FORTINET-NSE7-SPECIALTY Practice Test 2 — 30 Questions

Question 1

Which object must be created before assigning a health check to an SD-WAN service rule in an SD-WAN template?

Accepted Answer

An SD-WAN Health Check. In Fortinet SD-WAN, a health check must be defined as an SD-WAN Health Check object before it can be referenced in an SD-WAN service rule. The service rule uses the health check to monitor the status of the specified SLA targets (e.g., latency, jitter, packet loss) and to determine which member links are eligible for traffic steering. Without a preconfigured health check, the service rule has no monitoring mechanism to evaluate link quality, so the assignment cannot be made.

Answer

A routing protocol

Answer

A firewall address object

Answer

An SD-WAN Zone

Question 2

When configuring an SD-WAN rule, what is the purpose of the 'Source' address field?

Accepted Answer

To match traffic based on the source IP or user.. The Source address field in an SD-WAN rule is used to match traffic based on the source IP address or user identity, allowing the rule to apply only to specific sources. This is part of the rule's matching criteria, alongside destination and service, to determine which traffic is steered by the SD-WAN rule. It does not define gateway IPs or force zones.

Answer

To define the gateway IP for the route.

Answer

To force traffic to a specific SD-WAN zone.

Answer

To determine which ISP the traffic exits through regardless of SLA.

Question 3

When configuring SD-WAN services in a template, what does the 'Performance SLA' setting determine?

Accepted Answer

The criteria for path selection based on link quality. The Performance SLA setting in an SD-WAN template defines the health-check parameters — probe type, target, interval, and thresholds for latency, jitter, and packet loss — that determine whether a member link is considered alive and how it ranks for path selection. SD-WAN rules then use these SLA results to steer traffic to the best-quality link. It is fundamentally a link-quality criterion, not a bandwidth or port-priority setting.

Answer

The physical port priority

Answer

The maximum bandwidth allowed

Answer

The number of tunnels created

Question 4

Which TWO configuration changes require a push from FortiManager to the FortiGate?

Accepted Answer

Changes to an SD-WAN template. Options B and C are correct because they are FortiManager-managed objects that must be installed/pushed to the FortiGate to take effect: an SD-WAN template (B) is a central VPN/SD-WAN configuration object in FortiManager that is assigned to a managed device and requires a push (install) to apply the template settings, and a firewall policy package (C) is the core policy configuration managed in FortiManager that must be installed to the FortiGate for the policies to become active. In contrast, changes made directly on the FortiGate local GUI such as log settings (A) and adding a local user to the FortiGate local database (D) are local device changes that do not require a FortiManager push, and changing the FortiManager admin password (E) is a FortiManager administrative setting that has no relation to pushing configuration to a FortiGate.

Answer

Changes to the log settings on the FortiGate local GUI

Answer

Adding a new user to the FortiGate local database

Answer

Changing the FortiManager admin password

Question 5

When using SD-WAN templates, which option allows you to manage different ISPs on different branches within the same template?

Accepted Answer

Dynamic Mapping. Dynamic Mapping in SD-WAN templates lets you bind template variables to per-device values, so the same template can reference different ISP interfaces (e.g., wan1 vs. wan2, or different ISP names) on different branches. When the template is installed, FortiManager resolves each variable against the device's metadata, producing branch-specific SD-WAN configurations from one template. This is the mechanism Fortinet designed specifically for multi-ISP, multi-branch template reuse.

Answer

Global Objects

Answer

Device Groups

Answer

SD-WAN Rules

Question 6

When viewing the SD-WAN Monitor in FortiManager, what information is provided for the 'Health Check' status?

Accepted Answer

Latency, jitter, and packet loss metrics. The SD-WAN Monitor in FortiManager displays Health Check status, which is derived from the SD-WAN health-check probes configured on the FortiGate. These probes measure latency, jitter, and packet loss for each member link, and FortiManager surfaces those metrics so administrators can see link quality centrally. This is the core purpose of the health-check status view.

Answer

The firmware version of the device

Answer

The number of active users

Answer

The current IP address of the interface

Question 7

An administrator configures a static route where the gateway is an SD-WAN zone instead of a specific IP address. How does FortiOS process this SD-WAN static route?

Accepted Answer

The FortiOS SD-WAN engine intercepts the route lookup and applies SD-WAN rules to dynamically select the best member interface based on performance SLAs. When a static route's gateway is an SD-WAN zone, FortiOS treats it as an SD-WAN route and invokes the SD-WAN engine during route lookup. The engine evaluates the configured SD-WAN rules and health-check SLAs to dynamically select the best member interface for the traffic, rather than using a fixed next-hop IP. This enables performance-based routing and failover without changing the static route.

