FORTINET-NSE7-SPECIALTY Practice Questions

Question 1

What is the purpose of the 'Any' interface in a firewall policy?

Accepted Answer

To match traffic regardless of the ingress or egress interface. In a FortiGate firewall policy, the 'Any' interface is a wildcard that matches traffic regardless of the incoming or outgoing interface. It is used when you want a policy to apply to traffic from any source interface to any destination interface, simplifying rule creation. This is especially useful for policies that should not be tied to a specific interface, such as certain management or deny rules.

Answer

To force traffic through the hardware switch

Answer

To bypass the routing table

Answer

To match traffic only on the WAN port

Question 2

Which configuration mode allows you to define a virtual MAC address for an HA cluster to prevent ARP cache issues on switches?

Accepted Answer

Virtual MAC. In a FortiGate HA cluster, configuring a virtual MAC address ensures that the cluster's interfaces present a consistent MAC address to the network, regardless of which unit is active. This prevents ARP cache issues on switches and routers, as they see the same MAC for the cluster IP even after a failover. The virtual MAC is defined under the HA configuration and is used by the primary unit to send gratuitous ARP updates.

Answer

DHCP relay

Answer

Static ARP

Answer

Physical MAC

Question 3

In a site-to-site VPN, you need to allow traffic initiated from the remote site. What configuration is essential on the local FortiGate?

Accepted Answer

A firewall policy allowing traffic from the VPN zone to the Internal zone. For a site-to-site VPN, traffic initiated from the remote site must be allowed by a firewall policy on the local FortiGate. The policy must permit traffic from the VPN zone (the interface/tunnel where the remote site's traffic arrives) to the Internal zone (the local network). Without this policy, the FortiGate's implicit deny drops the traffic, even if the VPN tunnel is up and routes exist.

Answer

An IPSec phase 3 policy

Answer

A static route to the remote subnet

Answer

A NAT rule for the remote subnet

Question 4

You want to automate the onboarding of new FortiGate units. Which FortiManager feature allows you to pre-configure devices before they connect to the network?

Accepted Answer

Provisioning Templates. Provisioning Templates in FortiManager let administrators define a device's full configuration — system settings, interface configs, firewall policies, and more — before the FortiGate ever connects. When the new FortiGate registers with FortiManager (via serial number or pre-shared key), the template is automatically applied, enabling zero-touch onboarding. This is the standard mechanism for pre-configuring devices at scale.

Answer

Scripting

Answer

Device Registration Key

Answer

Policy cloning

Question 5

What is the default behavior for 'override' in FortiGate HA?

Accepted Answer

Disabled. In FortiGate HA, the 'override' setting is disabled by default. When disabled, the primary unit is selected based on the highest priority value, but if a higher-priority unit joins later it will not automatically preempt the current primary. Enabling override allows a unit with a higher priority to take over the primary role when it comes online.

Answer

Depends on the model

Answer

Enabled

Answer

Always enabled

Question 6

What is the purpose of 'dedicated HA' interfaces?

Accepted Answer

To isolate heartbeat traffic. Dedicated HA interfaces are physical ports reserved exclusively for HA heartbeat and synchronization traffic between cluster members. By isolating heartbeat traffic on its own link, the cluster avoids contention with user data and prevents heartbeat packets from being delayed or dropped by heavy production traffic, which could trigger false failovers. This separation is why Fortinet recommends dedicated heartbeat ports in Active-Passive and Active-Active deployments.

Answer

To provide extra management access

Answer

To increase throughput

Answer

To act as a backup WAN port

Question 7

When troubleshooting SD-WAN performance SLA packet loss, an administrator wants to view real-time latency, jitter, and packet loss statistics for individual health check members. Which CLI command should be executed?

Accepted Answer

diagnose sys sdwan health-check. The command 'diagnose sys sdwan health-check' displays real-time health check statistics for each SD-WAN member, including latency, jitter, packet loss, and SLA status. This is the correct CLI tool for troubleshooting performance SLA metrics on individual members.

Answer

get system interface physical

Answer

execute ping-server status

Answer

show system sdwan

Question 8

What does the 'set tcp-rst-timeout' command control?

Accepted Answer

The time to wait after sending a reset. The 'set tcp-rst-timeout' command defines how long the FortiGate keeps a session entry alive after it sends a TCP RST (reset) packet to tear down the connection. This allows the firewall to continue matching any stray packets belonging to that session for the specified duration, preventing them from being treated as new sessions. It is a session-cleanup timer, not a handshake or idle timer.

Answer

The TCP handshake timeout

Answer

The maximum session duration

Answer

The time before an idle session is dropped

Question 9

Which THREE types of traffic are typically NOT offloaded by the NP6 processor?

Accepted Answer

Traffic requiring proxy-based inspection. Options B, C, and D are correct because the NP6 network processor in FortiGate appliances only offloads traffic it can fully parse and accelerate at the hardware level: proxy-based inspection (B) requires the full TCP/IP stack and application-layer processing in the CPU, so it cannot be offloaded; encrypted traffic before decryption (C) cannot be inspected or accelerated by the NP6 because the payload is opaque until the CPU/SSL engine decrypts it; and traffic using unsupported protocols (D) is not recognized by the NP6's fast-path parser, so it is punted to the CPU. By contrast, simple ICMP packets (A) and standard UDP traffic (E) are common, well-formed flows that the NP6 can parse and offload to its fast path, so they are not among the traffic types typically excluded from NP6 offloading.

