Fortinet NSE 7 Advanced Security NSE7 (NSE7) — Questions 526–600

Option B is correct because FortiGate VDOM resource limits allow an administrator to set a specific memory cap for each VDOM, including the management VDOM. By enabling VDOM resource limits and configuring a memory cap, the management VDOM is prevented from consuming excessive memory, ensuring fair resource allocation across all VDOMs. This is the only option that directly limits memory usage at the VDOM level without requiring hardware changes or disabling features.

The output shows `duration=3600` and `expire=3599`, meaning the session was established 3600 seconds (1 hour) ago and has 3599 seconds remaining before timeout. The `proto=6` indicates TCP (protocol 6), and `proto_state=01` corresponds to TCP state ESTABLISHED. Therefore, the session is active and will expire in about 1 hour from the current time, making option C correct.

DPD with 'on-idle' sends periodic probes during idle periods to detect a dead peer, allowing quick re-negotiation if needed. Option D disables idle timeout but does not probe; the tunnel may still go down if the peer disappears.

CDR removes potentially dangerous content (like macros, scripts) from documents and then reconstructs a safe version, preventing exploits that might bypass signature-based detection.

The 'no proposal chosen' error during Phase 2, despite Phase 1 being up, indicates a mismatch in the IPsec security association (SA) parameters. Since the remote FortiGate has multiple Phase 2 selectors configured, the most likely cause is that the local and remote proxy IDs (local and remote subnets) do not match any of the configured selectors. Phase 2 negotiation uses these proxy IDs to define which traffic should be encrypted; if they don't align, the IKE SA cannot be established.

DPD is used to detect if the remote peer is still alive. It sends periodic messages and if no response is received, the tunnel is considered down. Option A is correct.

The ZTNA proxy has its own idle timeout setting that operates independently of the global timeout. Even though the global timeout is set to 30 minutes, if the per-proxy idle timeout is configured to a lower value (e.g., 30 seconds), the proxy will terminate the session after that idle period, logging 'ZTNA session timeout'. This explains why the connection fails after a few seconds despite the long global timeout.

The lowest-cost algorithm selects the member with the lowest cost value. If the cost exceeds a configurable threshold, traffic is sent to the next best member. This matches the requirement.

Option B is correct because a configuration checksum mismatch between peers is a common post-upgrade issue that causes BGP sessions to flap. A new default setting or changed behavior in the new firmware can alter the update message, leading to a checksum mismatch.

Inter-VDOM routing on FortiGate requires a VDOM link, which is a logical interface pair that connects two VDOMs. Firewall policies must be configured on both sides of the VDOM link to explicitly allow traffic between the VDOMs, ensuring logical separation while enabling controlled communication. Without these policies, traffic will be dropped even if routes exist.

Prefix lists are used to match specific IP prefixes and prefix lengths, commonly used in route maps to filter routes.

proto_state=01 indicates TCP SYN_SENT state, meaning the session has not completed three-way handshake.

In ADVPN, the hub must not include static routes for the spoke subnets, otherwise the spokes will use the hub as next-hop and not attempt shortcut establishment. The hub should use dynamic routing (BGP/OSPF) to propagate routes but not install a route with a next-hop of the hub itself for other spoke subnets. Option B is correct.

The 'Active' state means the router is trying to initiate a TCP connection but is not receiving a response. Common causes include BGP configuration mismatch, especially the remote AS number.

Application control requires visibility into the application layer to identify HTTPS-based traffic. Without SSL inspection, the firewall cannot decrypt the HTTPS payload to inspect the application signatures. Enabling an 'ssl-ssh-profile' with deep inspection on the policy allows the FortiGate to decrypt the traffic, apply the application control profile, and effectively block social media applications.

The ipsengine process handles Intrusion Prevention System (IPS) inspection. High CPU usage by ipsengine typically indicates that the FortiGate is processing a large volume of traffic through IPS signatures, which is computationally intensive. This is often triggered by a DoS attack or a sudden surge in traffic that requires deep packet inspection, overwhelming the CPU.

Performance monitoring logs contain periodic samples of system resource usage, including session count and CPU. The administrator should enable performance logging on FortiGate and send it to FortiAnalyzer.

OSPF over IPsec often requires adjusting the MTU to avoid fragmentation. The default MTU of 1500 can cause OSPF packets to be fragmented, leading to neighbor state issues.

ZTNA inline CASB can apply DLP (Data Loss Prevention) profiles to inspect content. To block uploads with credit card numbers, a DLP profile with a credit card number sensor should be applied to the ZTNA proxy rule. Option B is correct.

Aggressive mode is required for IKE behind NAT when using ADVPN shortcut tunnels. Without it, the hub cannot learn the public IP/port of each spoke to facilitate the shortcut.

