FORTINET-NSE7-SPECIALTY Practice Test 12 — 15 Questions

Question 1

An administrator is migrating a standalone FortiGate into an existing FortiManager. What happens to the existing firewall policies on the FortiGate during the import process?

Accepted Answer

They are imported and converted into a Policy Package. When importing a standalone FortiGate into FortiManager, the existing firewall policies are imported and converted into a Policy Package within the ADOM. FortiManager creates a policy package named after the device (or a chosen name) containing the imported policies, objects, and interfaces, so the device can then be managed centrally. The policies are not deleted or disabled; they become the managed baseline.

Answer

They are moved to a 'Disabled' state

Answer

They are deleted to ensure a clean slate

Answer

They are merged into the Global Policy

Question 2

Which TWO methods are used to achieve traffic separation in a multi-VDOM environment?

Accepted Answer

Using VLAN sub-interfaces. In a multi-VDOM FortiGate environment, traffic separation is achieved by assigning physical ports to VDOMs (option C), which places each interface in its own virtual domain so that traffic entering one VDOM cannot reach another VDOM unless an inter-VDOM link is explicitly configured. VLAN sub-interfaces (option A) also achieve traffic separation because each VLAN tag creates a distinct logical interface that can be bound to a specific VDOM, keeping tagged traffic isolated per VDOM. Options B, D, and E do not provide traffic separation: SSL inspection is a security inspection feature, different HA clusters relate to device redundancy rather than VDOM traffic isolation, and different firmware versions are irrelevant to VDOM traffic separation.

Answer

Enabling SSL inspection globally

Answer

Using different HA clusters

Answer

Using different firmware versions

Question 3

An administrator notices that logs are not appearing in FortiManager for a specific FortiGate. What is the first thing to check to ensure log forwarding is active?

Accepted Answer

Log forwarding configuration on the FortiGate. When logs are missing in FortiManager for a specific FortiGate, the first thing to verify is the log forwarding configuration on the FortiGate itself. FortiManager receives logs only if the FortiGate is configured to send them — either via 'config log fortianalyzer setting' (if FortiManager hosts FortiAnalyzer features) or through the Fabric/central management settings. If log forwarding is disabled or misconfigured (wrong FortiManager IP, disabled logging), no logs will appear regardless of other factors.

Answer

The FortiManager license

Answer

The device's physical connection

Answer

The firmware version of the FortiGate

Question 4

What is the benefit of using 'CLI Templates' in FortiManager?

Accepted Answer

They allow applying configuration commands to multiple devices. CLI Templates in FortiManager are reusable sets of CLI commands that can be assigned to device groups or individual devices, enabling consistent configuration across many FortiGates at once. They are a provisioning and standardization tool, not a GUI replacement or performance enhancer. This makes bulk changes efficient and reduces human error.

Answer

They replace the GUI completely

Answer

They convert the policy to a CLI script

Answer

They improve the FortiGate hardware performance

Question 5

In SD-WAN central management, what is the 'SD-WAN Zone' used for?

Accepted Answer

To group multiple SD-WAN members for logical policy routing. The SD-WAN Zone is used to group multiple SD-WAN members (interfaces) into a logical entity for policy routing. This allows administrators to apply consistent routing policies and SLA profiles across all members in the zone, simplifying configuration and management.

Answer

To define the physical port speed

Answer

To limit bandwidth for specific users

Answer

To isolate the SD-WAN traffic from the WAN

Question 6

Which component of FortiManager allows for the centralized management of firmware across multiple devices?

Accepted Answer

Firmware Management. Firmware Management is the FortiManager component that provides centralized firmware upgrade and downgrade capabilities across multiple FortiGate devices. It allows administrators to import firmware images, schedule upgrades, and monitor the firmware status of all managed devices from a single console.

Answer

Policy Database

Answer

Device Templates

Answer

Log View

Question 7

Which THREE of the following protocols can be used for Performance SLA probes?

Accepted Answer

ICMP. Performance SLA probes in FortiGate SD-WAN support several probe protocols, and ICMP (option B) is correct because it sends echo requests to measure latency, jitter, and packet loss to a target. TCP Echo (option C) is correct because it uses TCP port 7 echo to verify reachability and measure round-trip performance. HTTP (option D) is correct because FortiGate can issue HTTP GET requests to a monitored web server and evaluate response time and availability. FTP (option A) is not a supported Performance SLA probe type, and DHCP (option E) is a network configuration protocol, not a probe mechanism for SLA monitoring.

Answer

FTP

Answer

DHCP

Question 8

Which THREE pieces of information are displayed in the SD-WAN Monitor in FortiManager?

Accepted Answer

Status of SD-WAN members. Option A is correct because the SD-WAN Monitor in FortiManager displays the operational status of each SD-WAN member (up/down/standby), which is essential for verifying link health. Option B is correct because the monitor shows the performance SLA metrics per member — latency, jitter, and packet loss — that FortiGate uses to steer traffic and trigger failover. Option C is correct because interface bandwidth usage (throughput in/out) per SD-WAN member is presented, allowing admins to see load and utilization across links. Option D is not part of the SD-WAN Monitor; FortiGate system temperature is a hardware sensor value shown in device dashboards or SNMP monitoring, not SD-WAN monitoring. Option E is also unrelated, as the logged-in administrator's username is an administrative session detail, not SD-WAN telemetry.

Answer

System temperature of the FortiGate

Answer

The current username of the logged-in admin

Question 9

An administrator wants to use FortiManager to push a configuration change to 50 FortiGates simultaneously. Which method minimizes downtime and ensures consistency?