Answer

Simple ICMP packets

Answer

Standard UDP traffic

Question 10

Which THREE factors can affect the 'Performance SLA' logic in an SD-WAN template?

Accepted Answer

Packet loss threshold. The Performance SLA logic in an SD-WAN template is driven by the SLA criteria defined for each member link, and those criteria are the three measured metrics: packet loss threshold (A), jitter threshold (C), and latency threshold (E). Each of these thresholds is configured inside the Performance SLA object (e.g., set packet-loss-threshold, set jitter-threshold, set latency-threshold) and determines whether a link is considered within or out of SLA, which in turn influences SD-WAN rule selection and failover. Packet loss (A) is correct because exceeding the configured loss percentage marks the link as violating the SLA. Jitter (C) is correct because exceeding the configured jitter value in milliseconds marks the link as violating the SLA. Latency (E) is correct because exceeding the configured latency value in milliseconds marks the link as violating the SLA. The FortiGate firmware version (B) does not define SLA thresholds, and the number of active VPN tunnels (D) is a topology/state condition, not a Performance SLA metric, so neither belongs here.

Answer

The firmware version of the FortiGate

Answer

The number of active VPN tunnels

Question 11

A network administrator is configuring an HA cluster with two FortiGates in Active-Passive mode. Which parameter must be identical on both devices to ensure a successful cluster formation?

Accepted Answer

HA Group ID. In a FortiGate HA cluster, the HA Group ID (also called group-id) must be identical on all devices for them to form a cluster. The group ID is used to distinguish clusters on the same network and ensures that only devices with the same group ID can join the same cluster. Without a matching group ID, the devices will not form an HA cluster even if other settings match.

Answer

Device Hostname

Answer

Serial Number

Answer

Priority value

Question 12

You have a large SD-WAN deployment. Why would you use a 'Centralized Policy' in FortiManager instead of local policies?

Accepted Answer

To enforce global security and traffic routing policies consistently across multiple sites. A Centralized Policy in FortiManager (typically via Global Policy or ADOM-level shared policy packages) enforces consistent security and SD-WAN routing rules across many sites. It ensures that all managed FortiGates receive the same baseline policy, reducing configuration drift and administrative overhead. This is essential for large SD-WAN deployments where uniform enforcement is required.

Answer

To eliminate the need for logs

Answer

To reduce the CPU load on the FortiGate

Answer

To allow local admins to override global policies

Question 13

Which method is the most secure for managing FortiGate devices remotely?

Accepted Answer

HTTPS with restricted access via Trusted Hosts. HTTPS with restricted access via Trusted Hosts is the most secure method because HTTPS encrypts the entire management session using TLS, protecting credentials and configuration data from eavesdropping. Restricting administrative access to specific Trusted Hosts (defined per admin account or per interface) adds a network-layer allowlist so only known source IPs/subnets can even attempt to authenticate, dramatically shrinking the attack surface. Together, encryption plus source restriction satisfies both confidentiality and access-control requirements for remote FortiGate management.

Answer

HTTP with password authentication

Answer

Telnet

Answer

SNMPv1

Question 14

You have an SD-WAN rule with 'Priority' strategy. What happens if the highest priority member fails its SLA?

Accepted Answer

Traffic fails over to the member with the next highest priority value.. With the 'Priority' strategy in an SD-WAN rule, members are ranked by their configured priority value, and the FortiGate actively uses the highest-priority member that meets its SLA. When that member fails its SLA health check, the rule automatically fails over to the next-highest-priority member that is still within SLA, preserving connectivity. This is the defining behavior of the Priority strategy — strict ordered failover rather than load distribution.

Answer

Traffic is dropped.

Answer

The FortiGate enters an error state.

Answer

Traffic is load balanced across all remaining members.

Question 15

You are configuring an IPsec VPN tunnel between two FortiGates. Phase 2 fails to come up. What is the most likely cause?

Accepted Answer

Mismatched Phase 2 selectors. Phase 2 (Quick Mode) failures in IPsec VPNs are most commonly caused by mismatched Phase 2 selectors — the local and remote subnet definitions (proxy IDs) must mirror each other exactly. If the source/destination subnets do not match on both peers, the Phase 2 SA will not establish.

Answer

Incorrect IKE version

Answer

Expired certificate

Answer

Mismatched pre-shared key

Fortinet NSE7 Specialty Modules (SD-WAN and Enterprise Firewall tracks) FORTINET-NSE7-SPECIALTY practice test

Three ways to study

Study FORTINET-NSE7-SPECIALTY by domain

Study FORTINET-NSE7-SPECIALTY by topic

Nse7 SD Wan Security Profiles Routing And Ipsec practice questions

Nse7 Enterprise Firewall System Configuration practice questions

Nse7 Enterprise Firewall Central Management practice questions

Nse7 SD Wan System Configuration And Setup practice questions

Nse7 SD Wan Central Management practice questions

Nse7 Enterprise Firewall Security And VPN practice questions

FORTINET-NSE7-SPECIALTY fundamentals practice questions

FORTINET-NSE7-SPECIALTY scenario practice questions

FORTINET-NSE7-SPECIALTY troubleshooting practice questions

Fortinet NSE7 Specialty Modules (SD-WAN and Enterprise Firewall tracks) (FORTINET-NSE7-SPECIALTY) practice questions