FORTINET-NSE7-SPECIALTY Multiple Select — 10 Questions

Question 1

Which THREE types of traffic are typically NOT offloaded by the NP6 processor?

Accepted Answer

Traffic requiring proxy-based inspection. Options B, C, and D are correct because the NP6 network processor in FortiGate appliances only offloads traffic it can fully parse and accelerate at the hardware level: proxy-based inspection (B) requires the full TCP/IP stack and application-layer processing in the CPU, so it cannot be offloaded; encrypted traffic before decryption (C) cannot be inspected or accelerated by the NP6 because the payload is opaque until the CPU/SSL engine decrypts it; and traffic using unsupported protocols (D) is not recognized by the NP6's fast-path parser, so it is punted to the CPU. By contrast, simple ICMP packets (A) and standard UDP traffic (E) are common, well-formed flows that the NP6 can parse and offload to its fast path, so they are not among the traffic types typically excluded from NP6 offloading.

Answer

Simple ICMP packets

Answer

Standard UDP traffic

Question 2

Which THREE factors can affect the 'Performance SLA' logic in an SD-WAN template?

Accepted Answer

Packet loss threshold. The Performance SLA logic in an SD-WAN template is driven by the SLA criteria defined for each member link, and those criteria are the three measured metrics: packet loss threshold (A), jitter threshold (C), and latency threshold (E). Each of these thresholds is configured inside the Performance SLA object (e.g., set packet-loss-threshold, set jitter-threshold, set latency-threshold) and determines whether a link is considered within or out of SLA, which in turn influences SD-WAN rule selection and failover. Packet loss (A) is correct because exceeding the configured loss percentage marks the link as violating the SLA. Jitter (C) is correct because exceeding the configured jitter value in milliseconds marks the link as violating the SLA. Latency (E) is correct because exceeding the configured latency value in milliseconds marks the link as violating the SLA. The FortiGate firmware version (B) does not define SLA thresholds, and the number of active VPN tunnels (D) is a topology/state condition, not a Performance SLA metric, so neither belongs here.

Answer

The firmware version of the FortiGate

Answer

The number of active VPN tunnels

Question 3

Which TWO of the following can be used to optimize IPsec VPN performance?

Accepted Answer

Ensure the configuration uses AES-NI supported ciphers. Option C is correct because selecting AES-NI supported ciphers (e.g., AES-GCM or AES-CBC with SHA-2) allows the CPU to offload symmetric encryption to dedicated AES-NI instruction sets, dramatically increasing IPsec throughput and reducing CPU utilization compared to non-accelerated ciphers. Option D is correct because hardware acceleration via ASIC offloading moves IPsec encryption, hashing, and encapsulation processing from the general-purpose CPU to dedicated crypto hardware, which increases VPN throughput and lowers latency under heavy tunnel loads. Option A is not ideal because extending Phase 1 (IKE SA) lifetime to 24 hours reduces rekey frequency but does not optimize data-plane throughput and can weaken forward secrecy; it is not a recognized performance optimization. Option B is wrong because DES is a weak, deprecated cipher and is not faster in any meaningful way on modern hardware that supports AES-NI. Option E is wrong because disabling NAT-Traversal does not improve performance and breaks IPsec connectivity through NAT devices, which is required in most real-world deployments.

Answer

Increase the Phase 1 lifetime to 24 hours

Answer

Use DES encryption for speed

Answer

Disable NAT-Traversal

Question 4

Which THREE tasks are required to successfully deploy SD-WAN via FortiManager?

Accepted Answer

Installing the configuration to the devices. Option B is correct because deploying SD-WAN through FortiManager requires first creating an SD-WAN template (via the SD-WAN Manager/template wizard) that defines the SD-WAN members, zones, and related settings to be pushed to the FortiGates. Option E is correct because the created SD-WAN template must be assigned to the target managed FortiGates so FortiManager knows which devices should receive the SD-WAN configuration. Option A is correct because after the template is created and assigned, the configuration must be installed to the devices so the SD-WAN settings are actually pushed and activated on the FortiGates. Option C is not required, since a hard factory reset is not a prerequisite for SD-WAN deployment via FortiManager and would unnecessarily wipe the device. Option D is also not required, as existing firewall policies do not need to be deleted; SD-WAN can be deployed alongside or integrated with existing policies.

Answer

Performing a hard factory reset on the FortiGate

Answer

Deleting all existing firewall policies

Question 5

Which TWO actions can be performed on a Revision History item in FortiManager?

Accepted Answer

Compare with current version. In FortiManager, a Revision History item represents a saved configuration snapshot of an ADOM or policy package, and option A (Compare with current version) is correct because FortiManager provides a diff view that shows the differences between the selected revision and the current running configuration. Option B (Restore to a previous state) is also correct because you can revert the ADOM or policy package back to that saved revision, effectively rolling back configuration changes. Option C (Delete the entire ADOM) is wrong because deleting an ADOM is an ADOM-level administrative action, not an operation available on an individual revision history entry. Option D (Export the revision to an external cloud) is wrong because FortiManager does not offer a cloud export function for revision items; revisions are stored locally in the FortiManager database. Option E (Modify the version permanently) is wrong because revisions are immutable snapshots — you cannot edit a saved revision in place, only compare, restore, or delete it.

