FORTINET-NSE7-SPECIALTY Practice Test 5 — 25 Questions

Question 1

Which THREE steps are involved in the 'Policy Package Installation' workflow?

Accepted Answer

Select the target device. In the Policy Package Installation workflow, you must first select the policy package (D) that you intend to deploy, since the package defines the set of rules and objects to be installed. Next, you select the target device (A) — the managed gateway, cluster, or VSX — to which that package will be pushed. Before committing, you review the install preview (C), which shows the changes, warnings, and potential impacts so you can confirm or cancel the installation. Options B and E are not part of this workflow: a factory reset (B) is a device-recovery action unrelated to policy deployment, and rebooting the target device (E) is neither required nor a defined step in installing a policy package.

Answer

Perform a factory reset

Answer

Reboot the target device

Question 2

Which THREE items are included in a Policy Package when it is pushed from FortiManager?

Accepted Answer

Service Objects. A Policy Package in FortiManager is the container of the security configuration that gets installed to managed FortiGate devices, and it includes the firewall policy rules themselves (B, Firewall Policies), which define the traffic handling and are the core of the package. It also includes the reusable objects those policies reference, specifically Address Objects (E) and Service Objects (A), which define the source/destination addresses and the TCP/UDP port or protocol matches used inside the policies. These three items travel together as a unit when the policy package is pushed, because the policies cannot function without their referenced address and service objects. By contrast, System interface settings (C) and Routing tables (D) are device-level configuration that belongs to the FortiGate's system and network settings, not to the policy package, so they are not installed as part of a policy package push.

Answer

System interface settings

Answer

Routing tables

Question 3

When configuring advanced IPsec VPN tunnels to act as members of an SD-WAN zone, which TWO configuration parameters on the FortiGate are critical for ensuring proper IPsec tunnel operation and traffic steering? (Choose two)

Accepted Answer

Ensure the IPsec interface is added to an SD-WAN zone and assigned a valid virtual IP/interface configuration. Option A is correct because an IPsec interface must be a member of the SD-WAN zone to participate in SD-WAN path selection and steering; the tunnel interface needs a valid IP/interface configuration so the zone can reference it and health checks and rules can operate on it. Option E is correct because Phase 2 selectors define the interesting traffic for the tunnel: they should either match the exact protected source/destination subnets or use 0.0.0.0/0 for route-based VPNs, which allows routing and SD-WAN rules to steer traffic into the tunnel rather than being blocked by narrow selectors. Option B is wrong because NAT-T is often required when peers are behind NAT and disabling it globally would break many tunnels; it is not a critical SD-WAN membership parameter. Option C is wrong because not all participating spokes should be dialup servers; typically the hub is the dialup server and spokes are dialup clients, and tunnel mode is not the parameter that makes a tunnel an SD-WAN member. Option D is wrong because forcing RSA certificates only and disabling pre-shared keys is an authentication policy choice, not a requirement for IPsec tunnel operation or SD-WAN traffic steering.

Answer

Disable NAT traversal (NAT-T) globally on all IPsec phase 1 tunnels

Answer

Configure the IPsec tunnel mode as dialup server on all participating branch spokes

Answer

Set the IPsec phase 1 authentication method strictly to RSA certificates only, disabling pre-shared keys

Question 4

Which TWO of the following can cause an SD-WAN member to be marked as 'down' in an SLA?

Accepted Answer

The probe times out.. In SD-WAN SLA monitoring, a member is marked down when an SLA probe fails to receive a response within the configured timeout, so option A (the probe times out) directly triggers the down state. Option C (packet loss exceeds the threshold) is also correct because SLA criteria include metrics such as packet loss, latency, and jitter, and exceeding the configured loss threshold causes the member to fail the SLA and be marked down. Options B, D, and E do not by themselves cause an SLA member to be marked down: a system clock update does not affect probe reachability, disabling a firewall policy is a configuration change rather than an SLA metric violation, and changing an interface IP address would typically break connectivity or require reconfiguration but is not itself an SLA threshold breach that marks the member down.

Answer

The system clock is updated.

Answer

The firewall policy is disabled.

Answer

The interface IP address is changed.

Question 5

Which TWO methods can be used to authenticate a FortiGate when it registers to a FortiManager?

