FORTINET-NSE7-SPECIALTY Practice Test 2 — 25 Questions

Question 1

An administrator is troubleshooting an SD-WAN deployment where traffic matching an SD-WAN rule with a destination service object (e.g., HTTPS) is not being steered according to the SLA priority. Instead, it is always taking the default static route member. Upon checking the firewall policies, what is the most common reason why an SD-WAN rule fails to process application or service-based traffic matching?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The SD-WAN rules are evaluated sequentially from top to bottom; an earlier broad SD-WAN rule with matching source/destination IP addresses is intercepting the traffic before the service-specific rule is reached. SD-WAN rules are evaluated top-down in the order they appear in the rule list, and the first matching rule wins. If an earlier rule matches on broad source/destination IP criteria, it intercepts the traffic before the service-specific rule (e.g., HTTPS) is ever evaluated, so the service-based steering never applies. This is the most common cause of 'my SD-WAN rule isn't working' in FortiGate deployments.

Answer

IPsec VPN phase 2 selectors must be set to 0.0.0.0/0 for service-based rules to evaluate

Answer

The firewall policy containing the traffic has SSL inspection disabled, preventing service-based identification

Answer

The FortiGate kernel requires hardware acceleration (NP7) to be disabled for service-based SD-WAN rules to function

Question 2

Which TWO actions can be performed on a Revision History item in FortiManager?

Accepted Answer

Compare with current version. In FortiManager, a Revision History item represents a saved configuration snapshot of an ADOM or policy package, and option A (Compare with current version) is correct because FortiManager provides a diff view that shows the differences between the selected revision and the current running configuration. Option B (Restore to a previous state) is also correct because you can revert the ADOM or policy package back to that saved revision, effectively rolling back configuration changes. Option C (Delete the entire ADOM) is wrong because deleting an ADOM is an ADOM-level administrative action, not an operation available on an individual revision history entry. Option D (Export the revision to an external cloud) is wrong because FortiManager does not offer a cloud export function for revision items; revisions are stored locally in the FortiManager database. Option E (Modify the version permanently) is wrong because revisions are immutable snapshots — you cannot edit a saved revision in place, only compare, restore, or delete it.

Answer

Delete the entire ADOM

Answer

Export the revision to an external cloud

Answer

Modify the version permanently

Question 3

What is the primary function of the FortiGate Security Fabric?

Accepted Answer

To synchronize security policies and share intelligence across devices. The FortiGate Security Fabric is an integrated architecture that links FortiGate, FortiAnalyzer, FortiManager, FortiClient, and other Fortinet products so they share threat intelligence, synchronize policies, and coordinate automated responses. Its primary purpose is unified visibility and enforcement across the extended network, not raw throughput or routing.

Answer

To configure OSPF automatically

Answer

To increase the throughput of the firewall

Answer

To replace the need for an IPS sensor

Question 4

You are troubleshooting high CPU usage on a FortiGate. Which process would you check to see if the IPS engine is the cause?

Accepted Answer

diag sys top. The 'diagnose sys top' command displays real-time CPU and memory usage per process on the FortiGate, allowing you to identify if the IPS engine (often shown as 'ipsengine') is consuming excessive CPU. This is the standard tool for process-level CPU troubleshooting.

Answer

get system status

Answer

diagnose hardware status

Answer

show sys resource

Question 5

You want to standardize the SD-WAN configuration for 50 remote branch offices. Which FortiManager feature should you use?

Accepted Answer

SD-WAN Templates. SD-WAN Templates in FortiManager (D) are specifically designed to standardize SD-WAN configurations across multiple branch offices. They allow you to define SD-WAN settings, such as interface members, zones, and rules, in a template that can be applied to multiple FortiGates. This ensures consistency and simplifies management for large-scale deployments.

Answer

Policy Packages

Answer

Firmware Images

Answer

CLI Scripts

Question 6

Which object must be created before assigning a health check to an SD-WAN service rule in an SD-WAN template?

Accepted Answer

An SD-WAN Health Check. In Fortinet SD-WAN, a health check must be defined as an SD-WAN Health Check object before it can be referenced in an SD-WAN service rule. The service rule uses the health check to monitor the status of the specified SLA targets (e.g., latency, jitter, packet loss) and to determine which member links are eligible for traffic steering. Without a preconfigured health check, the service rule has no monitoring mechanism to evaluate link quality, so the assignment cannot be made.

Answer

A routing protocol

Answer

A firewall address object

Answer

An SD-WAN Zone

Question 7

When configuring an SD-WAN rule, what is the purpose of the 'Source' address field?

