FORTINET-NSE7-SPECIALTY Practice Test 11 — 15 Questions

Question 1

Which THREE steps are involved in the 'Policy Package Installation' workflow?

Accepted Answer

Select the target device. In the Policy Package Installation workflow, you must first select the policy package (D) that you intend to deploy, since the package defines the set of rules and objects to be installed. Next, you select the target device (A) — the managed gateway, cluster, or VSX — to which that package will be pushed. Before committing, you review the install preview (C), which shows the changes, warnings, and potential impacts so you can confirm or cancel the installation. Options B and E are not part of this workflow: a factory reset (B) is a device-recovery action unrelated to policy deployment, and rebooting the target device (E) is neither required nor a defined step in installing a policy package.

Answer

Perform a factory reset

Answer

Reboot the target device

Question 2

Which THREE items are included in a Policy Package when it is pushed from FortiManager?

Accepted Answer

Service Objects. A Policy Package in FortiManager is the container of the security configuration that gets installed to managed FortiGate devices, and it includes the firewall policy rules themselves (B, Firewall Policies), which define the traffic handling and are the core of the package. It also includes the reusable objects those policies reference, specifically Address Objects (E) and Service Objects (A), which define the source/destination addresses and the TCP/UDP port or protocol matches used inside the policies. These three items travel together as a unit when the policy package is pushed, because the policies cannot function without their referenced address and service objects. By contrast, System interface settings (C) and Routing tables (D) are device-level configuration that belongs to the FortiGate's system and network settings, not to the policy package, so they are not installed as part of a policy package push.

Answer

System interface settings

Answer

Routing tables

Question 3

When configuring advanced IPsec VPN tunnels to act as members of an SD-WAN zone, which TWO configuration parameters on the FortiGate are critical for ensuring proper IPsec tunnel operation and traffic steering? (Choose two)

Accepted Answer

Ensure the IPsec interface is added to an SD-WAN zone and assigned a valid virtual IP/interface configuration. Option A is correct because an IPsec interface must be a member of the SD-WAN zone to participate in SD-WAN path selection and steering; the tunnel interface needs a valid IP/interface configuration so the zone can reference it and health checks and rules can operate on it. Option E is correct because Phase 2 selectors define the interesting traffic for the tunnel: they should either match the exact protected source/destination subnets or use 0.0.0.0/0 for route-based VPNs, which allows routing and SD-WAN rules to steer traffic into the tunnel rather than being blocked by narrow selectors. Option B is wrong because NAT-T is often required when peers are behind NAT and disabling it globally would break many tunnels; it is not a critical SD-WAN membership parameter. Option C is wrong because not all participating spokes should be dialup servers; typically the hub is the dialup server and spokes are dialup clients, and tunnel mode is not the parameter that makes a tunnel an SD-WAN member. Option D is wrong because forcing RSA certificates only and disabling pre-shared keys is an authentication policy choice, not a requirement for IPsec tunnel operation or SD-WAN traffic steering.

Answer

Disable NAT traversal (NAT-T) globally on all IPsec phase 1 tunnels

Answer

Configure the IPsec tunnel mode as dialup server on all participating branch spokes

Answer

Set the IPsec phase 1 authentication method strictly to RSA certificates only, disabling pre-shared keys

Question 4

Which TWO of the following can cause an SD-WAN member to be marked as 'down' in an SLA?

Accepted Answer

The probe times out.. In SD-WAN SLA monitoring, a member is marked down when an SLA probe fails to receive a response within the configured timeout, so option A (the probe times out) directly triggers the down state. Option C (packet loss exceeds the threshold) is also correct because SLA criteria include metrics such as packet loss, latency, and jitter, and exceeding the configured loss threshold causes the member to fail the SLA and be marked down. Options B, D, and E do not by themselves cause an SLA member to be marked down: a system clock update does not affect probe reachability, disabling a firewall policy is a configuration change rather than an SLA metric violation, and changing an interface IP address would typically break connectivity or require reconfiguration but is not itself an SLA threshold breach that marks the member down.

Answer

The system clock is updated.

Answer

The firewall policy is disabled.

Answer

The interface IP address is changed.

Question 5

Which TWO methods can be used to authenticate a FortiGate when it registers to a FortiManager?

Accepted Answer

Password/Pre-shared Key. Option C (Password/Pre-shared Key) is correct because when a FortiGate is added to FortiManager using the 'Add Device' wizard, the administrator can specify a pre-shared key (PSK) that the FortiGate must present during the FGFM (FortiGate-FortiManager) registration handshake to authenticate itself. Option D (Serial Number registration) is correct because FortiManager can also authenticate a registering FortiGate by matching its serial number against a pre-authorized device entry, allowing the device to be recognized and added without a PSK. Options A, B, and E are not valid FortiGate-to-FortiManager authentication methods: RADIUS is used for administrative or user authentication, not device registration; SNMP community strings are for monitoring, not registration; and IP-based automatic discovery merely identifies candidate devices on the network but does not authenticate them for FortiManager registration.

