NSE7_FSN_AR-7.6 Fortinet NSE 7 - Secure Networking 7.6 Architect Questions and Answers

The Enterprise Firewall 7.6 Administrator Study Guide specifically warns that all-zero phase 2 selectors can introduce invalid paths during migrations, particularly when many routes are advertised across VPN tunnels or overlapping networks exist. One recommended mitigation is to use dynamic routing protocols to explicitly control which subnets are permitted and advertised through the tunnel, making A correct.

Fortinet also recommends defining the required encryption domains precisely in the phase 2 selectors. Specifying the exact network segments ensures that only designated traffic is eligible for the IPsec tunnel, making D correct. An IPsec aggregate provides redundancy but does not solve inappropriate route or encryption-domain selection. Assigning IP addresses to tunnel interfaces can support routing designs, but it is not the documented mitigation for invalid paths caused by overly broad all-zero selectors.

================

Intermittent behavior (working sometimes, failing others) points to resource or connectivity fluctuations rather than static misconfigurations.

B. Check that FortiGate is not entering conserve mode:

Reason: When FortiGate enters Conserve Mode (due to high memory usage), it changes its inspection behavior to save resources. Depending on the av-failopen setting, it may either bypass inspection (allowing blocked sites) or drop traffic (blocking valid sites) temporarily until memory recovers. This flapping between states causes intermittent filtering issues.

D. Check that the communication between FortiGate and FortiGuard is stable:

Reason: The Web Filter engine relies on real-time queries to the FortiGuard Distribution Network (FDN) to categorize URLs that are not in the local cache. If the internet connection or the specific path to FortiGuard is unstable (packet loss, latency), queries will time out. This results in " Rating Errors, " which can block or allow traffic unpredictably based on the " Allow websites when a rating error occurs " setting.

Why other options are incorrect:

A: A mismatch in inspection mode (e.g., Profile set to Proxy, Policy set to Flow) is a static configuration error. It would typically result in the profile not being selectable or consistently failing/not applying, rather than working intermittently.

C: If the wrong port is mapped (e.g., HTTP on 8080 is not mapped), the inspection engine will consistently ignore traffic on that port. It would not be intermittent.

The correct answers are A and D.

The debug output shows:

Sent RADIUS req to server ' RadiusServer ' : IP=172.25.188.164 ... user= " student " using CHAP

Result for radius svr ' RadiusServer ' 172.25.188.164(0) is 0

Sending result 0 for req 2

The study guide explains that in RADIUS real-time debug, FortiGate shows the IP address of the RADIUS server it is querying. In the example, it says FortiGate “creates an access request to the RADIUS server at IP address 10.0.13.130” and shows the line Sent radius req to server ... IP=10.0.13.130

So in your exhibit, the queried server is clearly 172.25.188.164, which makes A correct.

The study guide also states:

“The message fnbamd_comm_send_result-Sending result 0 indicates that the authentication was successful and that FortiGate received the Access-Accept message.”

Since your exhibit also ends with Sending result 0, that makes D correct.

Why the other options are wrong:

B is wrong because result 0 means authentication successful, not failed

C is wrong because the debug explicitly shows using CHAP, and the study guide lists supported RADIUS schemes as CHAP, PAP, MS-CHAP, and MS-CHAPv2

E is wrong because the study guide says two-factor authentication would involve an Access-Challenge response: “If two-factor authentication is enabled on the server, the response is an Access-Challenge message”Your exhibit shows successful result 0 / Access-Accept, not a challenge.

So the verified answers are: A, D.

The correct answers are B and C. The session table output clearly shows policy_id=1, which means the traffic matched firewall Policy ID 1. That directly validates option B. The output also shows NPU-related offload indicators, including npu_state=... ips_offload and npu info: ... offload=8/8, ips_offload=1/1. These fields indicate that the session has been offloaded to hardware, so option C is correct. The study guide explains that FortiGate can offload sessions to network processors after session establishment, allowing subsequent packets to bypass normal CPU/kernel processing for improved performance. It also states that offloaded sessions are handled by the network processor rather than the CPU path.

Option A is too specific and is not proven by the exhibit. The output shows NPU offload, but it does not explicitly identify the hardware as NP7. Do not assume NP7 unless the platform or output confirms it. Option D is wrong because the VLAN-related fields show vlan=0x0000/0x0000 and vtag_in=0x0000/0x0000, which means the traffic is not VLAN-tagged.

Comprehensive and Detailed 100 to 150 words of Explanation From Secure Networking Architect Study Guides topics:

FortiManager creates configuration revisions following several events, including installations, explicit configuration retrievals, automatic updates, and scripts executed directly on managed FortiGate devices. The FortiManager 7.6 Administrator Study Guide specifically explains that scripts run using Remote FortiGate Directly (via CLI) can cause an automatic update and create a new revision-history entry.

This accounts for the script_manager process and subsequent retrieve activity visible in the exhibit. script_manager represents FortiManager ' s script-processing mechanism; it is not an FDN API administrator, eliminating D. The Configuration and Installation widget belongs to FortiManager ' s device-management interface rather than being something the administrator must inspect directly on FortiGate, eliminating B. The revision history itself identifies which administrator or process generated a revision, so the proposed system-log filtering in C is unnecessary and incorrectly specified.

