Fortinet · Free Practice Questions · Last reviewed May 2026
36 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
An enterprise network uses ADVPN 2.0 with BGP running over IPsec tunnels. A spoke needs to initiate a shortcut tunnel to another spoke. Which FortiOS CLI command is used on the hub to verify the active shortcut tunnels and view the shortcut state information?
execute router clear bgp all
get system sdwan neighbor
diagnose vpn tunnel list
On the hub, diagnose vpn tunnel list enumerates IPsec tunnels including ADVPN shortcut sessions, showing their names, selectors and state. This confirms which spoke-to-spoke shortcuts are currently established and active without inspecting individual security associations.
diagnose netlink interface list
An administrator wants to apply a Web Filtering security profile to traffic that is being dynamically steered via an SD-WAN rule. Where must this security profile be enforced in FortiOS?
Inside the firewall policy that matches the traffic being steered by the SD-WAN rule
SD-WAN rules only select the egress member; they do not inspect payload. Web Filtering must therefore sit in the firewall policy that matches the steered traffic, so the profile is applied after the SD-WAN rule chooses the egress interface.
Directly inside the SD-WAN rule configuration under the advanced settings tab
Globally under the system settings as an SD-WAN overlay inspection profile
Within the IPsec tunnel phase 2 security association settings
An IPsec VPN tunnel used as an SD-WAN member is experiencing intermittent flapping due to DPD (Dead Peer Detection) timeout issues over a high-latency satellite link. How should the administrator adjust the Phase 1 IPsec settings on FortiOS to stabilize the tunnel without completely disabling failure detection?
Disable DPD entirely so the FortiGate never tears down the tunnel
Enable NP6/NP7 hardware offloading for Phase 1 SA renegotiation
Change the IPsec phase 1 mode from Main mode to Aggressive mode
Increase the DPD retry count and interval settings under the IPsec Phase 1 configuration
Satellite latency causes DPD probes to expire before replies arrive, flapping the tunnel. Raising the DPD retry count and interval under Phase 1 tolerates that delay while keeping dead peer detection active, satisfying the requirement not to disable detection.
When troubleshooting SD-WAN performance SLA packet loss, an administrator wants to view real-time latency, jitter, and packet loss statistics for individual health check members. Which CLI command should be executed?
diagnose sys sdwan health-check
`diagnose sys sdwan health-check` reports per-member SLA metrics, including latency, jitter and packet loss, for each configured health check. It directly satisfies the stem's requirement for real-time statistics on individual health check members, unlike interface-level or session-level diagnostics that aggregate or omit SLA measurements.
get system interface physical
execute ping-server status
show system sdwan
In an ADVPN 2.0 deployment, a hub unit uses BGP to advertise routes to spokes. When a spoke learns a prefix via BGP from the hub, what mechanism allows the spoke to automatically initiate an ADVPN shortcut tunnel directly to another spoke when traffic flows between them?
The FortiGate kernel detects traffic matching a dynamic BGP route over the IPsec interface and initiates an IKE shortcut negotiation with the target spoke
The FortiGate kernel monitors traffic egressing the ADVPN IPsec interface and matching a BGP-learned route; this triggers an IKE negotiation directly with the destination spoke, establishing the shortcut. This satisfies the requirement for automatic, traffic-driven shortcut initiation without hub involvement in the data path.
OSPF sends a special multicast hello packet across the hub to establish mesh point-to-point links
FortiManager pushes a dynamic static route to both spokes simultaneously
The Web Filtering profile intercepts the packet and redirects it via proxy to the destination spoke
An administrator configures an SD-WAN rule with a 'Lowest Cost (SLA)' strategy. What determines the metric used by FortiOS to select the best interface when multiple links meet the SLA criteria?
The round-robin algorithm applied sequentially across all active links
The lowest physical port number on the FortiGate hardware
The lowest packet loss, jitter, or latency value measured by the health check among the qualifying links
With Lowest Cost (SLA), FortiOS first filters members that satisfy the SLA targets, then ranks the survivors by their measured health-check metrics. Among qualifying links it picks the one reporting the lowest packet loss, jitter, or latency, so the metric is the live probe measurement rather than a static cost value.
The highest interface bandwidth capacity defined in the static route table
Want more Nse7 SD Wan Security Profiles Routing And Ipsec practice?
Practice this domainWhat is the impact of changing the 'set vdom-mode' from 'no-vdom' to 'multi-vdom'?
Automatic disablement of HA
Loss of all firewall policies
No impact, immediate change
System reboot required
Switching from no-vdom to multi-vdom restructures the entire configuration hierarchy, so the FortiGate must reboot to reinitialise interfaces and routing tables under the new mode. This satisfies the stem's constraint that the change cannot apply at runtime.
