Free Fortinet NSE 7 - Secure Networking 7.6 Architect Practice Questions

To establish a functional Security Fabric, specific network and configuration prerequisites must be met to ensure nodes can communicate, authorize, and share telemetry data:

A.  

TCP port 8013 is the dedicated port for FortiTelemetry (Fabric) communication. If firewalls (intermediate or local) block this port, the Fabric connection between the root and downstream FortiGates will fail.

D.  

Security Fabric relies on a trust relationship. When a downstream device attempts to join, it appears in the Root FortiGate ' s dashboard. The administrator must manually authorize this device (unless pre-authorized via serial number) to allow it to join the Fabric topology.

E.  

The interface on the Root (upstream) FortiGate that faces the downstream devices must have the " Security Fabric Connection " (formerly CAPWAP/FortiTelemetry) administrative access setting enabled. Without this, the interface will not listen for or accept Fabric connection requests.

Why other options are incorrect:

B: Neighbor Discovery uses standard multicast/broadcast or static settings; changing the port is not a standard requirement.

C: FortiGates can participate in the Security Fabric in either NAT or Transparent mode; Transparent mode is not a mandatory requirement for the Fabric itself.

The exhibit shows these key lines:

handle_req-Rcvd auth req ... for jsmith in Lab

start_search_dn-base: ' DC=TAC,DC=ottawa,DC=fortinet,DC=com ' filter:sAMAccountName=jsmith

get_all_dn-Found DN 1:CN=John Smith,CN=Users,DC=TAC,DC=ottawa,DC=fortinet,DC=com

The study guide explicitly shows the same LDAP real-time debug pattern and says the request line includes the LDAP server object name:

handle_req-Rcvd auth req ... for jsmith in Lab ...

That supports A: Lab is the configured LDAP server name being used for this authentication request.

For the LDAP flow stage, the study guide states:

“An fnbamd_ldap_build_dn_search_req-base message indicates that FortiGate is performing step two: searching for the user in the LDAP tree.” It also says that if the LDAP server finds the user, the output shows the user’s full DN.

That matches the exhibit’s start_search_dn-base ... filter:sAMAccountName=jsmith and Found DN ... CN=John Smith... lines, so D is correct.

Why the other options are wrong:

B is wrong because the exhibit shows FortiOS has found the user DN CN=John Smith,..., but that does not mean the user is already authenticating with that DN in this step. The study guide says this DN is discovered in step 2, and only in step 3 does FortiGate bind using the user DN.

C is wrong because the exhibit is showing step 2 (Search Request), not step 3 (Bind Request). The study guide separates these steps clearly and shows step 3 with fnbamd_ldap_build_userbind_req-Trying DN ... and __ldap_build_bind_req-Binding to ' CN=John Smith,... '

Comprehensive and Detailed 100 to 150 words of Explanation From Secure Networking Architect Study Guides topics:

The SD-WAN 7.6 Enterprise Administrator Study Guide describes two MSSP-hosted hub models that fit these requirements. A multi-tenant MSSP hub can dedicate one VDOM to each customer, while a second model provides a dedicated FortiGate VM hub for each customer. In both designs, spokes remain at customer locations and can use direct internet access locally.

These models also suit significant spoke-to-spoke traffic because most intersite traffic can use ADVPN shortcuts rather than being forced through the hub. The MSSP retains responsibility for the overlay control plane and centralized management. A customer-premises hub is more appropriate when substantial spoke-to-hub traffic exists, such as branches accessing centrally hosted workloads or centralized internet breakout. Therefore, the shared-VOM hub model and dedicated MSSP-hosted hub model are the appropriate choices.

================

The correct answers are A and

D.  

The Network Security Support Engineer 7.6 Study Guide explains that automation stitches consist of a trigger and one or more actions, and that they can detect events such as high CPU and conserve mode across the Security Fabric

The FortiOS administration guide then gives the exact practical example for A:

“Automation stitches can be created to run a CLI script and send an email message when memory or CPU usage exceeds specified thresholds.”

It also shows examples where the email body contains the script output using:

%%results%%

That directly confirms

A.  

For D, the FortiOS administration guide states:

“The URI and HTTP body can use parameters from logs or previous action results.”

It also explains the execution model:

“The stitch Action execution can be set to either Sequential or Parallel. In sequential execution actions will execute one after another with a delay (if specified). … In parallel execution all actions will execute immediately when the stitch is triggered.”

A concrete example shows a second action using the output of the first action:

“This string for the body text includes the results from the preceding CLI script action.” with

Body=%%results%%...

That confirms

D.  

Why the other options are wrong:

B is wrong because automation stitches can be triggered by IPS events, but the documentation does not describe them as modifying packet headers or payloads. Instead, they perform actions such as email, CLI script, webhook, quarantine, and similar automated responses

C is wrong because delay is associated with sequential execution, not parallel execution. The guide explicitly says: “A delay can be added before an action if Sequential action execution is used.”

So the verified answers are: A,

D.  

FortiManager template groups allow administrators to combine provisioning templates and assign the resulting group to managed devices. A template group can contain different applicable template categories, including system and SD-WAN templates, making E correct.

FortiManager also supports standard CLI and Jinja CLI templates. CLI template groups can contain a mixture of these template types, so C is correct. When multiple CLI templates are grouped, FortiManager processes them in their configured top-to-bottom sequence, making D correct.

Option B is incorrect because FortiManager uses standard CLI scripts and Jinja scripts; Perl is not the supported alternative scripting type described by the FortiManager 7.6 study material. Option A is also incorrect because FortiManager does not impose the stated three-IPsec-template-per-group rule. Template groups are intended to simplify consistent, reusable device provisioning.

================