Fortinet NSE7 Specialty Modules (SD-WAN and Enterprise Firewall tracks) (FORTINET-NSE7-SPECIALTY) FORTINET-NSE7-SPECIALTY Questions 76–150 | Page 2/3

MCQeasy

When troubleshooting SD-WAN performance SLA packet loss, an administrator wants to view real-time latency, jitter, and packet loss statistics for individual health check members. Which CLI command should be executed?

A.diagnose sys sdwan health-check

B.get system interface physical

C.execute ping-server status

D.show system sdwan

AnswerA

`diagnose sys sdwan health-check` reports per-member SLA metrics, including latency, jitter and packet loss, for each configured health check. It directly satisfies the stem's requirement for real-time statistics on individual health check members, unlike interface-level or session-level diagnostics that aggregate or omit SLA measurements.

Why this answer

The command 'diagnose sys sdwan health-check' displays real-time health check statistics for each SD-WAN member, including latency, jitter, packet loss, and SLA status. This is the correct CLI tool for troubleshooting performance SLA metrics on individual members.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the difference between configuration commands ('show system sdwan') and diagnostic commands ('diagnose sys sdwan health-check'), causing candidates to pick a show command when real-time performance statistics are required.

How to eliminate wrong answers

Option B is wrong because 'get system interface physical' shows interface physical status (link up/down, speed), not SD-WAN health check performance metrics. Option C is wrong because 'execute ping-server status' is not a valid FortiGate command for SD-WAN health check statistics. Option D is wrong because 'show system sdwan' displays the SD-WAN configuration, not real-time performance SLA statistics like latency, jitter, and packet loss.

Full explanation →

MCQmedium

You notice that an IPsec tunnel is up, but no traffic passes. What is the most common reason related to firewall policy configuration?

A.Missing static route

B.Incorrect IKE ID

C.Phase 1 lifetime expiration

D.Missing firewall policy

AnswerD

An IPsec tunnel can negotiate successfully at IKE and SA level while carrying no user traffic, because phase-two selectors only define what may be encrypted. Without a firewall policy permitting the protected subnets, the FortiGate drops the packets, so the missing policy is the usual cause.

Why this answer

When an IPsec tunnel is up but no traffic passes, the most common firewall policy-related reason is a missing firewall policy that permits traffic through the tunnel. In FortiGate, IPsec tunnels require explicit firewall policies to allow traffic between the tunnel interface and other interfaces; without them, the implicit deny drops all traffic.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the distinction between tunnel status (up/down) and traffic flow, catching candidates who overlook the need for explicit firewall policies even when the tunnel is established.

How to eliminate wrong answers

Option A is wrong because a missing static route would typically prevent the tunnel from coming up or cause routing failures, but the tunnel is already up; however, it could still be a factor, but it is not the most common policy-related reason. Option B is wrong because an incorrect IKE ID would prevent Phase 1 negotiation, so the tunnel would not be up. Option C is wrong because Phase 1 lifetime expiration would cause the tunnel to go down, not stay up without traffic.

Full explanation →

MCQmedium

You are troubleshooting high CPU usage on a FortiGate. Which process would you check to see if the IPS engine is the cause?

A.diag sys top

B.get system status

C.diagnose hardware status

D.show sys resource

AnswerA

'diag sys top' lists running processes with their CPU consumption, letting you identify whether the IPS engine (ipsengine) is consuming excessive CPU. This directly confirms or rules out the IPS engine as the cause of the high utilisation.

Why this answer

The 'diagnose sys top' command displays real-time CPU and memory usage per process on the FortiGate, allowing you to identify if the IPS engine (often shown as 'ipsengine') is consuming excessive CPU. This is the standard tool for process-level CPU troubleshooting.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the correct diagnostic command for process-level CPU analysis, causing candidates to choose general status commands like 'get system status' instead of the process-monitoring 'diagnose sys top'.

How to eliminate wrong answers

Option B is wrong because 'get system status' shows firmware version, serial number, and uptime — not per-process CPU usage. Option C is wrong because 'diagnose hardware status' reports hardware health (fans, power supplies, temperature), not process CPU consumption. Option D is wrong because 'show sys resource' is not a valid FortiGate command for real-time process CPU monitoring; resource usage is viewed via 'diagnose sys top' or 'get system performance status'.

Full explanation →

Multi-Selectmedium

Which TWO of the following are benefits of using the FortiGate flow-based inspection mode?

Select 2 answers

A.It supports deep content inspection for all protocols

B.It uses fewer system resources than proxy-based inspection

C.It provides higher throughput performance

D.It requires manual buffer allocation

E.It offers more granular application control

AnswersB, C

Flow-based inspection streams packets through the FortiGate without buffering entire files, so it consumes less CPU and memory than proxy-based inspection, which reassembles and scans complete content. This satisfies the benefit of reduced system resource consumption.

Why this answer

Flow-based inspection is beneficial because it uses fewer system resources than proxy-based inspection (B): it scans packets as they stream through the FortiGate without buffering entire files or sessions, so it consumes less CPU and memory. It also provides higher throughput performance (C), since it avoids the store-and-forward buffering and full-session reassembly that proxy-based inspection performs, allowing traffic to pass with lower latency and greater overall speed. The unmarked options do not belong: deep content inspection for all protocols (A) and more granular application control (E) are strengths associated with proxy-based inspection, which fully buffers and reconstructs content, while manual buffer allocation (D) is not a flow-based benefit because flow-based inspection does not require the administrator to manually allocate buffers.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the trade-off between flow-based and proxy-based inspection, tricking candidates into thinking flow-based provides the same deep inspection as proxy-based.

Full explanation →

MCQeasy

What is the primary function of the FortiGate Security Fabric?

A.To configure OSPF automatically

B.To increase the throughput of the firewall

C.To replace the need for an IPS sensor

D.To synchronize security policies and share intelligence across devices

AnswerD

The Security Fabric synchronises security policies and shares threat intelligence across FortiGate, FortiManager, FortiAnalyzer and endpoints, giving unified enforcement and visibility. This satisfies the stem's requirement by describing the Fabric's core purpose: coordinated policy and intelligence exchange rather than standalone device functions.

Why this answer

The FortiGate Security Fabric is an integrated architecture that links FortiGate, FortiAnalyzer, FortiManager, FortiClient, and other Fortinet products so they share threat intelligence, synchronize policies, and coordinate automated responses. Its primary purpose is unified visibility and enforcement across the extended network, not raw throughput or routing.

Exam trap

FORTINET-NSE7-SPECIALTY often tests whether candidates confuse the Security Fabric's integration/visibility role with performance or routing functions that belong to other FortiGate subsystems.

How to eliminate wrong answers

Option A is wrong because OSPF configuration is a routing protocol function handled by FortiGate's routing engine, unrelated to the Security Fabric's purpose. Option B is wrong because the Security Fabric does not increase firewall throughput — throughput is determined by hardware/ASIC capacity and traffic inspection load. Option C is wrong because the Security Fabric complements rather than replaces IPS; FortiGate's IPS sensor still performs signature-based inspection, while the Fabric adds cross-product correlation and automation.

Full explanation →

Multi-Selectmedium

Which TWO of the following are valid methods for user authentication on a FortiGate?

Select 2 answers

A.BGP

B.RADIUS

C.LDAP

D.IGMP

E.RIP

AnswersB, C

RADIUS is a valid authentication method on FortiGate, satisfying the stem's requirement for supported user authentication. The FortiGate acts as a RADIUS client, forwarding credentials to an external RADIUS server for verification, then applying the returned attributes for group mapping and firewall policy. This external-server delegation is the mechanism that qualifies it.

Why this answer

RADIUS (B) is a valid authentication method on a FortiGate, as FortiOS supports external RADIUS servers for user authentication via the config user radius command and can be referenced in firewall authentication, SSL VPN, and administrative login policies. LDAP (C) is also valid, since FortiGate supports LDAP directory servers (e.g., Active Directory) through config user ldap for authenticating users against directory credentials. Both are standard remote authentication protocols integrated into FortiOS user authentication.

BGP (A), IGMP (D), and RIP (E) are routing or multicast protocols, not authentication mechanisms, and therefore cannot be used to authenticate users on a FortiGate.

Exam trap

FORTINET-NSE7-SPECIALTY often tests whether candidates can distinguish authentication protocols from routing protocols — the distractor options are all routing/multicast protocols, so if you don't read carefully you may pick one thinking it's a AAA method.

Full explanation →

Multi-Selecthard

Which THREE items are included in the configuration file of a FortiGate?

Select 3 answers

A.User certificates

B.Network interface settings

C.FortiGuard cached updates

D.Real-time session tables

E.Firewall policies

AnswersA, B, E

User certificates are stored in the FortiGate configuration, so they are backed up and restored with it. This satisfies the stem's requirement for items contained in the configuration file, since certificate objects are defined and referenced within the config itself.

Why this answer

The FortiGate configuration file is a plain-text dump of the device's persistent configuration, so it includes user certificates (A), which are stored under config vpn certificate local/remote and referenced by name in the config; network interface settings (B), stored under config system interface with IP addresses, masks, and administrative access; and firewall policies (E), stored under config firewall policy with source/destination, services, and actions. These are all configuration objects that survive a reboot and are restored by commands such as execute restore config or execute backup config. FortiGuard cached updates (C) are not part of the configuration file; they are downloaded content (e.g., antivirus/IPS signatures) stored in the FortiGuard cache and managed via execute update-now or automatic updates.

Real-time session tables (D) are dynamic runtime state held in memory and shown by diagnose sys session list, not persisted in the configuration file.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the boundary between persistent configuration and runtime/signature data — candidates incorrectly assume that anything the FortiGate 'knows' (like cached FortiGuard updates or session tables) must be in the config file.

Full explanation →

MCQmedium

When using an IPS sensor, what is the difference between 'Protect' and 'Monitor' mode?

A.Protect applies only to WAN; Monitor applies to LAN

B.Protect drops traffic; Monitor only logs it

C.Protect requires SSL inspection; Monitor does not

D.Protect logs traffic; Monitor drops it

AnswerB

Protect mode actively drops packets matching a signature, while Monitor mode permits them through and only generates log entries. This distinction satisfies the question by clarifying that enforcement versus visibility is the axis separating the two sensor modes.

Why this answer

In a FortiGate IPS sensor, 'Protect' mode (also called block) drops or resets matching traffic when a signature is triggered, while 'Monitor' mode only logs the event without blocking it. This allows administrators to test signatures before enforcing them.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the misconception that Monitor mode drops traffic or that Protect mode only logs, reversing the actual behavior of the two modes.

How to eliminate wrong answers

Option A is wrong because Protect and Monitor are not tied to WAN or LAN interfaces; they are per-signature actions applied regardless of interface. Option C is wrong because SSL inspection is a separate profile setting and is not required for either Protect or Monitor mode. Option D is wrong because it reverses the definitions: Protect drops (and logs), while Monitor only logs.

Full explanation →

Multi-Selectmedium

Which TWO types of reports can be generated in the FortiAnalyzer module of FortiManager?

Select 2 answers

A.Custom reports

B.Pre-defined reports

C.Policy change impact reports

D.Hardware diagnostic reports

E.Firmware compatibility reports

AnswersA, B

Custom reports let administrators define datasets, filters, and layouts beyond shipped templates, satisfying the requirement for tailored output. FortiAnalyzer's report engine supports both this and pre-defined formats, so custom reports are one of the two valid types.

Why this answer

In the FortiAnalyzer module of FortiManager, reports are generated from log data using report templates, and the two supported report types are Custom reports (A) and Pre-defined reports (B). Custom reports (A) are right because administrators can build them from scratch or by modifying templates, choosing datasets, charts, time periods, and filters to meet specific log-analysis needs. Pre-defined reports (B) are right because FortiAnalyzer ships with built-in report templates (for example, security, traffic, and usage reports) that can be run as-is or used as a starting point.

Policy change impact reports (C) do not belong because FortiManager handles policy/configuration management, not impact analysis reporting in the FortiAnalyzer module. Hardware diagnostic reports (D) and Firmware compatibility reports (E) are not FortiAnalyzer report types; hardware diagnostics and firmware compatibility are handled through FortiGate/FortiManager device management and upgrade-path tools, not log-based reporting.

Exam trap

FORTINET-NSE7-SPECIALTY often tests whether candidates can distinguish FortiAnalyzer's actual report types from plausible-sounding but non-existent categories — the trap is selecting options like 'policy change impact' or 'firmware compatibility' that sound like reporting features but actually belong to FortiManager or other tools.

Full explanation →

MCQeasy

An administrator wants to apply a Web Filtering security profile to traffic that is being dynamically steered via an SD-WAN rule. Where must this security profile be enforced in FortiOS?

A.Inside the firewall policy that matches the traffic being steered by the SD-WAN rule

B.Directly inside the SD-WAN rule configuration under the advanced settings tab

C.Globally under the system settings as an SD-WAN overlay inspection profile

D.Within the IPsec tunnel phase 2 security association settings

AnswerA

SD-WAN rules only select the egress member; they do not inspect payload. Web Filtering must therefore sit in the firewall policy that matches the steered traffic, so the profile is applied after the SD-WAN rule chooses the egress interface.

Why this answer

In FortiOS, SD-WAN rules only control path selection (which outgoing interface to use) and do not themselves apply security profiles. Security profiles such as Web Filtering must be enforced in the firewall policy that matches the traffic, because the firewall policy is where UTM/security inspection is applied after the SD-WAN rule has chosen the egress path. Therefore, the Web Filtering profile must be attached to the firewall policy that handles the steered traffic.

Exam trap

The trap is assuming that because SD-WAN rules 'steer' traffic, they also inspect it; candidates may look for a security profile option inside the SD-WAN rule, but FortiOS separates path selection (SD-WAN rule) from security enforcement (firewall policy).

How to eliminate wrong answers

Option B is wrong because SD-WAN rule configuration in FortiOS does not include a security profile section; SD-WAN rules only define matching criteria, priority, and interface selection, not UTM inspection. Option C is wrong because there is no global 'SD-WAN overlay inspection profile' setting in FortiOS; security profiles are applied per firewall policy, not globally to SD-WAN. Option D is wrong because IPsec tunnel phase 2 SA settings define encryption and authentication parameters for the tunnel, not application-layer security profiles like Web Filtering.

