Fortinet NSE 7 Advanced Security NSE7 (NSE7) — Questions 376–450

Install preview is the correct feature because it allows the administrator to simulate the installation of policy package changes on a managed FortiGate without actually applying them. This provides a detailed diff of what will be added, modified, or removed, enabling verification before committing the changes. It is specifically designed for pre-commit validation in FortiManager's centralized management workflow.

Option A is correct because an automation stitch in FortiOS requires a trigger to initiate the workflow. In this scenario, the IPS event trigger is specifically designed to fire when a high-severity IPS signature match occurs, providing the necessary event data (e.g., attacker IP) to pass to subsequent actions. Without a trigger, the stitch would have no starting point.

FortiGate can assign IP pools based on user groups when using IKE with XAuth or IKEv2. The 'set ipv4-dns-server' and 'set ipv4-exclude-range' are not group-based. The 'set user-group' in phase1 associates a group with the tunnel, but IP pool per group requires separate phase1 configurations or using 'set ipv4-start-ip' with group mapping.

A stuck EXSTART state often indicates issues with the maximum transmission unit (MTU) or fragmentation, preventing OSPF packets from being exchanged properly. MTU mismatch or fragmentation due to encapsulation overhead can cause this.

FortiClient configuration profiles allow administrators to define and push ZTNA tags directly to FortiClient endpoints via the EMS-managed policy framework. This is a core method because tags are applied based on device posture and user identity, enabling granular access control without relying on network-layer attributes.

Option D is correct because an automation stitch in FortiManager is a sequence of automated actions (such as running scripts, sending alerts, or executing CLI commands) that are triggered by a specific event (e.g., a log message, a SNMP trap, or a schedule). This allows administrators to automate incident response and policy changes without manual intervention, directly within the FortiManager fabric.

In OSPF, area 0 must be a standard area (or at least not NSSA) for inter-area routes to be advertised. NSSA areas block type 3 LSAs by default.

Option A is correct. The 'diagnose sys sdwan info' command provides real-time information about SD-WAN rules, member status, SLA performance, and route selection. It is the first step to troubleshoot why traffic is not following the expected path.

In FortiGate session output, proto_state=01 for TCP (proto=6) means the session is in the 'SYN_SENT' state, indicating the three-way handshake has not completed.

ZTNA can be deployed in proxy-based or agent-based modes. For applications that cannot have a client software, the proxy-based method (where FortiGate acts as a reverse proxy) is ideal. The user's FortiClient can still provide posture data, but the application server does not need an agent.

Option D is correct because the admin account used to configure the automation stitch must have the necessary permissions to modify the blocked IP list. In FortiOS, the automation stitch action 'Add to Blocked IPs' requires write access to the firewall address object or the blocked IP list. If the admin account has read-only or restricted privileges, the action will fail silently, even if the trigger and action are correctly configured.

In transparent mode, the FortiGate operates as a Layer 2 bridge and does not route traffic based on IP addresses. Therefore, firewall policies must use 'all' for both source and destination addresses because the FortiGate does not see the original source or destination IPs—it only sees MAC addresses and forwards frames transparently. Using specific IP subnets would break the policy as the FortiGate cannot match Layer 3 addresses in this mode.

FortiNAC enforces network access by dynamically changing VLANs or applying ACLs based on compliance. FortiNAC's NAP defines the conditions and actions, such as moving a non-compliant endpoint to a quarantine VLAN.

Split-brain occurs when HA heartbeat communication fails, causing both units to believe they are the primary. A broken heartbeat link is the typical cause.

Option D is correct. SD-WAN rules require performance SLA targets to be configured and linked to the SD-WAN rule. Without an SLA, the latency strategy has no performance benchmark to trigger failover.

If the tag is met, the device passes posture. Access failure can be due to wrong proxy destination (A), missing firewall policy (C), or untrusted certificate (D). Tag assignment (B) is irrelevant if tag is already satisfied; FortiClient EMS is not required for device posture if using other telemetry (E), but even if required, not having FortiClient would prevent the tag from being met, which contradicts the premise.

