Fortinet NSE 7 Advanced Security NSE7 (NSE7) — Questions 301–375

Option A is correct. The 'no proposal chosen' error in phase 2 indicates a mismatch in the phase 2 parameters (encryption, authentication, PFS, etc.) between the two peers. The administrator should verify that the phase 2 selectors and proposals match on both ends.

Lowest-cost algorithm selects the member with the lowest cost (from performance SLA) for each session. Other algorithms do not consider cost.

Create virtual router, define areas and networks, set router ID, enable on interfaces, then verify.

Option D is correct: FortiAnalyzer reports use SQL-like queries and dataset definitions to filter and aggregate log data based on severity, attack type, etc.

FortiNAC is the Network Access Control solution from Fortinet. It provides visibility, control, and automated response for endpoints on the network, including device profiling, guest management, and policy enforcement. Option A is correct.

Option B is correct because an Antivirus profile with SSL inspection enabled is required to decrypt encrypted C2 (command-and-control) traffic so that FortiGate can inspect the payload for malware signatures, heuristics, and behavioral patterns. Without SSL inspection, the ATP engine cannot see inside the encrypted tunnel, rendering the antivirus and other security profiles ineffective against encrypted C2 communications.

FortiNAC policies can enforce compliance by moving endpoints to a quarantine VLAN or applying a quarantine ACL. The typical action is to place the endpoint in a quarantine VLAN where access is restricted.

The 'disconnected' status indicates that the FortiGate cannot establish a TCP connection to the FortiAnalyzer. The first step is to verify basic Layer 3 reachability (ping) and that the FortiAnalyzer service is listening on the default port (TCP 514 or 3000 for encrypted). Without confirming these, further troubleshooting is premature.

Option C is correct. Policy-Based Routing (PBR) allows forwarding decisions based on source IP, destination IP, protocol, port, etc., overriding the destination-based routing table.

SAML SSO requires certificate trust. If the IdP certificate is not trusted by the FortiGate, the SAML assertion will not be validated, causing authentication failures. The clock skew is another common issue.

FortiGate's IPsec virtual interfaces require the 'allowaccess' command to specify which dynamic routing protocols are allowed. Without 'allowaccess ospf', OSPF packets are dropped even if the tunnel is up.

Since both phases are up and policies are correct, the issue is likely routing. The administrator should verify that the correct routes are pointing to the VPN interface (tunnel interface) on both sides. Without proper routes, traffic will not be forwarded into the tunnel.

Even though OSPF neighbors are FULL, routes may not be installed if they are not selected as best paths. One common reason is that the OSPF cost is higher than a static route or another routing protocol's metric. The other options would prevent neighbor from reaching FULL state.

Option B is correct because the 'Install on Next Reboot' option ensures that configuration changes are staged on the remote FortiGate and applied atomically when the device reboots. This prevents partial or inconsistent application over an unreliable WAN link, as the FortiManager pushes the full configuration revision to the device, which then applies it during the boot process without requiring a persistent management session.

CDR requires proxy-based inspection to intercept, disarm, and reconstruct documents. Flow-based inspection bypasses the deep inspection engine, so CDR cannot process the files, causing delivery failures. FortiGate must use proxy-based inspection mode for CDR to function correctly.

Option A is correct because adding the source IP to a local address group that is referenced in a block policy dynamically updates the firewall rule set to drop all traffic from that IP. This is a common automation stitch action in FortiGate that leverages the local address object and policy to enforce immediate blocking without manual intervention.

The 'Maximize Bandwidth' strategy distributes traffic based on volume, but if the algorithm is set to 'Volume' and the bandwidth ratio settings (set bandwidth-weight) are imbalanced, one link might be preferred. However, the most common cause is that the SD-WAN rule's 'dst' or 'src' match criteria are restricting traffic to only wan1, or the rule's 'set member' includes only wan1. Another possibility: the rule might have 'set priority' or 'set input-device' that forces traffic to wan1.

Option D is correct because the output shows 'duration=3600' and 'expire=3599', meaning the session has been active for 3600 seconds (1 hour) and will expire in 3599 seconds (approximately 1 hour). The 'proto=6' indicates TCP, and 'proto_state=01' is the TCP state code for an established connection (ESTABLISHED), not a half-open state. This is a normal, healthy session.

The debug shows the load balancer selected a server, but the connection fails. This indicates the server is not responding or the health check is failing. The administrator should check the server's health and ensure the real server is up.

ZTNA tags are used to define device posture requirements, such as antivirus status. FortiClient reports compliance, and the FortiGate uses these tags to allow or deny access.

