FORTINET-NSE7-SPECIALTY Practice Test 13 — 15 Questions

Question 1

An enterprise network uses OSPF over SD-WAN IPsec tunnels. The administrator notices that OSPF adjacency is constantly dropping over a specific backup SD-WAN member link due to intermittent packet loss. Which THREE configuration adjustments can improve OSPF stability over unstable SD-WAN IPsec links? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure OSPF network type as point-to-point on the IPsec tunnel interfaces to eliminate unnecessary DR/BDR elections. Option A is correct because configuring the OSPF network type as point-to-point on the IPsec tunnel interfaces removes the DR/BDR election process, which is unnecessary on a tunnel that connects only two routers and whose election churn can cause adjacency resets during packet loss. Option B is correct because enabling OSPF graceful restart (and helper mode on the neighbor) allows a restarting or flapping router to keep forwarding traffic and preserve adjacencies without tearing down and relearning routes, which directly improves stability over intermittent SD-WAN links. Option D is correct because increasing the hello and dead intervals makes OSPF more tolerant of temporary packet loss, since the dead interval is typically 4x the hello interval and a longer timer prevents the adjacency from being declared down during brief outages. Option C is incorrect because a router ID of 0.0.0.0 is invalid for OSPF and would prevent the router from forming adjacencies or participating in the OSPF domain. Option E is incorrect because OSPF relies on hello packets to discover and maintain neighbors; disabling them would break adjacency formation and force reliance on static routes, which is not an OSPF stability adjustment.

Answer

Set the OSPF router ID to 0.0.0.0 on all branch spokes

Answer

Disable OSPF hello packets entirely and rely on static default routes

Question 2

Which THREE of the following are parameters that can be monitored in a Performance SLA?

Accepted Answer

Packet Loss. In a Performance SLA (as used by SD-WAN/performance-monitoring features such as Fortinet's SD-WAN performance SLAs), the monitored parameters are network-quality metrics measured by probes: Packet Loss (A) is correct because the SLA tracks the percentage of probe packets that never arrive at the remote target, Jitter (C) is correct because it measures the variation in delay between consecutive probe packets, and Latency (E) is correct because it measures the round-trip or one-way delay of the probes. These three metrics are exactly the ones used to decide whether a link meets the SLA and to trigger failover or rule changes. CPU load (B) and Disk usage (D) are host/resource utilization statistics reported by system sensors or SNMP, not link-quality parameters evaluated by a Performance SLA, so they do not belong.

Answer

CPU load

Answer

Disk usage

Question 3

What is the effect of changing the 'Hold-down' timer in a Performance SLA?

Accepted Answer

It prevents route flapping by delaying the transition back to an 'up' state.. The Hold-down timer in a Performance SLA specifies how long the SLA remains in a down state before it is allowed to transition back to up, even after probes succeed again. This delay prevents rapid flapping between up and down states when link quality is marginal, stabilizing SD-WAN rule decisions. It is a hysteresis mechanism, not a probe frequency or failure threshold.

Answer

It changes the frequency of the probes.

Answer

It sets the maximum number of failed probes allowed.

Answer

It determines the timeout duration for a single probe.

Question 4

When setting up a Performance SLA, what is the 'Participant' setting?

Accepted Answer

The SD-WAN member that originates the probe.. In a FortiGate Performance SLA, the 'Participant' setting specifies which SD-WAN member (interface) originates the health check probes. Each member that should be monitored must be added as a participant, and the SLA measures latency, jitter, and packet loss from that member to the configured server.

Answer

The monitoring interval.

Answer

The user group assigned to the probe.

Answer

The destination IP address.

Question 5

A FortiGate device is running ADVPN 2.0 with OSPF. A spoke experiences transient routing loops when a shortcut tunnel tears down due to inactivity timeout. Which configuration adjustment on the FortiGate hub and spokes prevents these temporary routing blackholes or loops during shortcut teardown?