Full explanation →

Multi-Selectmedium

Which TWO settings are modified to reduce the impact of a failover event in an HA cluster?

Select 2 answers

A.group-password

B.hb-interval

C.hb-lost-threshold

D.priority

E.monitored-interfaces

AnswersB, C

Shortening hb-interval makes heartbeat packets transmit more frequently, so a failed peer is detected sooner and the standby takes over faster. This directly reduces failover impact by cutting the outage window, satisfying the scenario's requirement to minimise disruption during an HA cluster failover event.

Why this answer

In an HA cluster, the heartbeat interval (B, hb-interval) controls how frequently heartbeat packets are exchanged between cluster members, so tuning it determines how quickly a node is detected as unreachable and thus how fast a failover is triggered. The heartbeat lost threshold (C, hb-lost-threshold) defines how many consecutive missed heartbeats are tolerated before the peer is declared dead, directly governing failover sensitivity and the resulting disruption window. Together, hb-interval and hb-lost-threshold are the two settings that shape failover timing and therefore reduce the impact of a failover event.

The group-password (A) is only an authentication secret for cluster communication and does not affect failover behavior, priority (D) influences which node becomes primary but not the failover impact itself, and monitored-interfaces (E) specifies which links are watched rather than tuning the failover event's impact.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the misconception that priority or monitored interfaces reduce failover impact, when the actual timing is controlled by heartbeat interval and lost threshold.

Full explanation →

Multi-Selectmedium

Which TWO of these are valid SD-WAN health check protocols?

Select 2 answers

A.SSH

B.FTP

C.HTTP

D.Ping

E.SNMP

AnswersC, D

HTTP health checks actively request a URL and validate the response, confirming application-layer reachability rather than mere IP connectivity. This satisfies the stem's requirement for a valid SD-WAN health check protocol, since FortiGate SD-WAN supports HTTP alongside ICMP, TCP, UDP-echo, DNS, and TWAMP as health check types.

Why this answer

HTTP (option C) is a valid SD-WAN health check protocol because SD-WAN controllers and edges can send HTTP GET requests to a target URL and evaluate the response code or latency to determine whether an application path is healthy. Ping (option D) is also valid because SD-WAN health checks commonly use ICMP echo requests to measure reachability, latency, jitter, and packet loss toward a specified destination. These two are the standard probe types supported for SD-WAN SLA/health-check configuration, alongside others like TCP and DNS in some implementations.

SSH (option A) is a remote management/shell protocol, not a health-check probe. FTP (option B) is a file-transfer protocol and is not used for periodic path health monitoring. SNMP (option E) is a management/monitoring protocol for polling device metrics, not a probe type used to validate SD-WAN path health.

Exam trap

FORTINET-NSE7-SPECIALTY often tests which protocols are valid SD-WAN health checks, tempting candidates with common network protocols like SSH, FTP, or SNMP that are not supported for this purpose.

Full explanation →

MCQhard

You are using 'SLA Target' as your strategy. What happens if multiple members meet the SLA?

A.The system selects the first member in the list.

B.The system selects the one with the highest bandwidth capacity.

C.The system selects the member with the best performance (e.g., lowest latency).

D.Traffic is sent through all of them simultaneously.

AnswerC

With SLA Target, FortiGate first filters members meeting the SLA criteria, then applies the secondary metric to break ties. When several members qualify, it picks the one with the best measured performance, such as lowest latency, rather than load-balancing across them.

Why this answer

With the SLA Target strategy, FortiGate selects the member that best meets the SLA criteria — typically the one with the lowest latency or best overall quality among those that satisfy the SLA. It is a quality-based selection, not a first-match or bandwidth-based one.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the confusion between SD-WAN strategies — candidates mix up SLA Target (best performance) with Maximize Bandwidth (highest capacity) or Lowest Cost (cheapest link).

How to eliminate wrong answers

Option A is wrong because selecting the first member in the list describes a static/priority-based selection, not SLA Target — SLA Target actively compares performance. Option B is wrong because highest bandwidth capacity is the criterion for the Maximize Bandwidth strategy, not SLA Target. Option D is wrong because sending traffic through all members simultaneously describes load balancing or per-packet distribution, not SLA Target, which picks a single best member.

Full explanation →

MCQeasy

When adding a FortiGate to FortiManager, which mode must the FortiGate be in to allow the FortiManager to manage its configuration and policies?

A.Registration-only mode

B.Backup mode

C.Normal mode

D.Read-only mode

AnswerC

Normal mode permits FortiManager to push configuration and policy packages, because the FortiGate retains its own local configuration while accepting centralised management. This satisfies the stem's requirement for full configuration and policy management. Other modes, such as backup, restrict FortiManager to read-only monitoring, so they cannot fulfil the management constraint.

Why this answer

For FortiManager to manage a FortiGate's configuration and policies, the FortiGate must be in Normal mode (the default operating mode). In Normal mode, the FortiGate can be added to FortiManager, and FortiManager can push policy packages, install configuration changes, and retrieve status. Other modes like backup or read-only are not valid FortiGate operational modes for full management.

Exam trap

The trap is inventing non-existent modes like 'Registration-only' or 'Read-only' — candidates may confuse FortiManager administrative permissions with FortiGate operating modes, but the FortiGate must always be in Normal mode for full management.

How to eliminate wrong answers

Option A is wrong because 'Registration-only mode' is not a valid FortiGate mode — while there is a concept of registering a device with FortiManager, the FortiGate itself must be in Normal mode to be managed. Option B is wrong because 'Backup mode' is not a FortiGate operating mode; FortiGate modes are NAT/Route, Transparent, and there is no 'Backup mode' for management purposes. Option D is wrong because 'Read-only mode' is not a FortiGate mode — FortiManager can have read-only administrative accounts, but the FortiGate itself must be in Normal mode for FortiManager to push configuration.

Full explanation →

Multi-Selecthard

Which THREE aspects of the FortiGate system are affected by changing the global 'set vdom-mode' to 'multi-vdom'?

Select 3 answers

A.CLI command hierarchy

B.The HA cluster size

C.Management of system resources

D.The physical port order

E.How firewall policies are applied

AnswersA, C, E

Switching to multi-vdom restructures the CLI command hierarchy, since configuration commands become scoped per VDOM under `config vdom`, and global settings move to `config global`. This directly satisfies the stem's constraint that the change affects the CLI command hierarchy, alongside routing and administrative domains.

Why this answer

Changing the global 'set vdom-mode' to 'multi-vdom' alters the CLI command hierarchy (A), because configuration commands become nested under 'config vdom' and you must enter a VDOM with 'config vdom / edit <name>' before configuring most objects. It also changes management of system resources (C), since interfaces, routing tables, firewall objects, and administrators can be partitioned and assigned per-VDOM, enabling independent resource and policy administration. It additionally changes how firewall policies are applied (E), because policies are defined and processed within each VDOM rather than globally, so traffic matching and policy lookup occur in the context of the VDOM that owns the ingress interface.

The HA cluster size (B) is not affected by VDOM mode, as HA membership and cluster limits are independent of VDOM configuration. The physical port order (D) is also unaffected, since interface naming and hardware port numbering remain the same regardless of VDOM mode.

Exam trap

The trap is assuming VDOM mode affects hardware or HA characteristics; Fortinet exams test that multi-VDOM changes CLI structure, resource management, and policy application scope.

Full explanation →

Multi-Selecthard

Which THREE items are included in a Policy Package when it is pushed from FortiManager?

Select 3 answers

A.Service Objects

B.Firewall Policies

C.System interface settings

D.Routing tables

E.Address Objects

AnswersA, B, E

Service Objects are bundled into the policy package, since firewall policies reference them for port and protocol matching. Pushing the package installs these objects on the managed FortiGate alongside the policies that depend on them.

Why this answer

A Policy Package in FortiManager is the container of the security configuration that gets installed to managed FortiGate devices, and it includes the firewall policy rules themselves (B, Firewall Policies), which define the traffic handling and are the core of the package. It also includes the reusable objects those policies reference, specifically Address Objects (E) and Service Objects (A), which define the source/destination addresses and the TCP/UDP port or protocol matches used inside the policies. These three items travel together as a unit when the policy package is pushed, because the policies cannot function without their referenced address and service objects.

By contrast, System interface settings (C) and Routing tables (D) are device-level configuration that belongs to the FortiGate's system and network settings, not to the policy package, so they are not installed as part of a policy package push.

Exam trap

The trap is assuming that all configuration is included in a policy package — candidates may include interface or routing settings, but these are device-level and not part of the policy package.

Full explanation →

MCQhard

In a VDOM-enabled environment, how are administrative accounts managed?

A.Admins can be scoped to specific VDOMs

B.Only the root VDOM admin can change settings

C.Admins must be global

D.All admins see all VDOMs

AnswerA

In a VDOM-enabled environment, administrator accounts can be scoped to specific VDOMs, restricting each admin's visibility and configuration rights to assigned virtual domains. This satisfies least-privilege management, letting a super-admin retain global access while other admins operate only within their VDOM.

Why this answer

In a VDOM-enabled FortiGate, administrative accounts can be scoped to specific VDOMs, allowing granular delegation of management. An admin can be assigned to a single VDOM, multiple VDOMs, or all VDOMs (global), depending on the profile and requirements. This enables multi-tenant or departmental separation of duties.

Exam trap

The trap is that candidates assume VDOM admins must be global or that only root can manage, when in fact FortiGate supports fine-grained VDOM-scoped administrative accounts.

How to eliminate wrong answers

Option B is wrong because while the root (global) admin has the broadest privileges, other scoped admins can also change settings within their assigned VDOMs. Option C is wrong because admins do not have to be global — scoped admins are a core feature of VDOMs. Option D is wrong because admins only see the VDOMs they are assigned to, not all VDOMs, unless they are global admins.

Full explanation →

MCQeasy

What is the primary purpose of an ADOM in FortiManager?

A.To logically group devices for delegated administration and policy management

B.To provide high availability for the FortiGate

C.To allow external API access to the FortiGate

D.To increase the storage capacity of the FortiManager

AnswerA

An ADOM partitions FortiManager into independent administrative domains, each holding its own devices, policies and objects. This directly satisfies the delegated administration and policy management requirement, letting separate teams manage their own device groups without affecting others. It is not merely a folder or a backup container; it is the fundamental management boundary within FortiManager.

Why this answer

An ADOM (Administrative Domain) in FortiManager is a logical container that groups managed devices, policies, and objects for administrative segregation. It enables delegated administration by allowing different administrators to manage only their assigned ADOMs, and it provides a boundary for policy management, ensuring that policies and objects are not shared across ADOMs unless explicitly done via global objects. This makes it the primary mechanism for multi-tenancy and organizational separation in FortiManager.

Exam trap

The trap here is confusing ADOMs with high availability or API features, as candidates might think ADOMs provide redundancy or external access, but they are purely for logical grouping and delegated administration.

How to eliminate wrong answers

Option B is wrong because high availability for FortiGate is achieved through FortiGate HA (FGCP or FGSP) or FortiManager HA for the manager itself, not through ADOMs. Option C is wrong because external API access to FortiGate is provided by the FortiGate REST API or FortiManager JSON API, which are independent of ADOM structure. Option D is wrong because ADOMs do not increase storage capacity; they are logical partitions, and storage capacity is determined by the FortiManager hardware or VM resources.

Full explanation →

MCQhard

You are troubleshooting an issue where traffic is not using an SD-WAN rule despite meeting criteria. What is the most likely cause?

A.A higher-priority SD-WAN rule is matching the traffic first.

B.The SD-WAN rule is disabled.

C.The Performance SLA has timed out.

D.The interface is not in an SD-WAN zone.

AnswerA

SD-WAN rules are evaluated in sequence order, and the first matching rule wins. If a higher-priority rule's criteria also match the traffic, it is applied instead, so the intended lower-priority rule never executes despite its own criteria being met.

Why this answer

SD-WAN rules are evaluated in order, and the first matching rule is applied. If a higher-priority rule matches the traffic first, the intended rule will not be used even if its criteria are met. This is the most likely cause when the rule itself is enabled and correctly configured.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the misconception that SD-WAN rules are evaluated by specificity, when in fact they are evaluated in strict order like firewall policies.

How to eliminate wrong answers

Option B is wrong because if the rule were disabled, it would not be evaluated at all, but the question states traffic meets criteria and the rule is not being used, implying it is active. Option C is wrong because a Performance SLA timeout affects member selection within a rule, not whether the rule matches traffic. Option D is wrong because if the interface were not in an SD-WAN zone, the rule could not reference it, but the question implies the rule is otherwise valid.

Full explanation →

MCQmedium

When configuring SD-WAN services in a template, what does the 'Performance SLA' setting determine?

A.The physical port priority

B.The maximum bandwidth allowed

C.The number of tunnels created

D.The criteria for path selection based on link quality

AnswerD

Performance SLA defines the thresholds—latency, jitter, packet loss—against which FortiGate probes each WAN link, so SD-WAN rules can select paths meeting the required quality. This directly satisfies the stem's constraint: determining the criteria for path selection based on link quality.

Why this answer

The Performance SLA setting in an SD-WAN template defines the health-check parameters — probe type, target, interval, and thresholds for latency, jitter, and packet loss — that determine whether a member link is considered alive and how it ranks for path selection. SD-WAN rules then use these SLA results to steer traffic to the best-quality link. It is fundamentally a link-quality criterion, not a bandwidth or port-priority setting.

Exam trap

FORTINET-NSE7-SPECIALTY often tests whether candidates conflate SLA (quality thresholds) with bandwidth or priority settings, so the trap is choosing an answer that describes capacity or port preference instead of link-quality-based path selection.

How to eliminate wrong answers

Option A is wrong because physical port priority is set on the interface/member configuration (e.g., priority or cost values), not by the Performance SLA. Option B is wrong because maximum bandwidth is controlled by traffic shaping, bandwidth limits on interfaces, or SD-WAN rule bandwidth settings — the SLA measures quality, not capacity. Option C is wrong because the number of tunnels is determined by the SD-WAN member and VPN configuration, not by the SLA, which only evaluates existing links.

