FORTINET-NSE7-SPECIALTY Practice Test 9 — 10 Questions

Question 1

An administrator is troubleshooting BGP route propagation over SD-WAN IPsec tunnels where a branch office is not receiving specific routes from the datacenter hub. Which TWO CLI commands on the FortiGate are most useful for diagnosing BGP peering and advertised route issues? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

get router info bgp neighbors advertised-routes. Option E, 'get router info bgp summary', is correct because it displays the state of all BGP peers, including whether the branch-to-hub session is Established, the peer AS number, uptime, and prefix counts received — the fastest way to confirm the BGP peering itself is up before investigating route propagation. Option D, 'get router info bgp neighbors advertised-routes', is correct because it shows exactly which prefixes the local FortiGate is advertising to a specific neighbor, letting the administrator verify whether the missing routes are actually being sent toward the branch over the SD-WAN IPsec tunnel. The unmarked options do not belong: 'execute ipsec tunnel list' only shows IPsec tunnel status and selectors, not BGP route exchange; 'diagnose sys sdwan member' reports SD-WAN member health, latency, and SLA state but no BGP information; and 'get system interface physical' merely lists physical interface link status and addressing, which is irrelevant to BGP peering or advertised-route troubleshooting.

Answer

execute ipsec tunnel list

Answer

diagnose sys sdwan member

Answer

get system interface physical

Question 2

You need to ensure that VoIP traffic stays on the interface with the lowest jitter. Which strategy should you use?

Accepted Answer

SLA Target. FortiGate SD-WAN's SLA Target strategy selects the member link that best meets a defined SLA target (latency, jitter, packet loss) for the specified traffic, making it the correct choice for keeping VoIP on the lowest-jitter interface. Unlike Lowest Cost, SLA Target prioritizes SLA compliance over cost, which is exactly what latency-sensitive VoIP requires.

Answer

Load Balance

Answer

Lowest Cost (SLA)

Answer

Manual

Question 3

A FortiGate SD-WAN deployment uses a firewall policy with an Intrusion Prevention System (IPS) profile applied. After turning on IPS, administrators notice that throughput over an IPsec SD-WAN tunnel drops significantly. What is the primary reason for this throughput reduction, and how can it be mitigated?

Accepted Answer

IPS inspection requires intensive CPU processing for packet payload analysis, which can be optimized by using flow-based inspection mode and ensuring hardware offloading is active where supported. IPS inspection is CPU-intensive because it analyzes packet payloads against signature databases, which reduces throughput on IPsec tunnels. Mitigation includes using flow-based inspection (which is less resource-intensive than proxy-based) and ensuring hardware offloading (NPU/CP) is active where supported, so encrypted traffic can be accelerated.

Answer

IPS requires proxy-based inspection, which permanently disables IPsec hardware acceleration

Answer

IPS blocks all IPsec AH/ESP headers, forcing fallback to unencrypted GRE tunnels

Answer

The IPS database size exceeds the IPsec Phase 2 buffer limit

Question 4

An administrator wants to view the active SD-WAN rule hit counts and verify which traffic is matching a specific SD-WAN rule in FortiOS. Which command should be used?

Accepted Answer

diagnose sys sdwan service. The command `diagnose sys sdwan service` is the correct choice because it displays the SD-WAN service table, which includes each rule's hit count and the list of matching traffic flows. This command provides real-time statistics on which sessions are being steered by specific SD-WAN rules, allowing administrators to verify rule effectiveness. It is the primary diagnostic tool for SD-WAN rule monitoring in FortiOS.

Answer

show system sdwan

Answer

execute router clear sdwan cache

Answer

get firewall policy statistics

Question 5

You are setting up an SD-WAN configuration via FortiManager. Which object type is used to group multiple WAN interfaces for SD-WAN member assignment?

Accepted Answer

SD-WAN Zone. In FortiManager SD-WAN configuration, an SD-WAN Zone is the object type used to group multiple WAN interfaces for SD-WAN member assignment. Zones allow you to logically group interfaces so that SD-WAN rules and performance SLAs can be applied to the group rather than individual interfaces. This is the correct object for organizing WAN members in an SD-WAN deployment managed via FortiManager.

Answer

IP Pool

Answer

Virtual Wire Pair

Answer

Interface Group

Question 6

You are implementing SSL VPN and need to ensure that only compliant corporate laptops can connect. Which feature should you use?

Accepted Answer

Host check. Host check (also called host integrity or endpoint compliance check) is the SSL VPN feature that inspects the connecting endpoint before granting access, verifying that required security software, OS patches, antivirus definitions, and registry keys are present. Only endpoints that pass the defined compliance rules are allowed to establish the tunnel or access protected resources. This directly satisfies the requirement that only compliant corporate laptops can connect.

Answer

SSL VPN portal settings

Answer

Two-factor authentication

Answer

PKI user authentication

Question 7

You are configuring an IPS policy to protect a web server. You notice that traffic is being dropped due to a false positive. Which action is the most efficient way to resolve this while maintaining security?

Accepted Answer

Create an IPS sensor override for the specific signature ID. Creating an IPS sensor override for the specific signature ID allows you to selectively disable or modify the action of only the offending signature, eliminating the false positive while keeping all other IPS protections active. This is the most surgical and efficient approach because it preserves the security posture of the entire sensor profile. FortiGate IPS sensors support per-signature overrides (set status disable, set action pass, or set log-packet enable) without affecting unrelated signatures.

Answer

Change the IPS mode from blocking to monitoring

Answer

Disable the entire IPS sensor profile

Answer

Increase the IPS packet buffer size

Question 8

What is the maximum number of members allowed in a single SD-WAN zone?

Accepted Answer

Depends on the model, but generally limited by system resources.. The maximum number of members in a single SD-WAN zone is not a fixed hard-coded number; it depends on the FortiGate model and is ultimately bounded by available system resources such as memory and CPU. Fortinet does not publish a universal cap like 4 or 8, and different platforms support different scales. Therefore the correct answer is the model/resource-dependent option.

Answer

8

Answer

2

Answer

4

Question 9

Which THREE aspects of the FortiGate system are affected by changing the global 'set vdom-mode' to 'multi-vdom'?

Accepted Answer

CLI command hierarchy. Changing the global 'set vdom-mode' to 'multi-vdom' alters the CLI command hierarchy (A), because configuration commands become nested under 'config vdom' and you must enter a VDOM with 'config vdom / edit <name>' before configuring most objects. It also changes management of system resources (C), since interfaces, routing tables, firewall objects, and administrators can be partitioned and assigned per-VDOM, enabling independent resource and policy administration. It additionally changes how firewall policies are applied (E), because policies are defined and processed within each VDOM rather than globally, so traffic matching and policy lookup occur in the context of the VDOM that owns the ingress interface. The HA cluster size (B) is not affected by VDOM mode, as HA membership and cluster limits are independent of VDOM configuration. The physical port order (D) is also unaffected, since interface naming and hardware port numbering remain the same regardless of VDOM mode.

Answer

The HA cluster size

Answer

The physical port order

Question 10

Which feature in FortiManager allows you to monitor SD-WAN performance across all managed FortiGates?

Accepted Answer

Dashboard > SD-WAN Monitor. FortiManager's Dashboard includes an SD-WAN Monitor widget that aggregates SD-WAN performance data — link health, SLA status, jitter, latency, and packet loss — across all managed FortiGates in the ADOM. This gives administrators a single pane of glass to spot degraded links or failed SLAs fleet-wide. It pulls from the same health-check data the FortiGates generate for their SD-WAN rules.

Answer

Device Manager

Answer

Log View

Answer

Policy & Objects