Accepted Answer

Password/Pre-shared Key. Option C (Password/Pre-shared Key) is correct because when a FortiGate is added to FortiManager using the 'Add Device' wizard, the administrator can specify a pre-shared key (PSK) that the FortiGate must present during the FGFM (FortiGate-FortiManager) registration handshake to authenticate itself. Option D (Serial Number registration) is correct because FortiManager can also authenticate a registering FortiGate by matching its serial number against a pre-authorized device entry, allowing the device to be recognized and added without a PSK. Options A, B, and E are not valid FortiGate-to-FortiManager authentication methods: RADIUS is used for administrative or user authentication, not device registration; SNMP community strings are for monitoring, not registration; and IP-based automatic discovery merely identifies candidate devices on the network but does not authenticate them for FortiManager registration.

Answer

External RADIUS server

Answer

SNMP community string

Answer

IP-based automatic discovery

Question 6

An administrator is configuring BGP over SD-WAN IPsec tunnels between a headquarters FortiGate and branch FortiGates. Which TWO configuration steps are required to ensure robust and stable dynamic routing over the SD-WAN IPsec tunnels? (Choose two)

Accepted Answer

Configure BGP neighbors using the loopback interface IP addresses or tunnel specific IP addresses rather than physical interface IPs. Option B is correct because peering BGP over loopback or tunnel-specific IP addresses decouples the BGP session from any single physical WAN link, so the session stays up when an individual SD-WAN member link flaps and traffic can be steered across remaining IPsec tunnels. Option C is correct because WAN latency spikes and failover delays can exceed default BGP keepalive (60s) and hold-down (180s) timers, causing session resets; enabling graceful restart or tuning these timers preserves routing state and prevents unnecessary reconvergence during transient SD-WAN events. Option A is wrong because administrative distance 255 makes the route unusable and does not disable BGP updates; it would break routing rather than stabilize it. Option D is wrong because static default routes to null0 would blackhole traffic and are not a BGP-over-SD-WAN requirement. Option E is wrong because disabling IPsec Phase 2 encryption would break the IPsec tunnel and is not needed for BGP, which is encapsulated inside the tunnel.

Answer

Set the BGP administrative distance to 255 to disable all routing updates

Answer

Configure static default routes on all BGP neighbors pointing to the null0 interface

Answer

Disable IPsec phase 2 encryption to allow BGP plaintext hello packets to pass through without encapsulation overhead

Question 7

An administrator configures an SD-WAN health check with multiple probes (e.g., ping and HTTP) to monitor a set of IPsec VPN tunnels. Which THREE criteria or settings govern how FortiOS determines whether an SD-WAN member has met or failed the performance SLA? (Choose three)

Accepted Answer

The restoretime parameter, which specifies how many consecutive successful probes are required before restoring a failed member to healthy status. Option B is correct because the restoretime setting in an SD-WAN health check defines how many consecutive successful probe responses must be received before FortiOS transitions a previously failed member back to a healthy state, preventing flapping. Option D is correct because the failtime parameter specifies the number of consecutive probe failures (across the configured probes such as ping and HTTP) required before FortiOS marks that SD-WAN member as failed. Option E is correct because the SLA targets themselves—configured thresholds for latency, jitter, and packet loss—are the metrics FortiOS compares against probe results to decide whether a member is meeting the performance SLA. Option A is not relevant because the BGP AS number is a routing attribute and does not govern SD-WAN health-check SLA evaluation. Option C is not relevant because physical cable length is not a configurable SD-WAN SLA criterion and is not used by FortiOS to determine member health.

Answer

The BGP AS number assigned to the WAN interface gateway

Answer

The physical cable length calculated in meters between the FortiGate and the nearest ISP switch

Question 8

Which THREE items can be managed via Device Templates in FortiManager?

Accepted Answer

NTP configuration. Device Templates in FortiManager are used to provision and manage system-level and network-level settings on managed FortiGate devices, including NTP configuration (B), DNS settings (D), and local interface IP settings (E), which are all part of the system/network configuration that templates push to devices. NTP and DNS are system settings commonly configured through the System template, while interface IPs are configured through the Interface template, making all three valid template-managed items. Firewall policies (A) are managed through Policy Packages, not Device Templates, since they are policy objects rather than device-level provisioning settings. Application control databases (C) are updated via FortiGuard services and are not provisioned through Device Templates.

Answer

Firewall policies

Answer

Application control databases

Question 9

Which TWO of the following steps are required to correctly configure a Performance SLA?

