FORTINET-NSE7-SPECIALTY Practice Test 4 — 25 Questions

Question 1

You are configuring a Performance SLA to monitor reachability to a SaaS application. Which parameter determines the threshold for an interface to be considered 'unhealthy' in the SD-WAN routing table?

Accepted Answer

Packet Loss Threshold. The Packet Loss Threshold in a Performance SLA defines the maximum acceptable percentage of lost probes before the member is marked unhealthy. When packet loss exceeds this threshold (along with latency and jitter thresholds), the SD-WAN engine disqualifies the member from the routing table.

Answer

Probe Mode

Answer

Sequence Number

Answer

Update Interval

Question 2

When configuring an SD-WAN rule for a specific application, how does the FortiGate identify the traffic?

Accepted Answer

By using the Application Control database.. FortiGate SD-WAN rules match traffic to applications using the Application Control signature database, which identifies applications by inspecting packet contents (DPI) rather than by static IP/port. When you select an 'Application' or 'Application Category' in an SD-WAN rule, the FortiGate leverages the same IPS/App-Ctrl engine signatures to classify the flow. This allows dynamic identification of SaaS and cloud apps whose IPs and ports change frequently.

Answer

By analyzing the packet payload size.

Answer

By looking at the source MAC address.

Answer

By forcing traffic through a specific VLAN.

Question 3

In a complex VPN scenario with NAT-Traversal (NAT-T) enabled, what is the primary purpose of the UDP 4500 port?

Accepted Answer

To encapsulate ESP packets. When NAT-Traversal is detected, IKE and ESP traffic are encapsulated in UDP datagrams on port 4500 to traverse NAT devices that would otherwise drop or mangle ESP (IP protocol 50). The UDP 4500 port carries both the IKE negotiation (with a non-ESP marker) and the encapsulated ESP payload, allowing the VPN to function through PAT/NAT.

Answer

To replace the AH protocol

Answer

To manage Phase 1 re-keying

Answer

To verify certificate revocation status

Question 4

You are configuring SD-WAN templates in FortiManager. What is the primary purpose of using SD-WAN Central Management instead of configuring SD-WAN directly on individual FortiGates?

Accepted Answer

To enable SD-WAN template inheritance and synchronized policy updates across multiple managed devices. SD-WAN Central Management in FortiManager uses templates (e.g., SD-WAN Template, CLI Template) to define SD-WAN configuration once and inherit it across multiple managed FortiGates. This enables synchronized policy updates, consistent SLA/steering rules, and efficient bulk changes. It eliminates the need to manually configure each FortiGate's SD-WAN settings individually.

Answer

To perform local traffic analysis on the FortiGate only

Answer

To allow FortiGates to manage their own SD-WAN interfaces independently

Answer

To bypass the need for ADOMs

Question 5

An administrator needs to inspect encrypted traffic traversing an SD-WAN IPsec tunnel using Deep Packet Inspection (DPI). What must be installed on the client endpoints or configured on the FortiGate to prevent browser trust warnings when using SSL/TLS full inspection?

Accepted Answer

The FortiGate's self-signed CA certificate must be installed in the trusted root certificate store of the client endpoints. When the FortiGate performs SSL/TLS full inspection, it acts as a man-in-the-middle, re-signing every server certificate with its own CA certificate. For browsers and applications to trust the re-signed certificates without warnings, the FortiGate's inspection CA certificate must be imported into the trusted root certificate store of every client endpoint. This is the standard requirement for any full DPI deployment, whether over SD-WAN IPsec tunnels or direct internet paths.

Answer

ADVPN 2.0 shortcut certificates must be exchanged between spokes

Answer

BGP MD5 authentication keys must match on both routers

Answer

A pre-shared key must be configured in the IPsec Phase 1 proposal

Question 6

An administrator is troubleshooting BGP route propagation over SD-WAN IPsec tunnels where a branch office is not receiving specific routes from the datacenter hub. Which TWO CLI commands on the FortiGate are most useful for diagnosing BGP peering and advertised route issues? (Choose two)

Accepted Answer

get router info bgp neighbors advertised-routes. Option E, 'get router info bgp summary', is correct because it displays the state of all BGP peers, including whether the branch-to-hub session is Established, the peer AS number, uptime, and prefix counts received — the fastest way to confirm the BGP peering itself is up before investigating route propagation. Option D, 'get router info bgp neighbors advertised-routes', is correct because it shows exactly which prefixes the local FortiGate is advertising to a specific neighbor, letting the administrator verify whether the missing routes are actually being sent toward the branch over the SD-WAN IPsec tunnel. The unmarked options do not belong: 'execute ipsec tunnel list' only shows IPsec tunnel status and selectors, not BGP route exchange; 'diagnose sys sdwan member' reports SD-WAN member health, latency, and SLA state but no BGP information; and 'get system interface physical' merely lists physical interface link status and addressing, which is irrelevant to BGP peering or advertised-route troubleshooting.

