FORTINET-NSE7-SPECIALTY Practice Test 7 — 10 Questions

Question 1

Which TWO criteria can be used in SD-WAN rules to select an outgoing interface?

Accepted Answer

Source and destination address. Option D (Source and destination address) is correct because SD-WAN rules commonly match traffic by source and/or destination IP address (and often subnet or address objects) to steer flows out a specific WAN interface. Option E (Application or service type) is correct because SD-WAN policies use application identification (e.g., via application signatures or ISDB) and service/port definitions to route traffic based on the recognized application or service. The administrator name (A) is not a traffic-matching criterion for interface selection, system temperature (B) is a hardware health metric not used in SD-WAN rule matching, and device serial number (C) identifies the device itself rather than classifying traffic for outbound interface selection.

Answer

The name of the administrator

Answer

System temperature

Answer

Device serial number

Question 2

An administrator applies security profiles (Antivirus, Web Filtering, and IPS) to traffic steered by an SD-WAN rule. Performance issues arise. Which TWO methods can the administrator use to optimize inspection performance without completely disabling security? (Choose two)

Accepted Answer

Switch the inspection mode from proxy-based to flow-based where supported, allowing hardware offloading (NP6/NP7) to accelerate packet processing. Option A is correct because switching from proxy-based to flow-based inspection where the FortiGate model supports it allows traffic to be accelerated by network processors (NP6/NP7) via hardware offloading, which dramatically reduces CPU load and latency while still applying Antivirus, Web Filtering, and IPS security. Option C is correct because configuring security profile exemptions or antivirus inspection overrides for trusted internal subnets or latency-sensitive VoIP traffic lets the administrator bypass heavy inspection only for specific low-risk or delay-sensitive flows, preserving security for the rest of the traffic. Option B is wrong because DES is a weak, deprecated cipher that does not meaningfully improve IPsec performance and would degrade security rather than optimize inspection. Option D is wrong because disabling SSL inspection globally removes a critical security control and does not address the SD-WAN inspection performance issue in a targeted way. Option E is wrong because removing the SD-WAN virtual interface from all firewall zones would break the SD-WAN routing and policy enforcement entirely, not optimize inspection.

Answer

Set the IPsec Phase 1 encryption algorithm to DES to speed up decryptions

Answer

Disable all SSL inspection globally across the entire FortiGate device

Answer

Remove the SD-WAN virtual interface from all firewall zones

Question 3

An IPsec VPN tunnel used as an SD-WAN member is experiencing intermittent flapping due to DPD (Dead Peer Detection) timeout issues over a high-latency satellite link. How should the administrator adjust the Phase 1 IPsec settings on FortiOS to stabilize the tunnel without completely disabling failure detection?

Accepted Answer

Increase the DPD retry count and interval settings under the IPsec Phase 1 configuration. Increasing the DPD retry count and interval under IPsec Phase 1 settings allows the FortiGate to tolerate longer delays before declaring the peer dead. On high-latency satellite links, packets may take longer to arrive, causing false DPD timeouts. By adjusting these parameters, the tunnel remains stable while still detecting genuine failures, as DPD is not disabled.

Answer

Disable DPD entirely so the FortiGate never tears down the tunnel

Answer

Enable NP6/NP7 hardware offloading for Phase 1 SA renegotiation

Answer

Change the IPsec phase 1 mode from Main mode to Aggressive mode

Question 4

What is the default behavior of a FortiGate firewall policy when no explicit policy matches the traffic?

Accepted Answer

Implicit Deny. FortiGate firewalls, like most stateful firewalls, follow a default-deny security posture. When a packet does not match any explicit firewall policy, it is dropped by the implicit deny rule. This implicit deny is not visible in the policy list but is always present at the bottom, ensuring that only traffic explicitly permitted by a policy is allowed. This behavior aligns with the principle of least privilege and is a fundamental security best practice.

Answer

Send to local DNS

Answer

Route to DMZ

Answer

Allow

Question 5

You are deploying a new SD-WAN interface. What is the mandatory step before you can add an interface to an SD-WAN zone?

