FORTINET-NSE7-SPECIALTY Practice Exam 3 — 20 Questions

Question 1

When creating an SD-WAN template, what must be defined before you can add an SD-WAN interface to the template?

Accepted Answer

Individual SD-WAN member interfaces. In FortiManager, an SD-WAN template requires the underlying SD-WAN member interfaces to be defined first, because the SD-WAN interface is a logical overlay that aggregates those physical or logical member links. Without member interfaces, there is nothing for the SD-WAN zone to bind to, so FortiManager will not allow you to add the SD-WAN interface to the template.

Answer

The SD-WAN health check probes

Answer

Global firewall policies

Answer

The virtual domain (VDOM) settings

Question 2

What does the 'FortiGuard' service provide to the FortiGate?

Accepted Answer

Real-time threat intelligence and database updates. FortiGuard is Fortinet's subscription-based security intelligence service that delivers real-time threat intelligence and database updates to FortiGate devices. This includes antivirus signatures, IPS signatures, web filtering categories, DNS filtering, and application control signatures, all updated continuously from Fortinet's global threat research.

Answer

User management and authentication

Answer

Local firmware storage

Answer

Hardware acceleration support

Question 3

What is the benefit of using 'SD-WAN Zones' in templates when managing 100+ branches?

Accepted Answer

They allow for easier mapping to physical ports across different hardware models. SD-WAN Zones in FortiManager templates allow administrators to define logical zones that map to physical ports consistently across different FortiGate hardware models. This abstraction simplifies template deployment to 100+ branches because the same template can be applied regardless of the specific port layout on each device.

Answer

They allow for multiple internet service providers

Answer

They automatically configure static routes

Answer

They increase the speed of the internet connection

Question 4

What is the impact of changing the 'set vdom-mode' from 'no-vdom' to 'multi-vdom'?

Accepted Answer

System reboot required. Changing 'set vdom-mode' from 'no-vdom' to 'multi-vdom' requires a reboot because the FortiGate must reinitialize its configuration database and process architecture to support multiple virtual domains. VDOM mode is a global system setting that affects how interfaces, policies, routing tables, and admin domains are partitioned, so the change cannot be applied live. After the reboot, the default 'root' VDOM is created and the previous global configuration is migrated into it.

Answer

Automatic disablement of HA

Answer

Loss of all firewall policies

Answer

No impact, immediate change

Question 5

Which protocol is NOT a valid option for Performance SLA probes?

Accepted Answer

UDP Broadcast. UDP Broadcast is not a valid protocol for Performance SLA probes in FortiGate SD-WAN. Valid probe protocols include TCP Echo, HTTP, HTTPS, ICMP, and others, but UDP Broadcast is not among them because SLA probes require a response to measure latency, jitter, and packet loss, which broadcast does not provide.

Answer

TCP Echo

Answer

HTTP

Answer

ICMP

Question 6

When configuring an IPsec tunnel using IKEv2, which THREE parameters are commonly negotiated during Phase 1?

Accepted Answer

Encryption algorithm (e.g., AES-256). During IKEv2 Phase 1 (IKE_SA_INIT and IKE_AUTH), the peers negotiate the encryption algorithm such as AES-256 (option A), which protects the IKE SA itself, making it a core Phase 1 parameter. The authentication method, such as PSK or RSA signatures (option B), is also negotiated and validated in Phase 1 to authenticate the peers and establish trust. The Diffie-Hellman group (option E) is likewise negotiated in Phase 1 to perform the key exchange and derive shared secret keys for the IKE SA. TCP port selection (option C) is not negotiated in Phase 1 because IKE uses UDP ports 500 and 4500, not TCP. Firewall policy ID (option D) is a local configuration construct and is not an IKEv2 Phase 1 negotiation parameter.

Answer

TCP port selection

Answer

Firewall policy ID

Question 7

Which TWO of the following can be used as a 'Source' in an SD-WAN rule?

Accepted Answer

Source IP address object.. In an SD-WAN rule, the 'Source' field identifies the traffic origin, and a source IP address object (Option A) is a valid match criterion because SD-WAN rules commonly match on IP address objects (host, subnet, or address group) to steer traffic. A user group (Option E) is also a valid Source match, since SD-WAN rules can classify traffic by user identity/group (typically resolved via FSSO or LDAP integration) so that different users get different path selection. SLA target name (Option B) is not a source; it is a performance/link-quality condition used in the rule's SLA/target definition to select the outgoing link. Interface MAC address (Option C) is a Layer-2 attribute not used as an SD-WAN rule Source match. Firewall policy ID (Option D) is a policy reference, not a traffic source identifier, so it cannot serve as the Source in an SD-WAN rule.

Answer

SLA target name.

Answer

Interface MAC address.

Answer

Firewall policy ID.