To gracefully test failover, the administrator can execute 'execute ha failover' on the primary unit. This forces the primary to become secondary, and the passive unit takes over.

For ADVPN to work, the hub must have 'auto-discovery-sender' enabled and also must not redistribute spoke routes back to other spokes in a way that prevents shortcut. Typically, the hub should not redistribute OSPF routes learned from one spoke into another; ADVPN relies on IKE shortcuts.

Option A is correct because setting the MPLS link priority to 10 (higher) and broadband to 5 (lower) ensures the SD-WAN rule with 'best quality' strategy selects the MPLS link as the preferred path. The 'best quality' strategy evaluates link quality metrics and, when priorities differ, prefers the higher-priority link. If the MPLS link fails, the strategy automatically fails over to the broadband link, meeting the requirement.

Option C is correct because a VDOM link creates a direct Layer 2 or Layer 3 connection between two VDOMs, allowing traffic to be controlled by firewall policies. This is the only method that enables policy-based inter-VDOM routing without requiring external cables or complex routing configurations.

This error typically indicates the SSL VPN client is not responding during tunnel setup, often due to network connectivity issues or a firewall blocking the required ports.

BFD provides fast failure detection between adjacent routers, enabling quicker convergence than routing protocol hellos.

BFD detects failures faster than BGP keepalives. If the network has high latency or occasional packet loss, BFD may time out and declare the peer down, causing BGP to reset. The BFD timers might be too aggressive for the network conditions.

ZTNA proxy provides application-level access without full network connectivity, enforcing identity and posture checks. IPsec and SSL VPN give full network access. Explicit proxy is for web traffic only.

Option B is correct because protocol anomalies require custom signatures to define the precise pattern or threshold, as pre-defined signatures may not cover specific behavior.

Header policies in policy packages allow global policies that apply before VDOM-specific policies. They are defined at the ADOM level and cannot be modified within individual VDOMs.

In IKEv2, the proposal order determines the preference. The first matching proposal is used. To enforce AES256-GCM and SHA256, the administrator should set those as the first proposal in the phase1 and phase2 configuration.

Option A is correct because automation stitches require a trigger to initiate the workflow. In this scenario, the trigger must detect the FortiSandbox verdict (e.g., malicious or clean) to start the automated response. Without a trigger, the stitch has no event to react to, making it non-functional.

Option A is correct because the output shows 'proto=6' which indicates TCP (protocol 6), 'duration=3600' means the session has been active for 3600 seconds (1 hour), and 'expire=3599' means the session will expire in 3599 seconds. The 'proto_state=01' is a TCP state code indicating an established connection. This is a standard FortiGate diagnostic session output.

When the remote FortiGate has a dynamic IP address, the local FortiGate cannot initiate the VPN because it does not know the remote peer's IP. Setting the phase1 mode to aggressive and using a pre-shared key allows the remote peer to initiate the connection by sending its identity (ID) in the first exchange, enabling the local FortiGate to identify and authenticate the peer without requiring a static IP address for the remote side.

High CPU or memory utilization on a FortiGate can directly cause packet drops, queuing delays, and slow throughput, especially under load. Checking these resources is a fundamental first step in troubleshooting performance issues, as resource exhaustion often manifests as a slow network connection.

Option A is correct. 'expire=0' and 'proto_state=01' indicate that the session has expired and is in a cleanup state. The traffic is being dropped because the session is no longer valid.

The management VDOM is a special-purpose VDOM used exclusively for out-of-band management traffic (e.g., GUI, SSH, SNMP). It operates in a separate management plane and cannot contain firewall policies because it is not designed to inspect or forward data-plane traffic. This isolation ensures that management access remains available even if the data-plane VDOMs are overloaded or misconfigured.

The sessions algorithm bases distribution on the current session count on each member.

Option B is correct because intermittent connectivity during peak hours strongly suggests session table exhaustion or session congestion. The FortiGate's session table has a finite capacity, and when it fills up, new sessions are dropped, causing timeouts. Checking the session table for limits and congestion is the fastest, least intrusive first step to confirm whether the firewall is running out of session resources before performing more complex diagnostics.

In ZTNA, device posture tags from FortiClient are used in access proxy rules to grant or deny access. The tags are matched in the ZTNA proxy rule (access proxy rule) under the ZTNA gateway configuration. Option C is correct.

Option A is correct because setting ha-mode to active-passive configures the HA cluster so that only the primary unit actively processes traffic while the secondary remains in standby, ready to take over upon failure. This mode is essential for the automatic failover behavior described in the question, as it defines the operational roles of the cluster members.

Protocol anomaly detection in FortiGate IPS allows administrators to define rules that identify deviations from standard protocol behavior as defined by RFCs. Unlike signature-based detection, which matches known attack patterns, protocol anomaly detection flags traffic that violates expected protocol structures, such as malformed packets or illegal flag combinations. This enables the detection of zero-day exploits and protocol abuse without requiring a pre-existing signature.

