FORTINET-NSE7-SPECIALTY Full-Length Exam Simulation

Question 1

What is the purpose of the 'Any' interface in a firewall policy?

Accepted Answer

To match traffic regardless of the ingress or egress interface. In a FortiGate firewall policy, the 'Any' interface is a wildcard that matches traffic regardless of the incoming or outgoing interface. It is used when you want a policy to apply to traffic from any source interface to any destination interface, simplifying rule creation. This is especially useful for policies that should not be tied to a specific interface, such as certain management or deny rules.

Answer

To force traffic through the hardware switch

Answer

To bypass the routing table

Answer

To match traffic only on the WAN port

Question 2

Which configuration mode allows you to define a virtual MAC address for an HA cluster to prevent ARP cache issues on switches?

Accepted Answer

Virtual MAC. In a FortiGate HA cluster, configuring a virtual MAC address ensures that the cluster's interfaces present a consistent MAC address to the network, regardless of which unit is active. This prevents ARP cache issues on switches and routers, as they see the same MAC for the cluster IP even after a failover. The virtual MAC is defined under the HA configuration and is used by the primary unit to send gratuitous ARP updates.

Answer

DHCP relay

Answer

Static ARP

Answer

Physical MAC

Question 3

In a site-to-site VPN, you need to allow traffic initiated from the remote site. What configuration is essential on the local FortiGate?

Accepted Answer

A firewall policy allowing traffic from the VPN zone to the Internal zone. For a site-to-site VPN, traffic initiated from the remote site must be allowed by a firewall policy on the local FortiGate. The policy must permit traffic from the VPN zone (the interface/tunnel where the remote site's traffic arrives) to the Internal zone (the local network). Without this policy, the FortiGate's implicit deny drops the traffic, even if the VPN tunnel is up and routes exist.

Answer

An IPSec phase 3 policy

Answer

A static route to the remote subnet

Answer

A NAT rule for the remote subnet

Question 4

You want to automate the onboarding of new FortiGate units. Which FortiManager feature allows you to pre-configure devices before they connect to the network?

Accepted Answer

Provisioning Templates. Provisioning Templates in FortiManager let administrators define a device's full configuration — system settings, interface configs, firewall policies, and more — before the FortiGate ever connects. When the new FortiGate registers with FortiManager (via serial number or pre-shared key), the template is automatically applied, enabling zero-touch onboarding. This is the standard mechanism for pre-configuring devices at scale.

Answer

Scripting

Answer

Device Registration Key

Answer

Policy cloning

Question 5

What is the default behavior for 'override' in FortiGate HA?

Accepted Answer

Disabled. In FortiGate HA, the 'override' setting is disabled by default. When disabled, the primary unit is selected based on the highest priority value, but if a higher-priority unit joins later it will not automatically preempt the current primary. Enabling override allows a unit with a higher priority to take over the primary role when it comes online.

Answer

Depends on the model

Answer

Enabled

Answer

Always enabled

Question 6

What is the purpose of 'dedicated HA' interfaces?

Accepted Answer

To isolate heartbeat traffic. Dedicated HA interfaces are physical ports reserved exclusively for HA heartbeat and synchronization traffic between cluster members. By isolating heartbeat traffic on its own link, the cluster avoids contention with user data and prevents heartbeat packets from being delayed or dropped by heavy production traffic, which could trigger false failovers. This separation is why Fortinet recommends dedicated heartbeat ports in Active-Passive and Active-Active deployments.

Answer

To provide extra management access

Answer

To increase throughput

Answer

To act as a backup WAN port

Question 7

When troubleshooting SD-WAN performance SLA packet loss, an administrator wants to view real-time latency, jitter, and packet loss statistics for individual health check members. Which CLI command should be executed?

Accepted Answer

diagnose sys sdwan health-check. The command 'diagnose sys sdwan health-check' displays real-time health check statistics for each SD-WAN member, including latency, jitter, packet loss, and SLA status. This is the correct CLI tool for troubleshooting performance SLA metrics on individual members.

Answer

get system interface physical

Answer

execute ping-server status

Answer

show system sdwan

Question 8

What does the 'set tcp-rst-timeout' command control?

Accepted Answer

The time to wait after sending a reset. The 'set tcp-rst-timeout' command defines how long the FortiGate keeps a session entry alive after it sends a TCP RST (reset) packet to tear down the connection. This allows the firewall to continue matching any stray packets belonging to that session for the specified duration, preventing them from being treated as new sessions. It is a session-cleanup timer, not a handshake or idle timer.

Answer

The TCP handshake timeout

Answer

The maximum session duration

Answer

The time before an idle session is dropped

Question 9

Which THREE types of traffic are typically NOT offloaded by the NP6 processor?