Option A is correct because VDOMs must be enabled on the FortiGate and each VDOM must be configured to allow FortiManager management. This is done by setting the 'set vdom mgmt' parameter within each VDOM or globally, which permits FortiManager to push policy and object changes to the specific VDOM context. Without this step, FortiManager cannot authenticate or communicate with the VDOMs, even if the device is added to the ADOM.

FortiGate communicates with FortiClient EMS using HTTPS (TCP/443) to retrieve tags and endpoint posture information.

PKI certificates allow the FortiGate to verify the identity of remote peers using digital certificates issued by a trusted Certificate Authority.

FortiClient's Advanced Threat Protection (ATP) includes endpoint detection and response capabilities such as ransomware behavior detection.

Option B is correct. The Active state in BGP means the router is attempting to establish a TCP connection; the session is not yet up.

Certificate-based authentication requires both sides to have valid certificates and the CA must be trusted. Without these, IKE negotiation fails.

'diagnose sys top' provides a real-time view of process CPU usage, similar to Linux 'top', allowing identification of resource-intensive processes.

FortiSIEM (or FortiSOAR) provides security information and event management. FortiSOC is a service, but the product that correlates events is FortiSIEM.

When packets arrive on the VDOM link interface but are not forwarded, the issue is typically a missing or misconfigured firewall policy in the destination VDOM (VDOM-2). Even though inter-VDOM routing is correctly set up via the VDOM link, FortiGate requires an explicit firewall policy in the destination VDOM to permit traffic from the VDOM link interface to the destination server. Without this policy, the FortiGate drops the packets after routing, which matches the symptom of packets arriving but not being forwarded.

Route maps used for redistribution require a 'match' statement to select routes. If the route map has only a 'set' action without a 'match', it may not match any routes, resulting in no redistribution. A common mistake is omitting the 'match' clause.

Option C, Install preview, is correct because it allows the administrator to review the exact configuration changes that FortiManager will push to the managed FortiGate before the changes are committed. This feature compares the current running configuration on the FortiGate with the intended policy package in FortiManager and displays a detailed diff of additions, deletions, and modifications. It is specifically designed to prevent unexpected policy mismatches by providing a pre-commit review step.

Option C is correct because per-VDOM logging must be enabled on the FortiGate to allow each VDOM to generate its own independent log stream. Without this setting, all VDOMs share a single log stream, making it impossible to separate traffic patterns per VDOM on FortiAnalyzer. Option E is correct because log forwarding from each VDOM to FortiAnalyzer is required to send the per-VDOM logs to the FortiAnalyzer for reporting.

The antivirus engine may be outdated (AV database) or the feature (FortiGuard AV) may not be enabled on the profile. Scanning mode (flow vs proxy) can affect detection but is less likely than these two.

ZTNA tags reflect device posture, including antivirus status. FortiClient EMS reports compliance, and FortiGate can use those tags in ZTNA rules to permit or deny access based on antivirus status.

These are common CLI commands used in FortiOS.

To handle asymmetric routing, the administrator can enable 'set pbr-enforce-symmetric', configure policy-based routing to enforce symmetric paths, or use route maps to influence route selection.

Option C is correct because when a FortiGate is configured to drop logs when the remote logging server (FortiAnalyzer or syslog) is unreachable, the logs are discarded locally rather than queued or buffered. This behavior is controlled by the 'log-drop-packet' setting or the 'reliable' vs 'unreliable' logging mode, and if the remote server is down, the logs never leave the FortiGate, resulting in no logging despite the policy being set to log all sessions.

These are authentication methods supported on FortiGate.

To block malicious files detected by FortiSandbox in email, the FortiGate must submit files to FortiSandbox and then use the verdict to update its local block list. Option A and D are the correct steps.

In transparent mode, the FortiGate acts as a Layer 2 bridge, and security policies are applied to the ingress interface where traffic enters the device. This allows the firewall to filter traffic between VLANs based on Layer 3 and Layer 4 criteria without requiring IP addresses on the interfaces, as the device is transparent to the network.

Option B is correct because the install preview in FortiManager allows the administrator to review the exact configuration changes (adds, deletes, modifications) that will be pushed to the target devices before committing the installation. This step is critical to avoid unintended policy disruptions, as it shows a diff of the policy package against the current device configuration. Option C is correct because selecting target devices and clicking 'Install' is the final manual step that triggers the actual deployment of the policy package to the chosen firewalls within the ADOM.

A prefix list in FortiGate is used to match routes based on their network prefix and subnet mask (prefix length). It is commonly applied in route maps or BGP configurations to filter or manipulate routing information, such as in redistribution or neighbor policy statements. Unlike access lists, prefix lists match the exact prefix and length, providing more granular control over route advertisement and acceptance.