Answer

execute ipsec tunnel list

Answer

diagnose sys sdwan member

Answer

get system interface physical

Question 7

You need to ensure that VoIP traffic stays on the interface with the lowest jitter. Which strategy should you use?

Accepted Answer

SLA Target. FortiGate SD-WAN's SLA Target strategy selects the member link that best meets a defined SLA target (latency, jitter, packet loss) for the specified traffic, making it the correct choice for keeping VoIP on the lowest-jitter interface. Unlike Lowest Cost, SLA Target prioritizes SLA compliance over cost, which is exactly what latency-sensitive VoIP requires.

Answer

Load Balance

Answer

Lowest Cost (SLA)

Answer

Manual

Question 8

A FortiGate SD-WAN deployment uses a firewall policy with an Intrusion Prevention System (IPS) profile applied. After turning on IPS, administrators notice that throughput over an IPsec SD-WAN tunnel drops significantly. What is the primary reason for this throughput reduction, and how can it be mitigated?

Accepted Answer

IPS inspection requires intensive CPU processing for packet payload analysis, which can be optimized by using flow-based inspection mode and ensuring hardware offloading is active where supported. IPS inspection is CPU-intensive because it analyzes packet payloads against signature databases, which reduces throughput on IPsec tunnels. Mitigation includes using flow-based inspection (which is less resource-intensive than proxy-based) and ensuring hardware offloading (NPU/CP) is active where supported, so encrypted traffic can be accelerated.

Answer

IPS requires proxy-based inspection, which permanently disables IPsec hardware acceleration

Answer

IPS blocks all IPsec AH/ESP headers, forcing fallback to unencrypted GRE tunnels

Answer

The IPS database size exceeds the IPsec Phase 2 buffer limit

Question 9

An administrator wants to view the active SD-WAN rule hit counts and verify which traffic is matching a specific SD-WAN rule in FortiOS. Which command should be used?

Accepted Answer

diagnose sys sdwan service. The command `diagnose sys sdwan service` is the correct choice because it displays the SD-WAN service table, which includes each rule's hit count and the list of matching traffic flows. This command provides real-time statistics on which sessions are being steered by specific SD-WAN rules, allowing administrators to verify rule effectiveness. It is the primary diagnostic tool for SD-WAN rule monitoring in FortiOS.

Answer

show system sdwan

Answer

execute router clear sdwan cache

Answer

get firewall policy statistics

Question 10

You are setting up an SD-WAN configuration via FortiManager. Which object type is used to group multiple WAN interfaces for SD-WAN member assignment?

Accepted Answer

SD-WAN Zone. In FortiManager SD-WAN configuration, an SD-WAN Zone is the object type used to group multiple WAN interfaces for SD-WAN member assignment. Zones allow you to logically group interfaces so that SD-WAN rules and performance SLAs can be applied to the group rather than individual interfaces. This is the correct object for organizing WAN members in an SD-WAN deployment managed via FortiManager.

Answer

IP Pool

Answer

Virtual Wire Pair

Answer

Interface Group

Question 11

You are implementing SSL VPN and need to ensure that only compliant corporate laptops can connect. Which feature should you use?

Accepted Answer

Host check. Host check (also called host integrity or endpoint compliance check) is the SSL VPN feature that inspects the connecting endpoint before granting access, verifying that required security software, OS patches, antivirus definitions, and registry keys are present. Only endpoints that pass the defined compliance rules are allowed to establish the tunnel or access protected resources. This directly satisfies the requirement that only compliant corporate laptops can connect.

Answer

SSL VPN portal settings

Answer

Two-factor authentication

Answer

PKI user authentication

Question 12

You are configuring an IPS policy to protect a web server. You notice that traffic is being dropped due to a false positive. Which action is the most efficient way to resolve this while maintaining security?

Accepted Answer

Create an IPS sensor override for the specific signature ID. Creating an IPS sensor override for the specific signature ID allows you to selectively disable or modify the action of only the offending signature, eliminating the false positive while keeping all other IPS protections active. This is the most surgical and efficient approach because it preserves the security posture of the entire sensor profile. FortiGate IPS sensors support per-signature overrides (set status disable, set action pass, or set log-packet enable) without affecting unrelated signatures.

Answer

Change the IPS mode from blocking to monitoring

Answer

Disable the entire IPS sensor profile

Answer

Increase the IPS packet buffer size

Question 13

What is the maximum number of members allowed in a single SD-WAN zone?

Accepted Answer

Depends on the model, but generally limited by system resources.. The maximum number of members in a single SD-WAN zone is not a fixed hard-coded number; it depends on the FortiGate model and is ultimately bounded by available system resources such as memory and CPU. Fortinet does not publish a universal cap like 4 or 8, and different platforms support different scales. Therefore the correct answer is the model/resource-dependent option.

Answer

8

Answer

2

Answer

4

Question 14

Which THREE aspects of the FortiGate system are affected by changing the global 'set vdom-mode' to 'multi-vdom'?

