How many Select Two (Multi-Select) Questions questions are on this page?

This page has 20 Select Two (Multi-Select) Questions scenario questions for the NSE7 exam, each with detailed explanations and wrong-answer analysis.

How should I approach NSE7 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Fortinet NSE 7 Advanced Security NSE7 questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise Fortinet NSE 7 Advanced Security NSE7 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

NSE7

exam code

Fortinet

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediummulti select

Read the full VPN explanation →

A FortiGate administrator is troubleshooting an IKEv2 VPN tunnel that fails to establish. The remote peer logs show 'no acceptable proposal' error. Which TWO possible causes should the administrator check?

A
The remote peer's IP address is unreachable
Why wrong: Unreachability would cause timeout, not proposal rejection.
B
The phase1 encryption algorithm or integrity algorithm is mismatched
If the local and remote proposals do not have a common algorithm, negotiation fails with 'no acceptable proposal'.
C
The local FortiGate has the wrong IKE version configured
Why wrong: IKE version mismatch would cause a different error (e.g., 'no acceptable proposal' could appear if one side expects IKEv1 and the other IKEv2, but typically the error is more specific.
D
The remote peer's pre-shared key is incorrect
Why wrong: A pre-shared key mismatch causes authentication failure after proposal negotiation, not a proposal error.
E
The Diffie-Hellman group configured is not supported by both peers
DH group is part of the proposal; if mismatched, negotiation fails.

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related NSE7 topic practice pages

Advanced Networking and SD-WAN practice questions

Advanced VPN and Zero Trust practice questions

Enterprise Firewall and VDOMs practice questions

Advanced Threat Protection practice questions

Troubleshooting and Diagnostics practice questions

NSE7 fundamentals practice questions

NSE7 scenario practice questions

NSE7 troubleshooting practice questions

Practice scenarios

A FortiGate administrator is troubleshooting an IKEv2 VPN tunnel that fails to establish. The remote peer logs show 'no acceptable proposal' error. Which TWO possible causes should the administrator check?

An administrator is configuring a new branch office VPN using IKEv2 with PKI certificates. Which TWO steps are essential to ensure the VPN tunnel establishes successfully?

A network engineer is troubleshooting an ADVPN scenario where shortcut tunnels between spokes are not forming. The hub has IKEv2 configured and the spokes are behind NAT. Which THREE conditions must be met for shortcut tunnels to establish?

An administrator is configuring FortiClient EMS to enforce compliance for ZTNA. Which TWO settings are required on FortiGate to use compliance-based ZTNA tags?

A FortiGate is experiencing high CPU usage due to IPsec VPN traffic. The admin wants to offload cryptographic operations to the hardware. Which THREE conditions must be met for hardware acceleration to work? (Choose three.)

A FortiGate administrator is configuring OSPF over an IPsec VPN overlay in a hub-and-spoke topology. The spokes have dynamic IPs and use ADVPN. Which THREE conditions are necessary for OSPF to work correctly over the VPN tunnels?

An administrator wants to implement ZTNA with FortiClient EMS to control access to an internal web application. Which TWO components are essential for the ZTNA proxy to function correctly?

A network admin is troubleshooting why FortiGate's antivirus is not detecting a known malware sample. The sample is detected by other scanners. Which two checks should the admin perform? (Choose two.)

A FortiGate is experiencing asymmetric routing due to route leaking between VRFs. The administrator wants to ensure that traffic using a specific VRF returns via the same path. Which THREE actions should be taken? (Choose three.)

A FortiGate administrator needs to use FortiManager to deploy a new security policy to all firewalls in a specific ADOM. Which two steps are part of the installation process? (Choose two.)

An administrator needs to ensure that traffic between two VDOMs (VDOM_A and VDOM_B) is inspected by an IPS profile. Which TWO configuration elements are required? (Choose TWO.)

A FortiGate administrator is planning to use policy packages in FortiManager to manage firewall policies for multiple devices. Which TWO statements about policy packages are true?

Which TWO features are required to implement an always-on SSL VPN tunnel with FortiGate that automatically reconnects when the user's network changes?

An administrator wants to use FortiAnalyzer to generate reports for compliance. Which two data sources can be included in a FortiAnalyzer report? (Choose two.)

Which TWO statements correctly describe the behavior of SD-WAN rules when using the 'maximize-bandwidth' strategy?

A network engineer needs to collect logs from multiple FortiGates and generate compliance reports. Which TWO FortiAnalyzer features should be used?

A FortiGate administrator is planning a multi-VDOM deployment for a service provider. Which TWO statements are true about VDOM limitations and best practices?