FORTINET-NSE7-SPECIALTY Hard Questions — 25 Difficult Questions

Question 1

An enterprise network implements BGP over ADVPN. Spoke units advertise their local subnets to the hub via BGP. To prevent spokes from learning each other's subnets directly through the hub via regular BGP route propagation before an ADVPN shortcut is established (forcing them to route through the hub unnecessarily), or conversely, to optimize route distribution, what BGP feature is typically configured on the hub?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

BGP Route Reflection configured on the hub with spoke routers set as clients. In a hub-and-spoke ADVPN topology, spokes peer with the hub but not with each other. BGP route reflection on the hub allows the hub to reflect routes learned from one spoke to other spokes without requiring a full iBGP mesh, which is the standard design for distributing spoke subnets while controlling propagation. This lets the hub act as the route reflector and spokes as clients, so shortcut establishment can be triggered by traffic while route distribution remains centralized and manageable.

Answer

BGP Multipath relaxing with maximum-paths set to 32

Answer

Static default route redistribution with aggregate-address suppression

Answer

BGP Confederation with each spoke acting as a separate autonomous system

Question 2

Which THREE types of traffic are typically NOT offloaded by the NP6 processor?

Accepted Answer

Traffic requiring proxy-based inspection. Options B, C, and D are correct because the NP6 network processor in FortiGate appliances only offloads traffic it can fully parse and accelerate at the hardware level: proxy-based inspection (B) requires the full TCP/IP stack and application-layer processing in the CPU, so it cannot be offloaded; encrypted traffic before decryption (C) cannot be inspected or accelerated by the NP6 because the payload is opaque until the CPU/SSL engine decrypts it; and traffic using unsupported protocols (D) is not recognized by the NP6's fast-path parser, so it is punted to the CPU. By contrast, simple ICMP packets (A) and standard UDP traffic (E) are common, well-formed flows that the NP6 can parse and offload to its fast path, so they are not among the traffic types typically excluded from NP6 offloading.

Answer

Simple ICMP packets

Answer

Standard UDP traffic

Question 3

Which THREE factors can affect the 'Performance SLA' logic in an SD-WAN template?

Accepted Answer

Packet loss threshold. The Performance SLA logic in an SD-WAN template is driven by the SLA criteria defined for each member link, and those criteria are the three measured metrics: packet loss threshold (A), jitter threshold (C), and latency threshold (E). Each of these thresholds is configured inside the Performance SLA object (e.g., set packet-loss-threshold, set jitter-threshold, set latency-threshold) and determines whether a link is considered within or out of SLA, which in turn influences SD-WAN rule selection and failover. Packet loss (A) is correct because exceeding the configured loss percentage marks the link as violating the SLA. Jitter (C) is correct because exceeding the configured jitter value in milliseconds marks the link as violating the SLA. Latency (E) is correct because exceeding the configured latency value in milliseconds marks the link as violating the SLA. The FortiGate firmware version (B) does not define SLA thresholds, and the number of active VPN tunnels (D) is a topology/state condition, not a Performance SLA metric, so neither belongs here.

Answer

The firmware version of the FortiGate

Answer

The number of active VPN tunnels

Question 4

You have a large SD-WAN deployment. Why would you use a 'Centralized Policy' in FortiManager instead of local policies?

Accepted Answer

To enforce global security and traffic routing policies consistently across multiple sites. A Centralized Policy in FortiManager (typically via Global Policy or ADOM-level shared policy packages) enforces consistent security and SD-WAN routing rules across many sites. It ensures that all managed FortiGates receive the same baseline policy, reducing configuration drift and administrative overhead. This is essential for large SD-WAN deployments where uniform enforcement is required.

Answer

To eliminate the need for logs

Answer

To reduce the CPU load on the FortiGate

Answer

To allow local admins to override global policies

Question 5

You have an SD-WAN rule with 'Priority' strategy. What happens if the highest priority member fails its SLA?

Accepted Answer

Traffic fails over to the member with the next highest priority value.. With the 'Priority' strategy in an SD-WAN rule, members are ranked by their configured priority value, and the FortiGate actively uses the highest-priority member that meets its SLA. When that member fails its SLA health check, the rule automatically fails over to the next-highest-priority member that is still within SLA, preserving connectivity. This is the defining behavior of the Priority strategy — strict ordered failover rather than load distribution.

Answer

Traffic is dropped.

Answer

The FortiGate enters an error state.

Answer

Traffic is load balanced across all remaining members.

Question 6

Which feature allows an administrator to offload SSL inspection to the hardware?

Accepted Answer

CP offloading. CP offloading refers to Content Processor offload, where the FortiGate's CP (Content Processor) ASIC handles SSL/TLS inspection tasks such as bulk encryption/decryption, freeing the main CPU. This is the feature that accelerates SSL inspection by moving cryptographic operations to dedicated hardware. NP6 offloading handles network-layer fast-path forwarding, not SSL inspection, and flow-based inspection is a mode, not an offload mechanism.

Answer

Flow-based inspection

Answer

IPS engine offloading

Answer

NP6 offloading

Question 7

Which parameter, when modified in a policy, causes a session flush for all active connections hitting that policy?