Accepted Answer

To match traffic based on the source IP or user.. The Source address field in an SD-WAN rule is used to match traffic based on the source IP address or user identity, allowing the rule to apply only to specific sources. This is part of the rule's matching criteria, alongside destination and service, to determine which traffic is steered by the SD-WAN rule. It does not define gateway IPs or force zones.

Answer

To define the gateway IP for the route.

Answer

To force traffic to a specific SD-WAN zone.

Answer

To determine which ISP the traffic exits through regardless of SLA.

Question 8

When configuring SD-WAN services in a template, what does the 'Performance SLA' setting determine?

Accepted Answer

The criteria for path selection based on link quality. The Performance SLA setting in an SD-WAN template defines the health-check parameters — probe type, target, interval, and thresholds for latency, jitter, and packet loss — that determine whether a member link is considered alive and how it ranks for path selection. SD-WAN rules then use these SLA results to steer traffic to the best-quality link. It is fundamentally a link-quality criterion, not a bandwidth or port-priority setting.

Answer

The physical port priority

Answer

The maximum bandwidth allowed

Answer

The number of tunnels created

Question 9

Which TWO configuration changes require a push from FortiManager to the FortiGate?

Accepted Answer

Changes to an SD-WAN template. Options B and C are correct because they are FortiManager-managed objects that must be installed/pushed to the FortiGate to take effect: an SD-WAN template (B) is a central VPN/SD-WAN configuration object in FortiManager that is assigned to a managed device and requires a push (install) to apply the template settings, and a firewall policy package (C) is the core policy configuration managed in FortiManager that must be installed to the FortiGate for the policies to become active. In contrast, changes made directly on the FortiGate local GUI such as log settings (A) and adding a local user to the FortiGate local database (D) are local device changes that do not require a FortiManager push, and changing the FortiManager admin password (E) is a FortiManager administrative setting that has no relation to pushing configuration to a FortiGate.

Answer

Changes to the log settings on the FortiGate local GUI

Answer

Adding a new user to the FortiGate local database

Answer

Changing the FortiManager admin password

Question 10

When using SD-WAN templates, which option allows you to manage different ISPs on different branches within the same template?

Accepted Answer

Dynamic Mapping. Dynamic Mapping in SD-WAN templates lets you bind template variables to per-device values, so the same template can reference different ISP interfaces (e.g., wan1 vs. wan2, or different ISP names) on different branches. When the template is installed, FortiManager resolves each variable against the device's metadata, producing branch-specific SD-WAN configurations from one template. This is the mechanism Fortinet designed specifically for multi-ISP, multi-branch template reuse.

Answer

Global Objects

Answer

Device Groups

Answer

SD-WAN Rules

Question 11

When viewing the SD-WAN Monitor in FortiManager, what information is provided for the 'Health Check' status?

Accepted Answer

Latency, jitter, and packet loss metrics. The SD-WAN Monitor in FortiManager displays Health Check status, which is derived from the SD-WAN health-check probes configured on the FortiGate. These probes measure latency, jitter, and packet loss for each member link, and FortiManager surfaces those metrics so administrators can see link quality centrally. This is the core purpose of the health-check status view.

Answer

The firmware version of the device

Answer

The number of active users

Answer

The current IP address of the interface

Question 12

An administrator configures a static route where the gateway is an SD-WAN zone instead of a specific IP address. How does FortiOS process this SD-WAN static route?

Accepted Answer

The FortiOS SD-WAN engine intercepts the route lookup and applies SD-WAN rules to dynamically select the best member interface based on performance SLAs. When a static route's gateway is an SD-WAN zone, FortiOS treats it as an SD-WAN route and invokes the SD-WAN engine during route lookup. The engine evaluates the configured SD-WAN rules and health-check SLAs to dynamically select the best member interface for the traffic, rather than using a fixed next-hop IP. This enables performance-based routing and failover without changing the static route.

Answer

The FortiGate drops the packet because static routes require a valid IP address gateway

Answer

The packet is forwarded exclusively through the physical interface with the lowest index number

Answer

Traffic is load-balanced equally across all physical interfaces in the FortiGate chassis using round-robin

Question 13

An administrator configures an SD-WAN rule with a 'Lowest Cost (SLA)' strategy. What determines the metric used by FortiOS to select the best interface when multiple links meet the SLA criteria?