Accepted Answer

Adjust the administrative distance or use route redistribution filters with appropriate metrics so hub routes and shortcut routes do not conflict during teardown. ADVPN 2.0 shortcut tunnels are dynamically created direct spoke-to-spoke IPsec tunnels, and when they tear down due to inactivity, the routing table must reconverge so traffic falls back to the hub. If OSPF metrics or administrative distances cause the hub-learned route and the shortcut route to conflict during teardown, transient loops or blackholes occur. Adjusting administrative distance or using redistribution filters with appropriate metrics ensures the hub route is preferred only when the shortcut is gone, preventing the race condition.

Answer

Disable OSPF on the spoke units and rely entirely on static default routes

Answer

Set the IPsec phase 1 lifetime to infinite to prevent shortcuts from timing out

Answer

Configure asymmetric routing bypass on all firewall policies

Question 6

Which TWO of the following are necessary to successfully deploy an SSL VPN in tunnel mode?

Accepted Answer

A valid SSL certificate for the VPN portal. Option C is correct because tunnel-mode SSL VPN relies on TLS to establish the encrypted session, so the VPN portal must present a valid SSL certificate that clients can validate during the TLS handshake. Option D is correct because once the tunnel is established, traffic from the SSL VPN interface must be permitted by a firewall policy into the Internal zone; otherwise, authenticated users cannot reach internal resources. Option A is incorrect because IPSec phase 1 (IKE SA) applies to IPSec VPNs, not SSL/TLS-based VPNs. Option B is incorrect because BGP is a dynamic routing protocol between routers and is not required for an SSL VPN client tunnel. Option E is incorrect because SSL VPN functionality is a software feature and does not require a dedicated hardware switch.

Answer

An IPSec phase 1 configuration

Answer

A BGP session with the client

Answer

A dedicated hardware switch

Question 7

A FortiGate is operating in transparent mode. What is the default behavior when the device receives a frame with an unknown MAC address?

Accepted Answer

Flood to all ports. In transparent mode, a FortiGate acts as a Layer 2 bridge and learns MAC addresses from incoming frames. When it receives a frame destined for a MAC address not present in its forwarding table (unknown unicast), the default behavior is to flood the frame out all ports in the same broadcast domain except the ingress port — standard Ethernet bridge behavior. This ensures the frame reaches its destination even before the MAC is learned.

Answer

Drop the packet

Answer

Forward to the management interface

Answer

Send an ICMP unreachable message

Question 8

If you modify a shared SD-WAN health check object that is referenced by ten different templates, what happens to the FortiGates?

Accepted Answer

All FortiGates using those templates will be affected after an install. In FortiManager, SD-WAN health check objects are shared objects that can be referenced by multiple templates. When you modify a shared object, the change is stored in the ADOM and must be installed to the managed FortiGates. After the install, all FortiGates using templates that reference that health check will receive the updated configuration.

Answer

The FortiGates will automatically revert to the old settings

Answer

The health check will be disabled on all devices

Answer

Only the templates are updated, not the FortiGates

Question 9

When configuring an SD-WAN health check to monitor internet reachability using HTTP/HTTPS requests, which parameter defines the specific string the FortiGate expects to receive in the server response body to validate that the path is healthy?

Accepted Answer

http-match. The http-match parameter in an SD-WAN health check defines the exact string that the FortiGate searches for in the HTTP/HTTPS response body to confirm the probe succeeded. When the FortiGate sends an HTTP GET to the configured URL, it compares the returned payload against this string; a mismatch marks the SLA member as failed. This allows administrators to validate not just TCP reachability but actual application-layer health.

Answer

probe-packet-size

Answer

sla-break-time

Answer

server-response-timeout

Question 10

Which THREE of the following criteria are used for SD-WAN rule traffic matching?

Accepted Answer

Destination address. In FortiGate SD-WAN rules, traffic matching is performed using criteria such as destination address (B), application/service (D), and source address (E), which are all standard SD-WAN rule match objects that identify which traffic should be steered. Destination address (B) and source address (E) match on IP prefixes or address objects, while application/service (D) matches on recognized applications or service definitions, allowing policy-based steering. Interface speed (A) is not a match criterion; it is a property of the member interface used for load-balancing decisions, not for classifying traffic. VLAN priority (C) is also not an SD-WAN rule match criterion; VLAN/802.1p priority is handled through QoS and traffic shaping, not through SD-WAN rule matching.

