Fortinet NSE 7 Advanced Security NSE7 (NSE7) — Questions 226–300

Option A is correct because inter-VDOM traffic on a FortiGate is controlled by firewall policies within each VDOM. By creating policies in each VDOM that specify the VDOM link as the interface, the administrator can explicitly allow or deny traffic between the VDOMs, enforcing security boundaries. Without these policies, traffic would be implicitly denied by the default firewall behavior.

ZTNA uses tags from EMS to make access decisions. The FortiGate must be configured to receive these tags via the EMS connector and then use them in firewall policies (via ZTNA rules). Option C is correct because the FortiGate needs to connect to EMS to pull tag information and then apply it in security policies.

Automation stitches can execute CLI commands or quarantine compromised hosts via EMS. These actions help contain the outbreak.

Outbreak prevention uses FortiGuard's outbreak alert database to block files that match outbreak criteria. It must be enabled in the antivirus profile under 'Outbreak Prevention'.

The correct answer is C because SQL injection attacks specifically target database queries by injecting malicious SQL statements through input fields. FortiGate's WAF signature category for SQL Injection is designed to detect and block these patterns, such as 'OR 1=1' or UNION-based injections, by matching against known attack signatures in the HTTP request payload.

An automation stitch consists of a trigger (event condition) and one or more actions. The trigger defines when the stitch runs; the action defines what happens (e.g., CLI script, email).

FortiManager can manage multiple Security Fabrics because it is designed as a centralized management platform that can oversee multiple independent FortiGate clusters or fabric topologies. Each Security Fabric is a logical grouping of FortiGate devices that share a common root FortiGate, and FortiManager can be configured to manage several such fabrics simultaneously, each with its own root and member devices, without requiring separate management servers.

To diagnose SIP ALG issues, the administrator should check SIP-specific debug, session table for UDP 5060, and application control logs. Viewing general traffic logs is less specific, and checking the routing table is not directly relevant to ALG processing.

Option D is correct. 'get router info bgp summary' displays a summary of all BGP neighbors and their states.

FortiExtender connects to a physical port (e.g., USB or Ethernet) and appears as a WAN interface. This interface can be added to the SD-WAN interface table as a member.

Option D is correct because inter-VDOM links are the only supported method for routing traffic between VDOMs on the same FortiGate. An inter-VDOM link creates a virtual point-to-point connection between two VDOMs, allowing traffic to flow through firewall policies. Without this link, VDOMs are isolated and cannot exchange traffic, even if static routes or BGP are configured.

FortiClient EMS is the correct component because it manages endpoint compliance policies, including antivirus status. It enforces the requirement by checking that devices have up-to-date antivirus software before issuing a ZTNA access token, which the FortiGate ZTNA gateway then validates to grant access.

Option B is correct because the root FortiGate acts as the central coordination point for the Security Fabric. All downstream FortiGate devices must be able to reach the root FortiGate's management IP address to establish and maintain the Fabric communication, which uses TCP port 8013 (HTTPS) for the initial handshake and subsequent keepalive messages. Without this reachability, downstream devices cannot join or synchronize with the Fabric.

Option A is correct because FortiManager supports centralized firmware management, allowing administrators to upgrade the firmware of multiple FortiGates simultaneously via the 'Firmware Upgrade' wizard in the Device Manager. This leverages the FortiManager's role as a central management point, which can stage and push firmware images to managed devices in a Security Fabric, reducing downtime and ensuring consistency across the fabric.

Option C is correct. Content Disarm and Reconstruction (CDR) is specifically designed to remove active content and rebuild files, making them safe for delivery.

The 'diagnose npu np6 sdf-wan health-check' command shows detailed probe statistics per member, including latency, jitter, and packet loss, helping to identify why the SLA is failing.

Active FTP requires the server to initiate a data connection back to the client. The session helper should dynamically create pinholes for these connections. If the session helper is not enabled for the policy, the data connection will be blocked.

SPF, DKIM, and DMARC are the three standard email authentication methods that work together to verify sender authenticity and prevent spoofing.