================

The command on this slide shows a summary of the statuses of all the OSPF neighbors. For each neighbor, it displays the adjacency state and if it is a DR, a BDR, or neither (DROther) Pagina 362 Enterprise_Firewall_7.2_Study. - Point-to-point networks contain only two peers, one at each end of a point-to-point link - Broadcast networks (multi-access) support more than two attached routers. They also support sending messages to multiple recipients (broadcasting). Pagina 365 Enterprise_Firewall_7.2_Study. In any multi-access network there is one DR and one BDR. Pagina 439 Network_Security_Support_Engineer_7.4_Study FULL/- This represents a point-to-point network

Comprehensive and Detailed 100 to 150 words of Explanation From Secure Networking Architect Study Guides topics:

Application-based SD-WAN steering depends on FortiGate being able to associate the new session with an already identified application. The SD-WAN 7.6 guide explains that the ISDB application cache contains an application ID, ISDB application ID, and 3-tuple, and FortiGate uses these values when matching an SD-WAN rule. If the new session ' s 3-tuple is absent from the cache, FortiGate cannot initially identify it as GoToMeeting for rule 1, so normal processing can select the implicit rule.

Application identification can occur only after traffic has already entered the session. That identification does not retroactively change the initial routing decision for packets already associated with the session. GoToMeeting belongs to the Collaboration criteria shown for rule 1, so A is false. Full SSL inspection is not intrinsically required for this SD-WAN application-cache mechanism, eliminating D.

================

We must analyze the flags (*, > , S, O, B) and Administrative Distances (AD) shown in the get router info routing-table database exhibit to determine the correct statements.

Analysis for Option A (The BGP route to 10.0.4.0/24 is not in the forwarding information base):

True. Look at the entry for 10.0.4.0/24.

There is an OSPF route: O * > 10.0.4.0/24 [110/2]. The * indicates it is in the FIB, and > indicates it is the selected route.

There is a BGP route: B 10.0.4.0/24 [200/10]. This line lacks the * flag.

Reason: The OSPF route has an Administrative Distance of 110. The BGP route (iBGP) has an AD of 200. Since 110 is lower than 200, OSPF wins, and the BGP route is not installed in the Forwarding Information Base (FIB).

Analysis for Option B (The default static route through 10.200.1.254 is in the forwarding information base):

True. Look at the 0.0.0.0/0 entries.

The first entry is S * > 0.0.0.0/0 [10/0] via 10.200.1.254.

The * flag confirms this specific route is installed in the FIB.

The second static route (via 10.200.2.254) has a higher distance ([20/0]) and no * flag, so it is inactive.

Why C is False: ECMP (Equal Cost Multi-Path) requires routes to have the same cost/priority. Here, one static route has AD 10 and the other has AD 20. They are not equal, so ECMP is not performed.

Why D is False: The routing table database shows active routes, not the raw Link State Advertisement (LSA) database. You cannot determine the number of LSAs received solely from this output.

The output explicitly states This router is an ABR. An OSPF area border router has interfaces participating in multiple OSPF areas and provides connectivity between those areas and the backbone. Therefore, A is correct.

The output also states that the RFC1583Compatibility flag is enabled. The Enterprise Firewall 7.6 Administrator Study Guide explains that FortiGate can use RFC 1583-compatible OSPF path selection for ECMP, where eligible external routes of equal cost can be installed concurrently. This makes D correct.

Nothing in the displayed status identifies the FortiGate as a backup designated router, so B cannot be concluded. Option C describes an autonomous system boundary router (ASBR), which originates external LSAs when redistributing routes into OSPF. Being an ABR does not by itself mean the router is injecting external routing information.

================

FortiGate requires an eligible SD-WAN member to have a valid route to the destination in the forwarding information base (FIB). Therefore, a member without such a route cannot be selected, making B correct. FortiGate also performs a FIB best-match check when evaluating an SD-WAN rule. If the resolved best-route interface is not an SD-WAN member, FortiGate skips that SD-WAN rule, confirming D.

ISDB routes operate as policy routes and are evaluated before SD-WAN rules, so C is also correct. A static route does not automatically bypass SD-WAN; static routes can provide the FIB routes required by SD-WAN members. Likewise, directly connected routes do not categorically take precedence over every SD-WAN rule. The applicable behavior depends on FIB resolution and whether the resolved interface belongs to SD-WAN.

================

The exhibit identifies the root VDOM as the management VDOM, indicated by the green check mark. The Enterprise Firewall 7.6 Administrator Study Guide explains that the management VDOM handles FortiGuard database downloads, license validation, and FortiGuard rating connectivity on behalf of the entire FortiGate system. It states that FortiGuard updates obtained through the management VDOM “will affect all VDOMs.”

Consequently, the root VDOM must reach either a public Fortinet Distribution Network server or a FortiManager configured as a FortiGuard Distribution Server in an isolated environment. The guide specifically identifies connectivity to “a FortiManager serving as a FortiGuard Distribution Server (FDS) in a closed network” as the alternative to public FortiGuard access. Loss of both paths prevents Core1 and Core2 from using current FortiGuard web-filtering information. Therefore, options A and B are correct.

Core1 and Core2 do not need to become management VDOMs; FortiGate uses one designated management VDOM for these system-level services. A VDOM link is used to route user traffic between VDOMs and is not required for distributing FortiGuard services, eliminating option D.

The 8.8.8.8/32 route is visible in the OSPF database on FGT-B but not installed into the routing table—the most likely explanation is that FGT-B is filtering it from being installed.

The study guide states:

“The kernel memory slabs are collections of objects with a common purpose. The kernel uses them to store information in memory.”

It also gives the exact calculation rule:

“Total slab size = available objects x object size”

From the exhibit:

tcp_session 3 5 1500 ...

So:

available objects = 5

object size = 1500

Therefore:

Total slab size = 5 × 1500 = 7500 kB

That makes D correct, and it is associated with the kernel, not user space.