Accepted Answer

The lowest packet loss, jitter, or latency value measured by the health check among the qualifying links. With the 'Lowest Cost (SLA)' strategy, FortiOS first filters SD-WAN members to those currently meeting their SLA targets (latency, jitter, packet loss thresholds defined in the health check). Among the qualifying members, it selects the one with the lowest measured cost metric — typically the lowest latency, jitter, or packet loss value reported by the health check probes. This makes the selection dynamic and performance-driven rather than static.

Answer

The round-robin algorithm applied sequentially across all active links

Answer

The lowest physical port number on the FortiGate hardware

Answer

The highest interface bandwidth capacity defined in the static route table

Question 14

An administrator needs to perform a firmware upgrade on 100 FortiGates. Which feature in FortiManager allows this to be done securely with a rollback option?

Accepted Answer

Firmware Management in Device Manager. FortiManager's Firmware Management feature (found under Device Manager) allows administrators to upload firmware images, schedule upgrades, and perform bulk upgrades across multiple FortiGates. It includes a rollback option that can revert devices to a previous firmware version if the upgrade fails or causes issues. This is the secure, centralized method for upgrading many devices.

Answer

Automated patch management

Answer

Manual script pushing

Answer

Global Policy upgrade task

Question 15

A FortiGate is performing OSPF routing. You want to redistribute connected routes into OSPF, but only for a specific subnet. How can this be achieved?

Accepted Answer

Use a route map in the OSPF redistribute configuration. On FortiGate, redistribution into OSPF is controlled with a route map applied under 'config router ospf' > 'config redistribute connected'. The route map can match a specific prefix (via an IP prefix list or access list) and permit only that subnet, so only the desired connected route is redistributed.

Answer

Configure a distribute-list in the OSPF process

Answer

Use an IP prefix list under the OSPF area command

Answer

Use an access list under the interface configuration

Question 16

When creating an SD-WAN template, what must be defined before you can add an SD-WAN interface to the template?

Accepted Answer

Individual SD-WAN member interfaces. In FortiManager, an SD-WAN template requires the underlying SD-WAN member interfaces to be defined first, because the SD-WAN interface is a logical overlay that aggregates those physical or logical member links. Without member interfaces, there is nothing for the SD-WAN zone to bind to, so FortiManager will not allow you to add the SD-WAN interface to the template.

Answer

The SD-WAN health check probes

Answer

Global firewall policies

Answer

The virtual domain (VDOM) settings

Question 17

What does the 'FortiGuard' service provide to the FortiGate?

Accepted Answer

Real-time threat intelligence and database updates. FortiGuard is Fortinet's subscription-based security intelligence service that delivers real-time threat intelligence and database updates to FortiGate devices. This includes antivirus signatures, IPS signatures, web filtering categories, DNS filtering, and application control signatures, all updated continuously from Fortinet's global threat research.

Answer

User management and authentication

Answer

Local firmware storage

Answer

Hardware acceleration support

Question 18

What is the benefit of using 'SD-WAN Zones' in templates when managing 100+ branches?

Accepted Answer

They allow for easier mapping to physical ports across different hardware models. SD-WAN Zones in FortiManager templates allow administrators to define logical zones that map to physical ports consistently across different FortiGate hardware models. This abstraction simplifies template deployment to 100+ branches because the same template can be applied regardless of the specific port layout on each device.

Answer

They allow for multiple internet service providers

Answer

They automatically configure static routes

Answer

They increase the speed of the internet connection

Question 19

What is the impact of changing the 'set vdom-mode' from 'no-vdom' to 'multi-vdom'?

Accepted Answer

System reboot required. Changing 'set vdom-mode' from 'no-vdom' to 'multi-vdom' requires a reboot because the FortiGate must reinitialize its configuration database and process architecture to support multiple virtual domains. VDOM mode is a global system setting that affects how interfaces, policies, routing tables, and admin domains are partitioned, so the change cannot be applied live. After the reboot, the default 'root' VDOM is created and the previous global configuration is migrated into it.

Answer

Automatic disablement of HA

Answer

Loss of all firewall policies

Answer

No impact, immediate change

Question 20

Which protocol is NOT a valid option for Performance SLA probes?

Accepted Answer

UDP Broadcast. UDP Broadcast is not a valid protocol for Performance SLA probes in FortiGate SD-WAN. Valid probe protocols include TCP Echo, HTTP, HTTPS, ICMP, and others, but UDP Broadcast is not among them because SLA probes require a response to measure latency, jitter, and packet loss, which broadcast does not provide.

Answer

TCP Echo

Answer

HTTP

Answer

ICMP