NSE7_LED-7.0 Practice Exam Questions with Answers Fortinet NSE 7 - LAN Edge 7.0 Certification

Based on the provided exhibit and Fortinet's official documentation for FortiOS and FortiSwitch, particularly the NSE 7 - LAN Edge 7.0 materials and the FortiSwitch Administration Guide, the behavior of the FortiSwitch security policy can be analyzed as follows:

The exhibit shows a FortiSwitch security policy configured with the following key settings:

Security mode:Port-based

User groups:FAC-Lab-User (a wired user group)

Guest VLAN:Set to "onboarding"

Guest authentication delay:30 seconds

Authentication fail VLAN:Set to "quarantine"

MAC authentication bypass:Disabled

EAP pass-through:Enabled

Override RADIUS timeout:Disabled

Analysis of the Scenario:

The question specifies that a device that does not support 802.1X authentication is connected to a port using this Port-Security security policy. Since the device does not support 802.1X, it cannot perform the standard 802.1X authentication process. The FortiSwitch will then evaluate alternative configurations to determine the port's behavior:

Guest VLAN Configuration:The Guest VLAN is set to "onboarding." According to Fortinet documentation, when a device fails to authenticate via 802.1X (e.g., due to lack of support), and a Guest VLAN is configured, the FortiSwitch assigns the port to the specified Guest VLAN after the guest authentication delay period (30 seconds in this case). The "onboarding" VLAN is typically used to place unauthenticated devices in a restricted network segment where they can be redirected to a captive portal or other onboarding process.

Authentication Fail VLAN:The Authentication Fail VLAN is set to "quarantine," which would apply if authentication fails after an attempt. However, since the device does not support 802.1X, no authentication attempt is made, and this setting does not trigger unless an authentication process is initiated and fails.

MAC Authentication Bypass:This option is disabled, so the FortiSwitch will not attempt to authenticate the device using its MAC address as the username and password.

EAP Pass-Through:This is enabled, allowing EAP frames to pass through to an external RADIUS server, but it is irrelevant here since the device does not support 802.1X.

Port Shutdown:There is no indication in the configuration or Fortinet documentation that the port will be shut down for a device that does not support 802.1X when a Guest VLAN is configured.

Conclusion:

When a device does not support 802.1X authentication and the security policy is set to Port-based with a Guest VLAN configured (set to "onboarding"), the FortiSwitch assigns the port to the Guest VLAN (onboarding) after the guest authentication delay (30 seconds). This behavior is consistent with Fortinet's design for handling unauthenticated devices in a secure network environment, as outlined in the FortiSwitch Port Security and VLAN assignment sections of the official documentation.

Why not the other options?

B. FortiSwitch shuts down the port:This action would occur only if the port security policy is configured to shut down the port upon authentication failure or violation (e.g., with a limit on MAC addresses), which is not indicated in this configuration.

C. FortiSwitch assigns the port to the quarantine VLAN:The quarantine VLAN is configured as the Authentication Fail VLAN, which applies only after an unsuccessful authentication attempt. Since no 802.1X authentication is attempted due to the device's lack of support, this does not apply.

D. FortiSwitch authenticates the device using the device MAC address as username and password:This requires MAC authentication bypass to be enabled, which it is not in this configuration.

Source Verification:

The answer is verified through the FortiSwitch Administration Guide (FortiOS 7.0) and NSE 7 - LAN Edge 7.0 training materials, specifically the sections on Port Security, 802.1X, and VLAN assignment for unauthenticated devices.

Based on LAN Edge 7.0 Study Guide page 217 When FortiGate discovers the first switch, it automatically adds to its configuration some settings that are default, quarantine, rspan, voice, video, onboarding, and nac_segment

According to the exhibit, the debug output shows that the device connected to port2 on FortiSwitch is sending an EAPOL-Start message, which is the first step of the 802.1X authentication process. However, the output also shows that the device is not sending any EAP-Response messages, which are required to complete the authentication process. Therefore, option A is true because the device is not configured for 802.1X authentication, which means that it does not have the correct credentials or settings to authenticate with the RADIUS server. Option D is also true because the device does not support 802.1X authentication, which means that it does not have the capability or software to perform 802.1X authentication. Option B is false because the device has not been quarantined for 3600 seconds, but rather has a session timeout of 3600 seconds, which is the default value for 802.1X sessions. Option C is false because the device has not been assigned the guest VLAN, but rather has been assigned the default VLAN, which is VLAN 1.