Accepted Answer

Action (Accept to Deny). Changing the Action of a policy from Accept to Deny alters the fundamental handling of traffic that matches the policy. FortiOS must immediately tear down existing sessions that were permitted under the previous Accept action, because they are no longer authorized. This forces all active connections hitting that policy to be flushed and re-evaluated against the new Deny action.

Answer

Schedule

Answer

Comments field

Answer

Policy Name

Question 8

Which THREE tasks are required to successfully deploy SD-WAN via FortiManager?

Accepted Answer

Installing the configuration to the devices. Option B is correct because deploying SD-WAN through FortiManager requires first creating an SD-WAN template (via the SD-WAN Manager/template wizard) that defines the SD-WAN members, zones, and related settings to be pushed to the FortiGates. Option E is correct because the created SD-WAN template must be assigned to the target managed FortiGates so FortiManager knows which devices should receive the SD-WAN configuration. Option A is correct because after the template is created and assigned, the configuration must be installed to the devices so the SD-WAN settings are actually pushed and activated on the FortiGates. Option C is not required, since a hard factory reset is not a prerequisite for SD-WAN deployment via FortiManager and would unnecessarily wipe the device. Option D is also not required, as existing firewall policies do not need to be deleted; SD-WAN can be deployed alongside or integrated with existing policies.

Answer

Performing a hard factory reset on the FortiGate

Answer

Deleting all existing firewall policies

Question 9

An administrator needs to provide access to FortiManager for a junior team member who should only be able to view logs and reports. Which feature is used to define this access?

Accepted Answer

Administrator Profiles. Administrator Profiles in FortiManager define granular permissions for administrative accounts, including which ADOMs, policy packages, and features (logs, reports, system settings) a user can access. To give a junior team member read-only access to logs and reports, the administrator creates a profile with only those permissions and assigns it to the user account. This is the standard RBAC mechanism in FortiManager.

Answer

Access Control Lists (ACLs)

Answer

ADOM Assignment

Answer

User Groups

Question 10

An administrator is troubleshooting an SD-WAN deployment where traffic matching an SD-WAN rule with a destination service object (e.g., HTTPS) is not being steered according to the SLA priority. Instead, it is always taking the default static route member. Upon checking the firewall policies, what is the most common reason why an SD-WAN rule fails to process application or service-based traffic matching?

Accepted Answer

The SD-WAN rules are evaluated sequentially from top to bottom; an earlier broad SD-WAN rule with matching source/destination IP addresses is intercepting the traffic before the service-specific rule is reached. SD-WAN rules are evaluated top-down in the order they appear in the rule list, and the first matching rule wins. If an earlier rule matches on broad source/destination IP criteria, it intercepts the traffic before the service-specific rule (e.g., HTTPS) is ever evaluated, so the service-based steering never applies. This is the most common cause of 'my SD-WAN rule isn't working' in FortiGate deployments.

Answer

IPsec VPN phase 2 selectors must be set to 0.0.0.0/0 for service-based rules to evaluate

Answer

The firewall policy containing the traffic has SSL inspection disabled, preventing service-based identification

Answer

The FortiGate kernel requires hardware acceleration (NP7) to be disabled for service-based SD-WAN rules to function

Question 11

Which THREE features are specific to the FortiManager 'Enterprise Firewall' management workflow?

Accepted Answer

Object database management. In the FortiManager Enterprise Firewall workflow, object database management (A) is correct because FortiManager maintains a centralized, normalized object database (addresses, services, etc.) that is shared across managed FortiGate devices, enabling consistent object reuse and conflict detection. Revision control (B) is correct because FortiManager stores configuration revisions and policy package versions, allowing administrators to compare, revert, and audit changes made to firewall policies. Centralized policy management (E) is correct because the Enterprise Firewall workflow is built around creating policy packages and assigning them to managed devices or ADOMs, so policies are authored once and deployed centrally. Traffic shaping on routers (C) is not specific to this workflow—it is a routing/QoS function configured on devices, not a FortiManager Enterprise Firewall management feature. Web filter database updates (D) relate to FortiGuard security service updates and content filtering, which are separate from the Enterprise Firewall policy-management workflow.

Answer

Traffic shaping on routers

Answer

Web filter database updates

Question 12

You are troubleshooting a high CPU issue on a FortiGate. Which utility should you use to identify which process is consuming the most resources?

Accepted Answer

diagnose sys top. The 'get system performance status' command is the primary tool to see process-level CPU usage.

Answer

get system hardware status

Answer

diagnose sniffer packet

Answer

get router info memory

Question 13

An administrator notices that hardware acceleration (NP6) is failing to offload traffic for a specific policy. Which command is best used to verify if hardware offloading is actually occurring for a specific session?

Accepted Answer

diagnose sys session list. The command 'diagnose sys session list' displays the session table, including flags that indicate whether a session is offloaded to NP6 hardware. By inspecting the session entry, you can see if the 'offload' flag is set, confirming hardware acceleration for that specific session.