Full explanation →

MCQmedium

You are configuring a Performance SLA to monitor reachability to a SaaS application. Which parameter determines the threshold for an interface to be considered 'unhealthy' in the SD-WAN routing table?

A.Probe Mode

B.Sequence Number

C.Packet Loss Threshold

D.Update Interval

AnswerC

The packet loss threshold sets the maximum percentage of lost probes a member may incur before FortiOS marks it unhealthy in the SD-WAN routing table. Exceeding it removes the interface from SLA-qualified selection, directly determining the unhealthy state for the monitored SaaS application.

Why this answer

The Packet Loss Threshold in a Performance SLA defines the maximum acceptable percentage of lost probes before the member is marked unhealthy. When packet loss exceeds this threshold (along with latency and jitter thresholds), the SD-WAN engine disqualifies the member from the routing table.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the confusion between probe configuration parameters (Probe Mode, Update Interval) and the actual health thresholds (latency, jitter, packet loss) that determine member status.

How to eliminate wrong answers

Option A is wrong because Probe Mode determines the protocol used for SLA probes (ping, tcp-echo, http, udp-echo, twamp) — it defines how the probe is sent, not the health threshold. Option B is wrong because Sequence Number is not a configurable SLA threshold parameter; it is not used to determine member health. Option D is wrong because Update Interval controls how frequently probes are sent, not the threshold that determines health — a short interval gives faster detection but does not itself define 'unhealthy'.

Full explanation →

MCQmedium

An administrator configures an SD-WAN rule using the 'Volume' strategy across two IPsec tunnels with different bandwidth capacities (Tunnel A: 100 Mbps, Tunnel B: 50 Mbps). How does FortiOS distribute traffic across these members when using the Volume strategy?

A.Traffic is balanced equally (50/50) regardless of interface capacity

B.Traffic is sent exclusively over Tunnel A until it reaches 100% packet loss, then fails over to Tunnel B

C.Traffic is distributed proportionally based on the configured weight or bandwidth ratio of each member interface

D.Traffic is steered strictly based on real-time latency measured by health checks

AnswerC

The Volume strategy balances sessions according to each member's configured weight, so Tunnel A at 100 Mbps receives roughly twice the traffic of Tunnel B at 50 Mbps. Distribution is proportional to the weight or bandwidth ratio rather than equal or purely latency-based.

Why this answer

The Volume strategy in FortiOS SD-WAN distributes sessions across member interfaces in proportion to each member's configured weight (or bandwidth-derived weight). With Tunnel A at 100 Mbps and Tunnel B at 50 Mbps, FortiOS sends roughly two-thirds of traffic over Tunnel A and one-third over Tunnel B, matching the 2:1 capacity ratio. This prevents overloading the lower-capacity link while maximizing aggregate throughput.

Exam trap

The trap is assuming Volume means equal distribution or that it uses real-time performance metrics — candidates confuse Volume (weight-based) with Lowest Cost/SLA (latency-based) strategies.

How to eliminate wrong answers

Option A is wrong because Volume is not a round-robin or equal-cost strategy — it explicitly uses weights to bias distribution. Option B is wrong because that describes a primary/standby or failover-only behavior, not Volume load balancing. Option D is wrong because latency-based steering is the job of the Lowest Cost (SLA) or Maximize Bandwidth (SLA) strategies, which use health-check metrics rather than static weights.

Full explanation →

MCQmedium

Which command is used to verify the current status of SD-WAN members and their SLA health from the CLI?

A.diagnose sys sdwan health-check

B.show router info bgp

C.get system interface

D.get system sdwan member

AnswerA

The diagnose sys sdwan health-check command outputs each member's SLA probe results, including latency, jitter, packet loss and up/down state per health-check. It is the CLI equivalent of the GUI SD-WAN monitor, satisfying the requirement to verify member status and SLA health.

Why this answer

The command 'diagnose sys sdwan health-check' displays the current SLA health status of each SD-WAN member, including latency, jitter, packet loss, and up/down state per health-check. It is the primary CLI tool for verifying SD-WAN member SLA status in real time.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the distinction between configuration-view commands ('get system sdwan') and diagnostic commands ('diagnose sys sdwan health-check') — candidates confuse the two and pick a config command that doesn't show live SLA state.

How to eliminate wrong answers

Option B is wrong because 'show router info bgp' is not a valid FortiGate CLI command for SD-WAN health — BGP neighbor status is checked with 'get router info bgp summary' and does not show SLA metrics. Option C is wrong because 'get system interface' displays interface configuration and status, not SD-WAN SLA health-check results. Option D is wrong because 'get system sdwan member' is not the correct syntax — SD-WAN member configuration is viewed under 'config system sdwan' or via 'diagnose sys sdwan member', but SLA health specifically requires the health-check diagnostic.

Full explanation →

MCQeasy

Which FortiGate feature is used to group multiple physical interfaces for redundancy at Layer 2?

A.Loopback interface

B.802.3ad Aggregate

C.SD-WAN

D.VLAN tagging

AnswerB

An 802.3ad aggregate bundles multiple physical interfaces into one logical link using LACP, providing Layer 2 redundancy and increased bandwidth. This satisfies the requirement to group physical interfaces for redundancy at Layer 2, unlike static or standalone interface configurations.

Why this answer

802.3ad Aggregate is the FortiGate feature that bundles multiple physical interfaces into a single logical link using the IEEE 802.3ad Link Aggregation Control Protocol (LACP). This provides Layer 2 redundancy and increased bandwidth: if one member link fails, traffic continues over the remaining links. Loopback, SD-WAN, and VLAN tagging do not provide Layer 2 link redundancy.

Exam trap

The trap is confusing Layer 2 link aggregation (802.3ad) with Layer 3 path selection (SD-WAN) — candidates pick SD-WAN because it also provides redundancy, but the question specifies Layer 2 physical interface grouping.

How to eliminate wrong answers

Option A is wrong because a loopback interface is a virtual interface used for management or routing stability, not for grouping physical links. Option C is wrong because SD-WAN operates at Layer 3 and manages multiple WAN links for path selection and failover, not Layer 2 link aggregation. Option D is wrong because VLAN tagging (802.1Q) adds VLAN identifiers to frames for logical segmentation, not physical link redundancy.

Full explanation →

100

MCQeasy

Which protocol is NOT a valid option for Performance SLA probes?

A.TCP Echo

B.UDP Broadcast

C.HTTP

D.ICMP

AnswerB

Performance SLA probes support ICMP, TCP echo, UDP echo, HTTP, HTTPS, DNS, and twamp. UDP Broadcast is not a probe protocol, so it cannot be selected; the FortiGate sends unicast probes to the configured server target.

Why this answer

UDP Broadcast is not a valid protocol for Performance SLA probes in FortiGate SD-WAN. Valid probe protocols include TCP Echo, HTTP, HTTPS, ICMP, and others, but UDP Broadcast is not among them because SLA probes require a response to measure latency, jitter, and packet loss, which broadcast does not provide.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the list of valid Performance SLA probe protocols, causing candidates to confuse generic network protocols with those supported for SLA measurement, and UDP Broadcast is a common distractor because it is a valid network concept but not an SLA probe protocol.

How to eliminate wrong answers

Option A is wrong because TCP Echo is a valid probe protocol used to measure round-trip time by sending a TCP packet and awaiting a response. Option C is wrong because HTTP is a valid probe protocol, commonly used to check web application responsiveness. Option D is wrong because ICMP is a valid probe protocol, using ping to measure latency and packet loss.

Full explanation →

101

Multi-Selectmedium

Which TWO criteria can be used in SD-WAN rules to select an outgoing interface?

Select 2 answers

A.The name of the administrator

B.System temperature

C.Device serial number

D.Source and destination address

E.Application or service type

AnswersD, E

Source and destination address are both matchable criteria within SD-WAN rules, letting policy steer traffic by endpoint identity. This satisfies the stem's requirement for interface selection criteria, since FortiGate SD-WAN rules evaluate source and destination IP objects to choose the outgoing member.

Why this answer

Option D (Source and destination address) is correct because SD-WAN rules commonly match traffic by source and/or destination IP address (and often subnet or address objects) to steer flows out a specific WAN interface. Option E (Application or service type) is correct because SD-WAN policies use application identification (e.g., via application signatures or ISDB) and service/port definitions to route traffic based on the recognized application or service. The administrator name (A) is not a traffic-matching criterion for interface selection, system temperature (B) is a hardware health metric not used in SD-WAN rule matching, and device serial number (C) identifies the device itself rather than classifying traffic for outbound interface selection.

Exam trap

The trap is selecting criteria that are not traffic-related (like administrator name or device serial number) as valid SD-WAN rule matching options; candidates must remember that SD-WAN rules match on traffic attributes, not administrative or hardware identifiers.

Full explanation →

102

Multi-Selecthard

Which TWO of the following can be used as a 'Source' in an SD-WAN rule?

Select 2 answers

A.Source IP address object.

B.SLA target name.

C.Interface MAC address.

D.Firewall policy ID.

E.User group.

AnswersA, E

SD-WAN rules accept firewall address objects as source criteria, so a source IP address object directly satisfies the requirement to match traffic by origin address. FortiGate resolves the object at rule evaluation, letting you steer or steer-select members based on that source.

Why this answer

In an SD-WAN rule, the 'Source' field identifies the traffic origin, and a source IP address object (Option A) is a valid match criterion because SD-WAN rules commonly match on IP address objects (host, subnet, or address group) to steer traffic. A user group (Option E) is also a valid Source match, since SD-WAN rules can classify traffic by user identity/group (typically resolved via FSSO or LDAP integration) so that different users get different path selection. SLA target name (Option B) is not a source; it is a performance/link-quality condition used in the rule's SLA/target definition to select the outgoing link.

Interface MAC address (Option C) is a Layer-2 attribute not used as an SD-WAN rule Source match. Firewall policy ID (Option D) is a policy reference, not a traffic source identifier, so it cannot serve as the Source in an SD-WAN rule.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the distinction between SD-WAN rule match criteria (source, destination, application, user) and SD-WAN member/SLA configuration parameters, causing candidates to confuse SLA targets with source match fields.

Full explanation →

103

MCQeasy

Where are SD-WAN zones managed in the FortiGate GUI?

A.Interface > Physical Interfaces.

B.System > Network > Zones.

C.Firewall > Policy > Objects.

D.Network > SD-WAN > SD-WAN Zones.

AnswerD

SD-WAN zones are configured under Network > SD-WAN > SD-WAN Zones in the FortiGate GUI, where members and zone membership are defined. This is the location for creating and editing the zones used by SD-WAN rules.

Why this answer

SD-WAN zones are configured and managed under Network > SD-WAN > SD-WAN Zones in the FortiGate GUI. This is where administrators create the SD-WAN zone, add member interfaces (physical, IPsec, VLAN), and define the virtual WAN link used by SD-WAN rules and static routes.

Exam trap

The trap is confusing SD-WAN zones with regular firewall zones — candidates pick System > Network > Zones because 'Zones' appears there, but SD-WAN zones live under the SD-WAN menu.

How to eliminate wrong answers

Option A is wrong because Interface > Physical Interfaces only shows physical port configuration, not SD-WAN zone membership. Option B is wrong because System > Network > Zones is for regular firewall zones (security zones), which are distinct from SD-WAN zones. Option C is wrong because Firewall > Policy > Objects contains address, service, and schedule objects, not SD-WAN zone definitions.

Full explanation →

104

MCQeasy

An administrator wants to view the active SD-WAN rule hit counts and verify which traffic is matching a specific SD-WAN rule in FortiOS. Which command should be used?

A.show system sdwan

B.execute router clear sdwan cache

C.get firewall policy statistics

D.diagnose sys sdwan service

AnswerD

The diagnose sys sdwan service command lists each SD-WAN rule with its member interfaces, health status and cumulative hit counts, letting the administrator confirm exactly which rule matched specific traffic. It is the direct CLI method for verifying rule matching in FortiOS.

Why this answer

The command `diagnose sys sdwan service` is the correct choice because it displays the SD-WAN service table, which includes each rule's hit count and the list of matching traffic flows. This command provides real-time statistics on which sessions are being steered by specific SD-WAN rules, allowing administrators to verify rule effectiveness. It is the primary diagnostic tool for SD-WAN rule monitoring in FortiOS.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the confusion between configuration display commands (like `show system sdwan`) and diagnostic commands that provide runtime statistics (like `diagnose sys sdwan service`), so candidates must distinguish between viewing settings and viewing operational data.

How to eliminate wrong answers

Option A is wrong because `show system sdwan` only displays the SD-WAN configuration (such as members, zones, and health-check settings) and does not provide any hit counts or active session information. Option B is wrong because `execute router clear sdwan cache` clears the SD-WAN cache, which resets state and does not show statistics; it is used for troubleshooting by forcing re-evaluation, not for viewing hit counts. Option C is wrong because `get firewall policy statistics` shows hit counts for firewall policies, not for SD-WAN rules; while firewall policies may reference SD-WAN, the statistics are per-policy, not per-SD-WAN-rule, and do not show which traffic matches a specific SD-WAN rule.

Full explanation →

105

Multi-Selectmedium

Which TWO actions should be taken when preparing to upgrade a FortiGate HA cluster?

Select 2 answers

A.Review release notes

B.Clear all sessions

C.Backup the configuration

D.Disable heartbeat interfaces

E.Change HA mode to Standalone

AnswersA, C

Release notes document the supported upgrade path, known issues and behaviour changes for the target firmware. Reviewing them first confirms the cluster can move directly to that build, satisfying the stem's requirement to prepare the HA cluster safely before upgrading.

Why this answer

Option A (Review release notes) is correct because Fortinet release notes document the supported upgrade path, firmware version compatibility, and known issues that must be checked before upgrading an HA cluster to avoid breaking the cluster or losing configuration. Option C (Backup the configuration) is correct because a full configuration backup (e.g., via System > Backup or 'execute backup config') provides a rollback point in case the upgrade fails or the cluster does not re-form properly. Option B is not required because clearing all sessions is not a prerequisite for an HA upgrade and would disrupt traffic unnecessarily.

Option D is incorrect because disabling heartbeat interfaces would break HA communication and cause a split-brain or cluster failure. Option E is incorrect because changing HA mode to Standalone is not part of the upgrade procedure and would defeat the purpose of upgrading an HA cluster.

