How many Select Two (Multi-Select) Questions questions are on this page?

This page has 20 Select Two (Multi-Select) Questions scenario questions for the NSE7 exam, each with detailed explanations and wrong-answer analysis.

How should I approach NSE7 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Fortinet NSE 7 Advanced Security NSE7 questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise Fortinet NSE 7 Advanced Security NSE7 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

NSE7

exam code

Fortinet

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediummulti select

Read the full VPN explanation →

An administrator is troubleshooting a VPN tunnel that is not coming up. The remote peer is a third-party device. Which THREE actions should be taken to diagnose the issue?

A
Ensure that the pre-shared key matches on both sides.
Mismatched PSK is a common cause of tunnel failure.
B
Confirm that UDP ports 500 and 4500 are not blocked by any firewall.
Why wrong: This should be checked, but it's not one of the three most direct actions for a tunnel not coming up; it's more about network path.
C
Verify that the remote peer's IP address is reachable via ping.
Basic connectivity must exist before IKE negotiation.
D
Check the IPSec VPN logs with 'diag debug application ike -1'.
IKE debug shows detailed negotiation steps.
E
Review the routing table to ensure the remote subnet is reachable through the tunnel interface.
Why wrong: This is relevant after the tunnel is established.

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related NSE7 topic practice pages

Advanced Networking and SD-WAN practice questions

Advanced VPN and Zero Trust practice questions

Enterprise Firewall and VDOMs practice questions

Advanced Threat Protection practice questions

Troubleshooting and Diagnostics practice questions

NSE7 fundamentals practice questions

NSE7 scenario practice questions

NSE7 troubleshooting practice questions

Practice scenarios

An administrator is troubleshooting a VPN tunnel that is not coming up. The remote peer is a third-party device. Which THREE actions should be taken to diagnose the issue?

Which TWO configurations are required to enable SSL VPN authentication using a RADIUS server on a FortiGate?

An HA cluster is configured with two FortiGates in active-passive mode. The administrator wants to ensure that the secondary unit automatically takes over if the primary unit fails. Which TWO settings must be configured?

Which TWO statements are true regarding BGP path selection in a FortiGate SD-WAN environment?

Which TWO actions are appropriate when troubleshooting a slow network connection through a FortiGate?

Which TWO statements about the Security Fabric and FortiManager are correct? (Choose two.)

Which TWO statements about Security Fabric deployment are correct? (Choose two.)

An administrator is troubleshooting an HA cluster issue. The cluster consists of two FortiGate units in active-passive mode. The passive unit is showing a 'heartbeat lost' error in the logs. Which TWO configuration checks should the administrator perform to resolve this issue?

A FortiGate with multiple VDOMs is experiencing high CPU usage. The administrator suspects that one VDOM is consuming excessive resources. Which THREE methods can be used to limit resource usage per VDOM?

Which TWO of the following are required components for a Fortinet ZTNA solution? (Select two.)

Which THREE of the following are valid methods to deliver ZTNA tags to FortiClient? (Select three.)

A FortiGate administrator is planning to use policy packages in FortiManager to manage firewall policies for multiple devices. Which TWO statements about policy packages are true?

A FortiGate administrator wants to use FortiAnalyzer to view traffic logs from multiple VDOMs. Which TWO steps must the administrator perform on FortiAnalyzer?

A company has a FortiGate with multiple VDOMs. The security team wants to use FortiManager to manage policies centrally. Which three steps are necessary to set up VDOM management via FortiManager? (Choose three.)

A FortiGate administrator is planning a multi-VDOM deployment for a service provider. Which TWO statements are true about VDOM limitations and best practices?

A FortiManager administrator wants to use automation stitches to respond to a specific security event on managed FortiGates. Which THREE components are required to build an automation stitch? (Select THREE.)

A FortiGate administrator is setting up automation stitches in FortiManager to remediate threats. The stitch should run a CLI script on a managed FortiGate when a specific event is logged. Which THREE components must be configured in the automation stitch?

A FortiGate administrator wants to generate customized reports in FortiAnalyzer for different departments. The administrator needs to ensure that each department can only see its own logs. Which TWO configurations are necessary?

An enterprise FortiGate has multiple VDOMs. The security policy requires that all traffic between VDOMs must be inspected by a next-generation firewall profile. Which three steps are necessary to achieve this? (Choose three.)

A FortiGate administrator uses FortiManager automation stitches to respond to a security incident. Which THREE components must be defined in an automation stitch? (Choose THREE.)