Fortinet NSE7_LED-7.0 Practice Test Questions, Exam Dumps

Practice Exams:

View All

NSE7_LED-7.0 Fortinet Practice Test Questions and Exam Dumps

Question No 1:

Examine the FortiGate user group configuration and the Windows AD LDAP group membership information shown in the exhibit. FortiGate is configured to authenticate SSL VPN users against Windows AD using LDAP. The administrator configured the SSL VPN user group for SSL VPN users. However, the administrator noticed that both the t and student and jsmith users can connect to SSL VPN.

Which change can the administrator make on FortiGate to restrict the SSL VPN service to the student user only?

A. In the SSL VPN user group configuration, set Group Name to CN=SSLVPN,CN=Users,DC=trainingAD,DC=training,DC=lab.
B. In the SSL VPN user group configuration, change Name to CN=SSLVPN,CN=Users,DC=trainingAD,DC=training,DC=lab.
C. In the SSL VPN user group configuration, set Group Name to CN=Domain Users,CN=Users,DC=trainingAD,DC=training,DC=lab.
D. In the SSL VPN user group configuration, change Type to Fortinet Single Sign-On (FSSO).

Correct answer: A

Explanation:

To restrict access to the SSL VPN service to the student user only, the administrator needs to correctly configure the FortiGate SSL VPN user group based on the LDAP group membership. The issue is that both users student and jsmith are able to connect, which suggests that the user group in FortiGate is not properly filtered.

The correct configuration involves specifying the Group Name that corresponds to the desired group in Active Directory (AD). The student user should belong to a specific group in AD, such as CN=SSLVPN,CN=Users,DC=trainingAD,DC=training,DC=lab.

Here’s why A is the correct answer:

A. In the SSL VPN user group configuration, set Group Name to CN=SSLVPN,CN=Users,DC=trainingAD,DC=training,DC=lab: This option is correct because it ensures that only users who are members of the SSLVPN group in Active Directory are allowed to connect to the SSL VPN. By configuring the Group Name to match the specific group for the student user, access is restricted accordingly.

Now, let’s examine why the other options are incorrect:

B. In the SSL VPN user group configuration, change Name to CN=SSLVPN,CN=Users,DC=trainingAD,DC=training,DC=lab: This is incorrect because it is changing the Name field instead of the Group Name field. The Group Name is used to filter users based on their AD group membership, not the user group Name.
C. In the SSL VPN user group configuration, set Group Name to CN=Domain Users,CN=Users,DC=trainingAD,DC=training,DC=lab: This is incorrect because Domain Users is a broad group that likely includes many users, including jsmith. Configuring the SSL VPN group with this group name would allow more users than intended to access the VPN, so this option does not restrict access to only the student user.
D. In the SSL VPN user group configuration, change Type to Fortinet Single Sign-On (FSSO): This option is irrelevant because FSSO is used for a different type of user authentication. The issue in this case is not related to SSO but to the correct LDAP group membership for restricting access.

In conclusion, A is the correct answer because it properly configures the SSL VPN user group to match the SSLVPN group in Active Directory, thereby restricting access to only the users in that group.

Question No 2:

Examine the firewall policy configuration and SSID settings.An administrator has configured a guest wireless network on FortiGate using the external captive portal. The administrator has verified that the external captive portal URL is correct. However, wireless users are not able to see the captive portal login page.

Given the configuration shown in the exhibit and the SSID settings, which configuration change should the administrator make to fix the problem?

A. Disable the user group from the SSID configuration.
B. Enable the captive-portal-exempt option in the firewall policy with the ID 11.
C. Apply a guest.portal user group in the firewall policy with the ID 11.
D. Include the wireless client subnet range in the Exempt Source section.

Correct answer: B

Explanation:

When setting up a guest wireless network with an external captive portal, it's essential to ensure that the appropriate firewall policies are configured to allow the redirection of users to the captive portal before they can access other network resources.

Here’s a breakdown of each option:

Option A: Disable the user group from the SSID configuration.

Disabling a user group in the SSID configuration would prevent users from authenticating to the wireless network based on their user group membership. However, the issue described here relates to users not being able to see the captive portal login page, which is more likely a result of the firewall policy configuration or the behavior of the captive portal itself. This change wouldn't necessarily resolve the issue of users being unable to see the captive portal.

Option B: Enable the captive-portal-exempt option in the firewall policy with the ID 11.

This option is most likely the solution. Enabling the captive-portal-exempt option in the firewall policy means that certain traffic will be allowed to bypass the captive portal, which is often necessary for users to initially reach the captive portal page. By setting this exemption, the FortiGate firewall can allow the users to access the external captive portal URL without the usual restrictions applied to regular traffic. This setting is crucial when trying to resolve the issue of wireless users not seeing the captive portal login page.