A FortiGate is operating in transparent mode. What is the default behavior when the device receives a frame with an unknown MAC address?
Drop the packet
Flood to all ports
In transparent mode the FortiGate forwards frames by MAC address; an unknown destination MAC triggers flooding out all ports except the ingress, mirroring switch behaviour. This satisfies the stem's default-behaviour constraint for unrecognised MAC addresses.
Forward to the management interface
Send an ICMP unreachable message
A network administrator is configuring an HA cluster with two FortiGates in Active-Passive mode. Which parameter must be identical on both devices to ensure a successful cluster formation?
Device Hostname
Serial Number
HA Group ID
The HA group ID must match on both members; it identifies which cluster a device joins, so mismatched values prevent the FortiGates from forming a single cluster. Identical group IDs satisfy the requirement for successful Active-Passive cluster formation.
Priority value
What is the purpose of 'dedicated HA' interfaces?
To provide extra management access
To isolate heartbeat traffic
Dedicated HA interfaces carry only heartbeat and synchronisation traffic between cluster members, separating it from data and management traffic. This satisfies the requirement to isolate heartbeat traffic, preventing session load or management access from disrupting HA failover communication.
To increase throughput
To act as a backup WAN port
You need to inspect traffic between two VDOMs. Which mechanism is required?
Policy-based routing
Physical loopback cable
Inter-VDOM Link
An inter-VDOM link creates a dedicated virtual connection between two VDOMs, allowing traffic to traverse and be inspected by firewall policies. Without it, VDOMs remain isolated, so this mechanism satisfies the requirement to inspect inter-VDOM traffic.
Static NAT
Which parameter, when modified in a policy, causes a session flush for all active connections hitting that policy?
Schedule
Action (Accept to Deny)
Changing a policy's action from Accept to Deny alters the policy's identity, so FortiGate tears down every session matching it, forcing re-evaluation against the new action. Other edits, such as logging or comments, leave established sessions intact.
Comments field
Policy Name
Want more Nse7 Enterprise Firewall System Configuration practice?
Practice this domainWhen adding a FortiGate to FortiManager, which mode must the FortiGate be in to allow the FortiManager to manage its configuration and policies?
Registration-only mode
Backup mode
Normal mode
Normal mode permits FortiManager to push configuration and policy packages, because the FortiGate retains its own local configuration while accepting centralised management. This satisfies the stem's requirement for full configuration and policy management. Other modes, such as backup, restrict FortiManager to read-only monitoring, so they cannot fulfil the management constraint.
Read-only mode
An administrator wants to use FortiManager to push a configuration change to 50 FortiGates simultaneously. Which method minimizes downtime and ensures consistency?
Create 50 separate ADOMs
Assign devices to a Device Group and push a common Policy Package
A Device Group with a shared Policy Package installs one consistent configuration across all 50 FortiGates in a single push, avoiding per-device drift and sequential edits. This satisfies the simultaneous, consistency-critical requirement while minimising downtime through centralised, atomic deployment.
Connect to each FortiGate via SSH and run scripts
Enable 'Auto-Push' for every change
What is the primary purpose of an ADOM in FortiManager?
To logically group devices for delegated administration and policy management
An ADOM partitions FortiManager into independent administrative domains, each holding its own devices, policies and objects. This directly satisfies the delegated administration and policy management requirement, letting separate teams manage their own device groups without affecting others. It is not merely a folder or a backup container; it is the fundamental management boundary within FortiManager.
To provide high availability for the FortiGate
To allow external API access to the FortiGate
To increase the storage capacity of the FortiManager
You are troubleshooting a policy installation failure where the FortiManager reports a 'Configuration conflict'. Which action should you perform to identify the root cause of the mismatch?
Force an 'Import Policy' operation
Reboot the FortiManager
Disable the policy package entirely
Use the 'Diff' feature in the Policy & Objects tab to compare the database and device config
The 'Diff' feature compares FortiManager's policy database against the managed device's running configuration, exposing exactly which objects or rules diverge. This directly satisfies the stem's need to identify the root cause of the 'Configuration conflict' mismatch before remediation, rather than guessing or reinstalling blindly.
You are setting up an SD-WAN configuration via FortiManager. Which object type is used to group multiple WAN interfaces for SD-WAN member assignment?
IP Pool
Virtual Wire Pair
SD-WAN Zone
SD-WAN zones group multiple WAN interfaces into a single logical object, and FortiManager assigns members to that zone. This satisfies the stem's requirement for grouping WAN interfaces during SD-WAN member assignment, rather than configuring each interface individually.
Interface Group
You are managing FortiGates across multiple ADOMs. How can you share common firewall objects (e.g., mail servers, common IP ranges) across these ADOMs?