Accepted Answer

Assign devices to a Device Group and push a common Policy Package. Assigning the 50 FortiGates to a Device Group and pushing a common Policy Package lets FortiManager install the same consistent configuration to all devices in one operation. This minimizes downtime because the install is orchestrated centrally with a single revision, and it guarantees consistency since every device receives identical policy objects. It also avoids the human error inherent in per-device changes.

Answer

Create 50 separate ADOMs

Answer

Connect to each FortiGate via SSH and run scripts

Answer

Enable 'Auto-Push' for every change

Question 10

Which TWO of the following are benefits of using SD-WAN templates in FortiManager?

Accepted Answer

Consistent SD-WAN policy application across devices. Option A is correct because SD-WAN templates in FortiManager let you define SD-WAN settings and policies once and apply them consistently across many managed FortiGates, ensuring uniform rules and reducing per-device drift. Option E is correct because these templates enable simplified, scalable configuration deployment for large branch environments by provisioning SD-WAN interfaces, members, and rules centrally instead of manually configuring each device. Option B is incorrect because firmware upgrades are handled by FortiManager's firmware management features, not SD-WAN templates. Option C is incorrect because log analysis is provided by FortiAnalyzer, not by SD-WAN templates in FortiManager. Option D is incorrect because direct FortiGate CLI access is a separate administrative capability and is not a benefit of SD-WAN templates.

Answer

Automatic firmware upgrades

Answer

Automated log analysis

Answer

Direct access to the FortiGate CLI

Question 11

Which TWO components are synchronized between HA members?

Accepted Answer

Active session table. In an HA (High Availability) cluster, the two members synchronize the active session table (option B) so that if a failover occurs, existing sessions can continue without being dropped, since session state is replicated to the standby unit. They also synchronize the configuration database (option E), ensuring both members share identical policy, object, and system settings so the standby can take over seamlessly. Administrator credentials are part of the configuration and are not synchronized as a separate component, local log files (option C) are not synchronized between HA peers, and firmware images (option D) are not synchronized as part of HA operation—each unit must be updated independently to matching versions.

Answer

Administrator credentials

Answer

Local log files

Answer

Firmware image

Question 12

What is the purpose of the 'Inbound' interface setting in an SD-WAN rule?

Accepted Answer

To restrict the rule to traffic originating from a specific interface.. The 'Inbound' interface setting in an SD-WAN rule specifies the incoming interface for traffic that the rule should match. It restricts the rule to traffic originating from a specific interface, allowing granular control over which traffic is subject to the SD-WAN rule. This is useful when you want to apply different SD-WAN strategies based on the source of the traffic, such as traffic from the LAN versus traffic from a VPN tunnel.

Answer

To enable reverse path forwarding checks.

Answer

To define the WAN gateway.

Answer

To specify the egress interface.

Question 13

Which interface can be used as an SD-WAN member in an SD-WAN template?

Accepted Answer

Physical ports, VLANs, and VPN tunnels. In Fortinet SD-WAN, an SD-WAN member interface can be any logical or physical interface that carries traffic and supports the necessary health-check and performance SLA monitoring. This includes physical ports (e.g., wan1, wan2), VLAN sub-interfaces (e.g., vlan10 on a physical port), and VPN tunnels (e.g., IPsec tunnels, ADVPN shortcuts). The SD-WAN template in FortiManager abstracts these members into a single virtual interface, allowing dynamic path selection based on link quality. Therefore, option A correctly identifies the full set of supported interface types.

Answer

Only WAN physical ports

Answer

Only VLANs

Answer

Only loopback interfaces

Question 14

Which FortiGate feature should be enabled to prevent internal users from accessing malicious websites based on real-time threat intelligence?

Accepted Answer

Web Filter. Web Filter is the FortiGate feature that inspects and controls HTTP/HTTPS traffic to block access to malicious or categorized websites using real-time threat intelligence feeds (FortiGuard). It evaluates URLs against FortiGuard's web filter database and can enforce policies based on categories, reputation, and threat scores. Antivirus, Application Control, and DNS Filter do not provide the same URL-based, real-time web categorization and blocking capability.

Answer

Antivirus profile

Answer

Application Control

Answer

DNS Filter

Question 15

An enterprise deploys ADVPN 2.0 with BGP and security profiles applied to traffic traversing the VPN overlay. Which THREE statements are correct regarding how security profiles and ADVPN 2.0 interact in FortiOS? (Choose three)

Accepted Answer

SSL inspection (DPI) applied on spoke firewall policies inspects decrypted traffic traversing the ADVPN shortcut tunnel. Option C is correct because in ADVPN 2.0, once a spoke-to-spoke shortcut tunnel is established, data traffic flows directly between the spokes and no longer traverses the hub, so the spoke FortiGates must have firewall policies with security profiles (Antivirus, IPS, etc.) applied to inspect that shortcut traffic. Option A is correct because SSL inspection (deep packet inspection) configured on those spoke policies will decrypt and inspect the TLS traffic traversing the ADVPN shortcut tunnel, since the spoke is the enforcement point for the shortcut. Option B is correct because FortiManager security profile templates allow centralized creation and push of security profiles (AV, IPS, web filter, etc.) to managed spoke FortiGates, which is a standard way to keep consistent UTM enforcement across an ADVPN deployment. Option D is incorrect because ADVPN 2.0 does not automatically disable firewall inspection profiles on shortcut interfaces; inspection is governed by the firewall policies and profiles the administrator configures. Option E is incorrect because after a shortcut is established, inter-spoke data traffic bypasses the hub entirely, so the hub cannot inspect those packets.

Answer

ADVPN 2.0 automatically disables all firewall inspection profiles on shortcut interfaces to maximize throughput

Answer

The hub FortiGate inspects all data packets exchanged between spokes even after a direct shortcut tunnel is established