FORTINET-NSE7-SPECIALTY Timed Practice Test 2 — 10 Questions

Question 1

A network administrator is configuring an HA cluster with two FortiGates in Active-Passive mode. Which parameter must be identical on both devices to ensure a successful cluster formation?

Accepted Answer

HA Group ID. In a FortiGate HA cluster, the HA Group ID (also called group-id) must be identical on all devices for them to form a cluster. The group ID is used to distinguish clusters on the same network and ensures that only devices with the same group ID can join the same cluster. Without a matching group ID, the devices will not form an HA cluster even if other settings match.

Answer

Device Hostname

Answer

Serial Number

Answer

Priority value

Question 2

You have a large SD-WAN deployment. Why would you use a 'Centralized Policy' in FortiManager instead of local policies?

Accepted Answer

To enforce global security and traffic routing policies consistently across multiple sites. A Centralized Policy in FortiManager (typically via Global Policy or ADOM-level shared policy packages) enforces consistent security and SD-WAN routing rules across many sites. It ensures that all managed FortiGates receive the same baseline policy, reducing configuration drift and administrative overhead. This is essential for large SD-WAN deployments where uniform enforcement is required.

Answer

To eliminate the need for logs

Answer

To reduce the CPU load on the FortiGate

Answer

To allow local admins to override global policies

Question 3

Which method is the most secure for managing FortiGate devices remotely?

Accepted Answer

HTTPS with restricted access via Trusted Hosts. HTTPS with restricted access via Trusted Hosts is the most secure method because HTTPS encrypts the entire management session using TLS, protecting credentials and configuration data from eavesdropping. Restricting administrative access to specific Trusted Hosts (defined per admin account or per interface) adds a network-layer allowlist so only known source IPs/subnets can even attempt to authenticate, dramatically shrinking the attack surface. Together, encryption plus source restriction satisfies both confidentiality and access-control requirements for remote FortiGate management.

Answer

HTTP with password authentication

Answer

Telnet

Answer

SNMPv1

Question 4

You have an SD-WAN rule with 'Priority' strategy. What happens if the highest priority member fails its SLA?

Accepted Answer

Traffic fails over to the member with the next highest priority value.. With the 'Priority' strategy in an SD-WAN rule, members are ranked by their configured priority value, and the FortiGate actively uses the highest-priority member that meets its SLA. When that member fails its SLA health check, the rule automatically fails over to the next-highest-priority member that is still within SLA, preserving connectivity. This is the defining behavior of the Priority strategy — strict ordered failover rather than load distribution.

Answer

Traffic is dropped.

Answer

The FortiGate enters an error state.

Answer

Traffic is load balanced across all remaining members.

Question 5

You are configuring an IPsec VPN tunnel between two FortiGates. Phase 2 fails to come up. What is the most likely cause?

Accepted Answer

Mismatched Phase 2 selectors. Phase 2 (Quick Mode) failures in IPsec VPNs are most commonly caused by mismatched Phase 2 selectors — the local and remote subnet definitions (proxy IDs) must mirror each other exactly. If the source/destination subnets do not match on both peers, the Phase 2 SA will not establish.

Answer

Incorrect IKE version

Answer

Expired certificate

Answer

Mismatched pre-shared key

Question 6

Which TWO of the following can be used to optimize IPsec VPN performance?

Accepted Answer

Ensure the configuration uses AES-NI supported ciphers. Option C is correct because selecting AES-NI supported ciphers (e.g., AES-GCM or AES-CBC with SHA-2) allows the CPU to offload symmetric encryption to dedicated AES-NI instruction sets, dramatically increasing IPsec throughput and reducing CPU utilization compared to non-accelerated ciphers. Option D is correct because hardware acceleration via ASIC offloading moves IPsec encryption, hashing, and encapsulation processing from the general-purpose CPU to dedicated crypto hardware, which increases VPN throughput and lowers latency under heavy tunnel loads. Option A is not ideal because extending Phase 1 (IKE SA) lifetime to 24 hours reduces rekey frequency but does not optimize data-plane throughput and can weaken forward secrecy; it is not a recognized performance optimization. Option B is wrong because DES is a weak, deprecated cipher and is not faster in any meaningful way on modern hardware that supports AES-NI. Option E is wrong because disabling NAT-Traversal does not improve performance and breaks IPsec connectivity through NAT devices, which is required in most real-world deployments.

Answer

Increase the Phase 1 lifetime to 24 hours

Answer

Use DES encryption for speed

Answer

Disable NAT-Traversal

Question 7

An administrator wants to apply a Web Filtering security profile to traffic that is being dynamically steered via an SD-WAN rule. Where must this security profile be enforced in FortiOS?

Accepted Answer

Inside the firewall policy that matches the traffic being steered by the SD-WAN rule. In FortiOS, SD-WAN rules only control path selection (which outgoing interface to use) and do not themselves apply security profiles. Security profiles such as Web Filtering must be enforced in the firewall policy that matches the traffic, because the firewall policy is where UTM/security inspection is applied after the SD-WAN rule has chosen the egress path. Therefore, the Web Filtering profile must be attached to the firewall policy that handles the steered traffic.

Answer

Directly inside the SD-WAN rule configuration under the advanced settings tab

Answer

Globally under the system settings as an SD-WAN overlay inspection profile

Answer

Within the IPsec tunnel phase 2 security association settings

Question 8

Which parameter, when modified in a policy, causes a session flush for all active connections hitting that policy?

Accepted Answer

Action (Accept to Deny). Changing the Action of a policy from Accept to Deny alters the fundamental handling of traffic that matches the policy. FortiOS must immediately tear down existing sessions that were permitted under the previous Accept action, because they are no longer authorized. This forces all active connections hitting that policy to be flushed and re-evaluated against the new Deny action.

Answer

Schedule

Answer

Comments field

Answer

Policy Name

Question 9

Which THREE tasks are required to successfully deploy SD-WAN via FortiManager?

Accepted Answer

Installing the configuration to the devices. Option B is correct because deploying SD-WAN through FortiManager requires first creating an SD-WAN template (via the SD-WAN Manager/template wizard) that defines the SD-WAN members, zones, and related settings to be pushed to the FortiGates. Option E is correct because the created SD-WAN template must be assigned to the target managed FortiGates so FortiManager knows which devices should receive the SD-WAN configuration. Option A is correct because after the template is created and assigned, the configuration must be installed to the devices so the SD-WAN settings are actually pushed and activated on the FortiGates. Option C is not required, since a hard factory reset is not a prerequisite for SD-WAN deployment via FortiManager and would unnecessarily wipe the device. Option D is also not required, as existing firewall policies do not need to be deleted; SD-WAN can be deployed alongside or integrated with existing policies.

Answer

Performing a hard factory reset on the FortiGate

Answer

Deleting all existing firewall policies

Question 10

An administrator needs to provide access to FortiManager for a junior team member who should only be able to view logs and reports. Which feature is used to define this access?

Accepted Answer

Administrator Profiles. Administrator Profiles in FortiManager define granular permissions for administrative accounts, including which ADOMs, policy packages, and features (logs, reports, system settings) a user can access. To give a junior team member read-only access to logs and reports, the administrator creates a profile with only those permissions and assigns it to the user account. This is the standard RBAC mechanism in FortiManager.

Answer

Access Control Lists (ACLs)

Answer

ADOM Assignment

Answer

User Groups