NSE7_FSN_AR-7.6 Practice Questions

OSPF Type 5 LSAs (Autonomous System External LSAs) are generated exclusively by an Autonomous System Border Router (ASBR) to advertise routes external to the OSPF domain. If the OSPF network lacks an ASBR, no Type 5 LSAs will be generated or exist in the Link-State Database (LSDB). Additionally, OSPF stub areas (including standard stub and totally stubby areas) are explicitly designed to block Type 5 LSAs from entering the area to reduce database size and memory overhead, replacing them with a default route injected by the Area Border Router (ABR).

B: OSPF requires routers within the same area to maintain identical LSDBs; prefix-lists cannot be used to filter outbound Type 5 LSAs to specific peers.

D: Blocking IP protocol 89 (OSPF) would prevent the OSPF adjacency from forming entirely, resulting in the absence of all LSA types, not just Type 5.

1. Fortinet, "NSE 7 Advanced Routing 7.2 Study Guide," Chapter 3: OSPF, sections on LSA Types and Stub Areas.

2. Moy, J. (1998). "OSPF Version 2," RFC 2328, Section 12.4.3 (AS-external-LSAs). https://doi.org/10.17487/RFC2328

Based on standard FortiOS FSSO daemon (fssod) debug outputs for this scenario, the logs indicate that the FortiGate is operating in agentless polling mode. In agentless polling, the FortiGate directly queries the Domain Controllers for logon events without requiring a Windows-based Collector Agent (making option D correct). Additionally, to maintain accurate user session states, the FortiGate performs workstation checks by directly polling the client workstations (e.g., IP 10.124.2.90) over TCP port 445 (SMB/WMI) to verify if the user is still actively logged on (making option A correct).

B: In agentless polling mode, there is no Windows-based Collector Agent involved; the FortiGate handles all polling directly.

C: DC agent mode requires a Collector Agent and DC Agents installed on Windows servers, which contradicts the direct agentless polling behavior.

Fortinet NSE 7 - Enterprise Firewall 7.x Study Guide, "FSSO" chapter, Agentless Polling and Workstation Check sections.

Fortinet Document Library: FortiOS 7.2 Administration Guide, "Agentless FSSO".

The LDAP debug output shows fnbamdldapparseresponse-ret=49 and Error: Invalid credentials. In LDAP, error code 49 (invalidCredentials) indicates that the user was successfully found in the directory, but the bind operation failed. This typically occurs because the user provided an incorrect password (invalid credentials) or the user account is disabled/locked in Active Directory, which also prevents a successful bind and returns an invalid credentials error. Therefore, the administrator should verify that the user is entering the correct password and that their AD account is active and not locked.

- Option A: The debug shows the search for 'jsmith' was successful and returned the correct DN, so the username format is not the issue.

- Option C: The authentication process failed at the bind stage (step 3), which occurs before the FortiGate attempts to query for group membership (step 4).

- Fortinet NSE 7 - Enterprise Firewall 7.2 Study Guide, "Authentication" chapter, section on LDAP Troubleshooting (LDAP error 49).

- RFC 4511: Lightweight Directory Access Protocol (LDAP): The Protocol, Section 4.1.9 (Result Codes - invalidCredentials).

To force an existing SNAT session to failover to another interface, two conditions must be met. First, the routing table must be updated so the alternative interface becomes the preferred route. In FortiOS, a lower route priority value is preferred. Changing the port1 static route priority to 11 makes it less preferred than the port2 route (which has a priority of 0), making port2 the active route. Second, by default, FortiGate does not re-evaluate routing for existing SNAT sessions when the routing table changes. The administrator must configure set snat-route-change enable under config system settings to force existing SNAT sessions to flush and re-establish over the new route.

B. In FortiOS, a lower priority value indicates a more preferred route. Changing port2's priority to 5 makes it less preferred than port1 (priority 0), so traffic would not shift.

C. The default setting for snat-route-change is disabled. Unsetting it returns it to disabled, which prevents existing SNAT sessions from failing over when routing changes.