To verify SSL inspection, check policy configuration, use session filter to see if sessions are decrypted, and use debug flow to inspect the traffic path. Option A, B, and D are correct.

Option A is correct because 'diagnose sniffer packet any host 10.1.2.100 4' captures packets to/from the server at the interface level, allowing the administrator to see if traffic from VLAN 100 is actually arriving at the FortiGate and whether it is being dropped or forwarded. This command helps identify if the issue is at Layer 2 (e.g., VLAN misconfiguration) or Layer 3 (e.g., routing or firewall drops).

Option C is correct because FortiManager uses policy packages that must be explicitly assigned to a device group or specific FortiGate. Even if the FortiGate is registered and part of the Security Fabric, if the policy package is not assigned to the correct device group or policy target, the FortiGate will not receive policy updates. This is a common misconfiguration where the policy package exists but is not linked to the device.

In transparent mode, FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses rather than IP addresses. This allows firewall policies, including antivirus inspection, to be applied to traffic between VLANs without modifying the IP path or requiring NAT, ensuring seamless integration into existing Layer 2 networks.

DPD is used to monitor the liveness of the remote peer. If the peer becomes unreachable, DPD detects it and can trigger a failover or tunnel teardown, ensuring traffic does not blackhole.

BGP Idle state often indicates a TCP connection issue. If the update source is a loopback, the neighbor must have a route to that loopback IP, or the update-source must match the neighbor's configured remote-as and reachability.

FortiAnalyzer reports are built from log data collected from FortiGate devices, which includes traffic logs, event logs, and security logs. This log data is the primary source for compliance reporting because it provides detailed records of network activity. FortiView traffic statistics are also a valid data source, as they aggregate real-time and historical traffic data from FortiGate logs, allowing reports to include graphical summaries and top-talker information.

VRF allows multiple independent routing tables to coexist on the same FortiGate, enabling traffic separation without separate physical devices.

Tunnel flapping with IKEv2 is often due to DPD mismatches or aggressive DPD retry intervals. If DPD is configured with very short intervals, the tunnel may drop due to transient delays.

OSPF requires multicast support (224.0.0.5) to form adjacencies. Without multicast over the VPN tunnel, OSPF cannot exchange hello packets properly.

Option D is correct because session pickup and HA session synchronization are specifically designed to replicate the session table from the primary FortiGate to the secondary unit in an active-passive cluster. Without this feature, the secondary unit becomes primary but has no knowledge of existing sessions, causing all active connections to drop. Enabling session synchronization ensures that session state information is continuously mirrored to the standby unit, allowing seamless failover without disrupting established flows.

The correct answer is C. SSL VPN tunnels typically allow TCP-based traffic like HTTP/HTTPS to internal web servers, but ICMP (ping) is a separate protocol that requires explicit permission in the firewall policy. Without a firewall policy rule permitting ICMP from the SSL VPN interface to the internal network, the FortiGate will drop the ping requests, even though the tunnel is established and other traffic flows.

The output shows `duration=3600`, meaning the session has been active for 3600 seconds (1 hour), and `expire=3599`, meaning the session will expire in 3599 seconds (approximately 1 hour). The `proto=6` indicates TCP (protocol 6), and `proto_state=01` corresponds to TCP state ESTABLISHED. Therefore, the session was established 1 hour ago and will expire in about 1 hour, making option A correct.

The error 'Maximum number of VDOMs reached' occurs when the FortiGate attempts to exceed the licensed VDOM count, even if the hardware model supports more. FortiGate VDOM licensing is enforced via a separate license file; without a valid, non-expired license, the device restricts VDOM creation to the default (often 1 or 2) or previously licensed limit. This is a common issue when a license has expired or was never installed.