Question 8

A network administrator is configuring SSL inspection for a group of users. Which certificate must be installed on the client endpoints to prevent browser certificate warnings?

Accepted Answer

The FortiGate CA certificate used for SSL inspection. When a FortiGate performs SSL deep inspection, it acts as a man-in-the-middle: it intercepts the client's TLS connection, presents its own certificate to the client, and establishes a separate TLS session to the real server. For the client browser to trust this substituted certificate without warnings, the FortiGate's CA certificate (the one used for SSL inspection, typically Fortinet_CA_SSL or a custom CA) must be installed in the client's trusted root store. This allows the browser to validate the certificate chain back to a trusted CA.

Answer

The FortiGate's local device certificate

Answer

The Fortinet_Factory CA certificate

Answer

A third-party public CA certificate

Question 9

Where are SD-WAN zones managed in the FortiGate GUI?

Accepted Answer

Network > SD-WAN > SD-WAN Zones.. SD-WAN zones are configured and managed under Network > SD-WAN > SD-WAN Zones in the FortiGate GUI. This is where administrators create the SD-WAN zone, add member interfaces (physical, IPsec, VLAN), and define the virtual WAN link used by SD-WAN rules and static routes.

Answer

Interface > Physical Interfaces.

Answer

System > Network > Zones.

Answer

Firewall > Policy > Objects.

Question 10

What is the impact of checking the 'Interface Preference' box in an SD-WAN rule?

Accepted Answer

It overrides the SLA strategy selection.. Checking 'Interface Preference' in an SD-WAN rule forces the rule to use the explicitly selected interface(s) rather than letting the SLA strategy dynamically pick the best-performing member. This effectively overrides the SLA-based path selection for that rule, so traffic egresses the preferred interface even if another member has better SLA metrics. It is used when a specific link must be used for policy, compliance, or cost reasons.

Answer

It enables failover to the default gateway.

Answer

It enables load balancing across interfaces.

Answer

It increases the probe frequency.

Question 11

An enterprise network uses ADVPN 2.0 with BGP running over IPsec tunnels. A spoke needs to initiate a shortcut tunnel to another spoke. Which FortiOS CLI command is used on the hub to verify the active shortcut tunnels and view the shortcut state information?

Accepted Answer

diagnose vpn tunnel list. On FortiOS, 'diagnose vpn tunnel list' displays all active IPsec tunnels including ADVPN shortcut tunnels, showing their names, source/destination, and state. This is the standard command to confirm that a shortcut has been negotiated between spokes and to inspect its current status.

Answer

execute router clear bgp all

Answer

get system sdwan neighbor

Answer

diagnose netlink interface list

Question 12

What is the purpose of the 'Gateway' override in an SD-WAN member configuration?

Accepted Answer

To specify a manual gateway for the SD-WAN member.. The 'Gateway' override in an SD-WAN member configuration lets you manually specify the next-hop gateway IP address for that member interface. This is needed when the interface is on a subnet where the default gateway cannot be auto-detected, or when you want to force traffic through a specific next-hop (for example, a secondary router). It overrides the automatically learned gateway for that SD-WAN member.

Answer

To force the use of a secondary ISP.

Answer

To bypass the firewall policy.

Answer

To enable load balancing.

Question 13

How do you apply an SD-WAN template to multiple managed FortiGates simultaneously?

Accepted Answer

By assigning the template in the Device Manager tab. In FortiManager, SD-WAN templates are applied to multiple managed FortiGates by assigning the template in the Device Manager tab. This allows you to select multiple devices and push the SD-WAN template configuration simultaneously, ensuring consistent SD-WAN settings across all selected FortiGates. The Device Manager provides a centralized interface for bulk template assignment, which is the intended method for scaling SD-WAN deployments.

Answer

By manually editing each FortiGate config

Answer

Through individual CLI console sessions

Answer

By creating a global profile

Question 14

You are troubleshooting an issue where traffic is not using an SD-WAN rule despite meeting criteria. What is the most likely cause?

Accepted Answer

A higher-priority SD-WAN rule is matching the traffic first.. SD-WAN rules are evaluated in order, and the first matching rule is applied. If a higher-priority rule matches the traffic first, the intended rule will not be used even if its criteria are met. This is the most likely cause when the rule itself is enabled and correctly configured.

Answer

The SD-WAN rule is disabled.

Answer

The Performance SLA has timed out.

Answer

The interface is not in an SD-WAN zone.

Question 15

Which THREE types of traffic are typically inspected by an IPS policy?