Answer

Interface speed

Answer

VLAN priority

Question 11

You are troubleshooting a policy installation failure where the FortiManager reports a 'Configuration conflict'. Which action should you perform to identify the root cause of the mismatch?

Accepted Answer

Use the 'Diff' feature in the Policy & Objects tab to compare the database and device config. When FortiManager reports a 'Configuration conflict' during policy installation, the root cause is usually a mismatch between the FortiManager policy package/database and the actual configuration on the FortiGate. The 'Diff' feature in the Policy & Objects tab compares the FortiManager database against the device configuration line-by-line, exposing exactly which objects, policies, or settings differ. This is the correct diagnostic step before deciding whether to import, overwrite, or reconcile.

Answer

Force an 'Import Policy' operation

Answer

Reboot the FortiManager

Answer

Disable the policy package entirely

Question 12

You notice that an IPsec tunnel is up, but no traffic passes. What is the most common reason related to firewall policy configuration?

Accepted Answer

Missing firewall policy. When an IPsec tunnel is up but no traffic passes, the most common firewall policy-related reason is a missing firewall policy that permits traffic through the tunnel. In FortiGate, IPsec tunnels require explicit firewall policies to allow traffic between the tunnel interface and other interfaces; without them, the implicit deny drops all traffic.

Answer

Missing static route

Answer

Incorrect IKE ID

Answer

Phase 1 lifetime expiration

Question 13

Which TWO of the following are valid methods for user authentication on a FortiGate?

Accepted Answer

RADIUS. RADIUS (B) is a valid authentication method on a FortiGate, as FortiOS supports external RADIUS servers for user authentication via the config user radius command and can be referenced in firewall authentication, SSL VPN, and administrative login policies. LDAP (C) is also valid, since FortiGate supports LDAP directory servers (e.g., Active Directory) through config user ldap for authenticating users against directory credentials. Both are standard remote authentication protocols integrated into FortiOS user authentication. BGP (A), IGMP (D), and RIP (E) are routing or multicast protocols, not authentication mechanisms, and therefore cannot be used to authenticate users on a FortiGate.

Answer

BGP

Answer

IGMP

Answer

RIP

Question 14

Which TWO types of reports can be generated in the FortiAnalyzer module of FortiManager?

Accepted Answer

Custom reports. In the FortiAnalyzer module of FortiManager, reports are generated from log data using report templates, and the two supported report types are Custom reports (A) and Pre-defined reports (B). Custom reports (A) are right because administrators can build them from scratch or by modifying templates, choosing datasets, charts, time periods, and filters to meet specific log-analysis needs. Pre-defined reports (B) are right because FortiAnalyzer ships with built-in report templates (for example, security, traffic, and usage reports) that can be run as-is or used as a starting point. Policy change impact reports (C) do not belong because FortiManager handles policy/configuration management, not impact analysis reporting in the FortiAnalyzer module. Hardware diagnostic reports (D) and Firmware compatibility reports (E) are not FortiAnalyzer report types; hardware diagnostics and firmware compatibility are handled through FortiGate/FortiManager device management and upgrade-path tools, not log-based reporting.

Answer

Policy change impact reports

Answer

Hardware diagnostic reports

Answer

Firmware compatibility reports

Question 15

Which TWO settings are modified to reduce the impact of a failover event in an HA cluster?

Accepted Answer

hb-interval. In an HA cluster, the heartbeat interval (B, hb-interval) controls how frequently heartbeat packets are exchanged between cluster members, so tuning it determines how quickly a node is detected as unreachable and thus how fast a failover is triggered. The heartbeat lost threshold (C, hb-lost-threshold) defines how many consecutive missed heartbeats are tolerated before the peer is declared dead, directly governing failover sensitivity and the resulting disruption window. Together, hb-interval and hb-lost-threshold are the two settings that shape failover timing and therefore reduce the impact of a failover event. The group-password (A) is only an authentication secret for cluster communication and does not affect failover behavior, priority (D) influences which node becomes primary but not the failover impact itself, and monitored-interfaces (E) specifies which links are watched rather than tuning the failover event's impact.

Answer

group-password

Answer

priority

Answer

monitored-interfaces