The correct answer is A because FortiSandbox's quarantine action can be configured based on a risk score threshold, not solely on the verdict. If the risk score for a file rated 'clean' exceeds the configured threshold, the file may still be quarantined. This occurs because the verdict and risk score are separate attributes; a 'clean' verdict indicates no known malware, but the file's behavior or heuristics may still generate a high risk score that triggers quarantine.

Log analytics (option B) is correct because it provides the ability to search, filter, and visualize logs from multiple FortiGates, enabling the identification of trends and anomalies necessary for compliance reporting. Reports (option C) is correct because FortiAnalyzer includes a dedicated reporting engine that can generate scheduled or on-demand compliance reports based on collected logs, with pre-defined templates for standards like PCI DSS, HIPAA, and SOX.

In a ZTNA connection, authentication can be performed using SAML (Security Assertion Markup Language) because it enables federated identity management and single sign-on (SSO), allowing the FortiGate to verify user identity via an external identity provider (IdP) without direct password handling. Certificate authentication is also valid because ZTNA leverages client certificates (X.509) to establish mutual TLS (mTLS) between the user device and the FortiGate, ensuring device identity and trust before granting access.

Route maps are used with route redistribution to filter which routes are redistributed and to modify route attributes (such as metric, tag, or next-hop) as they are injected from one routing protocol into another. Option D is correct because route maps provide granular control over the redistribution process, allowing administrators to match specific routes using prefix lists or ACLs and then set attributes like metric or tag before the routes are redistributed.

A Regular ADOM (non-root) is the correct choice because it allows the administrator to manage only the regular VDOMs (non-root VDOMs) on a FortiGate, excluding the root VDOM. This ADOM type is designed for managing individual VDOMs as separate entities, providing granular control without affecting the root VDOM's global settings or other VDOMs.

Option C is correct because each ZTNA rule maps to a single proxy destination port. The rule configured with proxy destination 10.0.10.100:443 only forwards traffic for that specific port. To access services on ports 8443 and 9090, separate ZTNA rules must be created for each port, each with its own proxy destination and access proxy configuration.

ZTNA proxy receives client requests, performs SSL inspection, and forwards the decrypted traffic to the internal server.

In ADVPN, shortcut tunnels require IKEv2 with the 'add-route' option and auto-negotiate. If the hub's phase2 configuration does not have 'auto-negotiate' enabled, it will not initiate shortcut tunnels.

Phase 1 establishes the IKE SA, Phase 2 creates the IPsec SA, then routing and policies are applied to allow traffic through the tunnel.

FortiGate's Antivirus feature is designed to scan SMTP traffic for malware by inspecting email attachments and body content against virus signatures. When configured in a security policy, it intercepts SMTP sessions, buffers the email data, and performs real-time scanning to block or quarantine malicious files before delivery to internal users.

FortiView is the correct feature because it provides real-time and historical traffic visibility, including top talkers, directly from the FortiGate's session table and logs. FortiView's 'Top Talkers' widget aggregates traffic by source IP, destination IP, or application, allowing the administrator to generate reports on the highest bandwidth consumers without needing to run complex queries in Log Analytics.

ECMP (Equal-Cost Multi-Path) by default uses a hash-based method to distribute traffic across the equal-cost paths.

Option C is correct. If both units show standalone, the HA heartbeat is not functioning. The most common cause is that the HA heartbeat interface is not configured correctly or is down on one unit.

Phase 2 uses IPsec SA negotiation, which is logged by IKE debug. Additionally, checking the phase 2 configuration can reveal mismatches. The correct commands are A and D.

Option D is correct because automation stitches on FortiManager are disabled by default after creation. The administrator must explicitly enable the stitch before it will trigger on incoming log events. Without enabling, the stitch remains inactive regardless of other configurations.

FortiWeb is a dedicated web application firewall that provides advanced bot detection and a positive security model, which allows only explicitly allowed traffic based on a whitelist of known good patterns. This is a key advantage over FortiGate, which primarily uses a negative security model (signature-based) and lacks the same depth of bot mitigation and positive enforcement for web-specific threats.