Exam trap

FORTINET-NSE7-SPECIALTY often tests whether candidates confuse routine operational tasks (like clearing sessions or changing HA mode) with the specific documented pre-upgrade checklist, which centers on release notes review and configuration backup.

Full explanation →

106

Multi-Selecthard

An administrator troubleshoots a scenario where traffic matching an application-based SD-WAN rule is bypassing the preferred high-speed MPLS tunnel and taking the backup broadband tunnel instead. Which THREE factors should the administrator check to resolve this routing discrepancy? (Choose three)

Select 3 answers

A.Verify the FortiGate factory default administrator password is changed

B.Check the physical layer OSI Model cable category connected to the FortiGate port

C.Inspect the member priorities and weights configured within the specific SD-WAN rule

D.Verify whether the preferred MPLS member is failing the configured performance SLA thresholds, causing the SD-WAN engine to disqualify it

E.Check the sequence order of the SD-WAN rules; an earlier rule might be matching the traffic first

AnswersC, D, E

Member priority and weight inside the SD-WAN rule determine which member the engine selects for matching traffic. If the MPLS member carries a lower priority or unsuitable weight, the rule steers traffic to broadband despite the preferred tunnel being available.

Why this answer

Option C is correct because within an SD-WAN rule the member priorities and weights determine which member is preferred; if the MPLS member has a lower priority value or weight than the broadband member, the SD-WAN engine will steer matching traffic to broadband instead. Option D is correct because SD-WAN performance SLAs (e.g., latency, jitter, packet loss thresholds) continuously probe each member, and if the MPLS member fails the SLA it is marked ineligible and traffic falls back to the next qualified member such as the broadband tunnel. Option E is correct because SD-WAN rules are evaluated top-down by sequence order, so an earlier rule matching the same application-based criteria can intercept the traffic and send it out the broadband member before the intended rule is reached.

Option A is not relevant because the factory default admin password has no bearing on SD-WAN member selection or tunnel routing. Option B is not relevant because the physical cable category affects link capability, not the SD-WAN engine's rule-based path selection between an MPLS and broadband member.

Exam trap

FORTINET-NSE7-SPECIALTY often tests whether candidates understand that SD-WAN member selection is driven by SLA health, rule sequence, and member priority — not by physical cabling or unrelated security settings.

Full explanation →

107

MCQhard

An IPsec VPN tunnel used as an SD-WAN member is experiencing intermittent flapping due to DPD (Dead Peer Detection) timeout issues over a high-latency satellite link. How should the administrator adjust the Phase 1 IPsec settings on FortiOS to stabilize the tunnel without completely disabling failure detection?

A.Disable DPD entirely so the FortiGate never tears down the tunnel

B.Enable NP6/NP7 hardware offloading for Phase 1 SA renegotiation

C.Change the IPsec phase 1 mode from Main mode to Aggressive mode

D.Increase the DPD retry count and interval settings under the IPsec Phase 1 configuration

AnswerD

Satellite latency causes DPD probes to expire before replies arrive, flapping the tunnel. Raising the DPD retry count and interval under Phase 1 tolerates that delay while keeping dead peer detection active, satisfying the requirement not to disable detection.

Why this answer

Increasing the DPD retry count and interval under IPsec Phase 1 settings allows the FortiGate to tolerate longer delays before declaring the peer dead. On high-latency satellite links, packets may take longer to arrive, causing false DPD timeouts. By adjusting these parameters, the tunnel remains stable while still detecting genuine failures, as DPD is not disabled.

Exam trap

The trap is thinking that disabling DPD or changing mode solves latency issues; the correct approach is to tune DPD parameters to match link characteristics while keeping detection active.

How to eliminate wrong answers

Option A is wrong because disabling DPD entirely removes failure detection, which can lead to blackholing traffic if the peer goes down. Option B is wrong because NP6/NP7 hardware offloading is for performance, not for DPD timing; it does not affect DPD retries. Option C is wrong because changing from Main mode to Aggressive mode affects authentication and speed, not DPD timeout issues; Aggressive mode is less secure and not a solution for latency.

Full explanation →

108

MCQeasy

How do you apply an SD-WAN template to multiple managed FortiGates simultaneously?

A.By manually editing each FortiGate config

B.By assigning the template in the Device Manager tab

C.Through individual CLI console sessions

D.By creating a global profile

AnswerB

Assigning the template in Device Manager pushes the configuration to every selected managed FortiGate at once, satisfying the requirement to apply it to multiple devices simultaneously. Device Manager supports bulk template assignment across FortiGates in the same ADOM, avoiding per-device manual configuration.

Why this answer

In FortiManager, SD-WAN templates are applied to multiple managed FortiGates by assigning the template in the Device Manager tab. This allows you to select multiple devices and push the SD-WAN template configuration simultaneously, ensuring consistent SD-WAN settings across all selected FortiGates. The Device Manager provides a centralized interface for bulk template assignment, which is the intended method for scaling SD-WAN deployments.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the misconception that SD-WAN templates must be applied individually or through CLI, when in fact FortiManager's Device Manager supports bulk assignment for efficiency.

How to eliminate wrong answers

Option A is wrong because manually editing each FortiGate config is time-consuming, error-prone, and does not leverage FortiManager's centralized management capabilities. Option C is wrong because using individual CLI console sessions requires per-device configuration and lacks the automation and consistency of template assignment. Option D is wrong because creating a global profile is not the correct mechanism for applying SD-WAN templates; global profiles are used for other policy objects, not for SD-WAN template assignment.

Full explanation →

109

MCQhard

An SD-WAN rule is configured with 'Lowest Cost (SLA)' strategy. If all members in the SLA meet the requirements, how does the FortiGate select the outgoing interface?

A.The member with the lowest interface cost value defined in the SD-WAN member configuration.

B.Round Robin

C.The interface with the highest bandwidth.

D.The interface that was most recently added to the zone.

AnswerA

Under Lowest Cost (SLA), FortiGate first filters members meeting every SLA target, then breaks ties by the configured interface cost value. The lowest-cost surviving member becomes the egress interface, so cost only decides once SLA health is satisfied.

Why this answer

With the 'Lowest Cost (SLA)' strategy, FortiGate first filters SD-WAN members to those that meet the SLA targets (latency, jitter, packet loss). Among the qualifying members, it then selects the member with the lowest configured interface cost value in the SD-WAN member configuration. This is a two-stage decision: SLA eligibility first, then cost-based tie-breaking.

Exam trap

The trap is that candidates conflate 'Lowest Cost (SLA)' with 'Maximize Bandwidth (SLA)' and pick the highest-bandwidth option, forgetting that Lowest Cost uses the configured interface cost value after SLA filtering.

How to eliminate wrong answers

Option B is wrong because Round Robin is a separate SD-WAN strategy (or a load-balancing method) that cycles through members regardless of cost; it is not the tie-breaker for Lowest Cost (SLA). Option C is wrong because 'highest bandwidth' is not the selection criterion for Lowest Cost (SLA) — that would be closer to Maximize Bandwidth (SLA), which uses bandwidth weights, not interface cost. Option D is wrong because FortiGate does not select the most recently added member; membership order or addition time is not a documented selection criterion for this strategy.

Full explanation →

110

Multi-Selecthard

Which THREE factors influence log storage efficiency on a FortiAnalyzer/FortiManager?

Select 3 answers

A.Log compression settings

B.Log retention days

C.The firewall firmware version

D.Disk quota for specific devices

E.The number of active users

AnswersA, B, D

Log compression settings directly reduce the disk footprint of stored logs by encoding them more compactly, so enabling compression increases storage efficiency. This satisfies the stem's requirement as one of the three factors influencing log storage efficiency on FortiAnalyzer/FortiManager.

Why this answer

Log compression settings (A) directly influence log storage efficiency because FortiAnalyzer/FortiManager can compress logs (e.g., using gzip) to reduce the physical disk space consumed by stored logs. Log retention days (B) determine how long logs are kept before being purged, so a longer retention period increases the total volume of logs stored and thus affects storage efficiency. Disk quota for specific devices (D) limits how much storage each device's logs can consume, directly controlling storage allocation and preventing one device from exhausting the analyzer's disk.

The firewall firmware version (C) does not itself govern log storage efficiency, though it may affect log format or features, and the number of active users (E) is unrelated to how efficiently logs are stored on the FortiAnalyzer/FortiManager.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the distinction between factors that directly affect storage efficiency (compression, retention, quotas) and those that indirectly influence log volume (firmware version, user count), causing candidates to select the latter.

Full explanation →

111

MCQeasy

Which feature in FortiManager allows you to monitor SD-WAN performance across all managed FortiGates?

A.Device Manager

B.Log View

C.Dashboard > SD-WAN Monitor

D.Policy & Objects

AnswerC

Dashboard > SD-WAN Monitor aggregates performance metrics from every managed FortiGate, satisfying the requirement to monitor SD-WAN across all devices from one console. It presents per-member link health, latency, jitter and packet loss centrally, rather than requiring per-device inspection.

Why this answer

FortiManager's Dashboard includes an SD-WAN Monitor widget that aggregates SD-WAN performance data — link health, SLA status, jitter, latency, and packet loss — across all managed FortiGates in the ADOM. This gives administrators a single pane of glass to spot degraded links or failed SLAs fleet-wide. It pulls from the same health-check data the FortiGates generate for their SD-WAN rules.

Exam trap

FORTINET-NSE7-SPECIALTY often tests whether candidates know which FortiManager pane provides which function, so the trap is confusing configuration panes (Device Manager, Policy & Objects) with the monitoring pane (Dashboard > SD-WAN Monitor).

How to eliminate wrong answers

Option A is wrong because Device Manager is used to add, organize, and manage FortiGate devices (and their configuration), not to visualize SD-WAN performance metrics. Option B is wrong because Log View displays raw log messages (traffic, event, security) and is not an aggregated SD-WAN performance dashboard. Option D is wrong because Policy & Objects is where firewall policies, addresses, and SD-WAN rules are defined, not where performance is monitored.

Full explanation →

112

MCQmedium

You are setting up an SD-WAN configuration via FortiManager. Which object type is used to group multiple WAN interfaces for SD-WAN member assignment?

A.IP Pool

B.Virtual Wire Pair

C.SD-WAN Zone

D.Interface Group

AnswerC

SD-WAN zones group multiple WAN interfaces into a single logical object, and FortiManager assigns members to that zone. This satisfies the stem's requirement for grouping WAN interfaces during SD-WAN member assignment, rather than configuring each interface individually.

Why this answer

In FortiManager SD-WAN configuration, an SD-WAN Zone is the object type used to group multiple WAN interfaces for SD-WAN member assignment. Zones allow you to logically group interfaces so that SD-WAN rules and performance SLAs can be applied to the group rather than individual interfaces. This is the correct object for organizing WAN members in an SD-WAN deployment managed via FortiManager.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the specific FortiManager object name for SD-WAN grouping, and candidates confuse it with generic interface groups or virtual wire pairs that serve entirely different purposes.

How to eliminate wrong answers

Option A is wrong because an IP Pool is a range of IP addresses used for NAT or DHCP, not for grouping WAN interfaces. Option B is wrong because a Virtual Wire Pair is a pair of interfaces configured in transparent mode to pass traffic without routing — it is unrelated to SD-WAN member grouping. Option D is wrong because 'Interface Group' is not the FortiManager object type used for SD-WAN; while interface groups exist for other purposes (like aggregate links), SD-WAN specifically uses zones.

Full explanation →

113

MCQeasy

What is the purpose of the 'Any' interface in a firewall policy?

A.To force traffic through the hardware switch

B.To bypass the routing table

C.To match traffic only on the WAN port

D.To match traffic regardless of the ingress or egress interface

AnswerD

The Any interface matches traffic irrespective of which interface it arrives on or leaves through, so the policy applies regardless of ingress or egress port. This satisfies scenarios requiring a single policy to cover traffic across multiple interfaces without specifying them individually.

Why this answer

In a FortiGate firewall policy, the 'Any' interface is a wildcard that matches traffic regardless of the incoming or outgoing interface. It is used when you want a policy to apply to traffic from any source interface to any destination interface, simplifying rule creation. This is especially useful for policies that should not be tied to a specific interface, such as certain management or deny rules.

Exam trap

The trap is thinking 'Any' bypasses routing or is limited to a specific interface; in reality, it is a wildcard that matches all interfaces while normal routing still applies.

How to eliminate wrong answers

Option A is wrong because 'Any' does not force traffic through the hardware switch; it simply matches any interface, and traffic still follows normal routing and switching. Option B is wrong because 'Any' does not bypass the routing table; the FortiGate still performs route lookups to determine the egress interface, and the policy matches whatever interface is selected. Option C is wrong because 'Any' is not limited to the WAN port; it matches all interfaces, including LAN, DMZ, and VPN tunnels.

Full explanation →

114

MCQeasy

Where can an administrator check the status of the connection between a FortiGate and FortiManager?

A.Log View

B.Device Manager

C.Policy & Objects

D.System Settings

AnswerB

Device Manager in FortiManager lists managed FortiGates and shows each device's connection state, so the administrator can confirm whether the tunnel to FortiManager is up. This directly satisfies the requirement to check the FortiGate-to-FortiManager connection status, displaying synchronisation and online/offline indicators per device.

Why this answer

In FortiManager, the Device Manager pane displays managed FortiGate devices and their status, including the connection state between the FortiGate and FortiManager. Administrators can see whether the device is online, the last update time, and other management details. This is the primary location to verify the FortiGate-FortiManager tunnel status.

Exam trap

The trap is confusing configuration panes (Policy & Objects, System Settings) with the monitoring pane (Device Manager) where connection status is actually displayed.

How to eliminate wrong answers

Option A is wrong because Log View displays logs (traffic, event, security) from managed devices or FortiManager itself; it does not show the live connection status of the management tunnel. Option C is wrong because Policy & Objects is used to configure firewall policies, objects, and packages; it does not display device connection status. Option D is wrong because System Settings contains FortiManager's own system configuration (administrators, network, HA), not the status of managed devices.

Full explanation →

115

MCQmedium

In a site-to-site VPN, you need to allow traffic initiated from the remote site. What configuration is essential on the local FortiGate?

