Fortinet NSE 7 - LAN Edge 7.0 - NSE7_LED-7.0 Exam Questions [2026]

QUESTION NO: 1
Refer to the exhibit.

Examine the LDAP server configuration shown in the exhibit Note that the Username setting has been expanded to display Its full content On the Windows AD server 10.0.1.10, the administrator used dsquery. which returned the following output:

According to the output which FortiGate LDAP setting is configured incorrectly''

A. Bind Type B. Username C. Distinguished Name D. Common Name Identifier

Correct Answer: C

QUESTION NO: 2
Refer to the exhibit.

Examine the IPsec VPN phase 1 configuration shown in the exhibit
An administrator wants to use certificate-based authentication for an IPsec VPN user Which three configuration changes must you make on FortiGate to perform certificate-based authentication for the IPsec VPN user? (Choose three)

A. Create a PKI user for the IPsec VPN user, and then configure the IPsec VPN tunnel to accept the PKI user as peer certificate. B. In the IKE section of the IPsec VPN tunnel, in the Mode field, select Main (ID protection). C. In the Authentication section of the IPsec VPN tunnel, in the Method drop-down list, select Signature, and then select the certificate that FortiGate will use for IPsec VPN. D. Enable XAUTH on the IPsec VPN tunnel. E. Import the CA that signed the user certificate.

Correct Answer: C,D,E

QUESTION NO: 3
Which statement correctly describes the guest portal behavior on FortiAuthenticator?

A. All guest accounts must be activated using SMS or email activation codes. B. Sponsored accounts cannot authenticate using guest portals. C. FortiAuthenticator uses POST parameters and a RADIUS client configuration to map the request to a guest portal for authentication. D. All self-registered and sponsored accounts are listed on the local Users GUI page on FortiAuthenticator.

Correct Answer: C

QUESTION NO: 4
When you configure a FortiAP wireless interface for auto TX power control which statement describes how it configures its transmission power"?

A. Every 30 seconds the AP will measure the signal strength of the AP using the client The AP will adjust its signal strength up or down until the AP signal is detected at -70 dBm B. Every 30 seconds FortiGate measures the signal strength of adjacent AP interfaces It will adjust its own AP power to match the adjacent AP signal strength C. Every 30 seconds FortiGate measures the signal strength of the weakest associated client The AP will then configure its radio power to match the detected signal strength of the client D. Every 30 seconds FortiGate measures the signal strength of adjacent FortiAP interfaces It will adjust the adjacent AP power to be detectable at -70 dBm

Correct Answer: D

QUESTION NO: 5
Refer to the exhibits.

Firewall Policy

Examine the firewall policy configuration and SSID settings
An administrator has configured a guest wireless network on FortiGate using the external captive portal The administrator has verified that the external captive portal URL is correct However wireless users are not able to see the captive portal login page Given the configuration shown in the exhibit and the SSID settings which configuration change should the administrator make to fix the problem?

A. Include the wireless client subnet range in the Exempt Source section B. Enable the captivs-portal-exempt option in the firewall policy with the ID 11. C. Apply a guest.portal user group in the firewall policy with the ID 11. D. Disable the user group from the SSID configuration

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 6
An administrator has configured an SSID in bridge mode for corporate employees All APs are online and provisioned using default AP profiles Employees are unable to locate the SSID to conned Which two configurations can the administrator verify? (Choose two)

A. Verify that the Block Intra-SSID Traffic (intra-vap-privacy) option in the SSID configuration is disabled B. Verify that the SSID to an AP group that should be broadcasting the SSID is applied C. Verify that the SSID is manually applied on AP profiles for both 2 4 GHz and 5 GHz radios D. Verify that the broadcast SSID option is enabled in the SSID configuration

Correct Answer: C,D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 7
Refer to the exhibit

A device connected to port2 on FortiSwitch cannot access the network The port is assigned a security policy to enforce 802 1X authentication While troubleshooting the issue, the administrator obtains the debug output shown in the exhibit Which two scenarios are likely to cause this issue? (Choose two.)

A. The device is not configured for 802 IX authentication. B. The device has been quarantined for 3600 seconds. C. The device has been assigned the guest VLAN D. The device does not support 802 1X authentication

Correct Answer: A,D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).