Option C: Apply a guest.portal user group in the firewall policy with the ID 11.

Applying a guest.portal user group could be part of the configuration, but it would typically be relevant for more complex user-based access control. Since the issue described is related to users not seeing the captive portal page, it is more likely related to the firewall policy’s handling of captive portal redirection. This option does not directly address the user's inability to view the login page.

Option D: Include the wireless client subnet range in the Exempt Source section.

This option could also be relevant if the goal is to exempt certain IP ranges from the captive portal. However, including the wireless client subnet range in the Exempt Source section would usually only affect traffic that needs to bypass the captive portal. The problem described—users not seeing the captive portal—suggests that they are not being properly redirected to the portal in the first place. Therefore, this change would not directly address the issue as effectively as enabling the captive-portal-exempt option.

To fix the issue where wireless users cannot see the captive portal login page, enabling the captive-portal-exempt option in the firewall policy would ensure that users are redirected to the external captive portal properly. Hence, Option B: Enable the captive-portal-exempt option in the firewall policy with the ID 11 is the correct answer.

Question No 3:

Which two statements about the MAC-based 802.1X security mode available on FortiSwitch are true? (Choose two.)

A. FortiSwitch authenticates a single device, and opens the port to other devices connected to the port.
B. FortiSwitch authenticates each device connected to the port.
C. It cannot be used in conjunction with MAC authentication bypass.
D. FortiSwitch can grant different access levels to each device connected to the port.

Answer: A and D

Explanation:

MAC-based 802.1X security is an authentication method that uses the MAC address of a device to determine whether it is allowed to access the network. It is different from traditional 802.1X authentication, which typically involves user credentials. Let's break down the options:

A. FortiSwitch authenticates a single device, and opens the port to other devices connected to the port.
This statement is correct. When using MAC-based 802.1X security mode, FortiSwitch authenticates the first device connected to the port based on its MAC address. Once authenticated, the switch opens the port to allow other devices to connect to the same port without requiring separate authentication for each device. This is a key feature of MAC-based authentication, where only the first device is authenticated.
B. FortiSwitch authenticates each device connected to the port.
This statement is incorrect. In MAC-based 802.1X, only the first device that connects to the port is authenticated. Other devices connected to the same port do not go through authentication again. Therefore, this option is not true.
C. It cannot be used in conjunction with MAC authentication bypass.
This statement is incorrect. MAC-based 802.1X can indeed be used in conjunction with MAC authentication bypass (MAB), where the switch may authenticate devices using their MAC addresses or allow devices to bypass authentication based on certain conditions. There are no inherent restrictions preventing their use together.
D. FortiSwitch can grant different access levels to each device connected to the port.
This statement is correct. Depending on the MAC address and associated authentication policies, FortiSwitch can grant different access levels to each device. While MAC-based 802.1X generally authenticates the first device and applies an access policy, it can be configured to apply varying levels of access for different devices depending on their MAC addresses.

Thus, the correct answers are A and D, as they accurately describe the behavior of MAC-based 802.1X security mode on FortiSwitch.

Correct answer: A and D

Question No 4:

A wireless network in a school provides guest access using a captive portal to allow unregistered users to self-register and access the network. The administrator is requested to update the existing configuration to provide captive portal authentication through a secure connection (HTTPS).

Which two changes must the administrator make to enforce HTTPS authentication? (Choose two.)

A. Create a new SSID with the HTTPS captive portal URL.
B. Enable HTTP redirect in the user authentication settings.
C. Disable HTTP administrative access on the guest SSID to enforce HTTPS connection.
D. Update the captive portal URL to use HTTPS on FortiGate and FortiAuthenticator.

Correct answer: D, C

Explanation:

To enforce HTTPS authentication on a captive portal for guest access, certain configuration steps are necessary to ensure secure communication. Let's break down the correct options:

A. Create a new SSID with the HTTPS captive portal URL:
This statement is unnecessary for enforcing HTTPS on the existing configuration. You don’t need to create a new SSID specifically for HTTPS; rather, you need to configure the current captive portal URL to use HTTPS. Creating a new SSID may be a more complex solution, but it isn't required just to implement HTTPS authentication.
B. Enable HTTP redirect in the user authentication settings:
This option is incorrect. Enabling an HTTP redirect could actually be counterproductive if the goal is to enforce HTTPS. The HTTP redirect feature typically redirects HTTP traffic to HTTPS, but it does not enforce HTTPS authentication. It would be better to directly configure the captive portal URL to use HTTPS.
C. Disable HTTP administrative access on the guest SSID to enforce HTTPS connection:
This statement is correct. Disabling HTTP administrative access on the guest SSID ensures that all management and communication through the guest network are carried out via HTTPS, which is a secure connection method. This helps in enforcing secure authentication practices and avoiding non-secure HTTP connections.
D. Update the captive portal URL to use HTTPS on FortiGate and FortiAuthenticator:
This is the key change. Updating the captive portal URL to use HTTPS ensures that the communication between the client device and the captive portal is encrypted. This change must be made on the FortiGate and FortiAuthenticator to ensure the security of user credentials and data during the authentication process.