The 'auth_fail' reason indicates that the authentication request was processed but rejected, typically because the SSL VPN portal is not configured to reference the user group that 'user1' belongs to. Without a group filter or group mapping in the SSL VPN settings, the FortiGate cannot match the user to any allowed group, causing the authentication to fail even if the user credentials are valid.

The command 'get system ha status' shows the cluster status and synchronization state. The command 'diagnose ha dump' provides detailed synchronization information.

The debug indicates the SSL VPN tunnel establishment fails because the client does not respond. This commonly occurs when the client is behind a NAT device that drops keepalive packets or blocks UDP/TCP ports needed for the tunnel. Option D correctly identifies a firewall blocking necessary ports.

The error indicates that the FortiGate cannot find the CA certificate that issued the peer's certificate. The CA certificate must be imported and trusted on the FortiGate.

FortiManager maintains revision history for managed devices. The admin can restore a previous revision to revert the configuration.

VDOM links are special inter-VDOM interfaces that require firewall policies on both VDOMs to permit traffic. Without a policy on VDOM-A and VDOM-B that allows traffic over the VDOM link interface, packets will be dropped by the implicit deny rule. This is the most common missing step when inter-VDOM routing fails.

FortiGate's Advanced Threat Protection (ATP) suite is designed to detect and block advanced, unknown, and zero-day threats. FortiGuard Antivirus (C) is a core ATP component that uses signature-based and heuristics-based scanning to detect known malware at the gateway. FortiSandbox (D) extends this by detonating suspicious files in a virtual environment to identify unknown threats, making both integral to the ATP suite.

The FortiGate 600F, when properly licensed, supports up to 500 VDOMs. This is because the 600F is a mid-range enterprise appliance designed for large-scale multi-tenant environments, and its hardware resources (CPU, memory, and NP7 processors) are provisioned to handle the control-plane and data-plane overhead of up to 500 virtual domains. The license unlocks the VDOM feature, but the maximum count is a hardware-imposed limit, not a software cap.

The output shows a TCP session (proto=6) with state 01, which in Fortinet's session table indicates an established TCP connection. The duration of 3600 seconds and expire value of 3599 seconds mean the session has been active for about one hour and has approximately one hour remaining before the idle timeout expires. This matches option B.

NAT traversal (NAT-T) is required when a VPN tunnel passes through a device performing Network Address Translation (NAT). NAT-T encapsulates ESP packets inside UDP 4500 to avoid issues with NAT modifying IP headers. Even if phase 1 parameters match, without NAT-T enabled on both peers, the tunnel may fail to establish if a NAT device is detected between them.

FortiExtender requires provisioning from the FortiGate; the APN must be configured correctly, and the extender may need to be activated.

FortiMail is the correct answer because it natively integrates Content Disarm and Reconstruction (CDR) to sanitize email attachments by removing active content (e.g., macros, scripts, embedded objects) and rebuilding the file in a safe format. This prevents zero-day exploits that bypass signature-based detection, as CDR does not rely on threat intelligence but instead strips potentially malicious elements before delivery.

The error indicates that FortiGate cannot find the CA certificate used to generate a proxy certificate for the site. This happens when deep inspection is enabled but the CA certificate used for re-signing is missing or misconfigured.

Option C is correct because the Revision History feature in FortiManager allows an administrator to compare the current configuration of a policy package with a previous version, showing a detailed diff of exactly which policies will be added, removed, or modified. This provides a precise verification of changes before installation, unlike the Install Preview which only indicates that changes exist without showing the specific modifications.

In an active-active HA cluster with virtual clusters, each VDOM must be explicitly assigned to a virtual cluster to participate in load balancing. If a VDOM is not assigned to any virtual cluster, it defaults to being handled only by the primary unit, regardless of the cluster mode. This explains why traffic from that VDOM is not load-balanced.

Option D is correct. Revision history stores previous versions of policy packages, allowing rollback. Install preview shows pending changes but does not roll back.