Why the other options are wrong:

A is wrong because sctp_session 0 0 1600 ... gives 0 × 1600 = 0, but slabs are associated with the kernel, not user space.

B is wrong because ip_session 1 3 1200 ... gives 3 × 1200 = 3600, but again slabs are kernel memory, not user space.

C is wrong because ip6_session 0 0 1300 ... gives 0 × 1300 = 0, not 1300.

The correct answer is D. IKE_AUTH.

The study guide explicitly states:

“IKE_Auth exchange:

• Performs the mutual authentication of two IKE endpoints.

• Configures settings like IP/mask, DNS, and so on.

• Sets up the piggyback of a child SA. Negotiates IP flow and security settings for the IPsec SA.”

It also says:

“By default, a piggyback child (IPsec) SA is negotiated along with the IKEv2 SA during IKE_AUTH. If additional IPsec SAs are needed … they are negotiated during subsequent CREATE_CHILD_SA exchanges.”

Why the other options are wrong:

A. IKE_SA_INIT is incorrect because this exchange negotiates the security settings to protect the IKE traffic, not the first CHILD_SA.

B. INFORMATIONAL is incorrect because it is used to convey control messages between IKE endpoints.

C. CREATE_CHILD_SA is incorrect for the first CHILD_SA, because it is used to create new additional child SAs or rekey existing ones after the initial exchange.

Remote breakout sends selected internet traffic through a centralized hub or gateway, where common security inspection and policy enforcement can be applied. This reduces the amount of security configuration that must be maintained independently at individual branches, making A correct.

Cloud on-ramp designs are intended to optimize connectivity between branches and cloud-hosted applications or services. By steering traffic toward an appropriate cloud gateway or optimized path, the design can improve application performance, making D correct.

DIA performs local internet breakout at the branch. It can reduce latency, but the branch must provide the required local security inspection, so it is not specifically intended for devices with limited security capabilities. A standalone SD-WAN deployment also normally derives value from multiple WAN paths; a site with only one WAN link provides no meaningful SD-WAN path-selection advantage.

================

The Enterprise Firewall 7.6 Administrator Study Guide ' s multiregion ADVPN example uses iBGP inside each region and eBGP between the two regions. On the hubs ' spoke-facing ADVPN phase 1 interfaces, Fortinet configures auto-discovery-sender enable so the hub can initiate ADVPN shortcut negotiation. It also configures network-id to identify the corresponding overlay. Therefore, B matches the documented configuration.

auto-discovery-receiver is associated with the spoke role and does not pair with remote-ip for this hub configuration. The separate hub-to-hub IPsec tunnel uses auto-discovery-forwarder enable to forward ADVPN shortcut information between regions. However, remote-as is a BGP neighbor parameter, not an IPsec phase 1 parameter. Consequently, D combines settings belonging to different configuration contexts.

================

The correct answer is C.

The exhibit shows:

562 in ESTABLISHED state

27 in CLOSE state

memory_tension_drop=0

ephemeral=0/131072

According to the study guide, for TCP sessions: “The protocol state in the session table is a two-digit number. For TCP, the first number (from left to right) is related to the server-side state and is 0 when the session is not subject to any inspection (flow or proxy)… The second digit is the client-side state.” The same page also shows that value 1 = ESTABLISHED

So, if a TCP session is in ESTABLISHED state and there is no inspection, its proto_state is 01:

first digit 0 = no inspection

second digit 1 = ESTABLISHED

That makes C correct. This is also consistent with FortiOS examples showing established TCP sessions with proto=6 proto_state=01

Why the other options are wrong:

A is wrong because the field that indicates sessions dropped due to low free memory is memory_tension_drop, and in the exhibit it is 0, not 113. The study guide states: “If there is a lack of free memory, the kernel deletes the oldest sessions. The command shown on this slide displays the number of sessions the kernel deleted because of this mechanism.”So 113 is the clash value, not memory-tension drops.

B is wrong because ephemeral=0/131072 does not mean 131072 ephemeral sessions were recorded. The study guide explains that FortiGate “sets a hard limit on the maximum number of ephemeral sessions that can exist at the same time in the session table.”Therefore:

0 = current ephemeral sessions

131072 = maximum allowed ephemeral sessions for that model/context

D is wrong because the study guide says the temporary retention for possible out-of-order packets happens in state value 5 (TIME_WAIT): “When a session is closed by both the sender and receiver, FortiGate keeps that session in the session table for a few seconds, to allow for any out-of-order packets that might arrive after the FIN/ACK packet. This is the state value 5.”But the exhibit shows 27 in CLOSE state, and the same table shows CLOSE = 6, not TIME_WAIT

So the verified answer is C.

The get router info ospf database brief output on FGT-2 clearly indicates that Area 0.0.0.5 is configured as a [Stub] area.

In OSPF, a Stub Area is specifically designed to reduce the size of the Link State Database (LSDB) on internal routers. The primary behavior of a Stub area is that it does not accept Type 5 (AS External) LSAs.

FGT-3 is the ASBR (Autonomous System Border Router) and is importing static routes, which are generated as Type 5 LSAs in the OSPF domain.

FGT-1 acts as the ABR (Area Border Router). Because Area 0.0.0.5 is a Stub area, FGT-1 blocks these Type 5 LSAs from entering Area 0.0.0.5.

Consequently, FGT-2 will not receive the specific external routes advertised by FGT-3. Instead, the ABR (FGT-1) injects a default route (0.0.0.0/0) into the Stub area to allow connectivity to the external world, which is visible in the database output.

While the question text mentions FGT-3 not receiving routes, the definitive configuration shown in the exhibit is the Stub area setting, which directly corresponds to the blocking of Type 5 LSA propagation (Option A).

