FORTINET-NSE7-SPECIALTY Practice Test 10 — 10 Questions

Question 1

An administrator implements BGP over SD-WAN tunnels to a cloud provider. The cloud provider requires BGP MD5 authentication on all peering sessions. Where is BGP MD5 authentication configured on the FortiGate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Under the router bgp neighbor configuration block in the CLI. BGP MD5 authentication is configured on the FortiGate under the BGP neighbor configuration in the CLI, using the command 'set password' within the 'config router bgp' and 'config neighbor' blocks. This sets the TCP MD5 signature option for the BGP session, which must match on both peers. It is not configured in firewall policies, IPsec Phase 1 settings, or SD-WAN health checks.

Answer

Within the firewall policy authentication settings

Answer

Under the IPsec phase 1 interface advanced settings

Answer

Inside the SD-WAN health check probe configuration

Question 2

When using SD-WAN zones, what is the primary benefit of grouping multiple physical interfaces into a single zone?

Accepted Answer

It allows you to apply a single firewall policy to the entire group.. Grouping multiple physical interfaces into a single SD-WAN zone allows you to apply a single firewall policy to the entire group, simplifying management and ensuring consistent security policies across all member interfaces. This is the primary benefit because it reduces administrative overhead and ensures that policies are uniformly enforced. While SD-WAN zones can also facilitate load balancing and failover, those are features of the SD-WAN rules applied to the zone, not the primary purpose of grouping interfaces.

Answer

It increases the throughput of individual physical links.

Answer

It prevents the need for performance SLAs.

Answer

It automatically enables load balancing between interfaces.

Question 3

During SD-WAN template deployment, what is the role of 'Dynamic Mapping'?

Accepted Answer

To map a single template object to different physical settings on different devices. Dynamic Mapping in SD-WAN template deployment allows a single template object (like an interface or SD-WAN rule) to be mapped to different physical settings on different devices. This enables flexibility when deploying the same template to multiple FortiGates with varying interface names or configurations. It uses variables and metadata to adapt the template to each device's specifics.

Answer

To automate firmware updates

Answer

To monitor bandwidth usage

Answer

To dynamically change the SD-WAN rule based on time

Answer

To calculate the latency of paths

Question 4

What is required before FortiManager can display SD-WAN monitoring data?

Accepted Answer

The FortiGate must be sending logs to FortiManager. FortiManager displays SD-WAN monitoring data by receiving logs from the FortiGate. The FortiGate must be configured to send logs to FortiManager, typically via the 'log fortianalyzer' or 'log fortimanager' settings. Without logs, FortiManager has no data to display for SD-WAN monitoring, such as performance SLAs, link status, and traffic statistics.

Answer

The FortiGate must have a cloud license

Answer

The FortiGate must be running a specific firmware

Answer

The FortiGate must be in Transparent mode

Question 5

What is the result of 'Pushing' a policy package from FortiManager to a FortiGate?

Accepted Answer

The FortiGate policy configuration is overwritten with the FortiManager version. When you push a policy package from FortiManager to a managed FortiGate, FortiManager installs its policy package configuration onto the device, replacing the corresponding firewall policy configuration on the FortiGate with the FortiManager version. This is the standard 'install' operation in the FortiManager workflow, and it overwrites the device-level policy configuration rather than merging or appending it. The FortiGate becomes a reflection of the FortiManager policy package for the policy-related objects that are pushed.

Answer

The FortiGate policy is sent to the FortiManager

Answer

The policy is saved in a draft state on the FortiGate

Answer

The FortiManager policy is appended to the existing FortiGate policy

Question 6

An SD-WAN rule is configured with 'Lowest Cost (SLA)' strategy. If all members in the SLA meet the requirements, how does the FortiGate select the outgoing interface?

Accepted Answer

The member with the lowest interface cost value defined in the SD-WAN member configuration.. With the 'Lowest Cost (SLA)' strategy, FortiGate first filters SD-WAN members to those that meet the SLA targets (latency, jitter, packet loss). Among the qualifying members, it then selects the member with the lowest configured interface cost value in the SD-WAN member configuration. This is a two-stage decision: SLA eligibility first, then cost-based tie-breaking.