A.An IPSec phase 3 policy

B.A static route to the remote subnet

C.A firewall policy allowing traffic from the VPN zone to the Internal zone

D.A NAT rule for the remote subnet

AnswerC

FortiGate evaluates traffic entering the IPsec VPN zone against firewall policies, so remote-initiated sessions are dropped without a policy permitting VPN zone to Internal zone. This policy is what authorises the inbound direction the scenario requires.

Why this answer

For a site-to-site VPN, traffic initiated from the remote site must be allowed by a firewall policy on the local FortiGate. The policy must permit traffic from the VPN zone (the interface/tunnel where the remote site's traffic arrives) to the Internal zone (the local network). Without this policy, the FortiGate's implicit deny drops the traffic, even if the VPN tunnel is up and routes exist.

Exam trap

The trap is focusing on routing or NAT as the enabler for VPN traffic, when the essential missing piece is often the firewall policy that explicitly allows traffic from the VPN zone to the internal zone.

How to eliminate wrong answers

Option A is wrong because there is no such thing as an 'IPSec phase 3 policy'; IPSec has phase 1 (IKE) and phase 2 (IPSec SA) negotiations, and firewall policies are separate. Option B is wrong because a static route to the remote subnet is necessary for the local FortiGate to know how to reach the remote network, but it does not permit traffic; it only directs it. The question asks for essential configuration to allow traffic, which is the firewall policy.

Option D is wrong because NAT is not required for site-to-site VPN traffic; in fact, NAT would typically break the communication unless specifically configured for NAT traversal, which is not the standard requirement.

Full explanation →

116

MCQmedium

When configuring an SD-WAN rule, what is the purpose of the 'Source' address field?

A.To define the gateway IP for the route.

B.To force traffic to a specific SD-WAN zone.

C.To determine which ISP the traffic exits through regardless of SLA.

D.To match traffic based on the source IP or user.

AnswerD

The Source field scopes which traffic the SD-WAN rule evaluates, matching flows by source IP address or identified user. Only traffic originating from those sources is steered by the rule's strategy, letting administrators apply different link-selection policies per subnet or user group.

Why this answer

The Source address field in an SD-WAN rule is used to match traffic based on the source IP address or user identity, allowing the rule to apply only to specific sources. This is part of the rule's matching criteria, alongside destination and service, to determine which traffic is steered by the SD-WAN rule. It does not define gateway IPs or force zones.

Exam trap

FORTINET-NSE7-SPECIALTY often tests confusion between match criteria (source/destination/service) and action/steering settings (zone, gateway, SLA), so candidates must know which field does what.

How to eliminate wrong answers

Option A is wrong because the gateway IP for a route is defined in static routes or the SD-WAN member configuration, not in the rule's source field. Option B is wrong because forcing traffic to a specific SD-WAN zone is done via the destination or the rule's outgoing interface selection, not the source address. Option C is wrong because ISP selection regardless of SLA is not how SD-WAN rules work; rules use SLA targets and priority, and the source field only matches traffic.

Full explanation →

117

MCQmedium

You want to automate the onboarding of new FortiGate units. Which FortiManager feature allows you to pre-configure devices before they connect to the network?

A.Provisioning Templates

B.Scripting

C.Device Registration Key

D.Policy cloning

AnswerA

Provisioning Templates let you pre-stage configuration — such as interface settings, static routes and security profiles — against a device model or serial number before the FortiGate ever contacts FortiManager. When the unit later registers, FortiManager automatically pushes that pre-configured template, satisfying the stem's requirement to onboard devices without manual intervention.

Why this answer

Provisioning Templates in FortiManager let administrators define a device's full configuration — system settings, interface configs, firewall policies, and more — before the FortiGate ever connects. When the new FortiGate registers with FortiManager (via serial number or pre-shared key), the template is automatically applied, enabling zero-touch onboarding. This is the standard mechanism for pre-configuring devices at scale.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the distinction between Provisioning Templates (pre-config before connect) and Scripting (post-management automation), since both sound like automation tools.

How to eliminate wrong answers

Option B is wrong because Scripting executes CLI or Tcl scripts on already-managed devices; it does not provide the pre-registration template framework that auto-applies config on first connect. Option C is wrong because a Device Registration Key is only an authentication credential used during initial FortiManager registration — it does not carry configuration. Option D is wrong because policy cloning duplicates existing policies between devices or ADOMs and requires the target device to already exist and be managed.

Full explanation →

118

MCQeasy

What is the purpose of 'dedicated HA' interfaces?

A.To provide extra management access

B.To isolate heartbeat traffic

C.To increase throughput

D.To act as a backup WAN port

AnswerB

Dedicated HA interfaces carry only heartbeat and synchronisation traffic between cluster members, separating it from data and management traffic. This satisfies the requirement to isolate heartbeat traffic, preventing session load or management access from disrupting HA failover communication.

Why this answer

Dedicated HA interfaces are physical ports reserved exclusively for HA heartbeat and synchronization traffic between cluster members. By isolating heartbeat traffic on its own link, the cluster avoids contention with user data and prevents heartbeat packets from being delayed or dropped by heavy production traffic, which could trigger false failovers. This separation is why Fortinet recommends dedicated heartbeat ports in Active-Passive and Active-Active deployments.

Exam trap

The trap is assuming HA interfaces carry user traffic or provide management access — candidates conflate the HA heartbeat link with data or management planes, when its sole purpose is cluster control traffic isolation.

How to eliminate wrong answers

Option A is wrong because management access is provided by the dedicated management interface (or out-of-band management port), not by HA heartbeat interfaces — mixing the two would expose the cluster to management-plane interference. Option C is wrong because HA interfaces carry only heartbeat and session-sync traffic, not user throughput; they do not increase forwarding capacity. Option D is wrong because a backup WAN port is a data-plane function handled by SD-WAN or link redundancy, not by the HA heartbeat link.

Full explanation →

119

MCQeasy

An administrator needs to inspect encrypted traffic traversing an SD-WAN IPsec tunnel using Deep Packet Inspection (DPI). What must be installed on the client endpoints or configured on the FortiGate to prevent browser trust warnings when using SSL/TLS full inspection?

A.ADVPN 2.0 shortcut certificates must be exchanged between spokes

B.BGP MD5 authentication keys must match on both routers

C.The FortiGate's self-signed CA certificate must be installed in the trusted root certificate store of the client endpoints

D.A pre-shared key must be configured in the IPsec Phase 1 proposal

AnswerC

Full SSL/TLS inspection makes the FortiGate re-sign server certificates with its own CA, so browsers flag them as untrusted. Installing that CA certificate into each endpoint's trusted root store restores the chain of trust, eliminating warnings while DPI decrypts, inspects and re-encrypts the tunnel traffic.

Why this answer

When the FortiGate performs SSL/TLS full inspection, it acts as a man-in-the-middle, re-signing every server certificate with its own CA certificate. For browsers and applications to trust the re-signed certificates without warnings, the FortiGate's inspection CA certificate must be imported into the trusted root certificate store of every client endpoint. This is the standard requirement for any full DPI deployment, whether over SD-WAN IPsec tunnels or direct internet paths.

Exam trap

The trap is conflating IPsec tunnel authentication (PSK, certificates for tunnel establishment) with SSL inspection trust — candidates who see 'certificate' in an IPsec context often pick the ADVPN or PSK answer instead of the client trust-store answer.

How to eliminate wrong answers

Option A is wrong because ADVPN 2.0 shortcut certificates are used for IPsec tunnel negotiation between spokes, not for browser trust of inspected TLS sessions. Option B is wrong because BGP MD5 authentication secures routing protocol peering, which is unrelated to certificate trust for DPI. Option D is wrong because the IPsec Phase 1 pre-shared key authenticates the tunnel endpoints; it has no bearing on whether a browser trusts a re-signed TLS certificate.

Full explanation →

120

MCQeasy

What does the 'FortiGuard' service provide to the FortiGate?

A.User management and authentication

B.Local firmware storage

C.Hardware acceleration support

D.Real-time threat intelligence and database updates

AnswerD

FortiGuard delivers real-time threat intelligence and database updates to the FortiGate, covering antivirus, IPS, web filter and botnet signatures. This subscription-based feed lets the FortiGate enforce current protections without manual signature loading, satisfying the requirement for continuously updated threat data.

Why this answer

FortiGuard is Fortinet's subscription-based security intelligence service that delivers real-time threat intelligence and database updates to FortiGate devices. This includes antivirus signatures, IPS signatures, web filtering categories, DNS filtering, and application control signatures, all updated continuously from Fortinet's global threat research.

Exam trap

The trap is that candidates confuse FortiGuard (cloud threat intelligence) with other Fortinet products like FortiAuthenticator (identity) or FortiManager (management), or with hardware acceleration features.

How to eliminate wrong answers

Option A is wrong because user management and authentication are handled by FortiAuthenticator or local/FSSO mechanisms, not FortiGuard. Option B is wrong because local firmware storage is a function of the FortiGate's flash storage and FortiManager, not FortiGuard. Option C is wrong because hardware acceleration is provided by FortiASIC processors (NP, CP, SP) built into the appliance, not by a cloud service.

Full explanation →

121

MCQeasy

An administrator configures a static route where the gateway is an SD-WAN zone instead of a specific IP address. How does FortiOS process this SD-WAN static route?

A.The FortiGate drops the packet because static routes require a valid IP address gateway

B.The FortiOS SD-WAN engine intercepts the route lookup and applies SD-WAN rules to dynamically select the best member interface based on performance SLAs

C.The packet is forwarded exclusively through the physical interface with the lowest index number

D.Traffic is load-balanced equally across all physical interfaces in the FortiGate chassis using round-robin

AnswerB

Pointing a static route at an SD-WAN zone rather than a next-hop IP hands member selection to the SD-WAN engine, which evaluates configured rules and SLA health per member, then installs the chosen interface. This satisfies the stem's dynamic best-member requirement.

Why this answer

When a static route's gateway is an SD-WAN zone, FortiOS treats it as an SD-WAN route and invokes the SD-WAN engine during route lookup. The engine evaluates the configured SD-WAN rules and health-check SLAs to dynamically select the best member interface for the traffic, rather than using a fixed next-hop IP. This enables performance-based routing and failover without changing the static route.

Exam trap

The trap is assuming static routes require a literal IP next-hop — candidates pick the 'drops the packet' answer, not realizing FortiOS extends static routing to support SD-WAN zones as dynamic gateways.

How to eliminate wrong answers

Option A is wrong because FortiOS explicitly supports SD-WAN zones as static route gateways — it does not drop the packet. Option C is wrong because selection is not based on interface index; it is driven by SD-WAN rules and SLA health checks. Option D is wrong because round-robin across all chassis interfaces is not how SD-WAN static routes work — the SD-WAN engine applies the configured strategy (e.g., Lowest Cost, Volume) and SLA constraints.

Full explanation →

122

Multi-Selectmedium

When configuring advanced IPsec VPN tunnels to act as members of an SD-WAN zone, which TWO configuration parameters on the FortiGate are critical for ensuring proper IPsec tunnel operation and traffic steering? (Choose two)

Select 2 answers

A.Ensure the IPsec interface is added to an SD-WAN zone and assigned a valid virtual IP/interface configuration

B.Disable NAT traversal (NAT-T) globally on all IPsec phase 1 tunnels

C.Configure the IPsec tunnel mode as dialup server on all participating branch spokes

D.Set the IPsec phase 1 authentication method strictly to RSA certificates only, disabling pre-shared keys

E.Configure Phase 2 selectors to match the exact source and destination subnets, or use 0.0.0.0/0 for route-based VPN flexibility

AnswersA, E

Adding the IPsec interface to an SD-WAN zone lets FortiOS treat the tunnel as a steerable member, while the valid virtual IP/interface binding gives the tunnel a usable local endpoint for encapsulated traffic. Without both, SD-WAN rules cannot select or forward across the tunnel.

Why this answer

Option A is correct because an IPsec interface must be a member of the SD-WAN zone to participate in SD-WAN path selection and steering; the tunnel interface needs a valid IP/interface configuration so the zone can reference it and health checks and rules can operate on it. Option E is correct because Phase 2 selectors define the interesting traffic for the tunnel: they should either match the exact protected source/destination subnets or use 0.0.0.0/0 for route-based VPNs, which allows routing and SD-WAN rules to steer traffic into the tunnel rather than being blocked by narrow selectors. Option B is wrong because NAT-T is often required when peers are behind NAT and disabling it globally would break many tunnels; it is not a critical SD-WAN membership parameter.

Option C is wrong because not all participating spokes should be dialup servers; typically the hub is the dialup server and spokes are dialup clients, and tunnel mode is not the parameter that makes a tunnel an SD-WAN member. Option D is wrong because forcing RSA certificates only and disabling pre-shared keys is an authentication policy choice, not a requirement for IPsec tunnel operation or SD-WAN traffic steering.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the misconception that SD-WAN IPsec membership requires special authentication changes (certificates, dialup roles) or disabling NAT-T, when in reality it is about interface membership and correct Phase 2 selector design for route-based VPNs.

Full explanation →

123

MCQmedium

What does the 'set tcp-rst-timeout' command control?

A.The TCP handshake timeout

B.The maximum session duration

C.The time to wait after sending a reset

D.The time before an idle session is dropped

AnswerC

The tcp-rst-timeout setting defines how long the FortiGate keeps a session entry alive after transmitting a TCP reset, before fully clearing it. This governs cleanup timing of torn-down sessions rather than idle timeouts or handshake behaviour.

Why this answer

The 'set tcp-rst-timeout' command defines how long the FortiGate keeps a session entry alive after it sends a TCP RST (reset) packet to tear down the connection. This allows the firewall to continue matching any stray packets belonging to that session for the specified duration, preventing them from being treated as new sessions. It is a session-cleanup timer, not a handshake or idle timer.

Exam trap

The trap is assuming tcp-rst-timeout is a general TCP timer like idle or handshake timeout — it specifically governs the post-RST session retention window, a narrow and easily confused behavior.