Accepted Answer

HTTP/HTTPS traffic. An IPS policy typically inspects application-layer protocols that carry user data and are common attack vectors, so HTTP/HTTPS traffic (A) is correct because the IPS performs deep packet inspection on web requests/responses to block exploits like SQL injection and cross-site scripting. SMTP traffic (B) is correct because mail transfer sessions are inspected for malicious attachments, spam relays, and SMTP command exploits. FTP traffic (D) is correct because FTP control and data channels are inspected for credential theft, directory traversal, and unauthorized file transfers. SNMP monitoring traffic (C) is not typically inspected by an IPS policy since it is management-plane traffic usually handled by monitoring systems rather than deep content inspection. ICMP echo requests (E) are network-layer diagnostic traffic, not application-layer content that an IPS policy inspects for threats.

Answer

SNMP monitoring traffic

Answer

ICMP echo requests

Question 16

Which TWO of the following are benefits of using the FortiGate flow-based inspection mode?

Accepted Answer

It uses fewer system resources than proxy-based inspection. Flow-based inspection is beneficial because it uses fewer system resources than proxy-based inspection (B): it scans packets as they stream through the FortiGate without buffering entire files or sessions, so it consumes less CPU and memory. It also provides higher throughput performance (C), since it avoids the store-and-forward buffering and full-session reassembly that proxy-based inspection performs, allowing traffic to pass with lower latency and greater overall speed. The unmarked options do not belong: deep content inspection for all protocols (A) and more granular application control (E) are strengths associated with proxy-based inspection, which fully buffers and reconstructs content, while manual buffer allocation (D) is not a flow-based benefit because flow-based inspection does not require the administrator to manually allocate buffers.

Answer

It supports deep content inspection for all protocols

Answer

It requires manual buffer allocation

Answer

It offers more granular application control

Question 17

An administrator configures an SD-WAN rule using the 'Volume' strategy across two IPsec tunnels with different bandwidth capacities (Tunnel A: 100 Mbps, Tunnel B: 50 Mbps). How does FortiOS distribute traffic across these members when using the Volume strategy?

Accepted Answer

Traffic is distributed proportionally based on the configured weight or bandwidth ratio of each member interface. The Volume strategy in FortiOS SD-WAN distributes sessions across member interfaces in proportion to each member's configured weight (or bandwidth-derived weight). With Tunnel A at 100 Mbps and Tunnel B at 50 Mbps, FortiOS sends roughly two-thirds of traffic over Tunnel A and one-third over Tunnel B, matching the 2:1 capacity ratio. This prevents overloading the lower-capacity link while maximizing aggregate throughput.

Answer

Traffic is balanced equally (50/50) regardless of interface capacity

Answer

Traffic is sent exclusively over Tunnel A until it reaches 100% packet loss, then fails over to Tunnel B

Answer

Traffic is steered strictly based on real-time latency measured by health checks

Question 18

When configuring SD-WAN in FortiManager, why would you use 'Shared Objects'?

Accepted Answer

To enable reuse of configuration elements across different templates. Shared Objects in FortiManager are global or ADOM-level configuration objects (addresses, services, VIPs, security profiles, SD-WAN templates) that can be referenced by multiple policy packages, provisioning templates, and SD-WAN templates. This eliminates duplication and ensures consistency when the same object (e.g., an SD-WAN member interface or SLA target) must appear across many FortiGates or VDOMs. Because SD-WAN deployments typically span dozens of branches with identical object definitions, Shared Objects is the mechanism that makes template reuse practical.

Answer

To increase the number of VDOMs supported

Answer

To allow FortiGates to share logs

Answer

To create a site-to-site VPN

Question 19

Which THREE of the following are mandatory for a BGP neighbor adjacency to establish?

Accepted Answer

Correct autonomous system numbers. Option B is correct because BGP peers must have compatible AS numbers: an eBGP session requires the neighbor's configured remote-as to match the AS actually present in the OPEN message, and an iBGP session requires both routers to be in the same AS, otherwise the OPEN is rejected. Option C is correct because the routers must have IP reachability to each other's neighbor addresses (typically via a route in the IGP or a directly connected link) so the TCP three-way handshake on port 179 can complete before any BGP session can form. Option E is correct because the BGP version negotiated in the OPEN message must match; both peers must support a common version (normally BGP-4), and a version mismatch causes the session to fail. Option A is not required because prefix lists are policy tools applied to filter advertised or received routes after the session is up, and they have no role in forming the adjacency. Option D is not required because router IDs only need to be unique within each AS and are used for tie-breaking and loop detection; they do not have to be identical between peers for the session to establish.

Answer

Identical prefix lists

Answer

Identical router IDs

Question 20

When using SD-WAN templates, how are SD-WAN rules ordered?

Accepted Answer

Top to bottom. SD-WAN rules in FortiManager (and on FortiGate) are evaluated top to bottom, and the first rule whose match criteria are satisfied is applied. Order therefore directly determines which path selection logic wins, making rule sequencing a critical design decision. This mirrors the behavior of firewall policies and other ordered rule sets.

Answer

Based on the creation date

Answer

By the interface speed

Answer

Randomly