Thus, the correct answers are C and D, as these actions directly contribute to enforcing HTTPS authentication on the captive portal.

Question No 5:

The exhibits show the wireless network (VAP) SSID profiles defined on FortiManager and an AP profile assigned to a group of APs that are supported by FortiGate. None of the APs are broadcasting the SSIDs defined by the AP profile.

Which changes do you need to make to enable the SSIDs to broadcast?

A. In the SSIDs section, enable Tunnel.
B. Enable one channel in the Channels section.
C. Enable multiple channels in the Channels section and enable Radio Resource Provision.
D. In the SSIDs section, enable Manual and assign the networks manually.

Correct answer: B

Explanation:

To enable the SSIDs to broadcast on the Access Points (APs), the issue lies with the configuration in the wireless settings related to the channels. The most likely cause for the SSIDs not being broadcasted is that the channels are not enabled or properly configured.

B. Enable one channel in the Channels section.
This option is the most straightforward. If the channel configuration in the AP profile is not set correctly, it may prevent the AP from broadcasting any SSIDs. Enabling at least one channel ensures that the AP can transmit the wireless signals and broadcast the SSIDs to devices. Without proper channel configuration, the AP will not be able to advertise the SSIDs.

Now, let’s evaluate the other options:

A. In the SSIDs section, enable Tunnel.
Enabling "Tunnel" in the SSIDs section is typically related to specific network configurations such as tunnel mode for wireless traffic, often used for certain advanced configurations or segmentation. This does not directly impact the broadcasting of SSIDs and would not solve the issue of SSID visibility on the APs.
C. Enable multiple channels in the Channels section and enable Radio Resource Provision.
This option suggests enabling multiple channels and a radio resource provision, which might help in optimizing the network in some cases but is not the immediate solution needed for enabling SSID broadcast. The primary issue is likely related to the basic configuration of channels, not the need for multiple channels or advanced radio provisioning.
D. In the SSIDs section, enable Manual and assign the networks manually.
This option refers to manually assigning SSIDs to specific interfaces or APs, but if SSIDs are already defined and the APs are not broadcasting them, the issue is likely not with manual assignment but with basic channel configuration. Therefore, this option is not the correct answer.

In conclusion, enabling at least one channel in the "Channels" section is necessary to allow the APs to broadcast the SSIDs. This ensures the wireless network is set up to transmit properly, which should resolve the issue.

Question No 6:

Examine the IPsec VPN phase 1 configuration shown in the exhibit.
An administrator wants to use certificate-based authentication for an IPsec VPN user.

Which three configuration changes must you make on FortiGate to perform certificate-based authentication for the IPsec VPN user? (Choose three.)

A. Create a PKI user for the IPsec VPN user, and then configure the IPsec VPN tunnel to accept the PKI user as peer certificate.
B. In the Authentication section of the IPsec VPN tunnel, in the Method drop-down list, select Signature, and then select the certificate that FortiGate will use for IPsec VPN.
C. In the IKE section of the IPsec VPN tunnel, in the Mode field, select Main (ID protection).
D. Import the CA that signed the user certificate.
E. Enable XAUTH on the IPsec VPN tunnel.

Correct answer: A, B, D

Explanation:

To perform certificate-based authentication for an IPsec VPN user on FortiGate, several key configuration steps are necessary to ensure secure and accurate communication using certificates. Here is an explanation of the correct actions:

A. Create a PKI user for the IPsec VPN user, and then configure the IPsec VPN tunnel to accept the PKI user as peer certificate:
This is the first step in enabling certificate-based authentication for the IPsec VPN user. FortiGate needs to associate a PKI (Public Key Infrastructure) user with the VPN connection. By creating a PKI user and configuring the IPsec VPN tunnel to recognize the certificate associated with that user, FortiGate will be able to authenticate the user based on the certificate presented during the connection setup.