Answer

Round Robin

Answer

The interface with the highest bandwidth.

Answer

The interface that was most recently added to the zone.

Question 7

Which TWO options are available when configuring an SD-WAN rule in FortiManager?

Accepted Answer

Source/Destination criteria. In FortiManager, an SD-WAN rule (the equivalent of a policy route within the SD-WAN zone) is defined primarily by matching traffic through source/destination criteria, so option B is correct: you specify source addresses, destination addresses, users, services, and applications to identify which traffic the rule applies to. Option C is also correct because every SD-WAN rule must select a traffic steering strategy — such as best quality, lowest cost, maximize bandwidth (SLA), or manual — which determines how the rule chooses among the SD-WAN members. Option A is not a configurable match or action in an SD-WAN rule; interface speed is a link attribute used by some steering strategies but is not itself a rule setting. Option D is incorrect because MAC address spoofing is not a FortiManager SD-WAN rule parameter. Option E is incorrect because hardware acceleration is a per-firewall-policy/interface setting, not an SD-WAN rule configuration option.

Answer

Interface physical speed

Answer

MAC address spoofing

Answer

Hardware acceleration toggle

Question 8

Which TWO items must be configured within an SD-WAN template for SD-WAN traffic steering to work?

Accepted Answer

SD-WAN Members. Option B (SD-WAN Members) is correct because traffic steering requires the physical or logical WAN interfaces (and their gateways/links) to be declared as SD-WAN members so the SD-WAN engine knows which links are eligible to carry traffic and can measure their SLA performance. Option C (SD-WAN Rules) is correct because the steering policy itself is defined in SD-WAN rules, which match traffic by criteria such as source/destination, application, or internet service and then select the preferred member (or SLA-based strategy) to forward it. Together, members define the available paths and rules define how traffic is distributed across them, which is exactly what SD-WAN traffic steering needs. Option A (DHCP server settings) is not required for steering, since DHCP only provides address assignment and is unrelated to path selection. Option D (VLAN tagging) is not mandatory, as VLANs are a Layer 2 segmentation mechanism and steering operates on SD-WAN member links and rules. Option E (Local users) is not required, because local user accounts are for administrative authentication and have no role in SD-WAN traffic steering.

Answer

DHCP server settings

Answer

VLAN tagging

Answer

Local users

Question 9

Which THREE factors influence log storage efficiency on a FortiAnalyzer/FortiManager?

Accepted Answer

Log compression settings. Log compression settings (A) directly influence log storage efficiency because FortiAnalyzer/FortiManager can compress logs (e.g., using gzip) to reduce the physical disk space consumed by stored logs. Log retention days (B) determine how long logs are kept before being purged, so a longer retention period increases the total volume of logs stored and thus affects storage efficiency. Disk quota for specific devices (D) limits how much storage each device's logs can consume, directly controlling storage allocation and preventing one device from exhausting the analyzer's disk. The firewall firmware version (C) does not itself govern log storage efficiency, though it may affect log format or features, and the number of active users (E) is unrelated to how efficiently logs are stored on the FortiAnalyzer/FortiManager.

Answer

The firewall firmware version

Answer

The number of active users

Question 10

Which THREE items are included in the configuration file of a FortiGate?

Accepted Answer

User certificates. The FortiGate configuration file is a plain-text dump of the device's persistent configuration, so it includes user certificates (A), which are stored under config vpn certificate local/remote and referenced by name in the config; network interface settings (B), stored under config system interface with IP addresses, masks, and administrative access; and firewall policies (E), stored under config firewall policy with source/destination, services, and actions. These are all configuration objects that survive a reboot and are restored by commands such as execute restore config or execute backup config. FortiGuard cached updates (C) are not part of the configuration file; they are downloaded content (e.g., antivirus/IPS signatures) stored in the FortiGuard cache and managed via execute update-now or automatic updates. Real-time session tables (D) are dynamic runtime state held in memory and shown by diagnose sys session list, not persisted in the configuration file.

Answer

FortiGuard cached updates

Answer

Real-time session tables