Accepted Answer

Remove all firewall policy, static route, and DHCP references from the interface.. Before an interface can be added to an SD-WAN zone, FortiOS requires that the interface have no existing references — specifically, it must not be referenced by firewall policies, static routes, or DHCP server configurations. This is because SD-WAN zones take over the interface's role in routing and policy, and leftover references cause conflicts or install failures. Removing those references is the mandatory prerequisite.

Answer

Configure a performance SLA for that specific interface.

Answer

Assign a VLAN ID to the interface.

Answer

Enable SD-WAN on the global system settings.

Question 6

If an SD-WAN template contains a reference to an interface that does not exist on a target FortiGate, what occurs during the installation process?

Accepted Answer

The installation fails with a configuration error. If an SD-WAN template references an interface that does not exist on the target FortiGate, the installation fails with a configuration error. FortiManager validates the template against the device's actual interfaces during the install process; a missing interface cannot be resolved, so the push is aborted. The administrator must correct the template or the device's interface configuration.

Answer

The FortiGate automatically creates a dummy interface

Answer

The installation proceeds and ignores the missing interface

Answer

The FortiGate enters an 'Emergency' state

Question 7

You need to inspect traffic between two internal VLANs. How do you ensure this traffic is processed by the FortiGate?

Accepted Answer

Configure firewall policies between the VLAN interfaces. For a FortiGate to inspect traffic between two internal VLANs, it must be the Layer 3 gateway for those VLANs and have firewall policies that permit and inspect traffic between the VLAN interfaces. Simply creating the VLAN interfaces is not enough — without policies, the implicit deny drops the traffic, and without the FortiGate as gateway, traffic never reaches it.

Answer

Enable hardware switching

Answer

Set the firewall mode to Transparent

Answer

Enable inter-VLAN routing on the switches only

Question 8

Which FortiGate feature is used to group multiple physical interfaces for redundancy at Layer 2?

Accepted Answer

802.3ad Aggregate. 802.3ad Aggregate is the FortiGate feature that bundles multiple physical interfaces into a single logical link using the IEEE 802.3ad Link Aggregation Control Protocol (LACP). This provides Layer 2 redundancy and increased bandwidth: if one member link fails, traffic continues over the remaining links. Loopback, SD-WAN, and VLAN tagging do not provide Layer 2 link redundancy.

Answer

Loopback interface

Answer

SD-WAN

Answer

VLAN tagging

Question 9

You need to inspect traffic between two VDOMs. Which mechanism is required?

Accepted Answer

Inter-VDOM Link. An Inter-VDOM Link is the virtual interface pair that connects two VDOMs on the same FortiGate, allowing traffic to pass between them. Each VDOM gets one end of the link, and firewall policies on both VDOMs control what traffic is permitted. Without an Inter-VDOM Link, VDOMs are fully isolated and cannot exchange traffic. Policy-based routing, physical loopback cables, and static NAT do not provide inter-VDOM connectivity.

Answer

Policy-based routing

Answer

Physical loopback cable

Answer

Static NAT

Question 10

In an ADVPN 2.0 deployment, a hub unit uses BGP to advertise routes to spokes. When a spoke learns a prefix via BGP from the hub, what mechanism allows the spoke to automatically initiate an ADVPN shortcut tunnel directly to another spoke when traffic flows between them?

Accepted Answer

The FortiGate kernel detects traffic matching a dynamic BGP route over the IPsec interface and initiates an IKE shortcut negotiation with the target spoke. In ADVPN 2.0, the spoke learns a BGP route to a remote spoke's subnet via the hub. When traffic matches that route and is sent over the IPsec interface to the hub, the FortiGate kernel detects it and triggers an IKE shortcut negotiation directly with the target spoke, establishing a direct tunnel. This is the core ADVPN shortcut mechanism.

Answer

OSPF sends a special multicast hello packet across the hub to establish mesh point-to-point links

Answer

FortiManager pushes a dynamic static route to both spokes simultaneously

Answer

The Web Filtering profile intercepts the packet and redirects it via proxy to the destination spoke