B. In the Authentication section of the IPsec VPN tunnel, in the Method drop-down list, select Signature, and then select the certificate that FortiGate will use for IPsec VPN:
The Authentication method needs to be configured to use certificates. In FortiGate, when using certificate-based authentication, the method should be set to "Signature." This means that the FortiGate device will validate the certificate’s signature during the IPsec VPN handshake. Additionally, the administrator must select the appropriate certificate for the FortiGate device to use in the authentication process.

D. Import the CA that signed the user certificate:
In a certificate-based authentication system, the FortiGate device must trust the certificate authority (CA) that signed the user’s certificate. Importing the CA's root certificate ensures that the FortiGate device can verify the authenticity of the user certificate and establish a secure connection with the user.

Why the other options are incorrect:

C. In the IKE section of the IPsec VPN tunnel, in the Mode field, select Main (ID protection):
While the "Main" mode with ID protection is typically used for scenarios where identity protection is required, it is not a mandatory change for enabling certificate-based authentication. Certificate-based authentication can be configured in both Main and Aggressive modes. Therefore, this option is not a requirement for the task.

E. Enable XAUTH on the IPsec VPN tunnel:
XAUTH (Extended Authentication) is typically used to enable username and password-based authentication in addition to the standard IPsec authentication methods. However, XAUTH is not needed for certificate-based authentication. In this case, the authentication will rely on the certificate, so enabling XAUTH is unnecessary.

In conclusion, the correct actions to enable certificate-based authentication for an IPsec VPN user include creating the necessary PKI user, selecting the appropriate authentication method (Signature), and importing the CA that signed the user certificate.

Question No 7:

You are investigating a report of poor wireless performance in a network that you manage. The issue is related to an AP interface in the 5 GHz range. You are monitoring the channel utilization over time.

What is the recommended maximum utilization value that an interface should not exceed?

A. 85%
B. 95%
C. 75%
D. 65%

Explanation:

When monitoring wireless network performance, particularly in the 5 GHz band, channel utilization is a critical metric. High channel utilization can lead to congestion, increased latency, and degraded performance. To maintain optimal performance, it is essential to ensure that the channel utilization remains below a certain threshold to avoid these issues.

A (85%): At this level of utilization, the network is still functional, but performance may start to degrade. As the utilization increases beyond this threshold, there is a greater chance of congestion, packet loss, and slow speeds. It is generally not recommended to exceed 85% for optimal performance.
B (95%): This is a very high level of channel utilization, and exceeding 90% utilization typically indicates severe congestion. At 95%, the network will likely experience significant performance issues, including slow data rates, packet drops, and high latency.
C (75%): A channel utilization of 75% is considered a good upper limit. This allows some headroom for traffic spikes while maintaining relatively high performance. It is generally recommended that the utilization stays below 75% to ensure stable wireless performance.
D (65%): This is a conservative value for channel utilization, ensuring that the network operates well under most conditions. While 65% is a safe target, it might not be necessary unless the network is highly sensitive to performance.

The generally accepted guideline is to keep channel utilization below 75% to maintain reliable and efficient wireless performance. Higher utilization leads to congestion and poorer user experiences.

Thus, the correct answer is C.

Question No 8:

Which CLI command should an administrator use to view the certificate verification process in real time?

A. diagnose debug application foauthd -1
B. diagnose debug application radiusd -1
C. diagnose debug application authd -1
D. diagnose debug application fnbamd -1

Correct answer: C

Explanation:

The correct CLI command to view the certificate verification process in real time is diagnose debug application authd -1. This command enables real-time debugging for the authentication daemon (authd), which is responsible for handling certificate verifications, among other tasks in Fortinet devices.

C. diagnose debug application authd -1: The authd application manages authentication processes, including certificate verification. By using this command with the -1 debug level, the administrator can monitor the real-time behavior and troubleshooting information related to certificate verification, which is key in diagnosing issues with SSL/TLS-based authentications.

Now, let's look at why the other options are less appropriate:

A. diagnose debug application foauthd -1: The foauthd process is related to Fortinet’s OAuth authentication service, which is typically used for token-based authentication. While this is relevant for certain types of authentication, it is not directly related to certificate verification.
B. diagnose debug application radiusd -1: The radiusd process is related to RADIUS (Remote Authentication Dial-In User Service) authentication. While RADIUS can sometimes involve certificates (for example, in EAP-TLS), it is not specifically focused on certificate verification in the way authd is for general SSL/TLS-based authentication.
D. diagnose debug application fnbamd -1: The fnbamd process is related to Fortinet’s Authentication and VPN services. It is not typically used for certificate verification directly, so this command would not provide the necessary insights into SSL/TLS certificate verification.

