the application uses hardcoded IP addresses or internal hostnames that are not resolvable externally. When the ZTNA proxy forwards the request to the internal server, the server responds with HTML content that references internal resources (e.g., images, scripts, or links) using private IP addresses (like 10.0.1.200) or internal DNS names. The remote client cannot resolve or reach these internal addresses, causing the page to load partially or display a blank page after a delay, even though the initial proxy connection and response are successful.

Option A is correct because FortiGate allows per-VDOM log configuration, including the FortiAnalyzer IP address, under the VDOM's log settings. This ensures that only logs from that specific VDOM are sent to the designated FortiAnalyzer, while other VDOMs remain unaffected.

For a FortiGate to join a Security Fabric, it must have network connectivity to the FortiManager that manages the fabric. FortiManager acts as the fabric root or controller, and the FortiGate registers with it using the FortiManager IP or FQDN. Without this connectivity, the FortiGate cannot be added to the Security Fabric topology.

Option D is correct because FortiGate integrates with FortiEDR via automation stitches, which allow events from FortiEDR (such as a detected threat) to trigger automated actions on FortiGate, such as blocking the source IP of the compromised endpoint. This provides real-time, policy-driven threat response without manual intervention, leveraging the Fortinet Security Fabric.

In transparent mode, the FortiGate acts as a Layer 2 bridge and does not participate in routing. A management IP address is required for administrative access (e.g., SSH, HTTPS) because the device does not have an IP on the bridged interfaces by default. This management IP is assigned to a dedicated management interface or a VLAN interface and allows the administrator to reach the FortiGate from the same subnet.

The IKE peer authentication method is controlled by the 'authmethod' parameter. Setting it to 'signature' enables RSA signature-based authentication using certificates.

Option C is correct because the 'Machine Learning Engine' in the antivirus profile uses on-device machine learning models to detect unknown malware based on file characteristics, without requiring signature updates. This provides proactive protection against zero-day threats directly on the FortiGate, aligning with the requirement to protect against unknown malware using machine learning.

FortiGuard Outbreak Prevention automatically blocks new threats by pushing updated signatures or indicators. It requires an active FortiGuard subscription and can be enabled globally.

The FortiGate's port1 IP (192.168.2.1/24) is on a different subnet (192.168.2.0/24) than the FortiManager's IP (192.168.1.100), which is on the 192.168.1.0/24 subnet. For a management connection to be established, the FortiGate and FortiManager must be able to route to each other, typically requiring them to be on the same subnet unless a gateway or static route is configured. Since no routing is mentioned, the subnet mismatch is the most likely cause of the failure.

FortiMail uses an 'Authentication Profile' to configure SPF, DKIM, and DMARC verification for incoming emails.

'diagnose debug application sip -1' enables SIP ALG debugging, showing how the ALG processes SIP messages.