Accepted Answer

Select the probe protocol.. Option C is correct because a Performance SLA health-check must specify the probe protocol (e.g., Ping, HTTP, TCP-echo, or UDP-echo) that FortiGate uses to send the probe packets and measure latency, jitter, and packet loss. Option D is correct because the SLA monitor requires a destination IP address (the server or target being probed) so the FortiGate knows where to send the probes and can evaluate link health against that endpoint. Options A, B, and E are not required: a firewall address object is not needed since the destination is entered directly in the SLA configuration, BGP is an unrelated routing protocol and not part of SLA setup, and assigning the probe to a VPN tunnel is optional (the SLA is typically bound to an SD-WAN member interface, not a tunnel).

Answer

Configure a firewall address object for the probe.

Answer

Enable BGP on the interface.

Answer

Assign the probe to a VPN tunnel.

Question 10

Which TWO actions should be taken when preparing to upgrade a FortiGate HA cluster?

Accepted Answer

Review release notes. Option A (Review release notes) is correct because Fortinet release notes document the supported upgrade path, firmware version compatibility, and known issues that must be checked before upgrading an HA cluster to avoid breaking the cluster or losing configuration. Option C (Backup the configuration) is correct because a full configuration backup (e.g., via System > Backup or 'execute backup config') provides a rollback point in case the upgrade fails or the cluster does not re-form properly. Option B is not required because clearing all sessions is not a prerequisite for an HA upgrade and would disrupt traffic unnecessarily. Option D is incorrect because disabling heartbeat interfaces would break HA communication and cause a split-brain or cluster failure. Option E is incorrect because changing HA mode to Standalone is not part of the upgrade procedure and would defeat the purpose of upgrading an HA cluster.

Answer

Clear all sessions

Answer

Disable heartbeat interfaces

Answer

Change HA mode to Standalone

Question 11

An administrator troubleshoots a scenario where traffic matching an application-based SD-WAN rule is bypassing the preferred high-speed MPLS tunnel and taking the backup broadband tunnel instead. Which THREE factors should the administrator check to resolve this routing discrepancy? (Choose three)

Accepted Answer

Inspect the member priorities and weights configured within the specific SD-WAN rule. Option C is correct because within an SD-WAN rule the member priorities and weights determine which member is preferred; if the MPLS member has a lower priority value or weight than the broadband member, the SD-WAN engine will steer matching traffic to broadband instead. Option D is correct because SD-WAN performance SLAs (e.g., latency, jitter, packet loss thresholds) continuously probe each member, and if the MPLS member fails the SLA it is marked ineligible and traffic falls back to the next qualified member such as the broadband tunnel. Option E is correct because SD-WAN rules are evaluated top-down by sequence order, so an earlier rule matching the same application-based criteria can intercept the traffic and send it out the broadband member before the intended rule is reached. Option A is not relevant because the factory default admin password has no bearing on SD-WAN member selection or tunnel routing. Option B is not relevant because the physical cable category affects link capability, not the SD-WAN engine's rule-based path selection between an MPLS and broadband member.

Answer

Verify the FortiGate factory default administrator password is changed

Answer

Check the physical layer OSI Model cable category connected to the FortiGate port

Question 12

Which TWO of these are valid SD-WAN health check protocols?

Accepted Answer

HTTP. HTTP (option C) is a valid SD-WAN health check protocol because SD-WAN controllers and edges can send HTTP GET requests to a target URL and evaluate the response code or latency to determine whether an application path is healthy. Ping (option D) is also valid because SD-WAN health checks commonly use ICMP echo requests to measure reachability, latency, jitter, and packet loss toward a specified destination. These two are the standard probe types supported for SD-WAN SLA/health-check configuration, alongside others like TCP and DNS in some implementations. SSH (option A) is a remote management/shell protocol, not a health-check probe. FTP (option B) is a file-transfer protocol and is not used for periodic path health monitoring. SNMP (option E) is a management/monitoring protocol for polling device metrics, not a probe type used to validate SD-WAN path health.

Answer

SSH

Answer

FTP

Answer

SNMP

Question 13

You are managing FortiGates across multiple ADOMs. How can you share common firewall objects (e.g., mail servers, common IP ranges) across these ADOMs?

Accepted Answer

Create objects in the Global Database. In FortiManager, the Global Database (Global ADOM) is the designated object space for creating firewall objects that must be shared across multiple ADOMs. Objects defined there can be referenced by policies in any ADOM, providing a single source of truth for common items like mail servers and IP ranges.

Answer

Manually copy objects to each ADOM

Answer

Use the API to script the creation in every ADOM

Answer

Enable 'Object Sharing' in system settings

Question 14

Which command allows you to view the current routing table for a specific VDOM?