The exhibit includes these key debug lines:

start_search_dn-base: ' DC=TAC,DC=ottawa,DC=fortinet,DC=com ' filter:sAMAccountName=jsmith

get_all_dn-Found DN 1:CN=John Smith,CN=Users,DC=TAC,DC=ottawa,DC=fortinet,DC=com

The study guide explains that in regular bind, LDAP authentication has four steps, and that during step 2, FortiGate searches the LDAP tree to find the user’s DN:

“During the second step, FortiGate does a search query in the LDAP database to find the user’s location—in other words, the user’s DN. If the user is found, the server replies with the user’s DN.”

It also states for the real-time debug of step 2:

“An fnbamd_ldap_build_dn_search_req-base message indicates that FortiGate is performing step two: searching for the user in the LDAP tree. This message includes the base branch (distinguished name setting) and the name of the attribute used to locate the user... If the LDAP server finds the user, the output shows the user’s full DN.”

That directly proves:

D is correct because the debug is showing step 2: Search Request

A is correct because the base DN and found DN are under DC=TAC,DC=ottawa,DC=fortinet,DC=com, which corresponds to the LDAP domain/tree root TAC.ottawa.fortinet.com

Why the other options are wrong:

B is wrong because binding with the user’s credentials is step 3, not the step shown here. The study guide says: “Step 3 – Bind user credentials” and shows that this happens later with fnbamd_ldap_build_userbind_req / __ldap_build_bind_req-Binding to ' CN=John Smith... '

C is wrong because collecting user group information is step 4, not the step shown in the exhibit. The study guide says: “The last step is to get the user group information” and shows step 4 with Attr query / memberOf search

The key point is that the two VPNs are dynamic dialup IPsec tunnels on the same interface and both are using IKEv1 main mode. In this design, FortiGate cannot reliably distinguish which dialup phase1 to match before phase 1 completes.

The uploaded Network Security Support Engineer 7.6 Study Guide shows that XAuth happens only after phase 1 is already established:

“The IKE real-time debug shows, after phase 1, the exchange of extended authentication (XAuth) packets… You can also see the CFG_REPLY, showing the XAuth user and group name.”

That means the user group is learned too late to be used for selecting the correct phase1 definition. So the fix must be applied to the phase1 matching method itself, not to XAuth.

The FortiOS administration guide gives the exact rule for this scenario:

“When the remote VPN peer has a dynamic IP address and is authenticated by a pre-shared key you must select Aggressive mode if there is more than one dialup phase 1 configuration for the interface IP address.”

For Option A:In Fortinet BGP (and standard BGP), when a prefix is displayed with an " i " (lowercase i) in the Path column, it represents an internal prefix that originated from the local router, typically configured via the BGP " network " command. In the exhibit, the prefix 10.20.30.0/24 is listed with a Path value of i, indicating it was injected into BGP by the local router using the network statement, not via redistribution from another routing protocol. The same logic applies to i as documented: " Origin code ' i ' means the route was injected via the network command. "

For Option D:The get router info bgp network output is a summary table displaying both local and received BGP routes. It lists all known routes to the BGP process, whether received from peers or originated locally. The exhibit shows all BGP prefixes known to the local router, matching the official admin guide’s description of this command’s output.

Explanation for B and C:

The phrase “legacy route advertisement” is not formalized in BGP documentation or Fortinet’s admin guide; the output uses standard BGP mechanics.

If a route was redistributed into BGP from another routing protocol, the Path field would display a " ? " (question mark) for incomplete (redistributed) origin. Here the /24 route has " i " so it is NOT a redistribution.

To determine the correct reasons for the adjacency failure, we must analyze the standard OSPF real-time debug output (diagnose ip router ospf all enable or diagnose sniffer packet) typically provided in this exam exhibit.

Analyze the Debug Output:

The debug output in this specific question scenario typically displays an incoming Hello packet line: OSPF: RECV[Hello]: ... auth-type 0 ...

" RECV " : Indicates the packet is coming from the Remote peer.

" auth-type 0 " : Indicates the Remote peer is sending " Null " (No) authentication.

Analyze the Failure:

The adjacency fails because the Local FortiGate is rejecting this packet.

If the Local FortiGate accepts " No Authentication " , it would match auth-type 0 and form the adjacency.

Since it is failing (and producing a debug log), the Local FortiGate must be expecting a different authentication type (Type 1 Cleartext or Type 2 MD5).

Evaluate the Options:

A. The remote peer has either OSPF cleartext or MD5 authentication configured.

Incorrect. The debug shows auth-type 0 (No Auth) coming from the remote peer.

B. There is an OSPF authentication configuration mismatch.

Correct. One side is sending " No Auth " (Remote), and the other expects " Auth " (Local). This is a definition of a mismatch.

C. The local FortiGate does not have OSPF authentication configured.

Incorrect. If the Local unit had " No Auth " configured, it would match the Remote ' s auth-type 0, and the adjacency would come up. The failure implies the Local unit does have auth configured.

D. The local FortiGate has either OSPF cleartext or MD5 authentication configured.

Correct. Because the Local unit is rejecting the " No Auth " packet from the remote peer, it confirms that the Local unit has authentication enabled (expecting Type 1 or 2).

Conclusion: The breakdown of the OSPF negotiation shows that the Remote peer is sending no authentication (Type 0), while the Local FortiGate expects authentication, resulting in a mismatch.