How to eliminate wrong answers

Option A is wrong because the TCP handshake timeout is governed by separate session timers (e.g., tcp-halfopen-timer, tcp-timewait-timer), not tcp-rst-timeout. Option B is wrong because maximum session duration is controlled by session-ttl or per-policy timeout settings, not the RST timer. Option D is wrong because idle session timeout is handled by tcp-idle-timer or the generic session idle timeout, whereas tcp-rst-timeout only applies after a RST is sent.

Full explanation →

124

MCQmedium

You are configuring SD-WAN templates in FortiManager. What is the primary purpose of using SD-WAN Central Management instead of configuring SD-WAN directly on individual FortiGates?

A.To perform local traffic analysis on the FortiGate only

B.To allow FortiGates to manage their own SD-WAN interfaces independently

C.To bypass the need for ADOMs

D.To enable SD-WAN template inheritance and synchronized policy updates across multiple managed devices

AnswerD

Central Management pushes a single SD-WAN template to many FortiGates, so inheritance propagates interface, member and health-check settings consistently. Editing the template updates every managed device at once, satisfying the stem's requirement for synchronised policy across the estate rather than per-device configuration drift.

Why this answer

SD-WAN Central Management in FortiManager uses templates (e.g., SD-WAN Template, CLI Template) to define SD-WAN configuration once and inherit it across multiple managed FortiGates. This enables synchronized policy updates, consistent SLA/steering rules, and efficient bulk changes. It eliminates the need to manually configure each FortiGate's SD-WAN settings individually.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the misconception that SD-WAN central management is about local analysis or bypassing ADOMs; the core benefit is template inheritance and synchronized updates across many devices.

How to eliminate wrong answers

Option A is wrong because local traffic analysis on the FortiGate is not the purpose of central management; FortiManager centralizes configuration, not local analysis. Option B is wrong because central management is the opposite of letting FortiGates manage their own SD-WAN independently — it enforces template-driven consistency. Option C is wrong because ADOMs are still required for organizing devices and policies; SD-WAN central management does not bypass ADOMs, it operates within them.

Full explanation →

125

MCQmedium

What is the benefit of using 'SD-WAN Zones' in templates when managing 100+ branches?

A.They allow for multiple internet service providers

B.They automatically configure static routes

C.They increase the speed of the internet connection

D.They allow for easier mapping to physical ports across different hardware models

AnswerD

SD-WAN Zones abstract logical overlays from physical interfaces, so a single template maps to varied port layouts across hardware models. This satisfies the 100+ branch constraint: one zone definition deploys consistently regardless of each site's device, eliminating per-model port remapping and template duplication.

Why this answer

SD-WAN Zones in FortiManager templates allow administrators to define logical zones that map to physical ports consistently across different FortiGate hardware models. This abstraction simplifies template deployment to 100+ branches because the same template can be applied regardless of the specific port layout on each device.

Exam trap

FORTINET-NSE7-SPECIALTY often tests whether candidates confuse SD-WAN Zones with SD-WAN rules or multiple ISP support — the key benefit is hardware-agnostic port mapping in templates.

How to eliminate wrong answers

Option A is wrong because multiple internet service providers are supported by SD-WAN itself (multiple WAN links), not specifically by SD-WAN Zones — zones are about logical grouping and port mapping. Option B is wrong because SD-WAN Zones do not automatically configure static routes; routing is configured separately via SD-WAN rules and static routes. Option C is wrong because SD-WAN Zones do not increase internet connection speed — they provide logical abstraction and traffic steering, not bandwidth amplification.

Full explanation →

126

Multi-Selecthard

Which THREE types of traffic are typically NOT offloaded by the NP6 processor?

Select 3 answers

A.Simple ICMP packets

B.Traffic requiring proxy-based inspection

C.Encrypted traffic before decryption

D.Traffic using unsupported protocols

E.Standard UDP traffic

AnswersB, C, D

Proxy-based inspection terminates and reassembles sessions for content scanning, which the NP6 cannot perform, so such traffic is handled by the CPU instead. This satisfies the scenario's constraint: offload requires flow-based processing, not proxy inspection.

Why this answer

Options B, C, and D are correct because the NP6 network processor in FortiGate appliances only offloads traffic it can fully parse and accelerate at the hardware level: proxy-based inspection (B) requires the full TCP/IP stack and application-layer processing in the CPU, so it cannot be offloaded; encrypted traffic before decryption (C) cannot be inspected or accelerated by the NP6 because the payload is opaque until the CPU/SSL engine decrypts it; and traffic using unsupported protocols (D) is not recognized by the NP6's fast-path parser, so it is punted to the CPU. By contrast, simple ICMP packets (A) and standard UDP traffic (E) are common, well-formed flows that the NP6 can parse and offload to its fast path, so they are not among the traffic types typically excluded from NP6 offloading.

Exam trap

The trap is assuming the NP6 offloads everything except 'complex' traffic — candidates often include ICMP or UDP as non-offloaded when in fact those are prime fast-path candidates.

Full explanation →

127

Multi-Selecthard

Which THREE factors can affect the 'Performance SLA' logic in an SD-WAN template?

Select 3 answers

A.Packet loss threshold

B.The firmware version of the FortiGate

C.Jitter threshold

D.The number of active VPN tunnels

E.Latency threshold

AnswersA, C, E

Packet loss threshold is one of the measured SLA criteria: FortiOS compares the health check's observed loss against this configured value to decide whether an SD-WAN member is within or outside the SLA, triggering member removal from the SLA-compliant set.

Why this answer

The Performance SLA logic in an SD-WAN template is driven by the SLA criteria defined for each member link, and those criteria are the three measured metrics: packet loss threshold (A), jitter threshold (C), and latency threshold (E). Each of these thresholds is configured inside the Performance SLA object (e.g., set packet-loss-threshold, set jitter-threshold, set latency-threshold) and determines whether a link is considered within or out of SLA, which in turn influences SD-WAN rule selection and failover. Packet loss (A) is correct because exceeding the configured loss percentage marks the link as violating the SLA.

Jitter (C) is correct because exceeding the configured jitter value in milliseconds marks the link as violating the SLA. Latency (E) is correct because exceeding the configured latency value in milliseconds marks the link as violating the SLA. The FortiGate firmware version (B) does not define SLA thresholds, and the number of active VPN tunnels (D) is a topology/state condition, not a Performance SLA metric, so neither belongs here.

Exam trap

The trap is including non-metric factors like firmware version or tunnel count — candidates may think any variable affecting SD-WAN is part of SLA, but Performance SLA is strictly about latency, jitter, and packet loss thresholds.

Full explanation →

128

MCQmedium

You want to standardize the SD-WAN configuration for 50 remote branch offices. Which FortiManager feature should you use?

A.Policy Packages

B.Firmware Images

C.CLI Scripts

D.SD-WAN Templates

AnswerD

SD-WAN Templates in FortiManager centralise overlay, member, and health-check definitions, then assign them across all 50 branches as a single reusable object. This satisfies the standardisation constraint directly, since per-device CLI edits are eliminated and every branch inherits identical SD-WAN settings from one template.

Why this answer

SD-WAN Templates in FortiManager (D) are specifically designed to standardize SD-WAN configurations across multiple branch offices. They allow you to define SD-WAN settings, such as interface members, zones, and rules, in a template that can be applied to multiple FortiGates. This ensures consistency and simplifies management for large-scale deployments.

Exam trap

Candidates might choose CLI Scripts because they are familiar with scripting, but the question asks for a FortiManager feature specifically for SD-WAN standardization, which is SD-WAN Templates.

How to eliminate wrong answers

Option A is wrong because Policy Packages are used to manage firewall policies, not specifically SD-WAN configurations; while they can include SD-WAN rules, they are not the primary feature for standardizing SD-WAN. Option B is wrong because Firmware Images are used to manage firmware versions, not configuration. Option C is wrong because CLI Scripts can be used to push configurations, but they are not as structured or scalable as SD-WAN Templates for this purpose.

Full explanation →

129

MCQeasy

A network administrator is configuring an HA cluster with two FortiGates in Active-Passive mode. Which parameter must be identical on both devices to ensure a successful cluster formation?

A.Device Hostname

B.Serial Number

C.HA Group ID

D.Priority value

AnswerC

The HA group ID must match on both members; it identifies which cluster a device joins, so mismatched values prevent the FortiGates from forming a single cluster. Identical group IDs satisfy the requirement for successful Active-Passive cluster formation.

Why this answer

In a FortiGate HA cluster, the HA Group ID (also called group-id) must be identical on all devices for them to form a cluster. The group ID is used to distinguish clusters on the same network and ensures that only devices with the same group ID can join the same cluster. Without a matching group ID, the devices will not form an HA cluster even if other settings match.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the parameters that must be identical for HA formation, and candidates may incorrectly assume that hostname or priority must match — the key is to remember that group ID is the critical matching parameter.

How to eliminate wrong answers

Option A is wrong because the device hostname does not need to be identical for HA formation; in fact, it is recommended that hostnames be unique to easily identify each unit, though they can be the same. Option B is wrong because the serial number is unique to each FortiGate and is never identical — it is used for licensing and identification, not for HA cluster formation. Option D is wrong because the priority value determines which device becomes the primary (higher priority wins) and can differ between devices; it is not required to be identical for cluster formation.

Full explanation →

130

Multi-Selecthard

Which THREE steps are involved in the 'Policy Package Installation' workflow?

Select 3 answers

A.Select the target device

B.Perform a factory reset

C.Review the install preview

D.Select the policy package

E.Reboot the target device

AnswersA, C, D

Selecting the target device identifies which managed FortiGate receives the policy package. Installation is device-scoped, so this step satisfies the workflow requirement of defining the destination before the package can be pushed and committed to that firewall.

Why this answer

In the Policy Package Installation workflow, you must first select the policy package (D) that you intend to deploy, since the package defines the set of rules and objects to be installed. Next, you select the target device (A) — the managed gateway, cluster, or VSX — to which that package will be pushed. Before committing, you review the install preview (C), which shows the changes, warnings, and potential impacts so you can confirm or cancel the installation.

Options B and E are not part of this workflow: a factory reset (B) is a device-recovery action unrelated to policy deployment, and rebooting the target device (E) is neither required nor a defined step in installing a policy package.

Exam trap

The trap is including unrelated operational steps like factory reset or reboot — candidates may think a reboot is needed for policy changes, but FortiManager applies policies dynamically without rebooting.

Full explanation →

131

MCQhard

You have a large SD-WAN deployment. Why would you use a 'Centralized Policy' in FortiManager instead of local policies?

A.To eliminate the need for logs

B.To enforce global security and traffic routing policies consistently across multiple sites

C.To reduce the CPU load on the FortiGate

D.To allow local admins to override global policies

AnswerB

A Centralized Policy in FortiManager is authored once and pushed to every managed device, so security and routing rules stay identical across the whole SD-WAN estate. This removes per-site drift and manual local configuration, which is the constraint a large deployment imposes.

Why this answer

A Centralized Policy in FortiManager (typically via Global Policy or ADOM-level shared policy packages) enforces consistent security and SD-WAN routing rules across many sites. It ensures that all managed FortiGates receive the same baseline policy, reducing configuration drift and administrative overhead. This is essential for large SD-WAN deployments where uniform enforcement is required.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the misconception that centralized policy reduces device CPU or allows local overrides; the real benefit is consistent, scalable enforcement across many devices.

How to eliminate wrong answers

Option A is wrong because centralized policy does not eliminate logging; logging is still generated locally and can be sent to FortiAnalyzer or syslog. Option C is wrong because centralized policy management does not reduce FortiGate CPU load — the FortiGate still processes the same policies; the benefit is operational consistency, not performance. Option D is wrong because centralized policies are designed to enforce global rules, not to allow local admins to override them; local override would defeat the purpose of centralization.

Full explanation →

132

MCQhard

In a complex VPN scenario with NAT-Traversal (NAT-T) enabled, what is the primary purpose of the UDP 4500 port?

A.To replace the AH protocol

B.To manage Phase 1 re-keying

C.To encapsulate ESP packets

D.To verify certificate revocation status

AnswerC

When NAT-T is detected, ESP is wrapped inside UDP datagrams on port 4500, allowing the encrypted payload to traverse NAT devices that would otherwise drop or mangle native ESP. Port 500 handles IKE negotiation; 4500 carries the encapsulated ESP traffic itself.

Why this answer

When NAT-Traversal is detected, IKE and ESP traffic are encapsulated in UDP datagrams on port 4500 to traverse NAT devices that would otherwise drop or mangle ESP (IP protocol 50). The UDP 4500 port carries both the IKE negotiation (with a non-ESP marker) and the encapsulated ESP payload, allowing the VPN to function through PAT/NAT.

Exam trap

FORTINET-NSE7-SPECIALTY often tests whether candidates know that UDP 4500 is specifically for NAT-T ESP encapsulation, not for IKE Phase 1 (UDP 500) or for AH — candidates who conflate the roles of 500 and 4500 pick the wrong answer.

How to eliminate wrong answers

Option A is wrong because AH (IP protocol 51) is not replaced by UDP 4500; AH is incompatible with NAT because it hashes the IP header, and NAT-T is used with ESP, not AH. Option B is wrong because Phase 1 re-keying occurs over UDP 500 (or 4500 once NAT-T is active) as part of IKE, but the primary purpose of 4500 is ESP encapsulation, not re-key management. Option D is wrong because certificate revocation checking uses CRL/OCSP over HTTP/HTTPS, not UDP 4500.

Full explanation →

133

MCQmedium

You are implementing SSL VPN and need to ensure that only compliant corporate laptops can connect. Which feature should you use?

A.Host check

B.SSL VPN portal settings

C.Two-factor authentication

D.PKI user authentication

AnswerA

Host check inspects the connecting endpoint against configured criteria, such as antivirus presence, OS patch level or registry keys, before granting SSL VPN access. This satisfies the compliance constraint by admitting only corporate laptops that pass the defined posture checks.

Why this answer

Host check (also called host integrity or endpoint compliance check) is the SSL VPN feature that inspects the connecting endpoint before granting access, verifying that required security software, OS patches, antivirus definitions, and registry keys are present. Only endpoints that pass the defined compliance rules are allowed to establish the tunnel or access protected resources. This directly satisfies the requirement that only compliant corporate laptops can connect.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the distinction between authentication (who you are) and authorization/compliance (is your device healthy) — candidates pick 2FA or PKI because they conflate identity verification with endpoint compliance.