Create objects in the Global Database
Objects created in the Global Database are inherited by every ADOM, so common firewall addresses and services are defined once and referenced everywhere. This satisfies the cross-ADOM sharing requirement without duplicating objects in each ADOM, though per-ADOM objects cannot be shared upward.
Manually copy objects to each ADOM
Use the API to script the creation in every ADOM
Enable 'Object Sharing' in system settings
Want more Nse7 Enterprise Firewall Central Management practice?
Practice this domainWhen configuring an SD-WAN rule, what is the purpose of the 'Source' address field?
To define the gateway IP for the route.
To force traffic to a specific SD-WAN zone.
To determine which ISP the traffic exits through regardless of SLA.
To match traffic based on the source IP or user.
The Source field scopes which traffic the SD-WAN rule evaluates, matching flows by source IP address or identified user. Only traffic originating from those sources is steered by the rule's strategy, letting administrators apply different link-selection policies per subnet or user group.
Which command is used to verify the current status of SD-WAN members and their SLA health from the CLI?
diagnose sys sdwan health-check
The diagnose sys sdwan health-check command outputs each member's SLA probe results, including latency, jitter, packet loss and up/down state per health-check. It is the CLI equivalent of the GUI SD-WAN monitor, satisfying the requirement to verify member status and SLA health.
show router info bgp
get system interface
get system sdwan member
You are configuring a Performance SLA to monitor reachability to a SaaS application. Which parameter determines the threshold for an interface to be considered 'unhealthy' in the SD-WAN routing table?
Probe Mode
Sequence Number
Packet Loss Threshold
The packet loss threshold sets the maximum percentage of lost probes a member may incur before FortiOS marks it unhealthy in the SD-WAN routing table. Exceeding it removes the interface from SLA-qualified selection, directly determining the unhealthy state for the monitored SaaS application.
Update Interval
Which SD-WAN rule strategy should you choose if you want to distribute traffic across multiple interfaces based on their bandwidth weights?
Manual
Maximize Bandwidth (SLA)
Maximize Bandwidth (SLA) distributes sessions across members proportionally to their configured bandwidth weights, provided each member passes its SLA targets. This satisfies the stem's requirement to spread traffic by bandwidth weight, unlike Best Quality or Lowest Cost, which pick a single member rather than load-sharing.
Lowest Cost (SLA)
SLA Target
An SD-WAN rule is configured with 'Lowest Cost (SLA)' strategy. If all members in the SLA meet the requirements, how does the FortiGate select the outgoing interface?
The member with the lowest interface cost value defined in the SD-WAN member configuration.
Under Lowest Cost (SLA), FortiGate first filters members meeting every SLA target, then breaks ties by the configured interface cost value. The lowest-cost surviving member becomes the egress interface, so cost only decides once SLA health is satisfied.
Round Robin
The interface with the highest bandwidth.
The interface that was most recently added to the zone.
When using SD-WAN zones, what is the primary benefit of grouping multiple physical interfaces into a single zone?
It increases the throughput of individual physical links.
It prevents the need for performance SLAs.
It automatically enables load balancing between interfaces.
It allows you to apply a single firewall policy to the entire group.
A zone groups several physical links so policy is written once against the logical zone rather than per member interface. Traffic is then load-balanced and failed over across members, satisfying the requirement to manage many links as one policy target.
Want more Nse7 SD Wan System Configuration And Setup practice?
Practice this domainWhat happens if you modify an SD-WAN template that is already applied to a FortiGate?
The changes take effect immediately without a push
The configuration status shows 'Modified' and requires an installation task
Editing an applied SD-WAN template marks the FortiGate's configuration status as 'Modified', because the device's running configuration no longer matches the last installed template revision. An explicit installation task must then push the updated template, satisfying the stem's requirement that changes are staged rather than applied automatically.
The FortiGate automatically pulls the new config
The FortiGate configuration is reverted
In SD-WAN central management, what is the 'SD-WAN Zone' used for?
To define the physical port speed
To limit bandwidth for specific users
To group multiple SD-WAN members for logical policy routing
An SD-WAN zone groups multiple SD-WAN members so that policies and rules can reference the zone rather than individual interfaces. This satisfies the stem by enabling logical policy routing across members, simplifying configuration when links change.
To isolate the SD-WAN traffic from the WAN
When using SD-WAN templates, how are SD-WAN rules ordered?
Top to bottom
SD-WAN rules in FortiManager templates are evaluated sequentially from the first entry downwards, so the topmost matching rule wins and later rules are skipped. This top-to-bottom precedence satisfies the stem's ordering constraint, letting administrators position specific traffic-steering rules above broader catch-all rules to control path selection deterministically.
Based on the creation date
By the interface speed
Randomly
Which object must be created before assigning a health check to an SD-WAN service rule in an SD-WAN template?