The correct answers are A, D, and E. This is a feasible path RPF check scenario. In FortiGate’s default RPF behavior, FortiGate checks whether the routing table contains a valid return route to the source IP address through the same interface on which the packet arrived. The study guide’s RPF feasible path example states that FortiGate “checks the routing table for a route that matches the source address and incoming interface of the first original packet.” It then gives the exact result: User A passes because “there is a default route through wan1,” so packets received on wan1 pass the RPF check regardless of source address. User B fails because FortiGate does not have a route to 95.56.234.24 through wan2. User C fails because FortiGate does not have a route to 10.0.4.63 through port1. Therefore, option B is wrong because FortiGate is not allowing asymmetric return routing here. Option C is wrong because the default route points out wan1, not port1, so it cannot validate User C’s packet arriving on port1.

Comprehensive and Detailed 100 to 150 words of Explanation From Secure Networking Architect Study Guides topics:

Fortinet documents three values for the phase 2 route-overlap setting: use-new, use-old, and allow. The required value for simultaneous VPNs advertising overlapping remote subnets is allow.

With route-overlap allow, FortiGate keeps the existing dial-up VPN active and also accepts the newly connected VPN. The Enterprise Firewall 7.6 Administrator Study Guide explicitly states that traffic from the central FortiGate is then load-balanced using equal-cost multipath across both VPNs. This directly satisfies the scenario and makes C correct.

The default use-new setting disconnects the existing VPN and accepts the new one, while use-old keeps the existing VPN and rejects the new connection. Neither produces ECMP. multipath enable and net-device ecmp are not the phase 2 commands FortiOS uses to permit overlapping dial-up VPN routes.

================

The correct answer is C. 64.26.151.37.

The study guide explains the FortiGuard flags shown by diagnose debug rating:

D = Default

I = Initial

T = Timing

F = Failedand specifically: “F = The server is down”

So even though 121.111.236.179 has the lowest RTT in the exhibit, it has the F flag, meaning FortiGate considers that server failed/down, so it will not be chosen.

To determine which active server is selected, the FortiOS administration guide states:

“The server list is sorted first by weight. The server with the smallest RTT appears at the top of the list regardless of weight. … Therefore the top position in the list is selected based on RTT while the other positions are based on weight.”

Among the valid, non-failed choices in the exhibit:

64.26.151.37 → RTT 45

209.22.147.36 → RTT 103

96.45.33.65 → RTT 144

208.91.112.194 → RTT 107

The active server with the lowest RTT is 64.26.151.37, so that is the server FortiGate will choose.

So the verified answer is: C.

The correct answer is D. The inbound IPsec SA was copied to the NPU.

The exhibit shows:

npu_flag=02

dec_npuid=1

enc_npuid=0

The study guide gives the exact meaning of the npu_flag field:

npu_flag=00 = Both IPsec SAs loaded to the kernel

npu_flag=01 = Outbound IPsec SA copied to NPU

npu_flag=02 = Inbound IPsec SA copied to NPU

npu_flag=03 = Both outbound and inbound IPsec SAs copied to NPU

It also explains: “If the first IPsec packet is inbound and can be offloaded, the inbound SA is copied to the NPU and the npu_flag changes to 02. After both SAs are copied to the NPU, the npu_flag changes to 03.”

So with npu_flag=02, only the inbound SA has been copied to the NPU. That makes D correct.

Why the other options are wrong:

A is wrong because outbound-only offload would be npu_flag=01, not 02

C is wrong because both directions offloaded would be npu_flag=03, not 02

B is wrong because dec_npuid=1 identifies the NPU ID used for decryption, but it does not state that the processor is specifically NP6. The study guide only maps the offload state through the npu_flag values in this context, not the NPU model from this field alone

So the verified answer is: D.

FortiOS performs several routing checks before standard forwarding-table processing. The FortiOS 7.6 Administrator Study Guide describes the sequence explicitly. FortiGate first evaluates regular policy routes. If no applicable policy route forwards the packet, FortiGate evaluates Internet Service Database routes, followed by configured SD-WAN rules.

Only after those policy-routing mechanisms have been evaluated does FortiGate perform the standard forwarding information base (FIB) lookup. Static and dynamically learned routes, including BGP routes, are represented in this normal routing stage.

Consequently, among the available choices, the correct ordering is policy routes, ISDB routes, SD-WAN rules, and then static routes through the FIB. Options A and B incorrectly place SD-WAN before ISDB or policy routing, while C incorrectly places SD-WAN ahead of the regular policy-routing stages. Therefore, D is correct.

================

The output on FGT-01 confirms that the device is actively encapsulating traffic and sending it as ESP packets (Protocol 50) out of port1 towards the IP address 97.86.16.52. The logs show outgoing packets, which confirms FGT-01 is attempting to initiate or maintain the tunnel and that NAT-Traversal is not being used (as it uses raw ESP).

The output on FGT-02, however, displays (no packets captured). This is significant because the sniffer command diagnose sniffer packet any ' esp ' captures traffic at the network interface level (ingress), regardless of whether a matching VPN configuration exists on the receiving unit. The absence of packets proves that the ESP traffic generated by FGT-01 is physically not arriving at FGT-02 ' s interface.

This behavior is explained by two primary factors:

Option A (Blocking): An intermediate device, such as an ISP router or firewall, is dropping Protocol 50 traffic. Unlike UDP 500/4500, raw ESP is often blocked by default on many networks or legacy devices.

Option C (Routing/Misconfiguration): If the administrator configured the wrong remote peer IP on FGT-01, the packets are being routed to a different destination entirely. Consequently, they never arrive at FGT-02 to be captured.

Option B is incorrect because even without a configured VPN tunnel, the sniffer would still display the incoming ESP packets if they were reaching the interface. Option D is incorrect because FGT-01 is sending ESP, making ' esp ' the correct filter.