How to eliminate wrong answers

Option B is wrong because SSL VPN portal settings only control what bookmarks, applications, and access methods are exposed to authenticated users after login — they do not evaluate endpoint compliance. Option C is wrong because two-factor authentication verifies user identity with a second credential (token, OTP, push) but says nothing about the health or compliance state of the device. Option D is wrong because PKI user authentication only validates the user's certificate against a trusted CA; a fully patched or completely unpatched laptop with a valid cert would both pass.

Full explanation →

134

MCQeasy

Which method is the most secure for managing FortiGate devices remotely?

A.HTTP with password authentication

B.HTTPS with restricted access via Trusted Hosts

C.Telnet

D.SNMPv1

AnswerB

HTTPS with Trusted Hosts satisfies the remote-management constraint by encrypting administrative sessions with TLS while restricting which source IP addresses may connect to the FortiGate interface. This blocks unauthenticated or off-network attempts before login, unlike plaintext protocols such as Telnet or HTTP, which expose credentials and configuration data in transit.

Why this answer

HTTPS with restricted access via Trusted Hosts is the most secure method because HTTPS encrypts the entire management session using TLS, protecting credentials and configuration data from eavesdropping. Restricting administrative access to specific Trusted Hosts (defined per admin account or per interface) adds a network-layer allowlist so only known source IPs/subnets can even attempt to authenticate, dramatically shrinking the attack surface. Together, encryption plus source restriction satisfies both confidentiality and access-control requirements for remote FortiGate management.

Exam trap

FORTINET-NSE7-SPECIALTY often tests whether candidates conflate 'encrypted protocol' with 'secure management' — HTTPS alone is not enough; the exam expects you to recognize that Trusted Hosts restriction is the differentiator.

How to eliminate wrong answers

Option A is wrong because HTTP transmits admin credentials and session data in cleartext, making it trivially susceptible to sniffing and session hijacking. Option C is wrong because Telnet is an unencrypted legacy protocol that sends usernames, passwords, and all management traffic in plaintext, and it is disabled by default on FortiGate for that reason. Option D is wrong because SNMPv1 has no encryption and only weak community-string authentication, and it is a monitoring protocol, not a secure remote management method.

Full explanation →

135

MCQhard

You have an SD-WAN rule with 'Priority' strategy. What happens if the highest priority member fails its SLA?

A.Traffic is dropped.

B.The FortiGate enters an error state.

C.Traffic is load balanced across all remaining members.

D.Traffic fails over to the member with the next highest priority value.

AnswerD

With the Priority strategy, members are ranked; the highest-priority member carries traffic until it breaches its SLA health check. Traffic then fails over to the next-highest-priority member, preserving the ordered preference rather than load-balancing across all members.

Why this answer

With the 'Priority' strategy in an SD-WAN rule, members are ranked by their configured priority value, and the FortiGate actively uses the highest-priority member that meets its SLA. When that member fails its SLA health check, the rule automatically fails over to the next-highest-priority member that is still within SLA, preserving connectivity. This is the defining behavior of the Priority strategy — strict ordered failover rather than load distribution.

Exam trap

The trap here is confusing the 'Priority' strategy with 'Load Balance' or 'Maximize Bandwidth' — candidates often assume SD-WAN always spreads traffic, but Priority enforces strict ordered failover.

How to eliminate wrong answers

Option A is wrong because SD-WAN is designed for resilience; dropping traffic on SLA failure defeats the purpose of the feature. Option B is wrong because an SLA failure is a normal, expected event that triggers failover logic — the FortiGate does not enter any error state. Option C is wrong because load balancing across all remaining members is the behavior of the 'Load Balance' or 'Maximize Bandwidth' strategies, not 'Priority', which uses ordered selection.

Full explanation →

136

MCQmedium

You are configuring an IPsec VPN tunnel between two FortiGates. Phase 2 fails to come up. What is the most likely cause?

A.Mismatched Phase 2 selectors

B.Incorrect IKE version

C.Expired certificate

D.Mismatched pre-shared key

AnswerA

Phase 2 negotiates the IPsec SA using the configured proxy IDs or selectors; if the local and remote quick-mode selectors do not mirror each other, the tunnel proposal is rejected and Phase 2 never establishes, even though Phase 1 succeeds.

Why this answer

Phase 2 (Quick Mode) failures in IPsec VPNs are most commonly caused by mismatched Phase 2 selectors — the local and remote subnet definitions (proxy IDs) must mirror each other exactly. If the source/destination subnets do not match on both peers, the Phase 2 SA will not establish.

Exam trap

The trap is that candidates confuse Phase 1 and Phase 2 failure symptoms — PSK, certificate, and IKE version issues cause Phase 1 failures, while selector mismatches are the classic Phase 2 failure.

How to eliminate wrong answers

Option B is wrong because an incorrect IKE version would cause Phase 1 to fail, not Phase 2 — Phase 1 negotiates the IKE version. Option C is wrong because an expired certificate would also cause Phase 1 failure (during authentication), not Phase 2. Option D is wrong because a mismatched pre-shared key is a Phase 1 authentication failure, preventing Phase 2 from even being attempted.

Full explanation →

137

MCQhard

An administrator has applied an SD-WAN template to a FortiGate managed by FortiManager. Later, the administrator modifies the template by adding a new SD-WAN member and installing the configuration. What is the expected outcome on the FortiGate?

A.The FortiGate rejects the template update because SD-WAN members cannot be added after initial deployment.

B.The template update fails because the new member conflicts with an existing interface on the FortiGate.

C.The new SD-WAN member is added, but existing SD-WAN rules are reset to default.

D.The FortiGate receives the updated template, and the new SD-WAN member is added without affecting other settings.

AnswerD

When an SD-WAN template is modified and installed, FortiManager pushes the updated configuration to the FortiGate. The new member is added to the SD-WAN zone, and other settings remain intact unless they were also changed in the template. This incremental update ensures minimal disruption. The FortiGate merges the template changes with its existing configuration, preserving unrelated settings.

Why this answer

Modifying an SD-WAN template and installing the configuration results in an incremental update to the FortiGate. The new SD-WAN member is added, and existing settings are preserved unless explicitly changed in the template. This allows administrators to adapt SD-WAN configurations dynamically without disrupting other functionality.

Exam trap

The trap here is thinking that modifying a template resets all SD-WAN rules or that members cannot be added later.

Full explanation →

138

Multi-Selectmedium

An administrator is troubleshooting BGP route propagation over SD-WAN IPsec tunnels where a branch office is not receiving specific routes from the datacenter hub. Which TWO CLI commands on the FortiGate are most useful for diagnosing BGP peering and advertised route issues? (Choose two)

Select 2 answers

A.execute ipsec tunnel list

B.diagnose sys sdwan member

C.get system interface physical

D.get router info bgp neighbors advertised-routes

E.get router info bgp summary

AnswersD, E

This command displays the routes the local FortiGate is advertising to a specific BGP neighbour. If the branch is missing routes, checking advertised-routes on the datacenter hub confirms whether those prefixes are actually being sent across the SD-WAN IPsec tunnel.

Why this answer

Option E, 'get router info bgp summary', is correct because it displays the state of all BGP peers, including whether the branch-to-hub session is Established, the peer AS number, uptime, and prefix counts received — the fastest way to confirm the BGP peering itself is up before investigating route propagation. Option D, 'get router info bgp neighbors advertised-routes', is correct because it shows exactly which prefixes the local FortiGate is advertising to a specific neighbor, letting the administrator verify whether the missing routes are actually being sent toward the branch over the SD-WAN IPsec tunnel. The unmarked options do not belong: 'execute ipsec tunnel list' only shows IPsec tunnel status and selectors, not BGP route exchange; 'diagnose sys sdwan member' reports SD-WAN member health, latency, and SLA state but no BGP information; and 'get system interface physical' merely lists physical interface link status and addressing, which is irrelevant to BGP peering or advertised-route troubleshooting.

Exam trap

The trap is picking interface- or tunnel-level commands (ipsec tunnel list, sdwan member) that verify connectivity but not BGP peering state or route advertisement, which are the actual diagnostic targets here.

Full explanation →

139

Multi-Selectmedium

Which TWO of the following can be used to optimize IPsec VPN performance?

Select 2 answers

A.Increase the Phase 1 lifetime to 24 hours

B.Use DES encryption for speed

C.Ensure the configuration uses AES-NI supported ciphers

D.Use hardware acceleration (ASIC offloading)

E.Disable NAT-Traversal

AnswersC, D

AES-NI is a CPU instruction set that offloads AES encryption and decryption from software to dedicated hardware, dramatically increasing IPsec throughput. Selecting AES-NI supported ciphers satisfies the performance optimisation goal by reducing CPU load during encryption.

Why this answer

Option C is correct because selecting AES-NI supported ciphers (e.g., AES-GCM or AES-CBC with SHA-2) allows the CPU to offload symmetric encryption to dedicated AES-NI instruction sets, dramatically increasing IPsec throughput and reducing CPU utilization compared to non-accelerated ciphers. Option D is correct because hardware acceleration via ASIC offloading moves IPsec encryption, hashing, and encapsulation processing from the general-purpose CPU to dedicated crypto hardware, which increases VPN throughput and lowers latency under heavy tunnel loads. Option A is not ideal because extending Phase 1 (IKE SA) lifetime to 24 hours reduces rekey frequency but does not optimize data-plane throughput and can weaken forward secrecy; it is not a recognized performance optimization.

Option B is wrong because DES is a weak, deprecated cipher and is not faster in any meaningful way on modern hardware that supports AES-NI. Option E is wrong because disabling NAT-Traversal does not improve performance and breaks IPsec connectivity through NAT devices, which is required in most real-world deployments.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the misconception that weaker ciphers like DES improve performance, when in fact modern hardware acceleration and AES-NI make AES-based ciphers both faster and more secure.

Full explanation →

140

Multi-Selecthard

An administrator configures an SD-WAN health check with multiple probes (e.g., ping and HTTP) to monitor a set of IPsec VPN tunnels. Which THREE criteria or settings govern how FortiOS determines whether an SD-WAN member has met or failed the performance SLA? (Choose three)

Select 3 answers

A.The BGP AS number assigned to the WAN interface gateway

B.The restoretime parameter, which specifies how many consecutive successful probes are required before restoring a failed member to healthy status

C.The physical cable length calculated in meters between the FortiGate and the nearest ISP switch

D.The failtime parameter, which dictates how many consecutive probe failures must occur before the member is marked as failed

E.Configured thresholds for latency, jitter, and packet loss that a member must remain under to be considered meeting the SLA

AnswersB, D, E

Restoretime defines how many consecutive successful probes must pass before FortiOS returns a failed SD-WAN member to healthy status. This hysteresis prevents flapping members from rejoining the SLA-qualified set too quickly, and it is one of the settings governing member health determination.

Why this answer

Option B is correct because the restoretime setting in an SD-WAN health check defines how many consecutive successful probe responses must be received before FortiOS transitions a previously failed member back to a healthy state, preventing flapping. Option D is correct because the failtime parameter specifies the number of consecutive probe failures (across the configured probes such as ping and HTTP) required before FortiOS marks that SD-WAN member as failed. Option E is correct because the SLA targets themselves—configured thresholds for latency, jitter, and packet loss—are the metrics FortiOS compares against probe results to decide whether a member is meeting the performance SLA.

Option A is not relevant because the BGP AS number is a routing attribute and does not govern SD-WAN health-check SLA evaluation. Option C is not relevant because physical cable length is not a configurable SD-WAN SLA criterion and is not used by FortiOS to determine member health.

Exam trap

FORTINET-NSE7-SPECIALTY often tests SD-WAN SLA mechanics — the trap is selecting plausible-sounding but irrelevant parameters (BGP AS, cable length) instead of the actual failtime/restoretime/threshold triad.

Full explanation →

141

MCQmedium

A FortiGate SD-WAN deployment uses a firewall policy with an Intrusion Prevention System (IPS) profile applied. After turning on IPS, administrators notice that throughput over an IPsec SD-WAN tunnel drops significantly. What is the primary reason for this throughput reduction, and how can it be mitigated?

A.IPS requires proxy-based inspection, which permanently disables IPsec hardware acceleration

B.IPS inspection requires intensive CPU processing for packet payload analysis, which can be optimized by using flow-based inspection mode and ensuring hardware offloading is active where supported

C.IPS blocks all IPsec AH/ESP headers, forcing fallback to unencrypted GRE tunnels

D.The IPS database size exceeds the IPsec Phase 2 buffer limit

AnswerB

IPS performs payload signature matching, which is CPU-intensive and caps throughput once traffic exceeds what the processor handles. Flow-based inspection reduces per-packet overhead, and hardware offloading where supported moves inspection to dedicated acceleration, restoring tunnel throughput without disabling protection.

Why this answer

IPS inspection is CPU-intensive because it analyzes packet payloads against signature databases, which reduces throughput on IPsec tunnels. Mitigation includes using flow-based inspection (which is less resource-intensive than proxy-based) and ensuring hardware offloading (NPU/CP) is active where supported, so encrypted traffic can be accelerated.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the misconception that IPS requires proxy mode or breaks IPsec — candidates pick extreme answers instead of the balanced flow-based + offload solution.

How to eliminate wrong answers

Option A is wrong because IPS does not require proxy-based inspection — flow-based IPS is supported and does not permanently disable IPsec hardware acceleration. Option C is wrong because IPS does not block IPsec AH/ESP headers; it inspects decrypted payloads after IPsec termination. Option D is wrong because IPS database size is unrelated to IPsec Phase 2 buffer limits; Phase 2 buffers are for SA negotiation, not signature storage.

Full explanation →

142

Multi-Selecthard

Which THREE tasks are required to successfully deploy SD-WAN via FortiManager?

Select 3 answers

A.Installing the configuration to the devices

B.Creating an SD-WAN template

C.Performing a hard factory reset on the FortiGate

D.Deleting all existing firewall policies

E.Assigning the template to managed FortiGates

AnswersA, B, E

Installing the configuration pushes the SD-WAN policy from FortiManager to the managed FortiGate devices, completing the deployment workflow. Without this step, the SD-WAN templates and rules remain staged in the manager only, so the devices never receive the configuration required to establish SD-WAN overlays and steer traffic.