Accepted Answer

Traffic requiring proxy-based inspection. Options B, C, and D are correct because the NP6 network processor in FortiGate appliances only offloads traffic it can fully parse and accelerate at the hardware level: proxy-based inspection (B) requires the full TCP/IP stack and application-layer processing in the CPU, so it cannot be offloaded; encrypted traffic before decryption (C) cannot be inspected or accelerated by the NP6 because the payload is opaque until the CPU/SSL engine decrypts it; and traffic using unsupported protocols (D) is not recognized by the NP6's fast-path parser, so it is punted to the CPU. By contrast, simple ICMP packets (A) and standard UDP traffic (E) are common, well-formed flows that the NP6 can parse and offload to its fast path, so they are not among the traffic types typically excluded from NP6 offloading.

Answer

Simple ICMP packets

Answer

Standard UDP traffic

Question 10

Which THREE factors can affect the 'Performance SLA' logic in an SD-WAN template?

Accepted Answer

Packet loss threshold. The Performance SLA logic in an SD-WAN template is driven by the SLA criteria defined for each member link, and those criteria are the three measured metrics: packet loss threshold (A), jitter threshold (C), and latency threshold (E). Each of these thresholds is configured inside the Performance SLA object (e.g., set packet-loss-threshold, set jitter-threshold, set latency-threshold) and determines whether a link is considered within or out of SLA, which in turn influences SD-WAN rule selection and failover. Packet loss (A) is correct because exceeding the configured loss percentage marks the link as violating the SLA. Jitter (C) is correct because exceeding the configured jitter value in milliseconds marks the link as violating the SLA. Latency (E) is correct because exceeding the configured latency value in milliseconds marks the link as violating the SLA. The FortiGate firmware version (B) does not define SLA thresholds, and the number of active VPN tunnels (D) is a topology/state condition, not a Performance SLA metric, so neither belongs here.

Answer

The firmware version of the FortiGate

Answer

The number of active VPN tunnels

Question 11

A network administrator is configuring an HA cluster with two FortiGates in Active-Passive mode. Which parameter must be identical on both devices to ensure a successful cluster formation?

Accepted Answer

HA Group ID. In a FortiGate HA cluster, the HA Group ID (also called group-id) must be identical on all devices for them to form a cluster. The group ID is used to distinguish clusters on the same network and ensures that only devices with the same group ID can join the same cluster. Without a matching group ID, the devices will not form an HA cluster even if other settings match.

Answer

Device Hostname

Answer

Serial Number

Answer

Priority value

Question 12

You have a large SD-WAN deployment. Why would you use a 'Centralized Policy' in FortiManager instead of local policies?

Accepted Answer

To enforce global security and traffic routing policies consistently across multiple sites. A Centralized Policy in FortiManager (typically via Global Policy or ADOM-level shared policy packages) enforces consistent security and SD-WAN routing rules across many sites. It ensures that all managed FortiGates receive the same baseline policy, reducing configuration drift and administrative overhead. This is essential for large SD-WAN deployments where uniform enforcement is required.

Answer

To eliminate the need for logs

Answer

To reduce the CPU load on the FortiGate

Answer

To allow local admins to override global policies

Question 13

Which method is the most secure for managing FortiGate devices remotely?

Accepted Answer

HTTPS with restricted access via Trusted Hosts. HTTPS with restricted access via Trusted Hosts is the most secure method because HTTPS encrypts the entire management session using TLS, protecting credentials and configuration data from eavesdropping. Restricting administrative access to specific Trusted Hosts (defined per admin account or per interface) adds a network-layer allowlist so only known source IPs/subnets can even attempt to authenticate, dramatically shrinking the attack surface. Together, encryption plus source restriction satisfies both confidentiality and access-control requirements for remote FortiGate management.

Answer

HTTP with password authentication

Answer

Telnet

Answer

SNMPv1

Question 14

You have an SD-WAN rule with 'Priority' strategy. What happens if the highest priority member fails its SLA?

Accepted Answer

Traffic fails over to the member with the next highest priority value.. With the 'Priority' strategy in an SD-WAN rule, members are ranked by their configured priority value, and the FortiGate actively uses the highest-priority member that meets its SLA. When that member fails its SLA health check, the rule automatically fails over to the next-highest-priority member that is still within SLA, preserving connectivity. This is the defining behavior of the Priority strategy — strict ordered failover rather than load distribution.

Answer

Traffic is dropped.

Answer

The FortiGate enters an error state.

Answer

Traffic is load balanced across all remaining members.

Question 15

You are configuring an IPsec VPN tunnel between two FortiGates. Phase 2 fails to come up. What is the most likely cause?

