Free Fortinet NSE 7 - Secure Networking 7.6 Architect practice test: 30 questions with answers

During DR election, the router with the highest OSPF interface priority on the segment wins, and the router ID only breaks ties. Interface cost affects route metrics rather than DR selection, and stub or area border roles do not influence the election.

OSPF requires every non-backbone area to connect to Area 0, either physically or through a virtual link, so inter-area routes can be exchanged through the backbone. Router IDs must be unique rather than shared, and stub or NSSA configuration does not replace the backbone connection.

Peers in different autonomous systems form an external BGP (eBGP) session, regardless of the tunnel that carries it. Internal BGP is used between peers in the same AS, while route reflectors and static redistribution are different mechanisms.

Because iBGP peers do not pass routes learned from other iBGP peers onward, router A withholds the prefix from peer C, which is why iBGP designs use a full mesh or route reflectors. The other options describe a different protocol's port, an unrelated attribute, or a requirement that does not exist.

Within an AS a higher local preference wins, and when earlier attributes tie, a shorter AS path is preferred. By default eBGP routes are preferred over iBGP routes and a lower MED is preferred, so the other two statements are reversed or wrong.

Separate SD-WAN rules let each application use its own strategy: best quality chooses the member with the best measured SLA for VoIP, and lowest cost picks the cheapest member that meets the file sync SLA. Manual pinning, fixed static policy routes, and equal load balancing ignore the requirement.

IKEv2 establishes the IKE and child SAs with fewer message exchanges than IKEv1 and natively supports EAP for client authentication. It still requires an authentication method, works with route-based tunnels, and uses UDP port 500 for IKE rather than port 179.

A route-based IPsec tunnel terminates on a virtual IPsec interface that routing protocols such as BGP can peer over, and that can carry route metrics for failover. Policy-based tunnels depend on proxy IDs and offer less routing flexibility, while manual keys and L2TP do not fit the requirement.

ADVPN lets the hub tell spokes about a better direct path (auto-discovery sender on the hub, receiver on the spokes), so they build on-demand shortcut tunnels between themselves. A full static mesh would need a tunnel per pair, an FGCP cluster adds hub redundancy rather than spoke-to-spoke paths, and static routes to the hub keep traffic on the hub.

Two hubs give the spoke redundant paths, so it stays connected when one hub, data center, or link fails. The other options describe routing shortcuts, shared SAs, or key sharing that do not reflect how multihub designs work.

Perfect forward secrecy runs a new Diffie-Hellman exchange when the phase 2 keys are created, so a later compromise of long-term keying material does not expose earlier captured sessions. DPD detects dead peers, split tunneling changes the routing scope, and IKE fragmentation handles message size, so none meets the auditor's requirement.

Dead peer detection sends probes to the remote IKE peer and removes the SA when the peer stops answering, so traffic is not sent into a dead tunnel. PFS, split tunneling, and replay protection do not detect a failed peer, so they cannot fix this symptom.

Automation stitches link a Security Fabric trigger, such as a threat detection, to an action such as quarantining the endpoint through FortiClient EMS, so no manual step is needed. The scheduled script only exports logs, the logging policy records events without acting on them, and a DNS filter does not isolate the endpoint.

In an automation stitch, the trigger is the Security Fabric event that starts the stitch and the action is the response it carries out. Reversing the two roles is the common mistake. The other options either swap the roles or invent a shared report requirement that stitches do not have.

FGCP forms one logical cluster with a primary and secondary unit, a heartbeat link, and shared configuration and session state, which is what the scenario describes. FGSP only synchronizes sessions between independent peers, VRRP is a gateway redundancy protocol without cluster configuration sync, and OSPF timers do not create a firewall cluster.

FGSP synchronizes session information between two peers that are not joined in one FGCP cluster, so return traffic that reaches the other firewall can still match its session. FGCP needs a cluster with a heartbeat, VRRP only provides gateway redundancy, and static route distances do not share session state.

VDOMs split one FortiGate into separate virtual firewalls, each with its own configuration, routing table, and administrators, which matches the separation the provider needs. VLAN subinterfaces only tag traffic and share one routing table, SD-WAN zones group WAN links, and connectors import address data.

A VLAN subinterface is a logical interface that matches 802.1Q-tagged frames with a VLAN ID on a parent physical port, so one port can carry many isolated VLANs. The claim that each subinterface needs its own port is wrong, and VLAN IDs must be unique within the switched network, not just per subnet.

Zero-touch provisioning lets a pre-registered device fetch its configuration from the central manager once it has power and connectivity, so no engineer is needed on site. The USB, emailed-CLI, and manual static-route options all depend on local staff or an engineer configuring each unit.

Metadata variables store a value for each managed device, such as a site name or local subnet, and FortiManager substitutes them into shared templates and objects. The archive option describes firmware storage, the policy-order option misdescribes how policies are ordered, and the serial-number option misstates how devices are identified.

The SD-WAN overlay template wizard in FortiManager generates hub and spoke IPsec overlay configuration, including BGP over the tunnels, from one reusable template. A console script or a copied static route table is manual for each device, and a FortiAnalyzer report shows tunnels but does not create them.

ADOMs group managed devices into a shared object and policy database, and policy packages are pushed from FortiManager to the devices assigned to them. The statements that each device needs its own FortiManager or that an ADOM is limited to one hardware model are not correct.

An ADOM is the FortiManager container that groups managed devices for management, while a VDOM is a virtual firewall instance inside a single FortiGate. The other options swap or merge the two concepts, which is a common point of confusion.

A shared SD-WAN template with per-device variables lets one rule design fit all 80 branches while each branch supplies its own interface names and gateways. Hand-editing copies, a single policy fixed to one branch's values, and a report that only exports settings do not give a controlled template that scales.

Certificate inspection only examines the certificate exchange, so the encrypted payload is not decrypted and content-based antivirus cannot see file contents. Full (deep) inspection would decrypt the traffic. The other options invent restrictions that FortiGate does not apply.

ISDB provides Fortinet-maintained internet service objects, such as the address ranges of popular cloud applications, that are updated automatically so administrators do not maintain IP lists by hand. The other options describe web filter data, identity credentials, and IPS history, which are stored elsewhere.

With certificate inspection, the web filter can classify an HTTPS request from the domain name exposed during the TLS handshake, but URL paths and query strings inside the encrypted session are not visible without full inspection. The other statements claim paths are exposed, that category filtering needs full inspection, or that blocking happens after the page loads.

Application control identifies applications using signatures and their behavior, so it can recognize an app even when it does not use its default port. Port numbers alone, user account lists, and DHCP lease tables do not identify applications.

A pass action logs the matching traffic and lets it continue, which supports tuning while nothing is dropped. A block action drops the traffic, a rate limit caps flows rather than observing a signature, and an allow-list entry is an exception rather than a way to observe a new signature.

An exemption entry in the SSL inspection profile skips decryption for the named destination while all other HTTPS remains inspected. Disabling antivirus across the VDOM, turning off IPS broadly, or using DNS to redirect the bank weakens protection more widely and is not a precise exemption.