Answer

The FortiGate drops the packet because static routes require a valid IP address gateway

Answer

The packet is forwarded exclusively through the physical interface with the lowest index number

Answer

Traffic is load-balanced equally across all physical interfaces in the FortiGate chassis using round-robin

Question 8

An administrator configures an SD-WAN rule with a 'Lowest Cost (SLA)' strategy. What determines the metric used by FortiOS to select the best interface when multiple links meet the SLA criteria?

Accepted Answer

The lowest packet loss, jitter, or latency value measured by the health check among the qualifying links. With the 'Lowest Cost (SLA)' strategy, FortiOS first filters SD-WAN members to those currently meeting their SLA targets (latency, jitter, packet loss thresholds defined in the health check). Among the qualifying members, it selects the one with the lowest measured cost metric — typically the lowest latency, jitter, or packet loss value reported by the health check probes. This makes the selection dynamic and performance-driven rather than static.

Answer

The round-robin algorithm applied sequentially across all active links

Answer

The lowest physical port number on the FortiGate hardware

Answer

The highest interface bandwidth capacity defined in the static route table

Question 9

An administrator needs to perform a firmware upgrade on 100 FortiGates. Which feature in FortiManager allows this to be done securely with a rollback option?

Accepted Answer

Firmware Management in Device Manager. FortiManager's Firmware Management feature (found under Device Manager) allows administrators to upload firmware images, schedule upgrades, and perform bulk upgrades across multiple FortiGates. It includes a rollback option that can revert devices to a previous firmware version if the upgrade fails or causes issues. This is the secure, centralized method for upgrading many devices.

Answer

Automated patch management

Answer

Manual script pushing

Answer

Global Policy upgrade task

Question 10

A FortiGate is performing OSPF routing. You want to redistribute connected routes into OSPF, but only for a specific subnet. How can this be achieved?

Accepted Answer

Use a route map in the OSPF redistribute configuration. On FortiGate, redistribution into OSPF is controlled with a route map applied under 'config router ospf' > 'config redistribute connected'. The route map can match a specific prefix (via an IP prefix list or access list) and permit only that subnet, so only the desired connected route is redistributed.

Answer

Configure a distribute-list in the OSPF process

Answer

Use an IP prefix list under the OSPF area command

Answer

Use an access list under the interface configuration

Question 11

When creating an SD-WAN template, what must be defined before you can add an SD-WAN interface to the template?

Accepted Answer

Individual SD-WAN member interfaces. In FortiManager, an SD-WAN template requires the underlying SD-WAN member interfaces to be defined first, because the SD-WAN interface is a logical overlay that aggregates those physical or logical member links. Without member interfaces, there is nothing for the SD-WAN zone to bind to, so FortiManager will not allow you to add the SD-WAN interface to the template.

Answer

The SD-WAN health check probes

Answer

Global firewall policies

Answer

The virtual domain (VDOM) settings

Question 12

What does the 'FortiGuard' service provide to the FortiGate?

Accepted Answer

Real-time threat intelligence and database updates. FortiGuard is Fortinet's subscription-based security intelligence service that delivers real-time threat intelligence and database updates to FortiGate devices. This includes antivirus signatures, IPS signatures, web filtering categories, DNS filtering, and application control signatures, all updated continuously from Fortinet's global threat research.

Answer

User management and authentication

Answer

Local firmware storage

Answer

Hardware acceleration support

Question 13

What is the benefit of using 'SD-WAN Zones' in templates when managing 100+ branches?

Accepted Answer

They allow for easier mapping to physical ports across different hardware models. SD-WAN Zones in FortiManager templates allow administrators to define logical zones that map to physical ports consistently across different FortiGate hardware models. This abstraction simplifies template deployment to 100+ branches because the same template can be applied regardless of the specific port layout on each device.

Answer

They allow for multiple internet service providers

Answer

They automatically configure static routes

Answer

They increase the speed of the internet connection

Question 14

What is the impact of changing the 'set vdom-mode' from 'no-vdom' to 'multi-vdom'?

Accepted Answer

System reboot required. Changing 'set vdom-mode' from 'no-vdom' to 'multi-vdom' requires a reboot because the FortiGate must reinitialize its configuration database and process architecture to support multiple virtual domains. VDOM mode is a global system setting that affects how interfaces, policies, routing tables, and admin domains are partitioned, so the change cannot be applied live. After the reboot, the default 'root' VDOM is created and the previous global configuration is migrated into it.