The SD-WAN rule uses the 'best quality' strategy, which selects the member with the best SLA performance. The MPLS link fails its SLA because its measured latency of 12 ms exceeds the configured threshold of 10 ms, even though jitter is within limits. The broadband link meets both its latency (25 ms < 50 ms) and jitter (10 ms < 20 ms) thresholds, so it becomes the active path for the application traffic.

ZTNA uses tags to indicate device posture. The FortiGate or FortiClient EMS can check for antivirus status and include that information in the device's posture tag. The ZTNA access proxy rule can then require that tag for access.

Option C is correct because protocol anomaly detection can have thresholds; adjusting them allows legitimate traffic to pass while still detecting anomalies.

Option A is correct because header and footer policies are global constructs that can only be created and managed within the global ADOM. These policies are automatically applied to all policy packages across all regular ADOMs, ensuring consistent enforcement at the top and bottom of the policy list without local modification.

Inter-VDOM routing on a FortiGate requires firewall policies in both VDOMs to permit traffic in both directions. Even if VDOM A has a policy allowing traffic to VDOM B, VDOM B must have a corresponding policy to allow the return traffic or the initial traffic from VDOM A to be processed. Without this, the FortiGate drops the packets due to asymmetric policy enforcement.

Options A and D are correct because triggers define what event starts the automation, and actions define what the automation does (e.g., block IP).

Option A is correct. 'diagnose sys top' shows real-time CPU and memory usage per process, similar to the Linux 'top' command. It helps identify which process is consuming CPU.

When FortiGate is the IdP, it must have the correct Assertion Consumer Service (ACS) URL to which the SAML response is sent after authentication. A mismatch prevents the redirect back to the SP.

FortiDeceptor is a dedicated deception-based security solution that deploys decoys (honeypots) and lures across the network to detect and misdirect attackers. It integrates with FortiGate and FortiSIEM to provide automated threat isolation and forensic data collection, making it the best choice for a honeypot deployment.

Option C is correct because an automation stitch requires at least one action to execute when triggered. Actions define the actual response, such as running a CLI script, adding an IP to a blocklist, or sending an email. Without an action, the stitch would have no effect on the network.

Increasing the phase2 rekey time to 8 hours (Option D) reduces the frequency of rekey events, which can cause brief packet loss during key regeneration. This is especially beneficial for stability when the tunnel experiences intermittent loss due to rekey timing. A longer rekey interval minimizes disruptions, making it a correct choice.

Start with basic configuration, then user authentication, then policies, then debug, then routing.

ZTNA tags are dynamic attributes (e.g., OS type, antivirus status) assigned to devices based on posture checks. They are used in firewall policies to grant access based on device compliance, not for routing or QoS.

CLI script execution is a valid action type in FortiManager automation stitches because it allows the administrator to run a predefined CLI script on a managed FortiGate device directly from the stitch. This enables automated configuration changes or troubleshooting commands in response to a trigger, such as blocking an IP address after an intrusion detection event.

A Global ADOM in FortiManager is a special administrative domain that stores objects and policies shared across multiple regular ADOMs. This allows administrators to define common objects (e.g., address groups, services, schedules) once in the Global ADOM and then reference them in per-ADOM policies, ensuring consistency and reducing duplication. It does not replace the root ADOM, nor is it limited to backups or single-VDOM management.

Common issues: firewall policies must allow traffic from VPN IP pool to internal network; routing must be correct; NAT should not be applied to VPN traffic (unless required). Checking these three areas typically resolves connectivity issues.

Duration 3600 seconds (1 hour) and expire 3599 seconds means the session has been active for 1 hour and will expire in about 1 hour, total timeout 2 hours, which matches the default TCP session timeout.

The most likely cause is an incorrect gateway IP address in the default route for the 'corp' VDOM. Since the guest VDOM works correctly, the HA cluster and VDOM configuration are functional, and the issue is isolated to the corporate VDOM's routing. A misconfigured next-hop IP would prevent traffic from reaching the internet, even though the route itself is present in the routing table.