Free NSE7-LED-7-0 sample questions

Correct answer: Set `broadcast-suppression` to `arp-known-clients`.

The `broadcast-suppression` setting controls how the FortiAP handles broadcast packets. Setting it to `arp-known-clients` instructs the AP to convert ARP request broadcasts into unicast frames for clients it already has in its ARP table. This reduces unnecessary broadcast traffic over the air, improving overall wireless network efficiency.

Correct answer: True

This is true. For ZTP to work via DHCP option 43, the string must contain the IP address of the managing FortiGate and the name of the FortiLink interface that the switch should connect to. This information allows the switch to automatically establish the FortiLink connection upon boot-up.

Correct answer: FortiGate, using an automation stitch triggered by an IoC.

In the Security Fabric, the FortiGate acts as the central enforcement point. When its security services (like IPS or Web Filter) detect an Indicator of Compromise (IoC), such as traffic to a C&C server, an automation stitch can be triggered. This stitch then instructs the FortiSwitch, via the FortiLink connection, to quarantine the offending client's switch port.

Correct answer: (&(objectClass=user)(sAMAccountName=*)(memberOf=CN=VPN_Users,CN=Users,DC=example,DC=com))

The correct LDAP filter syntax combines multiple conditions. `(objectClass=user)` ensures only user objects are considered. `(sAMAccountName=*)` is a placeholder for the username. `(memberOf=CN=VPN_Users,CN=Users,DC=example,DC=com)` checks for membership in the specified group, requiring the full Distinguished Name (DN) of the group.

Correct answers: Configure the SSID Security Mode to `Captive Portal` with authentication portal set to `Local` and user group configured for guests.; Set the SSID traffic mode to `Tunnel Mode`.

Setting the security mode to Captive Portal is the fundamental step for creating a guest network. Configuring a local portal with a guest-specific user group on the FortiGate allows for self-registration and policy enforcement, including setting expiration timers for the guest accounts.

Tunnel Mode (also known as Tunnel to Wireless Controller) encapsulates all wireless client traffic in a CAPWAP tunnel and sends it to the FortiGate. This is necessary for the FortiGate to inspect the traffic, apply security policies, and perform NAT before forwarding it to the internet.

Correct answer: The switch has been manually configured on the FortiGate, but the physical switch has not yet connected.

The `Pre-authorized` status means that an administrator has manually added the FortiSwitch's serial number to the FortiGate's managed switch list in anticipation of its connection. It is a placeholder entry waiting for the actual device to connect and establish the FortiLink tunnel.

Correct answer: A Firewall group that nests two other Firewall groups: one for the LDAP server and another for the PKI users.

To enforce two-factor authentication where both factors must be satisfied, you must create a Firewall group that includes multiple member groups. In this case, one member group would be tied to the remote LDAP server, and the second member group would be for PKI users, linked to the internal CA. By placing both of these groups inside a parent group and setting the logic to AND (the default), the FortiGate requires a user to satisfy the conditions of both member groups to be considered authenticated.

Correct answer: WPA2-Personal with a pre-shared key and MAC address filtering.

For devices that cannot use 802.1X, WPA2-Personal is the standard for encrypted communication. To add a layer of access control, MAC address filtering can be enabled. This allows the administrator to create a list of authorized MAC addresses for the IoT devices. While not foolproof, this combination provides both encryption and a basic level of device identity validation, which is a common and practical solution for securing legacy IoT devices.

Correct answer: Use the `Switch Templates` feature to define the VLANs and assign the template to the group of switches.

FortiManager's `Switch Templates` are specifically designed for this purpose. An administrator can create a template that defines a standard configuration, such as VLANs, port settings, or security policies. This template can then be applied to a group of FortiSwitches, ensuring consistent configuration and simplifying management at scale. This is far more efficient than applying scripts individually.

Correct answer: Cisco ISE Posture Report

FortiAuthenticator has pre-defined dictionaries for various logon event sources, including Windows Security Events, FortiGate logs, and Novell eDirectory. However, a Cisco ISE Posture Report is not a standard, pre-defined logon event dictionary. While a custom parser could potentially be created, it is not a built-in, valid dictionary entry for identifying user logon events.