Fortinet NSE 7 - LAN Edge 7.0 Free Sample Questions

In 802.1X-mac-based security mode, both 802.1X and MAB can be used. However, MAB is not enabled by default. The administrator must explicitly enable it on the interface using the set mac-auth-bypass enable command. If this is not set, the switch will not attempt MAB for non-802.1X capable devices, causing their connections to fail.

For FortiAuthenticator to map users to groups via RSSO, it relies on specific RADIUS attributes. The fortinet-group-name VSA is the primary attribute used to convey group membership information in RADIUS accounting records.

FortiAuthenticator will not process accounting messages from a RADIUS client unless the 'Enable RADIUS accounting' checkbox is explicitly enabled for that client's definition under Authentication > RADIUS Service > Clients.

The broadcast-suppression setting controls how the FortiAP handles broadcast packets. Setting it to arp-known-clients instructs the AP to convert ARP request broadcasts into unicast frames for clients it already has in its ARP table. This reduces unnecessary broadcast traffic over the air, improving overall wireless network efficiency.

This is true. For ZTP to work via DHCP option 43, the string must contain the IP address of the managing FortiGate and the name of the FortiLink interface that the switch should connect to. This information allows the switch to automatically establish the FortiLink connection upon boot-up.

In the Security Fabric, the FortiGate acts as the central enforcement point. When its security services (like IPS or Web Filter) detect an Indicator of Compromise (IoC), such as traffic to a C&C server, an automation stitch can be triggered. This stitch then instructs the FortiSwitch, via the FortiLink connection, to quarantine the offending client's switch port.

The correct LDAP filter syntax combines multiple conditions. (objectClass=user) ensures only user objects are considered. (sAMAccountName=*) is a placeholder for the username. (memberOf=CN=VPN_Users,CN=Users,DC=example,DC=com) checks for membership in the specified group, requiring the full Distinguished Name (DN) of the group.

Setting the security mode to Captive Portal is the fundamental step for creating a guest network. Configuring a local portal with a guest-specific user group on the FortiGate allows for self-registration and policy enforcement, including setting expiration timers for the guest accounts.

Tunnel Mode (also known as Tunnel to Wireless Controller) encapsulates all wireless client traffic in a CAPWAP tunnel and sends it to the FortiGate. This is necessary for the FortiGate to inspect the traffic, apply security policies, and perform NAT before forwarding it to the internet.

The Pre-authorized status means that an administrator has manually added the FortiSwitch's serial number to the FortiGate's managed switch list in anticipation of its connection. It is a placeholder entry waiting for the actual device to connect and establish the FortiLink tunnel.

To enforce two-factor authentication where both factors must be satisfied, you must create a Firewall group that includes multiple member groups. In this case, one member group would be tied to the remote LDAP server, and the second member group would be for PKI users, linked to the internal CA. By placing both of these groups inside a parent group and setting the logic to AND (the default), the FortiGate requires a user to satisfy the conditions of both member groups to be considered authenticated.

For devices that cannot use 802.1X, WPA2-Personal is the standard for encrypted communication. To add a layer of access control, MAC address filtering can be enabled. This allows the administrator to create a list of authorized MAC addresses for the IoT devices. While not foolproof, this combination provides both encryption and a basic level of device identity validation, which is a common and practical solution for securing legacy IoT devices.