FORTINET-NSE7-SPECIALTY Practice Test 8 — 10 Questions

Question 1

Which TWO administrative actions require a 'Workspace Mode' enabled in FortiManager?

Accepted Answer

Locking policies for editing. In FortiManager, Workspace Mode is the workflow that lets administrators lock objects (such as policies) for editing and then review pending changes before publishing them to managed devices, so options D and E are exactly the actions that require it. Locking policies for editing (D) is only meaningful inside Workspace Mode, because the lock prevents other admins from modifying the same policy while changes are staged. Reviewing changes before publishing (E) is the second half of that workflow, since FortiManager queues modifications in the workspace and requires an explicit review/publish step. The other options do not depend on Workspace Mode: automatic log rotation (A) is a logging/disk-management setting, creating new ADOMs (B) is a system-level administrative task performed outside the workspace workflow, and forcing a reboot (C) is a device/system operation available regardless of workspace state.

Answer

Automatic log rotation

Answer

Creating new ADOMs

Answer

Forcing a reboot

Question 2

You are configuring BGP and need to advertise a summary route to your ISP. How do you ensure only the summary route is advertised?

Accepted Answer

Use an aggregate-address with summary-only. The 'aggregate-address' command with the 'summary-only' keyword in BGP creates a summary route and suppresses the advertisement of more specific component routes to BGP peers. This ensures that only the summary route is advertised, which reduces the size of the BGP table on the ISP's routers and provides a clean, aggregated announcement. Without 'summary-only', both the summary and the more specific routes would be advertised.

Answer

Use a distribute-list

Answer

Set the weight to 0

Answer

Configure a route map with a prefix list

Question 3

What happens if you modify an SD-WAN template that is already applied to a FortiGate?

Accepted Answer

The configuration status shows 'Modified' and requires an installation task. When you modify an SD-WAN template that is already applied to a FortiGate, FortiManager marks the device's configuration status as 'Modified' because the running configuration on the FortiGate no longer matches the template. The change is not pushed automatically; an administrator must run an installation task (or 'Install Wizard') to push the updated template to the FortiGate. This is consistent with FortiManager's staged change model.

Answer

The changes take effect immediately without a push

Answer

The FortiGate automatically pulls the new config

Answer

The FortiGate configuration is reverted

Question 4

What is the effect of changing the IPS 'buffer' size on a FortiGate device?

Accepted Answer

It determines the maximum size of data packets to hold for inspection. The IPS buffer size on a FortiGate determines the maximum amount of data that the IPS engine will hold in memory for inspection before making a decision. A larger buffer allows the engine to reassemble and inspect larger payloads, which can improve detection of attacks that span multiple packets, but it also consumes more memory. The buffer size does not disable hardware acceleration, change signature timeouts, or increase concurrent connections.

Answer

It disables the hardware acceleration engine

Answer

It changes the signature timeout

Answer

It increases the number of concurrent IPS connections

Question 5

You are using 'SLA Target' as your strategy. What happens if multiple members meet the SLA?

Accepted Answer

The system selects the member with the best performance (e.g., lowest latency).. With the SLA Target strategy, FortiGate selects the member that best meets the SLA criteria — typically the one with the lowest latency or best overall quality among those that satisfy the SLA. It is a quality-based selection, not a first-match or bandwidth-based one.

Answer

The system selects the first member in the list.

Answer

The system selects the one with the highest bandwidth capacity.

Answer

Traffic is sent through all of them simultaneously.

Question 6

You are configuring a Performance SLA to monitor reachability to a SaaS application. Which parameter determines the threshold for an interface to be considered 'unhealthy' in the SD-WAN routing table?

Accepted Answer

Packet Loss Threshold. The Packet Loss Threshold in a Performance SLA defines the maximum acceptable percentage of lost probes before the member is marked unhealthy. When packet loss exceeds this threshold (along with latency and jitter thresholds), the SD-WAN engine disqualifies the member from the routing table.

Answer

Probe Mode

Answer

Sequence Number

Answer

Update Interval

Question 7

When configuring an SD-WAN rule for a specific application, how does the FortiGate identify the traffic?

Accepted Answer

By using the Application Control database.. FortiGate SD-WAN rules match traffic to applications using the Application Control signature database, which identifies applications by inspecting packet contents (DPI) rather than by static IP/port. When you select an 'Application' or 'Application Category' in an SD-WAN rule, the FortiGate leverages the same IPS/App-Ctrl engine signatures to classify the flow. This allows dynamic identification of SaaS and cloud apps whose IPs and ports change frequently.

Answer

By analyzing the packet payload size.

Answer

By looking at the source MAC address.

Answer

By forcing traffic through a specific VLAN.

Question 8

In a complex VPN scenario with NAT-Traversal (NAT-T) enabled, what is the primary purpose of the UDP 4500 port?

Accepted Answer

To encapsulate ESP packets. When NAT-Traversal is detected, IKE and ESP traffic are encapsulated in UDP datagrams on port 4500 to traverse NAT devices that would otherwise drop or mangle ESP (IP protocol 50). The UDP 4500 port carries both the IKE negotiation (with a non-ESP marker) and the encapsulated ESP payload, allowing the VPN to function through PAT/NAT.

Answer

To replace the AH protocol

Answer

To manage Phase 1 re-keying

Answer

To verify certificate revocation status

Question 9

You are configuring SD-WAN templates in FortiManager. What is the primary purpose of using SD-WAN Central Management instead of configuring SD-WAN directly on individual FortiGates?

Accepted Answer

To enable SD-WAN template inheritance and synchronized policy updates across multiple managed devices. SD-WAN Central Management in FortiManager uses templates (e.g., SD-WAN Template, CLI Template) to define SD-WAN configuration once and inherit it across multiple managed FortiGates. This enables synchronized policy updates, consistent SLA/steering rules, and efficient bulk changes. It eliminates the need to manually configure each FortiGate's SD-WAN settings individually.

Answer

To perform local traffic analysis on the FortiGate only

Answer

To allow FortiGates to manage their own SD-WAN interfaces independently

Answer

To bypass the need for ADOMs

Question 10

An administrator needs to inspect encrypted traffic traversing an SD-WAN IPsec tunnel using Deep Packet Inspection (DPI). What must be installed on the client endpoints or configured on the FortiGate to prevent browser trust warnings when using SSL/TLS full inspection?

Accepted Answer

The FortiGate's self-signed CA certificate must be installed in the trusted root certificate store of the client endpoints. When the FortiGate performs SSL/TLS full inspection, it acts as a man-in-the-middle, re-signing every server certificate with its own CA certificate. For browsers and applications to trust the re-signed certificates without warnings, the FortiGate's inspection CA certificate must be imported into the trusted root certificate store of every client endpoint. This is the standard requirement for any full DPI deployment, whether over SD-WAN IPsec tunnels or direct internet paths.

Answer

ADVPN 2.0 shortcut certificates must be exchanged between spokes

Answer

BGP MD5 authentication keys must match on both routers

Answer

A pre-shared key must be configured in the IPsec Phase 1 proposal