Accepted Answer

Mismatched Phase 2 selectors. Phase 2 (Quick Mode) failures in IPsec VPNs are most commonly caused by mismatched Phase 2 selectors — the local and remote subnet definitions (proxy IDs) must mirror each other exactly. If the source/destination subnets do not match on both peers, the Phase 2 SA will not establish.

Answer

Incorrect IKE version

Answer

Expired certificate

Answer

Mismatched pre-shared key

Question 16

Which TWO of the following can be used to optimize IPsec VPN performance?

Accepted Answer

Ensure the configuration uses AES-NI supported ciphers. Option C is correct because selecting AES-NI supported ciphers (e.g., AES-GCM or AES-CBC with SHA-2) allows the CPU to offload symmetric encryption to dedicated AES-NI instruction sets, dramatically increasing IPsec throughput and reducing CPU utilization compared to non-accelerated ciphers. Option D is correct because hardware acceleration via ASIC offloading moves IPsec encryption, hashing, and encapsulation processing from the general-purpose CPU to dedicated crypto hardware, which increases VPN throughput and lowers latency under heavy tunnel loads. Option A is not ideal because extending Phase 1 (IKE SA) lifetime to 24 hours reduces rekey frequency but does not optimize data-plane throughput and can weaken forward secrecy; it is not a recognized performance optimization. Option B is wrong because DES is a weak, deprecated cipher and is not faster in any meaningful way on modern hardware that supports AES-NI. Option E is wrong because disabling NAT-Traversal does not improve performance and breaks IPsec connectivity through NAT devices, which is required in most real-world deployments.

Answer

Increase the Phase 1 lifetime to 24 hours

Answer

Use DES encryption for speed

Answer

Disable NAT-Traversal

Question 17

An administrator wants to apply a Web Filtering security profile to traffic that is being dynamically steered via an SD-WAN rule. Where must this security profile be enforced in FortiOS?

Accepted Answer

Inside the firewall policy that matches the traffic being steered by the SD-WAN rule. In FortiOS, SD-WAN rules only control path selection (which outgoing interface to use) and do not themselves apply security profiles. Security profiles such as Web Filtering must be enforced in the firewall policy that matches the traffic, because the firewall policy is where UTM/security inspection is applied after the SD-WAN rule has chosen the egress path. Therefore, the Web Filtering profile must be attached to the firewall policy that handles the steered traffic.

Answer

Directly inside the SD-WAN rule configuration under the advanced settings tab

Answer

Globally under the system settings as an SD-WAN overlay inspection profile

Answer

Within the IPsec tunnel phase 2 security association settings

Question 18

Which parameter, when modified in a policy, causes a session flush for all active connections hitting that policy?

Accepted Answer

Action (Accept to Deny). Changing the Action of a policy from Accept to Deny alters the fundamental handling of traffic that matches the policy. FortiOS must immediately tear down existing sessions that were permitted under the previous Accept action, because they are no longer authorized. This forces all active connections hitting that policy to be flushed and re-evaluated against the new Deny action.

Answer

Schedule

Answer

Comments field

Answer

Policy Name

Question 19

Which THREE tasks are required to successfully deploy SD-WAN via FortiManager?

Accepted Answer

Installing the configuration to the devices. Option B is correct because deploying SD-WAN through FortiManager requires first creating an SD-WAN template (via the SD-WAN Manager/template wizard) that defines the SD-WAN members, zones, and related settings to be pushed to the FortiGates. Option E is correct because the created SD-WAN template must be assigned to the target managed FortiGates so FortiManager knows which devices should receive the SD-WAN configuration. Option A is correct because after the template is created and assigned, the configuration must be installed to the devices so the SD-WAN settings are actually pushed and activated on the FortiGates. Option C is not required, since a hard factory reset is not a prerequisite for SD-WAN deployment via FortiManager and would unnecessarily wipe the device. Option D is also not required, as existing firewall policies do not need to be deleted; SD-WAN can be deployed alongside or integrated with existing policies.

Answer

Performing a hard factory reset on the FortiGate

Answer

Deleting all existing firewall policies

Question 20

An administrator needs to provide access to FortiManager for a junior team member who should only be able to view logs and reports. Which feature is used to define this access?

Accepted Answer

Administrator Profiles. Administrator Profiles in FortiManager define granular permissions for administrative accounts, including which ADOMs, policy packages, and features (logs, reports, system settings) a user can access. To give a junior team member read-only access to logs and reports, the administrator creates a profile with only those permissions and assigns it to the user account. This is the standard RBAC mechanism in FortiManager.

Answer

Access Control Lists (ACLs)

Answer

ADOM Assignment

Answer

User Groups