In conclusion, the correct choice for viewing certificate verification in real time is C, as it specifically targets the authd service, which is responsible for handling certificate-based authentication processes.

Question No 9:

Which two statements about the guest portal on FortiAuthenticator are true? (Choose two.)

A. Each remote user on FortiAuthenticator can sponsor up to 10 guest accounts.
B. Administrators must approve all guest accounts before they can be used.
C. The guest portal provides pre and post-log in services.
D. Administrators can use one or more incoming parameters to configure a mapping rule for the guest portal.

Correct answer: C, D

Explanation:

The guest portal on FortiAuthenticator is an important feature for providing secure and managed access to network resources for guest users. It enables self-registration, account sponsorship, and a customizable user experience, helping organizations manage guest access efficiently.

Let's evaluate the options:

A. Each remote user on FortiAuthenticator can sponsor up to 10 guest accounts.
This statement is incorrect. The number of guest accounts a user can sponsor depends on the specific configuration set by the administrator, but it is not limited to 10 accounts by default. The limit can be adjusted based on organizational requirements.
B. Administrators must approve all guest accounts before they can be used.
This statement is incorrect. While administrators can configure FortiAuthenticator to require approval for guest accounts, it is not a mandatory setting. FortiAuthenticator can allow self-registration, where guest accounts are automatically active after creation, or it can be configured to require manual approval.
C. The guest portal provides pre and post-log in services.
This statement is correct. The guest portal on FortiAuthenticator can be configured to provide pre-login services, such as authentication and guest account registration, as well as post-login services, like bandwidth management, access control, and redirection to specific resources. These services help manage guest access before and after the user logs in.
D. Administrators can use one or more incoming parameters to configure a mapping rule for the guest portal.
This statement is correct. FortiAuthenticator allows administrators to define mapping rules that can be based on incoming parameters such as IP address, VLAN, or device type. These parameters help administrators assign different access privileges or configurations to guest users based on their specific circumstances, providing flexibility and security in managing guest access.

Thus, the two correct statements are C and D, as they accurately reflect the functionality of the FortiAuthenticator guest portal.

Question No 10:

In the wireless configuration shown in the exhibits, an AP is deployed in a remote site and has a wireless network (VAP) called Corporate deployed to it. The network is a tunnelled network; however, clients connecting to a wireless network require access to a local printer. Clients are trying to print to a printer on the remote site, but are unable to do so.

Which configuration change is required to allow clients connected to the Corporate SSID to print locally?

A. Configure split-tunneling in the vap configuration.
B. Configure split-tunneling in the wtp-profile configuration.
C. Disable the Block Intra-SSID Traffic (Intra-vap-privacy) setting on the SSID (VAP) profile.
D. Configure the printer as a wireless client on the Corporate wireless network.

Correct answer: A

Explanation:

The scenario involves a wireless network configuration in which clients are unable to print locally to a printer on a remote site. The key challenge here is that the network is a tunneled network, meaning that client traffic is likely being directed to a central location (like a controller) for processing. This can prevent local resources such as printers from being accessed by clients because their traffic is not being routed locally.

Let’s break down the options:

A. Configure split-tunneling in the vap configuration: Split tunneling allows part of the client traffic to be sent to the central location (controller), while other traffic (like printing traffic) is routed locally. By enabling split-tunneling in the VAP configuration, the traffic destined for the local printer can bypass the tunnel and be sent directly to the local network, thus allowing clients to print locally. This is the most appropriate solution for the problem.
B. Configure split-tunneling in the wtp-profile configuration: The WTP (Wireless Termination Point) profile controls how the AP communicates with the controller and the clients. While split-tunneling at the WTP profile level may control some aspects of the AP's communication, it is the VAP (Virtual Access Point) configuration that controls the traffic flow for individual wireless networks, including tunnel behavior. Therefore, this option is less directly related to resolving the issue of local printing.
C. Disable the Block Intra-SSID Traffic (Intra-vap-privacy) setting on the SSID (VAP) profile: The Block Intra-SSID Traffic setting is used to block communication between clients connected to the same SSID. Disabling this setting would allow communication between clients on the same wireless network, but it does not specifically address the issue of tunneling or local printing. Therefore, this is not the best solution for this situation.
D. Configure the printer as a wireless client on the Corporate wireless network: While configuring the printer as a wireless client may allow it to connect to the wireless network, it doesn’t solve the fundamental issue of traffic being tunneled to the central location. The clients still wouldn’t be able to route traffic directly to the printer unless the split-tunneling option is configured.

Thus, A. Configure split-tunneling in the vap configuration is the correct answer because it ensures that client traffic meant for local resources, such as printers, is routed directly to the local network, bypassing the tunnel.