ADVPN shortcut tunnels require the spoke to accept shortcut offers from the hub. Setting 'set add-route enable' on the phase1 interface allows the spoke to install routes for shortcuts. Without this, the spoke will not create shortcut tunnels even if it receives the offer.

The most likely cause is that the machine learning engine is configured in monitor-only mode. In this mode, the ML engine will log detections and generate alerts but will not take any action to block the file, allowing it to pass through the policy. This is a common initial deployment strategy to assess the ML engine's impact before enabling active blocking.

To enforce device posture requirements like disk encryption and OS patch level, you need FortiClient on the device to report posture, FortiClient EMS to define compliance policies and generate tags, and FortiGate ZTNA proxy to check those tags before granting access.

The FortiEDR Sensor (Agent) is the endpoint-resident component that collects telemetry data—such as process creation, network connections, file system changes, and registry modifications—and securely transmits it to the FortiEDR management console (Controller) for analysis and threat detection. Without the sensor, the management console has no visibility into endpoint activity.

These are routing features in FortiOS.

In FortiOS, the 'proto_state=0a' value in session diagnostics indicates the session is in the TCP FIN_WAIT_2 state (hex 0x0a = decimal 10). This state occurs after the local side has sent a FIN and received an ACK, but is still waiting for the remote side to close its connection. It is a normal part of TCP connection teardown, but an excessive number of sessions in this state can indicate that the remote peer is not properly closing connections, potentially contributing to slow performance due to resource exhaustion.

Inter-VDOM routing requires explicit policy enforcement on both sides of the inter-VDOM link. A single policy in VDOM A cannot control return traffic from VDOM B, and FortiGate does not implicitly allow traffic between VDOMs. Therefore, policies must be configured in both VDOMs to permit traffic in both directions, ensuring stateful inspection and security controls are applied consistently.

The 'max-vdom' option under 'config system global' directly limits the number of VDOMs that can be created on a FortiGate. This setting enforces a hard cap on the total VDOM count, regardless of licensing or administrative roles. By default, the value is set to 10 on most models, but it can be increased up to the maximum supported by the platform or license.

Option A is correct because an automation stitch in FortiManager triggers only when the event type defined in the stitch matches the actual event generated by the FortiGate. If the event type (e.g., 'event-log' vs. 'traffic-log') does not match, the stitch will not fire. This is a fundamental condition for stitch execution.

Option B is correct because when an email is forwarded by an intermediary (e.g., a mailing list or forwarding service), the intermediary often modifies the message headers or body, which invalidates the DKIM signature. Since DKIM relies on a cryptographic hash of the original message content and selected headers, any alteration—even by a legitimate forwarder—causes the signature verification to fail. The SPF check passes because the forwarding server may be authorized in the SPF record, but DKIM failure triggers spam classification if the DMARC policy is not aligned.

Options A, B, and D are correct because FortiEDR provides real-time detection, automated response, and forensic investigation capabilities.

Check routing and firewall policies. If the tunnel is up but traffic is not forwarded, routing may be missing or firewall policies may be blocking or not matching.

The phase2 src-subnet is set to 10.0.1.0/30, which includes the tunnel interface IP 10.0.1.1/30. In IPsec VPN configurations, the phase2 selector must not include the tunnel interface IP itself because the tunnel interface is used for routing encapsulated traffic; including it can cause routing loops or prevent the tunnel from establishing correctly. The correct src-subnet should be the protected internal network behind the FortiGate, not the tunnel subnet.

Header policies in FortiManager are evaluated before any other policies in the same policy package. This allows administrators to enforce mandatory rules—such as blocking specific traffic or applying global inspection—that must be processed first, ensuring they are not bypassed by more specific policies later in the sequence.

If the policy package uses a different ADOM or the device is not properly synchronized, the policies may not apply correctly. The most common issue is that the policy package is not installed to the correct VDOM on the FortiGate.

A management VDOM is a dedicated administrative VDOM that isolates system management traffic (e.g., SSH, HTTPS, SNMP, syslog) from data-plane VDOMs. This ensures that administrative access and logging remain available even if a data VDOM fails or is misconfigured, and it prevents management traffic from competing with production traffic for resources.