Answer

External RADIUS server

Answer

SNMP community string

Answer

IP-based automatic discovery

Question 6

An administrator is configuring BGP over SD-WAN IPsec tunnels between a headquarters FortiGate and branch FortiGates. Which TWO configuration steps are required to ensure robust and stable dynamic routing over the SD-WAN IPsec tunnels? (Choose two)

Accepted Answer

Configure BGP neighbors using the loopback interface IP addresses or tunnel specific IP addresses rather than physical interface IPs. Option B is correct because peering BGP over loopback or tunnel-specific IP addresses decouples the BGP session from any single physical WAN link, so the session stays up when an individual SD-WAN member link flaps and traffic can be steered across remaining IPsec tunnels. Option C is correct because WAN latency spikes and failover delays can exceed default BGP keepalive (60s) and hold-down (180s) timers, causing session resets; enabling graceful restart or tuning these timers preserves routing state and prevents unnecessary reconvergence during transient SD-WAN events. Option A is wrong because administrative distance 255 makes the route unusable and does not disable BGP updates; it would break routing rather than stabilize it. Option D is wrong because static default routes to null0 would blackhole traffic and are not a BGP-over-SD-WAN requirement. Option E is wrong because disabling IPsec Phase 2 encryption would break the IPsec tunnel and is not needed for BGP, which is encapsulated inside the tunnel.

Answer

Set the BGP administrative distance to 255 to disable all routing updates

Answer

Configure static default routes on all BGP neighbors pointing to the null0 interface

Answer

Disable IPsec phase 2 encryption to allow BGP plaintext hello packets to pass through without encapsulation overhead

Question 7

An administrator configures an SD-WAN health check with multiple probes (e.g., ping and HTTP) to monitor a set of IPsec VPN tunnels. Which THREE criteria or settings govern how FortiOS determines whether an SD-WAN member has met or failed the performance SLA? (Choose three)

Accepted Answer

The restoretime parameter, which specifies how many consecutive successful probes are required before restoring a failed member to healthy status. Option B is correct because the restoretime setting in an SD-WAN health check defines how many consecutive successful probe responses must be received before FortiOS transitions a previously failed member back to a healthy state, preventing flapping. Option D is correct because the failtime parameter specifies the number of consecutive probe failures (across the configured probes such as ping and HTTP) required before FortiOS marks that SD-WAN member as failed. Option E is correct because the SLA targets themselves—configured thresholds for latency, jitter, and packet loss—are the metrics FortiOS compares against probe results to decide whether a member is meeting the performance SLA. Option A is not relevant because the BGP AS number is a routing attribute and does not govern SD-WAN health-check SLA evaluation. Option C is not relevant because physical cable length is not a configurable SD-WAN SLA criterion and is not used by FortiOS to determine member health.

Answer

The BGP AS number assigned to the WAN interface gateway

Answer

The physical cable length calculated in meters between the FortiGate and the nearest ISP switch

Question 8

Which THREE items can be managed via Device Templates in FortiManager?

Accepted Answer

NTP configuration. Device Templates in FortiManager are used to provision and manage system-level and network-level settings on managed FortiGate devices, including NTP configuration (B), DNS settings (D), and local interface IP settings (E), which are all part of the system/network configuration that templates push to devices. NTP and DNS are system settings commonly configured through the System template, while interface IPs are configured through the Interface template, making all three valid template-managed items. Firewall policies (A) are managed through Policy Packages, not Device Templates, since they are policy objects rather than device-level provisioning settings. Application control databases (C) are updated via FortiGuard services and are not provisioned through Device Templates.

Answer

Firewall policies

Answer

Application control databases

Question 9

Which TWO of the following steps are required to correctly configure a Performance SLA?

Accepted Answer

Select the probe protocol.. Option C is correct because a Performance SLA health-check must specify the probe protocol (e.g., Ping, HTTP, TCP-echo, or UDP-echo) that FortiGate uses to send the probe packets and measure latency, jitter, and packet loss. Option D is correct because the SLA monitor requires a destination IP address (the server or target being probed) so the FortiGate knows where to send the probes and can evaluate link health against that endpoint. Options A, B, and E are not required: a firewall address object is not needed since the destination is entered directly in the SLA configuration, BGP is an unrelated routing protocol and not part of SLA setup, and assigning the probe to a VPN tunnel is optional (the SLA is typically bound to an SD-WAN member interface, not a tunnel).

Answer

Configure a firewall address object for the probe.

Answer

Enable BGP on the interface.

Answer

Assign the probe to a VPN tunnel.

Question 10

Which TWO actions should be taken when preparing to upgrade a FortiGate HA cluster?