Answer

get hardware npu np6

Answer

get system performance status

Answer

diagnose npu np6 status

Question 14

When using 'set session-ttl' globally, which sessions are affected?

Accepted Answer

Only new sessions. Global session TTL settings apply to all sessions that do not have a specific override or a policy-based setting.

Answer

All sessions

Answer

Only TCP sessions

Answer

Only existing sessions

Question 15

An enterprise deploys BGP over SD-WAN with multiple MPLS and broadband connections. A route-map is applied to incoming BGP updates on the FortiGate to set a specific weight for routes learned over the MPLS interface. Why is the 'weight' attribute particularly effective in this FortiOS SD-WAN and BGP integration scenario?

Accepted Answer

Weight is evaluated first in the BGP best-path selection algorithm on FortiOS, allowing local preference override without altering global AS path attributes. In FortiOS BGP, the weight attribute is a Cisco-style, locally significant value evaluated first in the best-path selection algorithm — before local preference, AS path, and other attributes. Setting a higher weight on routes learned over the MPLS interface ensures those routes are preferred without modifying globally propagated attributes like AS path or local preference, which keeps the change local to the FortiGate.

Answer

Weight replaces the need for SD-WAN SLA rules by performing layer 7 packet inspection

Answer

Weight automatically adjusts the SD-WAN health check probe frequency based on route stability

Answer

Weight is propagated to all iBGP peers, ensuring cluster-wide path synchronization

Question 16

An administrator needs to perform a firmware upgrade on 100 FortiGates. Which feature in FortiManager allows this to be done securely with a rollback option?

Accepted Answer

Firmware Management in Device Manager. FortiManager's Firmware Management feature (found under Device Manager) allows administrators to upload firmware images, schedule upgrades, and perform bulk upgrades across multiple FortiGates. It includes a rollback option that can revert devices to a previous firmware version if the upgrade fails or causes issues. This is the secure, centralized method for upgrading many devices.

Answer

Automated patch management

Answer

Manual script pushing

Answer

Global Policy upgrade task

Question 17

A FortiGate is performing OSPF routing. You want to redistribute connected routes into OSPF, but only for a specific subnet. How can this be achieved?

Accepted Answer

Use a route map in the OSPF redistribute configuration. On FortiGate, redistribution into OSPF is controlled with a route map applied under 'config router ospf' > 'config redistribute connected'. The route map can match a specific prefix (via an IP prefix list or access list) and permit only that subnet, so only the desired connected route is redistributed.

Answer

Configure a distribute-list in the OSPF process

Answer

Use an IP prefix list under the OSPF area command

Answer

Use an access list under the interface configuration

Question 18

When configuring an IPsec tunnel using IKEv2, which THREE parameters are commonly negotiated during Phase 1?

Accepted Answer

Encryption algorithm (e.g., AES-256). During IKEv2 Phase 1 (IKE_SA_INIT and IKE_AUTH), the peers negotiate the encryption algorithm such as AES-256 (option A), which protects the IKE SA itself, making it a core Phase 1 parameter. The authentication method, such as PSK or RSA signatures (option B), is also negotiated and validated in Phase 1 to authenticate the peers and establish trust. The Diffie-Hellman group (option E) is likewise negotiated in Phase 1 to perform the key exchange and derive shared secret keys for the IKE SA. TCP port selection (option C) is not negotiated in Phase 1 because IKE uses UDP ports 500 and 4500, not TCP. Firewall policy ID (option D) is a local configuration construct and is not an IKEv2 Phase 1 negotiation parameter.

Answer

TCP port selection

Answer

Firewall policy ID

Question 19

Which TWO of the following can be used as a 'Source' in an SD-WAN rule?

Accepted Answer

Source IP address object.. In an SD-WAN rule, the 'Source' field identifies the traffic origin, and a source IP address object (Option A) is a valid match criterion because SD-WAN rules commonly match on IP address objects (host, subnet, or address group) to steer traffic. A user group (Option E) is also a valid Source match, since SD-WAN rules can classify traffic by user identity/group (typically resolved via FSSO or LDAP integration) so that different users get different path selection. SLA target name (Option B) is not a source; it is a performance/link-quality condition used in the rule's SLA/target definition to select the outgoing link. Interface MAC address (Option C) is a Layer-2 attribute not used as an SD-WAN rule Source match. Firewall policy ID (Option D) is a policy reference, not a traffic source identifier, so it cannot serve as the Source in an SD-WAN rule.

Answer

SLA target name.

Answer

Interface MAC address.

Answer

Firewall policy ID.

Question 20

What is the purpose of the 'Gateway' override in an SD-WAN member configuration?

Accepted Answer

To specify a manual gateway for the SD-WAN member.. The 'Gateway' override in an SD-WAN member configuration lets you manually specify the next-hop gateway IP address for that member interface. This is needed when the interface is on a subnet where the default gateway cannot be auto-detected, or when you want to force traffic through a specific next-hop (for example, a secondary router). It overrides the automatically learned gateway for that SD-WAN member.

Answer

To force the use of a secondary ISP.

Answer

To bypass the firewall policy.

Answer

To enable load balancing.