In an ADVPN setup, enabling auto-discovery on the hub allows it to send shortcut route advertisements to spokes, which then can establish direct tunnels. The output confirms the gateway is configured to participate in ADVPN as a hub or as a spoke that can initiate shortcuts.

To enforce ZTNA tag-based access, the FortiGate must import the tag from EMS (A) and the ZTNA rule must be referenced in a firewall policy (D). Without the firewall policy, the rule is not applied to traffic.

Phase1 being up indicates IKE SA is established. Phase2 down indicates IPsec SA negotiation failed, typically due to mismatched proposals (encryption, integrity, PFS) or traffic selector mismatch.

ZTNA rules can require both authentication and device posture (ZTNA tags). If the device tag is missing or does not match, the access will be denied. The user may see an access denied page or a generic error.

For shortcut tunnels to be established in ADVPN, each spoke must have a tunnel interface with an IP address in the same subnet as other spokes, and the 'auto-discovery' setting must be enabled on the spoke's phase1 configuration. Additionally, a firewall policy must allow the shortcut traffic. Option D is correct because without enabling auto-discovery on the spoke's phase1, the spoke will not initiate shortcut negotiation.

proto=6 indicates TCP. proto_state=01 means the session is in 'established' state (TCP state established). duration=3600 seconds means the session has been active for 1 hour. expire=3599 means it will expire in 3599 seconds (almost 1 hour more). This indicates a healthy long-lived TCP session that is still active.

Option A is correct because tunnel mode is required for an always-on SSL VPN tunnel, as it encapsulates all traffic at the network layer (TUN) and maintains a persistent virtual interface on the client. This allows the VPN to stay active and automatically reconnect when the user's network changes, such as switching from Wi-Fi to cellular, without manual intervention.

For NAC enforcement, FortiNAC typically uses SNMP to query switch port status and RADIUS to authenticate devices. FortiClient EMS provides endpoint compliance data that FortiNAC can use to determine access rights.

BFD provides fast failure detection (sub-second) for routing protocols like OSPF, triggering quicker route convergence.

'diagnose sys session stat' displays session statistics including total active sessions.

Option C is correct because using a dedicated management VDOM is a best practice in multi-VDOM deployments. It isolates administrative traffic (e.g., HTTPS, SSH, SNMP) from data-plane VDOMs, ensuring that management access remains available even if a data VDOM fails or is misconfigured. This also simplifies auditing and RBAC by centralizing admin access without exposing production traffic.

ZTNA tags are assigned by FortiClient EMS based on device posture. If the FortiGate does not trust the EMS server or the tag names are mismatched, the tag check fails. The EMS must be configured as an endpoint control source and the tags must exactly match those defined in EMS.

When using SAML, the FortiGate needs to map the SAML attributes (e.g., username) to a user group. If the user is not in the correct group, access will be denied.

In transparent mode, FortiGate bridges traffic at Layer 2, so security policies must use the bridge interface as both source and destination. Option B correctly configures a security policy with source and destination interfaces set to the bridge, action ACCEPT, and a web filter profile applied. This allows the FortiGate to inspect HTTP traffic between the two broadcast domains and apply the web filter.

Options A and C are correct. 'diagnose sys sdwan info' shows SD-WAN configuration and SLA status. 'diagnose sys session list' with filters shows the session details including SD-WAN member selection. Option B is invalid, D shows overall status but not per-rule, E is unrelated.

Always back up config before upgrade, then upload, confirm, and verify.

In FortiManager, header and footer policies are specifically designed to be shared across multiple devices within a policy package. By configuring them as header/footer policies, the administrator ensures that these common rules are applied consistently at the top and bottom of the device-specific policy tables, while the middle policies can vary per device. This is the correct method for deploying shared policies without duplicating them in each device's policy set.

DPD (Dead Peer Detection) is configured with a retry count of 3 and a retry interval of 10 seconds. This means the FortiGate will send DPD probes every 10 seconds and after 3 consecutive failures (30 seconds total without response), it will consider the peer dead. The tunnel is currently down, likely because DPD detected the peer as unreachable.

In FortiManager, a Global ADOM is a special administrative domain that stores global objects (such as address objects, services, and policies) that can be shared and referenced by all regular ADOMs. This centralizes management of common resources, reducing duplication and ensuring consistency across multiple ADOMs. Regular ADOMs are isolated from each other by default, but they can import objects from the Global ADOM, which is the key distinction.

Split-brain occurs when heartbeat communication fails, and both units assume primary role. Restoring the heartbeat link (Option C) allows them to re-establish communication and elect a single primary.

For ADVPN shortcut tunnels to form, the hub must have 'set auto-discovery-sender enable' and spokes must have 'set auto-discovery-receiver enable'. If the hub does not advertise its ability to relay shortcut routes, spokes will not attempt to create direct tunnels.