NSE7 Enterprise Firewall and VDOMs Practice Question
A network engineer is troubleshooting a Security Fabric where a downstream FortiGate (model 60F) is not appearing in the Fabric topology of the root FortiGate (model 600E). Both devices are running FortiOS 7.4. The root FortiGate shows the downstream device as 'Unreachable' in the Security Fabric widget. The engineer has verified that the downstream FortiGate can ping the root FortiGate's management IP. What is the most likely cause of this issue?
⚠ Common exam trap
Watch out — candidates often assume connectivity issues (ping working) imply Fabric should work, but Fortinet deliberately tests the hardware memory limitation as a non-obvious cause for 'Unreachable' status in the Security Fabric topology.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The downstream FortiGate has insufficient memory to support Security Fabric features.
The FortiGate 60F has limited memory (typically 512 MB or less), and FortiOS 7.4 enforces a minimum memory requirement for downstream devices to participate in the Security Fabric. When the downstream device has insufficient memory, the root FortiGate marks it as 'Unreachable' even though basic IP connectivity (ping) works. This is a known hardware limitation for lower-end models like the 60F when running newer FortiOS versions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The root FortiGate does not have HTTPS access to the downstream FortiGate.
Why it's wrong here
The downstream FortiGate initiates the connection to the root.
- ✓
The downstream FortiGate has insufficient memory to support Security Fabric features.
Why this is correct
Low-end models may not meet the minimum memory requirements for Fabric operations.
- ✗
The downstream FortiGate's management interface is configured on a different VLAN.
Why it's wrong here
Ping works, so the interface is reachable.
- ✗
The administrator account on the downstream FortiGate does not have 'super_admin' privileges.
Why it's wrong here
Any admin with sufficient permissions can join the fabric.
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.