These are core UTM features in FortiOS.

Option A is correct because in an active-passive HA cluster, setting a higher HA priority (e.g., 200) on the primary unit ensures it is elected as the active unit. This guarantees that VDOM1, which is not load-balanced, will run on the primary unit under normal conditions, as the higher priority value makes the primary unit preferred during the election process.

The 'diagnose sys session stat' command displays session statistics, including the total number of sessions.

ZTNA uses a proxy rule (access proxy) to publish the application, and a firewall policy that references ZTNA tags and the access proxy to enforce access based on identity and posture.

Source IP hashing in SD-WAN uses a hash of the source IP address to select a member for each flow. When multiple hosts reside in the same /24 subnet, their source IPs share the same first 24 bits, which can cause the hash algorithm to map them to the same SD-WAN member if the hash function is not sufficiently granular or if the number of members is small. This results in poor load distribution despite multiple sources.

Option A is correct because meta fields in FortiAnalyzer allow you to tag devices with custom attributes, which can then be used as filters when generating compliance reports. This enables the report to include logs from multiple FortiGates across different ADOMs by filtering based on the meta field value, rather than being restricted to a single ADOM's scope.

These are fundamental IPsec VPN concepts.

The most likely missing configuration is a VDOM link, which is the logical interconnecting interface required to route traffic between VDOMs. Without a VDOM link, VDOM-A and VDOM-B are isolated from each other, and no firewall policy or route can forward traffic between them. The administrator must create a VDOM link (e.g., using the 'config system vdom-link' command) to establish the Layer 3 adjacency needed for inter-VDOM communication.

The Global ADOM in FortiManager allows administrators to define firewall policies that are automatically inherited by all ADOMs, ensuring consistent, centrally managed policy enforcement across multiple FortiGates without manual duplication. This approach leverages FortiManager's hierarchical policy model, where global policies are pushed to each ADOM's policy packages and take precedence over local policies unless overridden.

Option B is correct. BFD (Bidirectional Forwarding Detection) provides sub-second failure detection. It can be configured to monitor the BGP session and trigger faster convergence.

Option A is correct because ADOMs in FortiManager maintain a revision history for each managed device or VDOM, allowing administrators to track configuration changes over time, compare revisions, and roll back to previous states if needed. This revision control is essential for auditing and troubleshooting in multi-VDOM environments.

Option A is correct because inspection profiles (such as antivirus, web filtering, and IPS) must be explicitly applied to the firewall policies that govern traffic traversing the inter-VDOM link. Without these profiles, the FortiGate will forward traffic between VDOMs based solely on the policy action (accept/deny) without performing any deep packet inspection, leaving the traffic unexamined for threats. This is a fundamental requirement for UTM inspection in a multi-VDOM architecture.

FortiGate's WAF feature requires SSL inspection to decrypt HTTPS traffic. Without an SSL inspection profile applied to the policy, the WAF cannot see the plaintext HTTP content.

When an administrator pushes a policy containing an FQDN address object from FortiManager, FortiManager resolves the FQDN to its current IP addresses at installation time. The resolved IPs are then written into the policy on the managed FortiGate, ensuring the policy is immediately effective without requiring the FortiGate to perform DNS resolution. This behavior is specific to FortiManager-managed policies and differs from locally configured FQDN objects on FortiGate.

Option D is correct because FortiManager manages log forwarding at the ADOM level. To forward logs from a specific VDOM (Guest) to FortiAnalyzer, the administrator must configure the VDOM's log settings to send logs to FortiAnalyzer and assign the FortiGate to an ADOM that has log forwarding enabled. This ensures that logs from the Guest VDOM are properly forwarded to the FortiAnalyzer managed by FortiManager.

When VDOMs are enabled, the 'get system status' command displays only the management VDOM (the VDOM from which the administrator is currently logged in). To see all configured VDOMs, the administrator must use the 'config vdom' command followed by 'show' or 'get system status' within the global context. Option D correctly identifies this behavior, as the second VDOM is not deleted or hidden by a bug; it simply is not shown by that command.