Answer

Delete the entire ADOM

Answer

Export the revision to an external cloud

Answer

Modify the version permanently

Question 6

Which TWO configuration changes require a push from FortiManager to the FortiGate?

Accepted Answer

Changes to an SD-WAN template. Options B and C are correct because they are FortiManager-managed objects that must be installed/pushed to the FortiGate to take effect: an SD-WAN template (B) is a central VPN/SD-WAN configuration object in FortiManager that is assigned to a managed device and requires a push (install) to apply the template settings, and a firewall policy package (C) is the core policy configuration managed in FortiManager that must be installed to the FortiGate for the policies to become active. In contrast, changes made directly on the FortiGate local GUI such as log settings (A) and adding a local user to the FortiGate local database (D) are local device changes that do not require a FortiManager push, and changing the FortiManager admin password (E) is a FortiManager administrative setting that has no relation to pushing configuration to a FortiGate.

Answer

Changes to the log settings on the FortiGate local GUI

Answer

Adding a new user to the FortiGate local database

Answer

Changing the FortiManager admin password

Question 7

When configuring an IPsec tunnel using IKEv2, which THREE parameters are commonly negotiated during Phase 1?

Accepted Answer

Encryption algorithm (e.g., AES-256). During IKEv2 Phase 1 (IKE_SA_INIT and IKE_AUTH), the peers negotiate the encryption algorithm such as AES-256 (option A), which protects the IKE SA itself, making it a core Phase 1 parameter. The authentication method, such as PSK or RSA signatures (option B), is also negotiated and validated in Phase 1 to authenticate the peers and establish trust. The Diffie-Hellman group (option E) is likewise negotiated in Phase 1 to perform the key exchange and derive shared secret keys for the IKE SA. TCP port selection (option C) is not negotiated in Phase 1 because IKE uses UDP ports 500 and 4500, not TCP. Firewall policy ID (option D) is a local configuration construct and is not an IKEv2 Phase 1 negotiation parameter.

Answer

TCP port selection

Answer

Firewall policy ID

Question 8

Which TWO of the following can be used as a 'Source' in an SD-WAN rule?

Accepted Answer

Source IP address object.. In an SD-WAN rule, the 'Source' field identifies the traffic origin, and a source IP address object (Option A) is a valid match criterion because SD-WAN rules commonly match on IP address objects (host, subnet, or address group) to steer traffic. A user group (Option E) is also a valid Source match, since SD-WAN rules can classify traffic by user identity/group (typically resolved via FSSO or LDAP integration) so that different users get different path selection. SLA target name (Option B) is not a source; it is a performance/link-quality condition used in the rule's SLA/target definition to select the outgoing link. Interface MAC address (Option C) is a Layer-2 attribute not used as an SD-WAN rule Source match. Firewall policy ID (Option D) is a policy reference, not a traffic source identifier, so it cannot serve as the Source in an SD-WAN rule.

Answer

SLA target name.

Answer

Interface MAC address.

Answer

Firewall policy ID.

Question 9

Which THREE types of traffic are typically inspected by an IPS policy?

Accepted Answer

HTTP/HTTPS traffic. An IPS policy typically inspects application-layer protocols that carry user data and are common attack vectors, so HTTP/HTTPS traffic (A) is correct because the IPS performs deep packet inspection on web requests/responses to block exploits like SQL injection and cross-site scripting. SMTP traffic (B) is correct because mail transfer sessions are inspected for malicious attachments, spam relays, and SMTP command exploits. FTP traffic (D) is correct because FTP control and data channels are inspected for credential theft, directory traversal, and unauthorized file transfers. SNMP monitoring traffic (C) is not typically inspected by an IPS policy since it is management-plane traffic usually handled by monitoring systems rather than deep content inspection. ICMP echo requests (E) are network-layer diagnostic traffic, not application-layer content that an IPS policy inspects for threats.

Answer

SNMP monitoring traffic

Answer

ICMP echo requests

Question 10

Which TWO of the following are benefits of using the FortiGate flow-based inspection mode?

Accepted Answer

It uses fewer system resources than proxy-based inspection. Flow-based inspection is beneficial because it uses fewer system resources than proxy-based inspection (B): it scans packets as they stream through the FortiGate without buffering entire files or sessions, so it consumes less CPU and memory. It also provides higher throughput performance (C), since it avoids the store-and-forward buffering and full-session reassembly that proxy-based inspection performs, allowing traffic to pass with lower latency and greater overall speed. The unmarked options do not belong: deep content inspection for all protocols (A) and more granular application control (E) are strengths associated with proxy-based inspection, which fully buffers and reconstructs content, while manual buffer allocation (D) is not a flow-based benefit because flow-based inspection does not require the administrator to manually allocate buffers.

Answer

It supports deep content inspection for all protocols

Answer

It requires manual buffer allocation

Answer

It offers more granular application control