According to the exhibits, the AP 2.4 GHz interface is currently configured on channel 6, which is overlapping with other nearby APs on channels 4 and 8. This can cause interference and reduce the wireless performance. Therefore, changing the AP 2.4 GHz channel to 1 would improve the wireless connection, as it would avoid the overlapping channels and use a non-overlapping channel instead. Option A is false because changing the AP 2.4 GHz channel to 11 would still overlap with other nearby APs on channels 9 and 13. Option C is false because changing the AP 2.4 GHz channel to 9 would still overlap with other nearby APs on channels 6, 8, and 11. Option D is false because changing the AP 2.4 GHz channel to 13 would still overlap with other nearby APs on channels 9 and 11.

According to the exhibit, the firewall policy from port3 to port1 has no user group specified, which means that it allows all users to access the internet. Therefore, option B is true because adding RSSO Group to the firewall policy will restrict internet access to RSSO users only. Option A is false because changing the RADIUS Attribute Value setting will not affect the firewall policy, but rather the RSSO user group membership. Option C is false because enabling Security Fabric Connection on port3 will not affect the firewall policy, but rather the communication between FortiGate and other Security Fabric devices. Option D is false because creating a second firewall policy from port3 to port1 will not affect the existing firewall policy, but rather create a redundant or conflicting policy.

According to the FortiGate Administration Guide, “To enable automated wireless client quarantine using IOC, you must configure the following settings: Configure your wireless network to be in tunnel mode. This allows FortiGate to inspect all wireless traffic and apply security policies. Configure your FortiGate device in the Security Fabric with a FortiAnalyzer device. This allows FortiAnalyzer to detect indicators of compromise (IOC) from wireless traffic and send quarantine commands to FortiGate.” Therefore, options A and B are true because they describe the configurations that must be put in place for a wireless client to be quarantined successfully using IOC. Option C is false because configuring a firewall policy to allow communication is not required, as the default firewall policy for tunnel mode wireless networks is to allow all traffic. Option D is false because configuring the wireless network to be in bridge mode is not supported, as FortiGate cannot inspect or quarantine wireless traffic in bridge mode.

According to the Fortinet documentation1, “Split tunneling allows you to specify which traffic is tunneled to the FortiGate and which traffic is sent directly to the Internet. This can improve performance and reduce bandwidth usage.” Therefore, by configuring split-tunneling in the vap configuration, you can allow the clients connected to the Corporate SSID to access both the corporate network and the local printer. Option B is incorrect because split-tunneling is configured at the vap level, not the wtp-profile level. Option C is incorrect becauseblocking intra-SSID traffic prevents wireless clients on the same SSID from communicating with each other, which is not related to accessing a local printer. Option D is unnecessary and impractical because the printer does not need to be a wireless client on the Corporate wireless network to be accessible by the clients.

According to the FortiGate Administration Guide, “EAP-TLS is the most secure EAP method. It requires a digital certificate on both the server end and the client end. The server and client authenticate each other using their certificates.” Therefore, option D is true because it describes the EAP method that requires the use of a digital certificate on both the server end and the client end. Option A is false because EAP-TTLS only requires a digital certificate on the server end, not the client end. Option B is false because PEAP also only requires a digital certificate on the server end, not the client end. Option C is false because EAP-GTC does not require a digital certificate on either the server end or the client end.

According to the FortiAuthenticator Administration Guide2, “The guest portal provides pre and post-log in services for users (such as password reset and token registration abilities), and rules and replacement messages can be configured.” Therefore, option C is true. The same guide also states that “Administrators can use one or more incoming parameters to configure a mapping rule for the guest portal.” Therefore, option D is true. Option A is false because remote users can sponsor any number of guest accounts, as long as they do not exceed the maximum number of guest accounts allowed by the license. Option B is false because administrators can choose to approve or reject guest accounts, or enable auto-approval.