The correct answers are B and C.

The study guide has a section titled “Not Verified Status on the Collector Agent” and states:

“The collector agent cannot verify if the user is still logged in” and lists these common causes:

“A firewall is blocking traffic to port 139 and 445”

“The workstation remote registry service is not running”

The guide also explains the verification method:

“For WMI polling mode, the collector agent checks the WMI service. For all the other modes, the collector agent checks the HKEY_USERS hive through remote registry services.” If the workstation does not respond to these checks, the status can become not verified

An additional requirements slide in the same study guide confirms:

“TCP ports 139 and 445 must be open between the collector agent and all workstations”

“Remote registry service must be up and running on each workstation”

Why the other options are wrong:

A is wrong because the study guide mentions a workstation coming out of hibernate mode under a different problem: “No Internet After IP Address Change”, not as a common cause of Not Verified status

D is wrong because DNS resolution issues are also discussed under the IP address change scenario, where the collector agent uses DNS to resolve the workstation name after an IP change. That is separate from the Not Verified causes listed for this log message

So the verified answers are: B, C.

From the exhibit, you can observe that the debug output captures an IKEv1 negotiation in aggressive mode. Let ' s break down the supporting details in line with official Fortinet IPsec VPN troubleshooting resources and debug guides:

For Option B:

The very first line of the debug output shows:

comes 10.0.0.2:500- > 10.0.0.1:500, ifindex=7.

This indicates the traffic direction—from the remote IP (10.0.0.2) with port 500 to the local IP (10.0.0.1) with port 500. According to Fortinet ' s documentation, the right side of the arrow always represents the local FortiGate gateway. Thus, 10.0.0.1 is the local gateway IP address.

For Option D:

You see the statement:

negotiation result " remote "

and

received peer identifier FQDNCE88525E7DE7F00D6C2D3C00000000

Official debug documentation describes that the " peer identifier " or peer ID sent by the initiator is displayed here. In the context of IKE/IPsec negotiation, this value is used as the IPsec peer ID for authentication and identification purposes. The initiator is providing " remote " as the peer ID for its connection.

Why Not A or C:

Perfect Forward Secrecy (PFS): The debug does not show any DH group negotiation in phase 2 (no reference to group2, group5, etc., for phase 2), so you cannot deduce the presence of PFS solely from this output.

Phase 2 negotiation: The log focuses on IKE (phase 1) negotiation and establishment; there’s no reference to ESP protocol, Quick Mode, or other identifiers that would show phase 2 SA negotiation and establishment.

This interpretation aligns with the explanation in the FortiOS 7.6.4 Administration Guide ' s VPN section and the official debug command output samples published in Fortinet’s documentation. It demonstrates how to distinguish between local and remote addresses and how to identify the use of peer IDs.

The issue is caused by the strict matching logic of the configured Prefix List.

Current State: The rule is edit 1 with set prefix 172.16.0.0 255.255.0.0 and both ge (greater than or equal) and le (less than or equal) are unset.

Behavior: When ge and le are unset, FortiOS requires an exact match of the subnet mask. The current rule only matches the exact network 172.16.0.0/16. It denies 172.16.52.0/24 because the mask (/24) does not match the rule ' s mask (/16).

To fix this and inject 172.16.52.0/24, you must modify the list to match the /24 mask:

A. Add another entry to the prefix list to specifically allow the 172.16.52.0/24 network:

Creating a new rule (e.g., edit 2) with set prefix 172.16.52.0 255.255.255.0 will provide an exact match for the incoming route, allowing it to pass the distribute-list.

B. Change the ge value to 17:

By configuring set ge 17 on the existing rule (conceptually 172.16.0.0/16 ge 17), you change the logic from " exact match " to " range match " .

This configuration tells the router to match any prefix starting with 172.16.x.x that has a subnet mask length of 17 or greater.

Since the incoming route is a /24, and 24 is greater than 17, the route will match the prefix list and be accepted.

Why other options are incorrect:

C: The option text appears to read " Change the ... value to 16 " . If this refers to le 16, it would enforce the mask to be exactly /16 or less, which still excludes /24.

D: Changing the default behavior to implicit allow defeats the purpose of a filter (security control) and is not a standard configuration step for fixing a single missing route.

The 7.6 study guide explains the route selection order:

“Route Selection Process

Most specific route

Lowest distance

Lowest metric (dynamic routes)

Lowest priority (static routes)

ECMP (static, BGP, and OSPF routes)”**

It then states:

“If there are multiple routes with the same netmask, distance, metric, and priority, FortiGate shares the traffic among all of them. This is called equal-cost multi-path (ECMP).”

The FortiOS administration guide confirms the ECMP prerequisite:

“Routes must have the same destination and costs. In the case of static routes costs include distance and priority.”

In the exhibit, the kernel/FIB output shows the two default routes as:

gwy=100.64.1.254 dev=3 (port1) prio=0

gwy=100.64.2.254 dev=6 (port2) prio=10

So although both are default routes, their priorities are different. Since FortiGate uses the FIB/kernel for forwarding traffic, ECMP will not happen until the static-route priorities are the same. The study guide also notes that the FIB is the table used to perform standard routing

Therefore, to make the two default routes eligible for ECMP, the administrator must make the priorities equal. Since port2 is already 10, the needed change is to set the port1 default route priority to 10.