1. Fortinet FortiOS 7.2 Administration Guide, "Network" -> "Routing" -> "Static routing".

2. Fortinet FortiOS 7.2 CLI Reference, config system settings -> snat-route-change.

3. Fortinet NSE 7 Enterprise Firewall 7.2 Study Guide, "Routing" and "Session Helpers" modules.

By default, SD-WAN rules do not apply to traffic originating from the FortiGate device itself (local-out traffic). To enable SD-WAN rule evaluation for local-out traffic such as DNS queries, NTP synchronization, or management traffic, you must explicitly configure the local-out setting in the SD-WAN interface. The command is: config system sdwan followed by set local-out enabled. This is a common troubleshooting scenario in SD-WAN deployments because administrators expect SD-WAN rules to apply uniformly, but the default behavior restricts SD-WAN rule evaluation to data-plane traffic (traffic passing through the device) rather than control-plane traffic (traffic generated by the device itself). Enabling local-out ensures that DNS queries and other device-generated traffic also benefit from SD-WAN member selection and steering policies. SINGLE CHOICE

In FortiOS, the diagnose test application ipsmonitor command is used to troubleshoot and control the Intrusion Prevention System (IPS) engine. Specifically, passing the level 5 (diagnose test application ipsmonitor 5) toggles the IPS bypass mode. When bypass mode is enabled, the IPS engine stops inspecting traffic, allowing packets to pass through without IPS processing. This is highly useful for isolating performance issues or determining if the IPS engine is responsible for dropping traffic.

A: Disabling the IPS engine is typically done using level 2 (diagnose test application ipsmonitor 2).

B: Providing information regarding IPS sessions is done using level 4 (diagnose test application ipsmonitor 4).

C: Restarting all IPS engines and monitors is accomplished using level 99 (diagnose test application ipsmonitor 99).

Fortinet NSE 7 Enterprise Firewall 7.2 Study Guide, "Troubleshooting" chapter, section "IPS Troubleshooting".

FortiOS 7.2 CLI Reference Guide, "diagnose test application ipsmonitor".

In the FortiOS web filtering order of operations, the URL filter is evaluated before the FortiGuard category filter. If a URL matches a URL filter entry with the action set to "Allow", the traffic is not immediately permitted or exempted from further inspection. Instead, "Allow" simply passes the traffic to the next inspection step, which is the FortiGuard category filter. Since www.dropbox.com falls under the "File Sharing and Storage" category, and this category is configured to "Block" in the profile, FortiGate will block the connection based on the FortiGuard category-based filter configuration.

A. The URL is a valid format; FortiGate does not block it as an invalid URL.

B. A URL filter action of "Allow" only passes the traffic to the next inspection phase; it does not bypass category filtering.

D. Web Content filtering is evaluated after URL and Category filtering, so the connection is already blocked before reaching it.

1. Fortinet, "FortiOS 7.4 Administration Guide," Security Profiles -> Web Filter -> Web filter order of execution, pp. 2105-2107.

2. Fortinet Knowledge Base, "Technical Tip: Web filter order of execution," Article ID: FD46321.

In FortiOS, the command diagnose vpn tunnel list displays the status of IPsec VPN tunnels, including hardware offloading details. The npuflag value in the output indicates the offload status of the Security Associations (SAs). A value of npuflag=03 signifies that both the inbound (flag 01) and outbound (flag 02) IPsec SAs have been successfully copied to the Network Processor Unit (NPU) for hardware acceleration. This ensures that bidirectional traffic flowing through the tunnel is offloaded, reducing CPU load and increasing overall throughput.

A: This corresponds to an npuflag value of 02, indicating that only the outbound SA was offloaded to the NPU.

B: While an NPU (like NP6) handles offloading, the specific output details the SA directionality (inbound/outbound) rather than just confirming the processor model.

D: This corresponds to an npuflag value of 01, indicating that only the inbound SA was offloaded to the NPU.

Fortinet NSE 7 Enterprise Firewall 7.x Study Guide, Chapter: IPsec VPN, Section: Hardware Offloading and NPU Flags.

FortiOS 7.x CLI Reference Guide, diagnose vpn tunnel list command output definitions.

The partial output fromdiagnose hardware sysinfo memoryprovides details on system RAM allocation. According to Fortinet's technical documentation for memory troubleshooting and Linux memory management (which FortiOS is based on): MemFreeis the portion of physical memory not currently allocated to any running process or kernel function. Thus, 708880 kB is avaiable and can be immediately used by user-space programs or system operations. Inactiverefers to pges in the memory cache that were previously in use for I/O or file system buffering but are now not actively referenced. These pages are retained in memory for quick access if needed again, but can be reclaimed for other memory operations if demand increases. The value 98908 kB here represents currently unused cache pages (inactive pages), ready for repurposing or deletion if the system requires more RAM. Cachedrepresents the total amount of system memory allocated to cache, which includes both active and inactive cache pages. It does not, by itself, represent I/O cache exclusively, nor does 'inactive' mean memory ''will never be used'' as the kernel can re-purpose inactive pages on demand. Fortinet Technical Tip: Explaining the 'diagnose hard sysinfo memory' command FortiOS System Administration Guide: Linux Memory Reporting, Cached and Inactive Statistics https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/1_Fortinet_NSE7_FSN_AR-7.6/page_37_img_1.jpg SINGLE CHOICE