How many Refer to the Exhibit Practice Questions questions are on this page?

This page has 5 Refer to the Exhibit Practice Questions scenario questions for the NSE7 exam, each with detailed explanations and wrong-answer analysis.

How should I approach NSE7 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Fortinet NSE 7 Advanced Security NSE7 questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise Fortinet NSE 7 Advanced Security NSE7 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

NSE7

exam code

Fortinet

vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Practice scenarios

Question 1hardmultiple choice

Full question →

A FortiGate is blocking HTTP traffic from 10.0.1.5 to 10.0.2.100, despite an explicit allow policy. The exhibit shows the configuration and debug flow output. What is the most likely cause?

Exhibit

Refer to the exhibit.

config firewall policy
    edit 1
        set name "Allow-Web"
        set srcintf "port1"
        set dstintf "port2"
        set srcaddr "10.0.1.0/24"
        set dstaddr "10.0.2.100"
        set action accept
        set schedule "always"
        set service "HTTP"
        set logtraffic all
    next
end

diag debug flow show function-name show-verbose

--- flow debug output ---
proton_state=0, reason=session-denied
id=20085 trace_id=155 func=print_pkt_detail line=4945 msg="vd-root:0 received a packet from port1: 10.0.1.5:45231 -> 10.0.2.100:80, proto 6."
id=20085 trace_id=155 func=resolve_ip_tuple line=4125 msg="Find an existing session, id 00001234, original direction"
id=20085 trace_id=155 func=__ip_session_match_tuple line=2818 msg="Session state: not ready"
id=20085 trace_id=155 func=__ip_session_find_by_session_id line=2773 msg="session session_deny because state proto is not ready"

A
The policy is applied to the wrong source interface.
Why wrong: The debug shows the packet received on port1, which matches the policy.
B
The policy action is set to deny.
Why wrong: Exhibit shows action accept.
C
TCP SYN flood protection is dropping the incomplete session.
The 'state proto not ready' indicates TCP handshake incomplete; often due to DoS protection thresholds.
D
The source address object does not include 10.0.1.5.
Why wrong: The srcaddr is 10.0.1.0/24 which includes 10.0.1.5.

Full breakdown with real-world context →

Question 2hardmultiple choice

Full question →

Refer to the exhibit. A FortiGate is connected to the Security Fabric and registered with FortiManager. However, the administrator notices that the FortiGate is not receiving policy updates from FortiManager. What is the most likely cause?

Exhibit

FGT # get system fabric-status
Fabric Role: Member
Fabric Status: Connected
Fabric Group: MyGroup
Fabric Root: FGT-Root (serial: FG100D3TF16800001)
Last contact: 2024-01-15 10:30:00
FGT # diagnose test application fgfms 3
FGFMs status:
  Registered with FortiManager: Yes
  FortiManager IP: 192.168.1.100
  FortiManager status: Connected
  Last heartbeat: 2024-01-15 10:29:55

A
The Fabric Root serial number is incorrect
Why wrong: The serial number is present.
B
The FortiGate is not registered with FortiManager
Why wrong: Registration is 'Yes'.
C
The policy package on FortiManager is not assigned to the correct device group or policy target
The device is in a fabric group, but policy must be assigned to that group.
D
The Security Fabric is not fully connected
Why wrong: The fabric status shows 'Connected'.

Full breakdown with real-world context →

Question 3easymultiple choice

Full question →

Refer to the exhibit. An administrator has configured an active-passive HA cluster. After reviewing the configuration and status, the administrator wants to ensure that the management interface (port2) is accessible on both units using the same IP address. What additional configuration is required?