Why the other options are wrong:

A is wrong because snat-route-change affects how existing SNAT sessions react to routing changes, not whether static routes qualify for ECMP

B is wrong because changing port2 to priority 1 still would not match port1 at 0, so the routes still would not have equal cost for ECMP

C is wrong because preserve-session-route affects existing-session route persistence after routing changes, not ECMP qualification

According to the official Fortinet administration guide for FortiOS 7.6.4 under the section " Configuring a RADIUS server, " the supported RADIUS authentication methods you can configure via the CLI with config user radius are:

pap

chap

mschap

mschapv2

auto

The relevant CLI syntax is set auth-type {auto | ms_chap_v2 | ms_chap | chap | pap}​. You can confirm this directly in the configuration table and from real CLI sessions.

EAP (Extensible Authentication Protocol) is NOT an authentication option you can directly set under config user radius. EAP methods (such as EAP-TLS, EAP-PEAP, EAP-TTLS) are negotiated between the RADIUS client and server but are not configurable as an explicit auth-type option in FortiOS. EAP authentication is typically used automatically by features like 802.1X, not through the user radius object authentication-type setting, and always requires proper backend workings between supplicant and RADIUS server

The correct answer is C. The session is offloaded using NPU.

The exact session example in the study guide shows:

proto=6 → this is a TCP session

expire=3599 → the session will expire in 3599 seconds, not in one second

hook=post dir=org act=snat 10.9.31.117:45388- > 200.8.57.5:443(10.1.0.3:45388)

hook=pre dir=reply act=dnat 200.8.57.5:443- > 10.1.0.3:45388(10.9.31.117:45388)

npu info: ... offload=8/8 ...

and the slide explicitly states: “Offloaded in both directions using NP6”

The study guide also explains this exact point clearly:

“Counters for hardware acceleration—The presence of the npu info field indicates the session has been offloaded to hardware acceleration. In this example, traffic is being offloaded in both directions using network processor (NP) 6, which is represented by the value of 8.”

Why the other options are wrong:

A is wrong because expire=3599, not 1. The duration=1 field means the session has existed for 1 second, not that it will expire in 1 second.

B is wrong because the original session is from 10.9.31.117 to the remote server 200.8.57.5:443. The IP 10.1.0.3 is the SNAT-translated source address, not the final destination.

D is not the best answer for this single-select question. The reply is indeed DNATed back toward the original client, but the exact validated takeaway highlighted by the study guide for this exhibit is the NPU offload state.

FortiManager template groups allow administrators to combine provisioning templates and assign the resulting group to managed devices. A template group can contain different applicable template categories, including system and SD-WAN templates, making E correct.

FortiManager also supports standard CLI and Jinja CLI templates. CLI template groups can contain a mixture of these template types, so C is correct. When multiple CLI templates are grouped, FortiManager processes them in their configured top-to-bottom sequence, making D correct.

Option B is incorrect because FortiManager uses standard CLI scripts and Jinja scripts; Perl is not the supported alternative scripting type described by the FortiManager 7.6 study material. Option A is also incorrect because FortiManager does not impose the stated three-IPsec-template-per-group rule. Template groups are intended to simplify consistent, reusable device provisioning.

================

The correct answer is A.

The debug output is for an HTTPS request and shows a hostname value. The study guide explains that with SSL certificate inspection, FortiGate extracts the FQDN from either:

“TLS extension server name indication (SNI)”

“SSL certificate common name (CN)”

So the hostname shown in the real-time web-filter debug can be derived from the SNI in the client request or, if needed, from the CN in the server certificate. That makes A correct.

Why the other options are wrong:

B is wrong because the study-guide example for web-filter real-time debug explicitly says: “This slide shows an example of real-time debug output when the URL to categorize isn ' t in the FortiGuard cache.”In these debugs, cat=255 appears before the final lookup result, so this does not indicate a local-cache hit.

C is wrong because ftgd-allow is the action, not the profile name. The debug line shows the action as action=9 (ftgd-allow) while the profile shown is profile= ' default ' . FortiOS web-filter logs also use the profile field separately from the action field

D is wrong because the final category shown is url_cat=52, not 255. The study guide’s example shows the same pattern: an initial cat=255 in the request line, followed by the resolved result cat=52 url_cat=52

So the verified answer is: A.

Comprehensive and Detailed 100 to 150 words of Explanation From Secure Networking Architect Study Guides topics:

The SD-WAN 7.6 Enterprise Administrator Study Guide describes two MSSP-hosted hub models that fit these requirements. A multi-tenant MSSP hub can dedicate one VDOM to each customer, while a second model provides a dedicated FortiGate VM hub for each customer. In both designs, spokes remain at customer locations and can use direct internet access locally.

These models also suit significant spoke-to-spoke traffic because most intersite traffic can use ADVPN shortcuts rather than being forced through the hub. The MSSP retains responsibility for the overlay control plane and centralized management. A customer-premises hub is more appropriate when substantial spoke-to-hub traffic exists, such as branches accessing centrally hosted workloads or centralized internet breakout. Therefore, the shared-VOM hub model and dedicated MSSP-hosted hub model are the appropriate choices.

================

" FortiManager offers two approaches to configuring SD-WAN: per-device management and central management. "

The guide also states:

" In per-device management, you configure SD-WAN settings for individual devices. "

Technical Explanation:

FortiManager supports two management approaches for SD-WAN deployments: per-device configuration and centralized SD-WAN management.

Option C is correct because the devices are already managed by FortiManager, and the administrator only needs to configure SD-WAN on a limited number of standalone FortiGate devices.

With per-device management, administrators can configure settings individually through Device Manager without migrating devices to a separate SD-WAN management workflow.

The administrator can access these settings through:

Device Manager → Select Managed FortiGate → Network → SD-WAN

From this interface, administrators can configure SD-WAN zones, members, performance SLAs, and SD-WAN rules according to each device ' s requirements.