Accepted Answer

get router info routing-table all. On FortiGate, the routing table for a specific VDOM is inspected with 'get router info routing-table all' executed inside that VDOM context. This command dumps all routes (connected, static, and dynamic) in the RIB for the active VDOM, which is essential when troubleshooting inter-VDOM or per-VDOM routing issues.

Answer

get system routing

Answer

diag ip route

Answer

show router table

Question 15

Which TWO methods can be used to update SD-WAN policies across all managed devices in FortiManager?

Accepted Answer

Using a CLI script to push updates. Option A is correct because FortiManager supports running CLI scripts (via Device Manager > Scripts) against managed FortiGates, allowing SD-WAN policy commands to be pushed to all devices in a single script execution. Option B is correct because SD-WAN policies are provisioned through SD-WAN templates in FortiManager, and modifying the template followed by an Install Wizard operation propagates the updated policy to all devices bound to that template. Option C is not the intended method since editing an individual FortiGate policy only affects that single device and does not centrally update policies across all managed devices. Option D is incorrect because creating a new ADOM merely establishes a separate administrative domain and does not push any SD-WAN policy changes. Option E is incorrect because rebooting FortiManager does not modify or distribute SD-WAN policies to managed devices.

Answer

Editing the individual FortiGate policy

Answer

Creating a new ADOM

Answer

Rebooting the FortiManager

Question 16

An administrator is migrating a standalone FortiGate into an existing FortiManager. What happens to the existing firewall policies on the FortiGate during the import process?

Accepted Answer

They are imported and converted into a Policy Package. When importing a standalone FortiGate into FortiManager, the existing firewall policies are imported and converted into a Policy Package within the ADOM. FortiManager creates a policy package named after the device (or a chosen name) containing the imported policies, objects, and interfaces, so the device can then be managed centrally. The policies are not deleted or disabled; they become the managed baseline.

Answer

They are moved to a 'Disabled' state

Answer

They are deleted to ensure a clean slate

Answer

They are merged into the Global Policy

Question 17

Which TWO methods are used to achieve traffic separation in a multi-VDOM environment?

Accepted Answer

Using VLAN sub-interfaces. In a multi-VDOM FortiGate environment, traffic separation is achieved by assigning physical ports to VDOMs (option C), which places each interface in its own virtual domain so that traffic entering one VDOM cannot reach another VDOM unless an inter-VDOM link is explicitly configured. VLAN sub-interfaces (option A) also achieve traffic separation because each VLAN tag creates a distinct logical interface that can be bound to a specific VDOM, keeping tagged traffic isolated per VDOM. Options B, D, and E do not provide traffic separation: SSL inspection is a security inspection feature, different HA clusters relate to device redundancy rather than VDOM traffic isolation, and different firmware versions are irrelevant to VDOM traffic separation.

Answer

Enabling SSL inspection globally

Answer

Using different HA clusters

Answer

Using different firmware versions

Question 18

An administrator notices that logs are not appearing in FortiManager for a specific FortiGate. What is the first thing to check to ensure log forwarding is active?

Accepted Answer

Log forwarding configuration on the FortiGate. When logs are missing in FortiManager for a specific FortiGate, the first thing to verify is the log forwarding configuration on the FortiGate itself. FortiManager receives logs only if the FortiGate is configured to send them — either via 'config log fortianalyzer setting' (if FortiManager hosts FortiAnalyzer features) or through the Fabric/central management settings. If log forwarding is disabled or misconfigured (wrong FortiManager IP, disabled logging), no logs will appear regardless of other factors.

Answer

The FortiManager license

Answer

The device's physical connection

Answer

The firmware version of the FortiGate

Question 19

What is the benefit of using 'CLI Templates' in FortiManager?

Accepted Answer

They allow applying configuration commands to multiple devices. CLI Templates in FortiManager are reusable sets of CLI commands that can be assigned to device groups or individual devices, enabling consistent configuration across many FortiGates at once. They are a provisioning and standardization tool, not a GUI replacement or performance enhancer. This makes bulk changes efficient and reduces human error.

Answer

They replace the GUI completely

Answer

They convert the policy to a CLI script

Answer

They improve the FortiGate hardware performance

Question 20

In SD-WAN central management, what is the 'SD-WAN Zone' used for?

Accepted Answer

To group multiple SD-WAN members for logical policy routing. The SD-WAN Zone is used to group multiple SD-WAN members (interfaces) into a logical entity for policy routing. This allows administrators to apply consistent routing policies and SLA profiles across all members in the zone, simplifying configuration and management.

Answer

To define the physical port speed

Answer

To limit bandwidth for specific users

Answer

To isolate the SD-WAN traffic from the WAN