An SD-WAN Health Check
An SD-WAN health check object must exist first, because the service rule references it by name to determine link quality and steer traffic. This satisfies the stem's prerequisite ordering before assignment within the SD-WAN template.
A routing protocol
A firewall address object
An SD-WAN Zone
When creating an SD-WAN template, what must be defined before you can add an SD-WAN interface to the template?
Individual SD-WAN member interfaces
An SD-WAN interface is a logical overlay aggregating physical links, so FortiManager cannot build it until the underlying member interfaces exist. Defining those individual SD-WAN member interfaces first gives the template the concrete members it references, satisfying the prerequisite before the SD-WAN interface can be added.
The SD-WAN health check probes
Global firewall policies
The virtual domain (VDOM) settings
You are configuring SD-WAN templates in FortiManager. What is the primary purpose of using SD-WAN Central Management instead of configuring SD-WAN directly on individual FortiGates?
To perform local traffic analysis on the FortiGate only
To allow FortiGates to manage their own SD-WAN interfaces independently
To bypass the need for ADOMs
To enable SD-WAN template inheritance and synchronized policy updates across multiple managed devices
Central Management pushes a single SD-WAN template to many FortiGates, so inheritance propagates interface, member and health-check settings consistently. Editing the template updates every managed device at once, satisfying the stem's requirement for synchronised policy across the estate rather than per-device configuration drift.
Want more Nse7 SD Wan Central Management practice?
Practice this domainYou are configuring an IPS policy to protect a web server. You notice that traffic is being dropped due to a false positive. Which action is the most efficient way to resolve this while maintaining security?
Change the IPS mode from blocking to monitoring
Disable the entire IPS sensor profile
Create an IPS sensor override for the specific signature ID
An IPS sensor override targets the exact signature ID generating the false positive, disabling or tuning only that signature while every other IPS signature remains active. This preserves protection for the web server and avoids weakening the whole sensor or policy, satisfying the requirement to resolve the drop efficiently.
Increase the IPS packet buffer size
You are implementing SSL VPN and need to ensure that only compliant corporate laptops can connect. Which feature should you use?
Host check
Host check inspects the connecting endpoint against configured criteria, such as antivirus presence, OS patch level or registry keys, before granting SSL VPN access. This satisfies the compliance constraint by admitting only corporate laptops that pass the defined posture checks.
SSL VPN portal settings
Two-factor authentication
PKI user authentication
A FortiGate is performing OSPF routing. You want to redistribute connected routes into OSPF, but only for a specific subnet. How can this be achieved?
Configure a distribute-list in the OSPF process
Use an IP prefix list under the OSPF area command
Use a route map in the OSPF redistribute configuration
A route map applied to the OSPF redistribute connected statement filters which connected prefixes enter OSPF, matching only the specified subnet via an access list or prefix list. This satisfies the stem's constraint of advertising a single subnet rather than every connected route, which plain redistribution would leak.
Use an access list under the interface configuration
You are configuring an IPsec VPN tunnel between two FortiGates. Phase 2 fails to come up. What is the most likely cause?
Mismatched Phase 2 selectors
Phase 2 negotiates the IPsec SA using the configured proxy IDs or selectors; if the local and remote quick-mode selectors do not mirror each other, the tunnel proposal is rejected and Phase 2 never establishes, even though Phase 1 succeeds.
Incorrect IKE version
Expired certificate
Mismatched pre-shared key
What is the default behavior of a FortiGate firewall policy when no explicit policy matches the traffic?
Send to local DNS
Implicit Deny
FortiGate applies an implicit deny at the end of policy processing, silently dropping traffic that matches no explicit policy. This default-deny posture satisfies the stem's scenario by ensuring unmatched traffic is blocked rather than permitted.
Route to DMZ
Allow
A network administrator is configuring SSL inspection for a group of users. Which certificate must be installed on the client endpoints to prevent browser certificate warnings?
The FortiGate CA certificate used for SSL inspection
SSL deep inspection makes the FortiGate re-sign each session with its own CA certificate. Installing that CA certificate in the endpoints' trust stores lets browsers validate the re-signed chain, eliminating warnings. Without it, clients see an untrusted issuer for every inspected site.
The FortiGate's local device certificate
The Fortinet_Factory CA certificate
A third-party public CA certificate
Want more Nse7 Enterprise Firewall Security And VPN practice?
Practice this domainThe vendor does not publish an exact question count for the FORTINET-NSE7-SPECIALTY. Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 6 domains: Nse7 SD Wan Security Profiles Routing And Ipsec, Nse7 Enterprise Firewall System Configuration, Nse7 Enterprise Firewall Central Management, Nse7 SD Wan System Configuration And Setup, Nse7 SD Wan Central Management, Nse7 Enterprise Firewall Security And VPN. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Fortinet FORTINET-NSE7-SPECIALTY exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.