Accepted Answer

Review release notes. Option A (Review release notes) is correct because Fortinet release notes document the supported upgrade path, firmware version compatibility, and known issues that must be checked before upgrading an HA cluster to avoid breaking the cluster or losing configuration. Option C (Backup the configuration) is correct because a full configuration backup (e.g., via System > Backup or 'execute backup config') provides a rollback point in case the upgrade fails or the cluster does not re-form properly. Option B is not required because clearing all sessions is not a prerequisite for an HA upgrade and would disrupt traffic unnecessarily. Option D is incorrect because disabling heartbeat interfaces would break HA communication and cause a split-brain or cluster failure. Option E is incorrect because changing HA mode to Standalone is not part of the upgrade procedure and would defeat the purpose of upgrading an HA cluster.

Answer

Clear all sessions

Answer

Disable heartbeat interfaces

Answer

Change HA mode to Standalone

Question 11

An administrator troubleshoots a scenario where traffic matching an application-based SD-WAN rule is bypassing the preferred high-speed MPLS tunnel and taking the backup broadband tunnel instead. Which THREE factors should the administrator check to resolve this routing discrepancy? (Choose three)

Accepted Answer

Inspect the member priorities and weights configured within the specific SD-WAN rule. Option C is correct because within an SD-WAN rule the member priorities and weights determine which member is preferred; if the MPLS member has a lower priority value or weight than the broadband member, the SD-WAN engine will steer matching traffic to broadband instead. Option D is correct because SD-WAN performance SLAs (e.g., latency, jitter, packet loss thresholds) continuously probe each member, and if the MPLS member fails the SLA it is marked ineligible and traffic falls back to the next qualified member such as the broadband tunnel. Option E is correct because SD-WAN rules are evaluated top-down by sequence order, so an earlier rule matching the same application-based criteria can intercept the traffic and send it out the broadband member before the intended rule is reached. Option A is not relevant because the factory default admin password has no bearing on SD-WAN member selection or tunnel routing. Option B is not relevant because the physical cable category affects link capability, not the SD-WAN engine's rule-based path selection between an MPLS and broadband member.

Answer

Verify the FortiGate factory default administrator password is changed

Answer

Check the physical layer OSI Model cable category connected to the FortiGate port

Question 12

Which TWO of these are valid SD-WAN health check protocols?

Accepted Answer

HTTP. HTTP (option C) is a valid SD-WAN health check protocol because SD-WAN controllers and edges can send HTTP GET requests to a target URL and evaluate the response code or latency to determine whether an application path is healthy. Ping (option D) is also valid because SD-WAN health checks commonly use ICMP echo requests to measure reachability, latency, jitter, and packet loss toward a specified destination. These two are the standard probe types supported for SD-WAN SLA/health-check configuration, alongside others like TCP and DNS in some implementations. SSH (option A) is a remote management/shell protocol, not a health-check probe. FTP (option B) is a file-transfer protocol and is not used for periodic path health monitoring. SNMP (option E) is a management/monitoring protocol for polling device metrics, not a probe type used to validate SD-WAN path health.

Answer

SSH

Answer

FTP

Answer

SNMP

Question 13

You are managing FortiGates across multiple ADOMs. How can you share common firewall objects (e.g., mail servers, common IP ranges) across these ADOMs?

Accepted Answer

Create objects in the Global Database. In FortiManager, the Global Database (Global ADOM) is the designated object space for creating firewall objects that must be shared across multiple ADOMs. Objects defined there can be referenced by policies in any ADOM, providing a single source of truth for common items like mail servers and IP ranges.

Answer

Manually copy objects to each ADOM

Answer

Use the API to script the creation in every ADOM

Answer

Enable 'Object Sharing' in system settings

Question 14

Which command allows you to view the current routing table for a specific VDOM?

Accepted Answer

get router info routing-table all. On FortiGate, the routing table for a specific VDOM is inspected with 'get router info routing-table all' executed inside that VDOM context. This command dumps all routes (connected, static, and dynamic) in the RIB for the active VDOM, which is essential when troubleshooting inter-VDOM or per-VDOM routing issues.

Answer

get system routing

Answer

diag ip route

Answer

show router table

Question 15

Which TWO methods can be used to update SD-WAN policies across all managed devices in FortiManager?

Accepted Answer

Using a CLI script to push updates. Option A is correct because FortiManager supports running CLI scripts (via Device Manager > Scripts) against managed FortiGates, allowing SD-WAN policy commands to be pushed to all devices in a single script execution. Option B is correct because SD-WAN policies are provisioned through SD-WAN templates in FortiManager, and modifying the template followed by an Install Wizard operation propagates the updated policy to all devices bound to that template. Option C is not the intended method since editing an individual FortiGate policy only affects that single device and does not centrally update policies across all managed devices. Option D is incorrect because creating a new ADOM merely establishes a separate administrative domain and does not push any SD-WAN policy changes. Option E is incorrect because rebooting FortiManager does not modify or distribute SD-WAN policies to managed devices.

Answer

Editing the individual FortiGate policy

Answer

Creating a new ADOM

Answer

Rebooting the FortiManager