Accepted Answer

CLI command hierarchy. Changing the global 'set vdom-mode' to 'multi-vdom' alters the CLI command hierarchy (A), because configuration commands become nested under 'config vdom' and you must enter a VDOM with 'config vdom / edit <name>' before configuring most objects. It also changes management of system resources (C), since interfaces, routing tables, firewall objects, and administrators can be partitioned and assigned per-VDOM, enabling independent resource and policy administration. It additionally changes how firewall policies are applied (E), because policies are defined and processed within each VDOM rather than globally, so traffic matching and policy lookup occur in the context of the VDOM that owns the ingress interface. The HA cluster size (B) is not affected by VDOM mode, as HA membership and cluster limits are independent of VDOM configuration. The physical port order (D) is also unaffected, since interface naming and hardware port numbering remain the same regardless of VDOM mode.

Answer

The HA cluster size

Answer

The physical port order

Question 15

Which feature in FortiManager allows you to monitor SD-WAN performance across all managed FortiGates?

Accepted Answer

Dashboard > SD-WAN Monitor. FortiManager's Dashboard includes an SD-WAN Monitor widget that aggregates SD-WAN performance data — link health, SLA status, jitter, latency, and packet loss — across all managed FortiGates in the ADOM. This gives administrators a single pane of glass to spot degraded links or failed SLAs fleet-wide. It pulls from the same health-check data the FortiGates generate for their SD-WAN rules.

Answer

Device Manager

Answer

Log View

Answer

Policy & Objects

Question 16

An administrator implements BGP over SD-WAN tunnels to a cloud provider. The cloud provider requires BGP MD5 authentication on all peering sessions. Where is BGP MD5 authentication configured on the FortiGate?

Accepted Answer

Under the router bgp neighbor configuration block in the CLI. BGP MD5 authentication is configured on the FortiGate under the BGP neighbor configuration in the CLI, using the command 'set password' within the 'config router bgp' and 'config neighbor' blocks. This sets the TCP MD5 signature option for the BGP session, which must match on both peers. It is not configured in firewall policies, IPsec Phase 1 settings, or SD-WAN health checks.

Answer

Within the firewall policy authentication settings

Answer

Under the IPsec phase 1 interface advanced settings

Answer

Inside the SD-WAN health check probe configuration

Question 17

When using SD-WAN zones, what is the primary benefit of grouping multiple physical interfaces into a single zone?

Accepted Answer

It allows you to apply a single firewall policy to the entire group.. Grouping multiple physical interfaces into a single SD-WAN zone allows you to apply a single firewall policy to the entire group, simplifying management and ensuring consistent security policies across all member interfaces. This is the primary benefit because it reduces administrative overhead and ensures that policies are uniformly enforced. While SD-WAN zones can also facilitate load balancing and failover, those are features of the SD-WAN rules applied to the zone, not the primary purpose of grouping interfaces.

Answer

It increases the throughput of individual physical links.

Answer

It prevents the need for performance SLAs.

Answer

It automatically enables load balancing between interfaces.

Question 18

During SD-WAN template deployment, what is the role of 'Dynamic Mapping'?

Accepted Answer

To map a single template object to different physical settings on different devices. Dynamic Mapping in SD-WAN template deployment allows a single template object (like an interface or SD-WAN rule) to be mapped to different physical settings on different devices. This enables flexibility when deploying the same template to multiple FortiGates with varying interface names or configurations. It uses variables and metadata to adapt the template to each device's specifics.

Answer

To automate firmware updates

Answer

To monitor bandwidth usage

Answer

To dynamically change the SD-WAN rule based on time

Answer

To calculate the latency of paths

Question 19

What is required before FortiManager can display SD-WAN monitoring data?

Accepted Answer

The FortiGate must be sending logs to FortiManager. FortiManager displays SD-WAN monitoring data by receiving logs from the FortiGate. The FortiGate must be configured to send logs to FortiManager, typically via the 'log fortianalyzer' or 'log fortimanager' settings. Without logs, FortiManager has no data to display for SD-WAN monitoring, such as performance SLAs, link status, and traffic statistics.

Answer

The FortiGate must have a cloud license

Answer

The FortiGate must be running a specific firmware

Answer

The FortiGate must be in Transparent mode

Question 20

What is the result of 'Pushing' a policy package from FortiManager to a FortiGate?

Accepted Answer

The FortiGate policy configuration is overwritten with the FortiManager version. When you push a policy package from FortiManager to a managed FortiGate, FortiManager installs its policy package configuration onto the device, replacing the corresponding firewall policy configuration on the FortiGate with the FortiManager version. This is the standard 'install' operation in the FortiManager workflow, and it overwrites the device-level policy configuration rather than merging or appending it. The FortiGate becomes a reflection of the FortiManager policy package for the policy-related objects that are pushed.

Answer

The FortiGate policy is sent to the FortiManager

Answer

The policy is saved in a draft state on the FortiGate

Answer

The FortiManager policy is appended to the existing FortiGate policy