Fortinet NSE 7 - Secure Networking 7.6 Architect

Last checked November 10, 2026 against the official Fortinet exam page.

1. Question 1Rules and Routing

   Three OSPF routers share one broadcast LAN segment. The administrator wants one specific FortiGate to become the designated router (DR) at the next election. Which setting gives that unit the best chance of winning?

   1. AA lower OSPF cost on the interface facing the segment, so the link looks cheaper
   2. BAn area border router role placed on the unit between area 0 and area 1
   3. CA stub area configuration applied to the segment's interface so that it stays passive
   4. DA higher OSPF interface priority configured on that FortiGate's interface
   Show answer and explanationHide answer

   Correct answer: D

   During DR election, the router with the highest OSPF interface priority on the segment wins, and the router ID only breaks ties. Interface cost affects route metrics rather than DR selection, and stub or area border roles do not influence the election.

2. Question 2Advanced IPsec

   An architect is choosing between IKEv1 and IKEv2 for a new site-to-site VPN. Which advantage does IKEv2 offer?

   1. AIt removes the need for any authentication method, such as a pre-shared key or certificate
   2. BIt runs only in policy-based mode, so route-based virtual interfaces cannot carry the tunnel
   3. CIt uses UDP port 179 for its key exchange, which lets it pass through BGP filters
   4. DIt needs fewer message exchanges and supports EAP for client authentication
   Show answer and explanationHide answer

   Correct answer: D

   IKEv2 establishes the IKE and child SAs with fewer message exchanges than IKEv1 and natively supports EAP for client authentication. It still requires an authentication method, works with route-based tunnels, and uses UDP port 500 for IKE rather than port 179.

3. Question 3System Configuration and SD-WAN Setup

   A FortiGate administrator wants a host that triggers a high-severity IPS detection to be quarantined through FortiClient EMS automatically, with no manual step. Which Security Fabric feature should be configured?

   1. AA recurring scheduled CLI script that exports the IPS log to a file every hour
   2. BA static firewall policy that logs every high-severity event to local disk
   3. CAn automation stitch that runs an EMS quarantine action after the detection
   4. DA DNS filter profile that blocks the affected host's domains for all users
   Show answer and explanationHide answer

   Correct answer: C

   Automation stitches link a Security Fabric trigger, such as a threat detection, to an action such as quarantining the endpoint through FortiClient EMS, so no manual step is needed. The scheduled script only exports logs, the logging policy records events without acting on them, and a DNS filter does not isolate the endpoint.

4. Question 4Central Management

   A company receives 15 preconfigured FortiGate units for remote offices. Local staff will only connect power and the WAN cable, and each unit must pick up its full configuration without an engineer on site. Which approach fits this requirement?

   1. ARegister each unit's serial number on the central manager so it self-provisions when online
   2. BEmail each office a text file of CLI commands and ask staff to paste them into the console
   3. CSet a default static route on each unit and create the firewall policies later by hand
   4. DShip each unit with a console-loaded configuration file that staff copy in from a USB stick
   Show answer and explanationHide answer

   Correct answer: A

   Zero-touch provisioning lets a pre-registered device fetch its configuration from the central manager once it has power and connectivity, so no engineer is needed on site. The USB, emailed-CLI, and manual static-route options all depend on local staff or an engineer configuring each unit.

5. Question 5Security Profiles

   A security team enables certificate inspection in an SSL inspection profile for outbound HTTPS traffic. Later they find that antivirus does not inspect the contents of files downloaded in those sessions. What is the most likely explanation?

   1. ACertificate inspection reads the certificate without decrypting the payload
   2. BThe web filter profile overwrites the antivirus profile whenever a URL category matches
   3. CAntivirus profiles cannot be applied to any policy that uses an SSL inspection profile at all
   4. DAntivirus scanning works only on plain HTTP traffic and is disabled for all HTTPS sessions
   Show answer and explanationHide answer

   Correct answer: A

   Certificate inspection only examines the certificate exchange, so the encrypted payload is not decrypted and content-based antivirus cannot see file contents. Full (deep) inspection would decrypt the traffic. The other options invent restrictions that FortiGate does not apply.