Free Fortinet NSE 7 - Secure Networking 7.6 Architect Practice Questions

Based on the Fortinet FCSS - Network Security 7.6 documents and the analysis of the VPN tunnel exhibit, here is the verified answer.

Questions no: 91

Verified Answer: A, C

Comprehensive and Detailed Explanation with all FCSS - Network Security 7.6 documents:

To determine the status of the VPN tunnel, we must examine the specific counters and fields in the diagnose vpn tunnel list output provided in the exhibit.

Analyze Phase 2 Status (Option A):

The output displays child_num=0.

In IKEv2 (and IKEv1 implementations in FortiOS), " Child SAs " refer to the Phase 2 (IPsec) Security Associations that carry the actual data traffic.

A value of 0 indicates that no Phase 2 tunnels are established. If Phase 2 were up, child_num would be at least 1.

Additionally, under the proxyid section, the field sa=0 confirms there is no active Security Association for that traffic selector.

Analyze Traffic Status (Option C):

The stat line shows: rxp=0 txp=0 rxb=0 txb=0.

rxp (Received Packets) and txp (Transmitted Packets) are both zero. This definitively confirms that no traffic is traversing the tunnel currently. This is expected since Phase 2 is down.

Analyze Phase 1 Status (Why B is incorrect):

The tunnel entry exists in the list with a valid tun_id, and NAT-Traversal is active (natt: mode=keepalive).

The presence of the tunnel in this command output, along with active Keepalive mechanisms, typically indicates that Phase 1 (IKE SA) is established and the peers are communicating on port 4500 (NAT-T), even though the data tunnels (Phase 2) failed to negotiate. If Phase 1 were down, the tunnel would often not appear in this " list " view or would show different status flags indicating a complete connection failure.

Conclusion: The exhibit shows a scenario where the Phase 1 control channel is likely up (evidenced by the entry existence and NATT keepalives), but the Phase 2 data channel is down (child_num=0), resulting in zero traffic flow (rxp=0/txp=0).

The SD-WAN 7.6 Enterprise Administrator Study Guide explicitly defines the relationship between underlays and overlays:

“Overlays are virtual links built on top of physical links—called underlay links.”

It further explains that the overlay topology consists of VPN tunnels and “adds flexible routing options.” Therefore, option B is directly supported.

Option D is also correct. An overlay is not restricted to a particular physical transport. Fortinet identifies ISP, MPLS, and 4G/5G cellular connectivity as possible WAN transports. Consequently, a wireless WAN connection can provide the underlying transport over which an IPsec, GRE, or IP-in-IP overlay tunnel is established.

Option C is incorrect because underlay connectivity is not limited to wired links; cellular 4G/5G is a valid WAN transport.

Option A is incorrect because FortiLink is primarily the proprietary connectivity used between FortiGate and managed LAN extensions such as FortiSwitch and FortiAP. It is not inherently an SD-WAN WAN underlay.

Option E is incorrect because Fortinet identifies VPN tunnels—principally IPsec, but also GRE and IP-in-IP—as SD-WAN overlay links. A VLAN is a Layer 2 logical segmentation mechanism, not an SD-WAN overlay tunnel.

The correct answers are A and

C.  

The exhibit shows that preserve-session-route is enabled on port1:

config system interface

edit " port1 "

set preserve-session-route enable

next

end

The study guide explains the effect of this setting exactly:

“enable: FortiGate marks existing session routing information as persistent, and applies only the modified routes to new sessions”

It also states:

“The current route must still be present in the FI

B.  

And the same page further clarifies:

“If you enable this setting, sessions passing through that interface continue to pass without being affected by the routing changes. The routing changes apply only to new sessions. If the route is removed from the FIB, then FortiGate must flag the session as dirty, flush its gateway information, and reevaluate the session.”

This proves:

A is correct because with preserve-session-route enable, existing sessions are normally preserved and routing changes apply only to new sessions.

C is correct because the session remains unchanged unless the current route is removed from the FIB/routing table, in which case FortiGate dirties and reevaluates the session.