The configuration changes are subsequently installed on the managed FortiGate.

Why the other options are incorrect:

Option A: Moving devices into the SD-WAN Manager workflow and using a standalone wizard is not mandatory for basic per-device configuration.

Option B: A dedicated device group is not required simply to configure SD-WAN settings on individual devices.

Option D: FortiManager supports per-device SD-WAN rule configuration without requiring SD-WAN Manager enrollment.

Architectural Consideration:

Centralized SD-WAN management becomes particularly valuable in large deployments requiring consistent templates, automation, and overlay orchestration. However, for a small environment with distinct device configurations, per-device management remains a supported and practical approach.

The correct answers are A and C.

The exhibit shows that preserve-session-route is enabled on port1:

config system interface

edit " port1 "

set preserve-session-route enable

next

end

The study guide explains the effect of this setting exactly:

“enable: FortiGate marks existing session routing information as persistent, and applies only the modified routes to new sessions”

It also states:

“The current route must still be present in the FIB. Otherwise, FortiGate flags the session as dirty and reevaluates it”

And the same page further clarifies:

“If you enable this setting, sessions passing through that interface continue to pass without being affected by the routing changes. The routing changes apply only to new sessions. If the route is removed from the FIB, then FortiGate must flag the session as dirty, flush its gateway information, and reevaluate the session.”

This proves:

A is correct because with preserve-session-route enable, existing sessions are normally preserved and routing changes apply only to new sessions.

C is correct because the session remains unchanged unless the current route is removed from the FIB/routing table, in which case FortiGate dirties and reevaluates the session.

Why the other options are wrong:

B is wrong because when the active route is removed, FortiGate does not simply mark the session dirty and stop there. The study guide says it “flags the session as dirty and reevaluates it”, which means route lookup happens again.

D is wrong because the session does change if the active route is removed. FortiGate flushes gateway information and reevaluates the session.

So the verified answers are: A, C.

The session output includes the flags:

state=redir local may_dirty ...

npu_state=00000000

offload=0/0

The 7.6 study guide explains these flags directly:

local = “Session is to/from local stack”

redir = “Session is being processed by an application layer proxy”

may_dirty = “Session is allowed by a firewall policy”

This makes C correct, because the local flag means the session either originates from FortiGate or terminates on FortiGate. The FortiOS administration guide states the same meaning: “Session is originated from or destined for local stack.”

This also makes A correct. The redir flag means the session is handled by an application-layer proxy. FortiOS documents explain that proxy-based inspection buffers traffic on the FortiGate and inspects it there, and that proxy-based processing is CPU and memory-intensive

Since the session also shows no NPU offload (npu_state=00000000, offload=0/0), this traffic is being handled in software/CPU, not by the NPU.

Why the other options are wrong:

B is wrong because the redir flag proves the session is not passing without inspection; it is being processed by an application-layer proxy

D is wrong because there is no authentication flag in this session. In Fortinet examples of captive portal/authentication-related sessions, the session state includes auth or authed flags. The study guide shows: “Any session for traffic coming from an authenticated user contains the authed flag.” This exhibit does not show auth or authed, so there is no basis to conclude the client was redirected to a captive portal for authentication.

The BGP debug output shows session information for peers, including state details. According to official Fortinet BGP documentation, if the session state with a peer does not show " Idle, " " Active, " or " Connect, " but instead shows " Established, " " Up, " or related counters (e.g., messages sent/received or uptime), it indicates the session is operational. In this scenario, the peer 10.127.0.75 is the only one showing a positive indication of a live, established session. Other options like neighbor-range configuration, AS mismatch, or route-maps blocking prefixes are not supported by evidence provided in a simple BGP session state debug, nor does the output show errors relating to local or remote AS issues.

The correct interpretation comes from Fortinet ' s BGP troubleshooting guide, which outlines how to read session status and neighbor states in debug and summary outputs.

The session output reveals a session with proto=1 (ICMP) and the origin and reply directions show address and NAT translations. Specifically, the hook=post dir=org act=snat shows that source NAT is performed for outgoing packets, where the source 10.1.10.10:40602 is translated to 10.200.5.1:8 (likely ICMP id 8, not a TCP/UDP port). The reply direction, hook=pre dir=reply act=dnat, indicates destination NAT for incoming packets: packets incoming for 10.200.5.1:60430 are destination-NATed to 10.1.10.10:40602. The gateway (gwy) is listed as 10.200.1.254/10.1.0.1, which for outgoing traffic means that return traffic is directed to the gateway (10.200.1.254), per the NAT policy. This is confirmed by the FortiOS Session Table Guide, which explains that the returned ICMP reply will be routed out to this NAT gateway. The session statistics and logical flow (SNAT out, matching DNAT in) reinforce that reply traffic to the initiator traverses via 10.200.1.254.

TCP Maximum Segment Size (MSS) defines the maximum amount of TCP payload data that a device can place in one TCP segment. The Enterprise Firewall 7.6 Administrator Study Guide explicitly explains that MSS includes only the TCP payload and does not include the TCP or IP headers. FortiGate allows the sender and receiver MSS values to be adjusted in a firewall policy using tcp-mss-sender and tcp-mss-receiver. Therefore, A is correct.

These settings are intended primarily to avoid fragmentation and accommodate reduced effective MTUs, particularly where encapsulation such as IPsec adds overhead. MSS does not determine whether a firewall policy permits or denies a TCP packet, eliminating B. It also does not alter the IP-header size, eliminating D. Option C incorrectly describes when MSS adjustment operates.

================