NSE7-LED-7-0 Sample Questions & Answers

The correct LDAP filter syntax combines multiple conditions. (objectClass=user) ensures only user objects are considered. (sAMAccountName=*) is a placeholder for the username. (memberOf=CN=VPN_Users,CN=Users,DC=example,DC=com) checks for membership in the specified group, requiring the full Distinguished Name (DN) of the group.

Setting the security mode to Captive Portal is the fundamental step for creating a guest network. Configuring a local portal with a guest-specific user group on the FortiGate allows for self-registration and policy enforcement, including setting expiration timers for the guest accounts.

Tunnel Mode (also known as Tunnel to Wireless Controller) encapsulates all wireless client traffic in a CAPWAP tunnel and sends it to the FortiGate. This is necessary for the FortiGate to inspect the traffic, apply security policies, and perform NAT before forwarding it to the internet.

The Pre-authorized status means that an administrator has manually added the FortiSwitch's serial number to the FortiGate's managed switch list in anticipation of its connection. It is a placeholder entry waiting for the actual device to connect and establish the FortiLink tunnel.

To enforce two-factor authentication where both factors must be satisfied, you must create a Firewall group that includes multiple member groups. In this case, one member group would be tied to the remote LDAP server, and the second member group would be for PKI users, linked to the internal CA. By placing both of these groups inside a parent group and setting the logic to AND (the default), the FortiGate requires a user to satisfy the conditions of both member groups to be considered authenticated.

For devices that cannot use 802.1X, WPA2-Personal is the standard for encrypted communication. To add a layer of access control, MAC address filtering can be enabled. This allows the administrator to create a list of authorized MAC addresses for the IoT devices. While not foolproof, this combination provides both encryption and a basic level of device identity validation, which is a common and practical solution for securing legacy IoT devices.

FortiManager's Switch Templates are specifically designed for this purpose. An administrator can create a template that defines a standard configuration, such as VLANs, port settings, or security policies. This template can then be applied to a group of FortiSwitches, ensuring consistent configuration and simplifying management at scale. This is far more efficient than applying scripts individually.

FortiAuthenticator has pre-defined dictionaries for various logon event sources, including Windows Security Events, FortiGate logs, and Novell eDirectory. However, a Cisco ISE Posture Report is not a standard, pre-defined logon event dictionary. While a custom parser could potentially be created, it is not a built-in, valid dictionary entry for identifying user logon events.

When a FortiGate's internal hardware switch is used for FortiLink, by default, all ports in that switch become part of the FortiLink interface. Enabling fortilink-split-interface allows the administrator to break this behavior, dedicating one or more ports for FortiLink while leaving the remaining ports on the hardware switch available for other purposes, such as connecting to other network segments.

The standard method for RADIUS-based dynamic VLAN assignment uses a combination of three attributes. Tunnel-Type specifies the tunneling protocol (VLAN). Tunnel-Medium-Type specifies the medium (802 for Ethernet/Wi-Fi). Tunnel-Private-Group-ID contains the actual VLAN ID as a string.

This is false. While the FortiLink configuration is synchronized to the secondary unit, the FortiLink tunnel itself is only active on the primary FortiGate. In the event of a failover, the secondary unit becomes the new primary and must then establish a new FortiLink connection with the managed FortiSwitches. There is a brief period of management disruption during this process.