FortiNAC uses policies to define security requirements. The Enforcement Engine applies the policy by changing the VLAN or applying ACLs on network devices to quarantine non-compliant endpoints.

For ZTNA tags to be sent to FortiGate, the FortiClient must be registered with EMS and the EMS must be configured as an endpoint control connector on FortiGate. If the connector is missing or misconfigured, FortiGate cannot retrieve tags.

DPD (Dead Peer Detection) is used to check the liveness of a VPN peer. 'Dead' means the peer is not responding to DPD messages, indicating the tunnel is down.

Option A is correct. Automation stitches allow triggering an action (like endpoint isolation) when a specific event (malicious process detected) occurs. The ML engine can generate a log event that triggers the stitch.

Automation stitches can trigger an action (like adding the source IP to a threat feed or blocking it) based on a condition such as IPS anomaly events.

FortiWeb provides deep application-layer inspection, custom signatures, and high throughput for WAF without impacting other security functions. FortiGate's built-in WAF is limited in comparison.

FortiClient EMS can enforce compliance rules such as requiring up-to-date antivirus and specific OS version. When a FortiClient connects to the FortiGate VPN, the FortiGate can check the endpoint's posture via FortiClient EMS and apply a matching firewall policy.

In Fortinet's IPS anomaly detection, a score of 0 indicates that the traffic exhibited suspicious patterns (e.g., SQLi signatures) but did not accumulate enough anomaly points to meet the configured threshold for triggering an action. This means the traffic was flagged as potentially malicious but was not deemed severe enough to warrant logging or blocking, so it remains in a 'monitoring' state without enforcement.

Option B is correct because creating a custom IPS signature allows you to define specific patterns (e.g., multiple TCP SYN packets to different ports from the same source) that match scanning behavior, and then set the action to 'block'. This granular approach blocks only the malicious scanning traffic while permitting legitimate traffic from the same IP, unlike a blanket IP block or a global anomaly action that could impact normal sessions.

Email Authentication (SPF, DKIM, DMARC) is part of FortiMail's advanced threat protection because it verifies sender identity and prevents email spoofing and phishing. SPF checks the sending server's IP against authorized records, DKIM uses cryptographic signatures to ensure message integrity, and DMARC provides policy enforcement for alignment. These mechanisms collectively reduce the risk of domain impersonation and are integral to FortiMail's anti-phishing capabilities.

Option D is correct because Incident Management in FortiAnalyzer provides a detailed log of automation stitch execution, including trigger events, script actions, and any errors. This allows the admin to verify whether the stitch ran as expected and to diagnose why the script did not produce the intended result.

Each VRF requires a virtual routing table (VRF instance), interfaces assigned to it, and optionally route leaking between VRFs.

Playbooks in FortiAnalyzer allow administrators to define a sequence of automated response actions that are triggered by specific log events. This feature enables event-driven automation, such as executing CLI scripts, sending alerts, or integrating with external systems via webhooks, directly from the FortiAnalyzer interface.

Options D and E are correct because first the feed must be configured (D), then a firewall policy using that feed must be created (E) to block traffic.

The 'get system status' command displays the current FortiGate system status, including the maximum number of VDOMs allowed by the installed license. This is the correct command to verify the licensed VDOM limit before deploying additional VDOMs.

Option C is correct because inter-VDOM link traffic requires routing in both VDOMs. Even with correct firewall policies, VDOM1 must have a route to the destination network (10.10.10.0/24) pointing to the inter-VDOM link interface. Without this route, VDOM1 drops the packet before it can be forwarded across the link, causing the failure.

Option C is correct because the output shows `proto=6` (TCP), `proto_state=01` (ESTABLISHED in Fortinet's session table), `duration=3600` seconds (1 hour), and `expire=3599` seconds (remaining lifetime). This combination indicates a fully established TCP session that has been active for one hour and is still valid, not blocked or in a transitional state.

WAF signatures must be enabled in the WAF profile. If SQL injection signatures are disabled, they will not be detected.

The most likely cause is that a firewall policy is blocking communication to FortiSandbox on port 514. FortiGate uses port 514 (syslog) to submit files to FortiSandbox, and if this port is blocked by an intermediate firewall or an implicit deny policy, the submission will fail even if the server IP is correctly configured. The administrator should verify that traffic to the FortiSandbox IP on UDP/TCP 514 is permitted by all relevant policies.

Inline CASB requires a proxy-based firewall policy that intercepts traffic to the SaaS application. If the policy is using flow-based inspection, CASB will not be invoked. Inline CASB works only with proxy-based inspection.

Option B is correct because session synchronization relies on the heartbeat link; congestion can cause loss of session sync packets, leading to session loss during failover.