Exhibit

config system ha
    set mode a-p
    set group-name "HA_Cluster"
    set password ENC abcd1234
    set hbdev "port1" 100
    set session-pickup enable
    set session-pickup-connectionless enable
    set ha-mgmt-status enable
    config ha-mgmt-interfaces
        edit 1
            set interface "port2"
            set gateway 10.0.0.1
        next
    end
end

HA cluster status:

HA Health Status: OK
Model: FortiGate-100F
Mode: Active-Passive
Group: HA_Cluster
Debug: 0
npu-1: primary
npu-2: standby

A
Set the gateway to 0.0.0.0
Why wrong: The gateway is already configured correctly.
B
Enable ha-mgmt-status on the secondary unit
Why wrong: ha-mgmt-status is already enabled globally.
C
Configure a virtual management IP under the cluster settings
A virtual IP ensures the management interface is reachable via the same IP on both units.
D
Disable session-pickup to free resources
Why wrong: Session pickup is unrelated to management interface access.

Full breakdown with real-world context →

Question 4easymultiple choice

Full question →

An administrator is reviewing the HA configuration shown in the exhibit. The primary unit has failed, and the secondary unit (with priority 100) has taken over. However, the administrator notices that the secondary unit has an IP address of 10.10.10.2 on port3, but cannot ping the management gateway 10.10.10.1. What is the most likely cause?

Exhibit

Refer to the exhibit.

config system ha
    set group-name "HA_Cluster"
    set mode a-p
    set hbdev "port1" 50 "port2" 50
    set session-pickup enable
    set session-pickup-connectionless enable
    set ha-mgmt-status enable
    set ha-mgmt-interface "port3"
    set ha-mgmt-interface-gateway 10.10.10.1
    set override enable
    set priority 200
end

A
The HA management interface IP is not active on the secondary
The management IP is active only on the primary unit; the secondary uses the same IP after failover, but the network may not have updated.
B
The hbdev configuration is incorrect
Why wrong: hbdev is configured correctly.
C
The override setting is preventing the secondary from taking over management
Why wrong: override only affects priority, not management IP.
D
session-pickup is not enabled
Why wrong: session-pickup is enabled in the config.

Full breakdown with real-world context →

Question 5hardmultiple choice

Review the full OSPF breakdown →

A FortiGate is running OSPF in a multi-area topology. The administrator needs to redistribute connected routes from area 0 into area 1 but does not want to leak any other routes. Which configuration is correct?

A
Use policy-based routing to forward traffic to the connected networks.
Why wrong: PBR does not affect OSPF route advertisement.
B
Add the connected networks as networks in area 1 using 'network x.x.x.x 255.255.255.0 area 1'.
Why wrong: This would include the interface in OSPF, but it would advertise the route as an OSPF internal route, not redistributed. Also, it might require the interface to be in that area.
C
Configure route redistribution under OSPF with 'redistribute connected' and apply a route map that permits only the desired connected networks.
Using redistribution with a route map allows selective advertisement of only the specified connected routes.
D
Use 'set redistribute connected' under the OSPF interface configuration for the connected interface in area 0.
Why wrong: The redistribute command is global under OSPF, not per-interface.

Full breakdown with real-world context →

These NSE7 practice questions are part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style NSE7 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Refer to the Exhibit Practice Questions

How to approach refer to the exhibit practice questions

Quick answer

Related NSE7 topic practice pages

Advanced Networking and SD-WAN practice questions

Advanced VPN and Zero Trust practice questions

Enterprise Firewall and VDOMs practice questions

Advanced Threat Protection practice questions

Troubleshooting and Diagnostics practice questions

NSE7 fundamentals practice questions

NSE7 scenario practice questions

NSE7 troubleshooting practice questions

Practice scenarios

A FortiGate is blocking HTTP traffic from 10.0.1.5 to 10.0.2.100, despite an explicit allow policy. The exhibit shows the configuration and debug flow output. What is the most likely cause?

Exhibit

Refer to the exhibit. A FortiGate is connected to the Security Fabric and registered with FortiManager. However, the administrator notices that the FortiGate is not receiving policy updates from FortiManager. What is the most likely cause?

Exhibit

Refer to the exhibit. An administrator has configured an active-passive HA cluster. After reviewing the configuration and status, the administrator wants to ensure that the management interface (port2) is accessible on both units using the same IP address. What additional configuration is required?

Exhibit

Exhibit

A FortiGate is running OSPF in a multi-area topology. The administrator needs to redistribute connected routes from area 0 into area 1 but does not want to leak any other routes. Which configuration is correct?