Answer

Automatic disablement of HA

Answer

Loss of all firewall policies

Answer

No impact, immediate change

Question 15

Which protocol is NOT a valid option for Performance SLA probes?

Accepted Answer

UDP Broadcast. UDP Broadcast is not a valid protocol for Performance SLA probes in FortiGate SD-WAN. Valid probe protocols include TCP Echo, HTTP, HTTPS, ICMP, and others, but UDP Broadcast is not among them because SLA probes require a response to measure latency, jitter, and packet loss, which broadcast does not provide.

Answer

TCP Echo

Answer

HTTP

Answer

ICMP

Question 16

When configuring an IPsec tunnel using IKEv2, which THREE parameters are commonly negotiated during Phase 1?

Accepted Answer

Encryption algorithm (e.g., AES-256). During IKEv2 Phase 1 (IKE_SA_INIT and IKE_AUTH), the peers negotiate the encryption algorithm such as AES-256 (option A), which protects the IKE SA itself, making it a core Phase 1 parameter. The authentication method, such as PSK or RSA signatures (option B), is also negotiated and validated in Phase 1 to authenticate the peers and establish trust. The Diffie-Hellman group (option E) is likewise negotiated in Phase 1 to perform the key exchange and derive shared secret keys for the IKE SA. TCP port selection (option C) is not negotiated in Phase 1 because IKE uses UDP ports 500 and 4500, not TCP. Firewall policy ID (option D) is a local configuration construct and is not an IKEv2 Phase 1 negotiation parameter.

Answer

TCP port selection

Answer

Firewall policy ID

Question 17

Which TWO of the following can be used as a 'Source' in an SD-WAN rule?

Accepted Answer

Source IP address object.. In an SD-WAN rule, the 'Source' field identifies the traffic origin, and a source IP address object (Option A) is a valid match criterion because SD-WAN rules commonly match on IP address objects (host, subnet, or address group) to steer traffic. A user group (Option E) is also a valid Source match, since SD-WAN rules can classify traffic by user identity/group (typically resolved via FSSO or LDAP integration) so that different users get different path selection. SLA target name (Option B) is not a source; it is a performance/link-quality condition used in the rule's SLA/target definition to select the outgoing link. Interface MAC address (Option C) is a Layer-2 attribute not used as an SD-WAN rule Source match. Firewall policy ID (Option D) is a policy reference, not a traffic source identifier, so it cannot serve as the Source in an SD-WAN rule.

Answer

SLA target name.

Answer

Interface MAC address.

Answer

Firewall policy ID.

Question 18

A network administrator is configuring SSL inspection for a group of users. Which certificate must be installed on the client endpoints to prevent browser certificate warnings?

Accepted Answer

The FortiGate CA certificate used for SSL inspection. When a FortiGate performs SSL deep inspection, it acts as a man-in-the-middle: it intercepts the client's TLS connection, presents its own certificate to the client, and establishes a separate TLS session to the real server. For the client browser to trust this substituted certificate without warnings, the FortiGate's CA certificate (the one used for SSL inspection, typically Fortinet_CA_SSL or a custom CA) must be installed in the client's trusted root store. This allows the browser to validate the certificate chain back to a trusted CA.

Answer

The FortiGate's local device certificate

Answer

The Fortinet_Factory CA certificate

Answer

A third-party public CA certificate

Question 19

Where are SD-WAN zones managed in the FortiGate GUI?

Accepted Answer

Network > SD-WAN > SD-WAN Zones.. SD-WAN zones are configured and managed under Network > SD-WAN > SD-WAN Zones in the FortiGate GUI. This is where administrators create the SD-WAN zone, add member interfaces (physical, IPsec, VLAN), and define the virtual WAN link used by SD-WAN rules and static routes.

Answer

Interface > Physical Interfaces.

Answer

System > Network > Zones.

Answer

Firewall > Policy > Objects.

Question 20

What is the impact of checking the 'Interface Preference' box in an SD-WAN rule?

Accepted Answer

It overrides the SLA strategy selection.. Checking 'Interface Preference' in an SD-WAN rule forces the rule to use the explicitly selected interface(s) rather than letting the SLA strategy dynamically pick the best-performing member. This effectively overrides the SLA-based path selection for that rule, so traffic egresses the preferred interface even if another member has better SLA metrics. It is used when a specific link must be used for policy, compliance, or cost reasons.

Answer

It enables failover to the default gateway.

Answer

It enables load balancing across interfaces.

Answer

It increases the probe frequency.