Why this answer

Option B is correct because deploying SD-WAN through FortiManager requires first creating an SD-WAN template (via the SD-WAN Manager/template wizard) that defines the SD-WAN members, zones, and related settings to be pushed to the FortiGates. Option E is correct because the created SD-WAN template must be assigned to the target managed FortiGates so FortiManager knows which devices should receive the SD-WAN configuration. Option A is correct because after the template is created and assigned, the configuration must be installed to the devices so the SD-WAN settings are actually pushed and activated on the FortiGates.

Option C is not required, since a hard factory reset is not a prerequisite for SD-WAN deployment via FortiManager and would unnecessarily wipe the device. Option D is also not required, as existing firewall policies do not need to be deleted; SD-WAN can be deployed alongside or integrated with existing policies.

Exam trap

The trap is thinking that SD-WAN deployment via FortiManager requires disruptive actions like factory reset or deleting policies; candidates may overcomplicate the process, but the essential steps are template creation, assignment, and installation.

Full explanation →

143

MCQhard

An administrator needs to provide access to FortiManager for a junior team member who should only be able to view logs and reports. Which feature is used to define this access?

A.Administrator Profiles

B.Access Control Lists (ACLs)

C.ADOM Assignment

D.User Groups

AnswerA

Administrator Profiles bundle per-domain read/write permissions, so a profile granting read-only access to logs and reports lets the junior member view those areas without configuration rights. Assigning that profile to the administrator account enforces the least-privilege constraint the scenario demands.

Why this answer

Administrator Profiles in FortiManager define granular permissions for administrative accounts, including which ADOMs, policy packages, and features (logs, reports, system settings) a user can access. To give a junior team member read-only access to logs and reports, the administrator creates a profile with only those permissions and assigns it to the user account. This is the standard RBAC mechanism in FortiManager.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the distinction between ADOM Assignment (which ADOMs a user sees) and Administrator Profiles (what actions a user can perform) — candidates pick ADOM Assignment thinking it controls permissions, but it only scopes visibility.

How to eliminate wrong answers

Option B is wrong because ACLs in FortiManager are used for network-level access control (e.g., trusted hosts, interface restrictions), not for defining what a logged-in administrator can view or modify. Option C is wrong because ADOM Assignment determines which ADOMs a user can see, but it does not by itself restrict the user to logs and reports — that requires a profile with the appropriate permissions. Option D is wrong because User Groups are used for authentication and policy matching (e.g., in firewall policies or VPN), not for defining administrative permissions within FortiManager.

Full explanation →

144

Multi-Selecthard

Which TWO of the following steps are required to correctly configure a Performance SLA?

Select 2 answers

A.Configure a firewall address object for the probe.

B.Enable BGP on the interface.

C.Select the probe protocol.

D.Define the destination IP address.

E.Assign the probe to a VPN tunnel.

AnswersC, D

A Performance SLA must specify how FortiGate measures link health, so selecting the probe protocol (Ping, HTTP, or DNS) is mandatory. Without it, no probes are sent and SLA members cannot be evaluated, so the rule cannot steer traffic by measured latency, jitter, or packet loss.

Why this answer

Option C is correct because a Performance SLA health-check must specify the probe protocol (e.g., Ping, HTTP, TCP-echo, or UDP-echo) that FortiGate uses to send the probe packets and measure latency, jitter, and packet loss. Option D is correct because the SLA monitor requires a destination IP address (the server or target being probed) so the FortiGate knows where to send the probes and can evaluate link health against that endpoint. Options A, B, and E are not required: a firewall address object is not needed since the destination is entered directly in the SLA configuration, BGP is an unrelated routing protocol and not part of SLA setup, and assigning the probe to a VPN tunnel is optional (the SLA is typically bound to an SD-WAN member interface, not a tunnel).

Exam trap

FORTINET-NSE7-SPECIALTY often tests the specific steps for Performance SLA configuration, and candidates may overcomplicate it by thinking firewall address objects or BGP are required, when only the probe protocol and destination are essential.

Full explanation →

145

MCQhard

An administrator is troubleshooting an SD-WAN deployment where traffic matching an SD-WAN rule with a destination service object (e.g., HTTPS) is not being steered according to the SLA priority. Instead, it is always taking the default static route member. Upon checking the firewall policies, what is the most common reason why an SD-WAN rule fails to process application or service-based traffic matching?

A.IPsec VPN phase 2 selectors must be set to 0.0.0.0/0 for service-based rules to evaluate

B.The SD-WAN rules are evaluated sequentially from top to bottom; an earlier broad SD-WAN rule with matching source/destination IP addresses is intercepting the traffic before the service-specific rule is reached

C.The firewall policy containing the traffic has SSL inspection disabled, preventing service-based identification

D.The FortiGate kernel requires hardware acceleration (NP7) to be disabled for service-based SD-WAN rules to function

AnswerB

SD-WAN rules are evaluated top-down, so a broader earlier rule matching the same source and destination IPs captures the traffic first. The service-specific rule is never reached, and traffic follows the default static route member instead.

Why this answer

SD-WAN rules are evaluated top-down in the order they appear in the rule list, and the first matching rule wins. If an earlier rule matches on broad source/destination IP criteria, it intercepts the traffic before the service-specific rule (e.g., HTTPS) is ever evaluated, so the service-based steering never applies. This is the most common cause of 'my SD-WAN rule isn't working' in FortiGate deployments.

Exam trap

The trap is assuming SD-WAN rules match on service objects regardless of rule order — candidates forget that an earlier broad IP-based rule silently intercepts traffic, making the service-specific rule appear broken.

How to eliminate wrong answers

Option A is wrong because IPsec phase 2 selectors do not need to be 0.0.0.0/0 for service-based SD-WAN rules to evaluate — selectors affect which traffic is encrypted, not how SD-WAN rules match. Option C is wrong because SSL inspection is not required for service-based SD-WAN matching; FortiGate identifies services via its application signature database and destination service objects, not by decrypting traffic. Option D is wrong because NP7 hardware acceleration does not need to be disabled — SD-WAN rules function with hardware acceleration enabled, and disabling it would degrade performance without fixing the matching issue.

Full explanation →

146

Multi-Selectmedium

Which TWO items must be configured within an SD-WAN template for SD-WAN traffic steering to work?

Select 2 answers

A.DHCP server settings

B.SD-WAN Members

C.SD-WAN Rules

D.VLAN tagging

E.Local users

AnswersB, C

SD-WAN members define the participating interfaces and their roles, which traffic steering requires to identify viable egress paths. Without members configured in the template, rules have no interfaces to steer across, so this satisfies the stem's requirement for steering to function.

Why this answer

Option B (SD-WAN Members) is correct because traffic steering requires the physical or logical WAN interfaces (and their gateways/links) to be declared as SD-WAN members so the SD-WAN engine knows which links are eligible to carry traffic and can measure their SLA performance. Option C (SD-WAN Rules) is correct because the steering policy itself is defined in SD-WAN rules, which match traffic by criteria such as source/destination, application, or internet service and then select the preferred member (or SLA-based strategy) to forward it. Together, members define the available paths and rules define how traffic is distributed across them, which is exactly what SD-WAN traffic steering needs.

Option A (DHCP server settings) is not required for steering, since DHCP only provides address assignment and is unrelated to path selection. Option D (VLAN tagging) is not mandatory, as VLANs are a Layer 2 segmentation mechanism and steering operates on SD-WAN member links and rules. Option E (Local users) is not required, because local user accounts are for administrative authentication and have no role in SD-WAN traffic steering.

Exam trap

The trap is selecting unrelated interface features like DHCP or VLAN tagging; Fortinet exams test that you know SD-WAN Members and SD-WAN Rules are the two mandatory building blocks for steering.

Full explanation →

147

MCQhard

You need to ensure that VoIP traffic stays on the interface with the lowest jitter. Which strategy should you use?

A.Load Balance

B.Lowest Cost (SLA)

C.SLA Target

D.Manual

AnswerC

SLA targets measure link quality metrics including jitter, latency and packet loss, then dynamically steer traffic to the member interface meeting the defined threshold. This directly satisfies the requirement to keep VoIP on the lowest-jitter interface, since the SLA probe continuously evaluates each WAN link and withdraws failing ones from routing.

Why this answer

FortiGate SD-WAN's SLA Target strategy selects the member link that best meets a defined SLA target (latency, jitter, packet loss) for the specified traffic, making it the correct choice for keeping VoIP on the lowest-jitter interface. Unlike Lowest Cost, SLA Target prioritizes SLA compliance over cost, which is exactly what latency-sensitive VoIP requires.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the distinction between Lowest Cost (SLA) and SLA Target — candidates incorrectly assume 'SLA' in Lowest Cost means best performance, when it actually means cheapest link that merely satisfies the SLA.

How to eliminate wrong answers

Option A is wrong because Load Balance distributes sessions across links without regard to per-link jitter or SLA, so VoIP could land on a high-jitter link. Option B is wrong because Lowest Cost (SLA) selects the cheapest link that still meets the SLA, which may not be the lowest-jitter link — cost is the primary criterion, not jitter. Option D is wrong because Manual selection pins traffic to a fixed interface and cannot dynamically adapt to changing jitter conditions.

Full explanation →

148

Multi-Selecthard

Which THREE items can be managed via Device Templates in FortiManager?

Select 3 answers

A.Firewall policies

B.NTP configuration

C.Application control databases

D.DNS settings

E.Local interface IP settings

AnswersB, D, E

NTP configuration is provisioned through Device Templates, which push shared settings such as time synchronisation to managed FortiGates. This satisfies the requirement by grouping NTP servers and authentication under centralised template management rather than per-device manual configuration.

Why this answer

Device Templates in FortiManager are used to provision and manage system-level and network-level settings on managed FortiGate devices, including NTP configuration (B), DNS settings (D), and local interface IP settings (E), which are all part of the system/network configuration that templates push to devices. NTP and DNS are system settings commonly configured through the System template, while interface IPs are configured through the Interface template, making all three valid template-managed items. Firewall policies (A) are managed through Policy Packages, not Device Templates, since they are policy objects rather than device-level provisioning settings.

Application control databases (C) are updated via FortiGuard services and are not provisioned through Device Templates.

Exam trap

The trap here is confusing Device Templates with Policy Packages; candidates often assume that any configuration item can be managed via Device Templates, but firewall policies and application control databases are not part of Device Templates.

Full explanation →

149

Multi-Selectmedium

Which TWO configuration changes require a push from FortiManager to the FortiGate?

Select 2 answers

A.Changes to the log settings on the FortiGate local GUI

B.Changes to an SD-WAN template

C.Updating a firewall policy package

D.Adding a new user to the FortiGate local database

E.Changing the FortiManager admin password

AnswersB, C

SD-WAN templates are metadata objects stored centrally on FortiManager, not locally on the FortiGate. The device holds no native SD-WAN template configuration, so any template edit must be installed to the managed FortiGate via a push, satisfying the stem's requirement for changes requiring FortiManager-to-FortiGate installation.

Why this answer

Options B and C are correct because they are FortiManager-managed objects that must be installed/pushed to the FortiGate to take effect: an SD-WAN template (B) is a central VPN/SD-WAN configuration object in FortiManager that is assigned to a managed device and requires a push (install) to apply the template settings, and a firewall policy package (C) is the core policy configuration managed in FortiManager that must be installed to the FortiGate for the policies to become active. In contrast, changes made directly on the FortiGate local GUI such as log settings (A) and adding a local user to the FortiGate local database (D) are local device changes that do not require a FortiManager push, and changing the FortiManager admin password (E) is a FortiManager administrative setting that has no relation to pushing configuration to a FortiGate.

Exam trap

The trap is assuming any configuration change requires a FortiManager push — local device changes and FortiManager system settings do not, so candidates must distinguish managed objects from local or FortiManager-only settings.

Full explanation →

150

Multi-Selectmedium

An administrator is configuring BGP over SD-WAN IPsec tunnels between a headquarters FortiGate and branch FortiGates. Which TWO configuration steps are required to ensure robust and stable dynamic routing over the SD-WAN IPsec tunnels? (Choose two)

Select 2 answers

A.Set the BGP administrative distance to 255 to disable all routing updates

B.Configure BGP neighbors using the loopback interface IP addresses or tunnel specific IP addresses rather than physical interface IPs

C.Enable BGP graceful restart or adjust keepalive and holddown timers to accommodate potential latency spikes and failover delays on WAN links

D.Configure static default routes on all BGP neighbors pointing to the null0 interface

E.Disable IPsec phase 2 encryption to allow BGP plaintext hello packets to pass through without encapsulation overhead

AnswersB, C

Loopback or tunnel-specific addresses keep BGP sessions up regardless of which physical WAN link carries the IPsec tunnel. Peering to physical interface IPs breaks the session when that link fails or the tunnel renegotiates, so this satisfies the requirement for stable dynamic routing across SD-WAN members.

Why this answer

Option B is correct because peering BGP over loopback or tunnel-specific IP addresses decouples the BGP session from any single physical WAN link, so the session stays up when an individual SD-WAN member link flaps and traffic can be steered across remaining IPsec tunnels. Option C is correct because WAN latency spikes and failover delays can exceed default BGP keepalive (60s) and hold-down (180s) timers, causing session resets; enabling graceful restart or tuning these timers preserves routing state and prevents unnecessary reconvergence during transient SD-WAN events. Option A is wrong because administrative distance 255 makes the route unusable and does not disable BGP updates; it would break routing rather than stabilize it.

Option D is wrong because static default routes to null0 would blackhole traffic and are not a BGP-over-SD-WAN requirement. Option E is wrong because disabling IPsec Phase 2 encryption would break the IPsec tunnel and is not needed for BGP, which is encapsulated inside the tunnel.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the misconception that disabling encryption or using null0 routes can solve routing issues, but the real focus is on stable BGP peering and timer adjustments for SD-WAN resilience.

Full explanation →

Fortinet NSE7 Specialty Modules (SD-WAN and Enterprise Firewall tracks) (FORTINET-NSE7-SPECIALTY) (FORTINET-NSE7-SPECIALTY) — Questions 76–150