Free NSE7-LED-7-0 sample questions

Correct answer: The `set mac-auth-bypass` command is disabled on the port.

In `802.1X-mac-based` security mode, both 802.1X and MAB can be used. However, MAB is not enabled by default. The administrator must explicitly enable it on the interface using the `set mac-auth-bypass enable` command. If this is not set, the switch will not attempt MAB for non-802.1X capable devices, causing their connections to fail.

Correct answers: The `fortinet-group-name` Vendor-Specific Attribute (VSA) must be included in the RADIUS accounting messages.; The 'Enable RADIUS accounting' option must be activated for the specific RADIUS client configuration on FortiAuthenticator.

For FortiAuthenticator to map users to groups via RSSO, it relies on specific RADIUS attributes. The `fortinet-group-name` VSA is the primary attribute used to convey group membership information in RADIUS accounting records.

FortiAuthenticator will not process accounting messages from a RADIUS client unless the 'Enable RADIUS accounting' checkbox is explicitly enabled for that client's definition under `Authentication > RADIUS Service > Clients`.

Correct answer: Set `broadcast-suppression` to `arp-known-clients`.

The `broadcast-suppression` setting controls how the FortiAP handles broadcast packets. Setting it to `arp-known-clients` instructs the AP to convert ARP request broadcasts into unicast frames for clients it already has in its ARP table. This reduces unnecessary broadcast traffic over the air, improving overall wireless network efficiency.

Correct answer: True

This is true. For ZTP to work via DHCP option 43, the string must contain the IP address of the managing FortiGate and the name of the FortiLink interface that the switch should connect to. This information allows the switch to automatically establish the FortiLink connection upon boot-up.

Correct answer: FortiGate, using an automation stitch triggered by an IoC.

In the Security Fabric, the FortiGate acts as the central enforcement point. When its security services (like IPS or Web Filter) detect an Indicator of Compromise (IoC), such as traffic to a C&C server, an automation stitch can be triggered. This stitch then instructs the FortiSwitch, via the FortiLink connection, to quarantine the offending client's switch port.

Correct answer: (&(objectClass=user)(sAMAccountName=*)(memberOf=CN=VPN_Users,CN=Users,DC=example,DC=com))

The correct LDAP filter syntax combines multiple conditions. `(objectClass=user)` ensures only user objects are considered. `(sAMAccountName=*)` is a placeholder for the username. `(memberOf=CN=VPN_Users,CN=Users,DC=example,DC=com)` checks for membership in the specified group, requiring the full Distinguished Name (DN) of the group.

Correct answers: Configure the SSID Security Mode to `Captive Portal` with authentication portal set to `Local` and user group configured for guests.; Set the SSID traffic mode to `Tunnel Mode`.

Setting the security mode to Captive Portal is the fundamental step for creating a guest network. Configuring a local portal with a guest-specific user group on the FortiGate allows for self-registration and policy enforcement, including setting expiration timers for the guest accounts.

Tunnel Mode (also known as Tunnel to Wireless Controller) encapsulates all wireless client traffic in a CAPWAP tunnel and sends it to the FortiGate. This is necessary for the FortiGate to inspect the traffic, apply security policies, and perform NAT before forwarding it to the internet.

Correct answer: The switch has been manually configured on the FortiGate, but the physical switch has not yet connected.

The `Pre-authorized` status means that an administrator has manually added the FortiSwitch's serial number to the FortiGate's managed switch list in anticipation of its connection. It is a placeholder entry waiting for the actual device to connect and establish the FortiLink tunnel.

Correct answer: A Firewall group that nests two other Firewall groups: one for the LDAP server and another for the PKI users.

To enforce two-factor authentication where both factors must be satisfied, you must create a Firewall group that includes multiple member groups. In this case, one member group would be tied to the remote LDAP server, and the second member group would be for PKI users, linked to the internal CA. By placing both of these groups inside a parent group and setting the logic to AND (the default), the FortiGate requires a user to satisfy the conditions of both member groups to be considered authenticated.

Correct answer: WPA2-Personal with a pre-shared key and MAC address filtering.

For devices that cannot use 802.1X, WPA2-Personal is the standard for encrypted communication. To add a layer of access control, MAC address filtering can be enabled. This allows the administrator to create a list of authorized MAC addresses for the IoT devices. While not foolproof, this combination provides both encryption and a basic level of device identity validation, which is a common and practical solution for securing legacy IoT devices.