Why the other options are wrong:

B is wrong because when the active route is removed, FortiGate does not simply mark the session dirty and stop there. The study guide says it “flags the session as dirty and reevaluates it”, which means route lookup happens again.

D is wrong because the session does change if the active route is removed. FortiGate flushes gateway information and reevaluates the session.

So the verified answers are: A,

C.  

The correct answers are A and

B.  

The Network Security Support Engineer 7.6 Study Guide states under OSPF Troubleshooting:

“Follow these steps to troubleshoot an OSPF problem between two peers:

Check that the local router can reach the remote peer. IP addresses must be in the same subnet and have the same subnet mask.

Ensure that IP protocol 89 is not blocked.

Hello and dead intervals must match.

The OSPF router ID for each peer must be unique. Duplicate router IDs are not allowed.

Do the MTUs match?

If authentication is enabled, the type and password must match on both sides.”**

The same page also summarizes the troubleshooting tips as:

“Do peers have an IP address within the same subnet?”

“Is IP protocol 89 blocked?”

This directly confirms:

A is correct

B is correct

Why the other options are wrong:

C is wrong because TCP port 179 is used by BGP, not OSP

F.  

D is wrong because the study guide’s OSPF adjacency troubleshooting checklist does not require an active static route to the peer. OSPF neighbors form adjacency on directly reachable networks, and the guide instead focuses on same subnet, protocol 89, intervals, router ID, MTU, and authentication matching

So the verified answers are: A,

B.  

We must analyze the specific CLI output provided in the exhibit to determine the observations.

Analyze the Command and Output:

Command: # diagnose automation test HAFailOver

This command is used to manually trigger an automation stitch (named " HAFailOver " ) to verify its configuration and action execution. It simulates the trigger event to run the defined actions.

Output: automation test failed(1). stitch:HAFailOver

The output explicitly states that the test failed. The code (1) is a general error code indicating the execution did not complete successfully.

Evaluate the Options:

A.  

Incorrect. Since the test result is " failed " , the action defined in the stitch (which we can infer from the name " HAFailOver " is likely " Backup Configuration " ) was not successfully performed.

B.  

Incorrect. The command diagnose automation test is a simulation tool. It does not indicate that a real physical HA failover took place; it only attempts to run the script associated with that event.

C.  

Correct. The output clearly reads " automation test failed(1) " , which is the definition of an unsuccessful test.

D.  

Correct. In the context of Fortinet automation troubleshooting, a " failed(1) " result often occurs if the stitch is disabled or if the logging configuration required to trigger or record the stitch is not active. Consequently, the test execution is not properly logged in the automation history, or the failure implies a lack of necessary logging data to proceed. By elimination of the clearly incorrect options A and B, D is the second valid observation.

We must analyze the flags (*, > , S, O, B) and Administrative Distances (AD) shown in the get router info routing-table database exhibit to determine the correct statements.

Analysis for Option A (The BGP route to 10.0.4.0/24 is not in the forwarding information base):

True. Look at the entry for 10.0.4.0/24.

There is an OSPF route: O * > 10.0.4.0/24 [110/2]. The * indicates it is in the FIB, and > indicates it is the selected route.

There is a BGP route: B 10.0.4.0/24 [200/10]. This line lacks the * flag.

Reason: The OSPF route has an Administrative Distance of 110. The BGP route (iBGP) has an AD of 200. Since 110 is lower than 200, OSPF wins, and the BGP route is not installed in the Forwarding Information Base (FIB).

Analysis for Option B (The default static route through 10.200.1.254 is in the forwarding information base):

True. Look at the 0.0.0.0/0 entries.

The first entry is S * > 0.0.0.0/0 [10/0] via 10.200.1.254.

The * flag confirms this specific route is installed in the FI

B.  

The second static route (via 10.200.2.254) has a higher distance ([20/0]) and no * flag, so it is inactive.

Why C is False: ECMP (Equal Cost Multi-Path) requires routes to have the same cost/priority. Here, one static route has AD 10 and the other has AD 20. They are not equal, so ECMP is not performed.

Why D is False: The routing table database shows active routes, not the raw Link State Advertisement (LSA) database. You cannot determine the number of LSAs received solely from this output.