Free Fortinet NSE 7 - Secure Networking 7.6 Architect Practice Questions

The correct answers are A and

C.  

The study guide describes this exact asymmetric ICMP scenario. It states:

“The server sends an echo request to the PC through port2 of the local router, effectively bypassing FortiGate. When it receives the echo request, the PC responds with an echo reply through its default gateway, 10.1.0.2, which is port1 on FortiGate. Because there is no existing session, the echo reply is dropped. All subsequent echo replies are blocked.”

That means the current problem exists because:

the ICMP request bypasses FortiGate

the ICMP reply goes through FortiGate

FortiGate has no matching session, so it drops the reply

The study guide then shows the exact corrective option:

“Allowing asymmetric routing:”

config system settings

set asymroute enable

end

It further explains:

“After the packet passes through the FortiGate CPU, FortiGate forwards the packet using the FIB, even though there are no session matches. FortiGate forwards all subsequent echo replies using the FI

B.  

So A is correct.

The other valid fix is to make the traffic symmetric by changing the laptop’s default gateway so the reply no longer goes through FortiGate. In the exhibit, the alternate gateway is 10.1.0.254, which is the local router on the same subnet. If the laptop uses 10.1.0.254 instead of 10.1.0.2, the ICMP echo reply follows the same bypass path as the echo request, so the server receives it without involving FortiGate session validation. This makes C correct.

Why the other options are wrong:

B is wrong because this is not an RPF problem. The study guide explains RPF as a reverse path lookup used to validate whether a packet arrived on a legitimate interface, mainly for spoofing protection. The issue in this scenario is a missing session due to asymmetric routing, not a strict-versus-feasible RPF failure

D is wrong because FortiGate already has the specific route 10.4.0.0/24 through port3 in the routing table shown in the exhibit, so adding a default static route to port3 is unnecessary and not the reason the echo reply is being dropped

So the verified answers are: A,

C.  

The SD-WAN 7.6 Enterprise Administrator Study Guide identifies the recommended BGP-on-loopback IPsec settings. For branches, it specifies:

“Static tunnel type (remote end IP address is known).”

“net-device enable.”

Enabling net-device on the spoke creates a kernel interface for the tunnel. This assists with tunnel monitoring and management and is required to support ADVPN shortcut tunnels. Dynamic BGP establishes on-demand BGP peerings between spokes after an ADVPN shortcut is created; therefore, the spoke must support those dynamic shortcut interfaces. This makes option C correct.

The spoke should also configure localid. The FortiOS 7.6 Administrator Study Guide explains: “Local ID: if the peer accepts a specific peer ID, type that same peer ID in this field.” The local ID supplies the spoke’s IKE identity to the dial-up hub, allowing the hub to identify and authenticate the connecting spoke correctly. Therefore, option D is correct.

Option A reverses the recommended roles. The hub must use a dynamic tunnel type because it operates as the dial-up server and does not require every spoke’s changing public gateway address in advance.

Option B is also incorrect. The guide states: “There is no need to configure any tunnel IP address, so the IKE Mode Config is not used.” BGP on loopback uses the loopback address and exchange-interface-ip instead of IKE mode configuration.

The correct answers are B and

D.  

The study guide explains that expectation sessions are pinhole sessions created by session helpers for protocols such as FTP that need additional negotiated connections. It states: “FortiGate created an expectation session and opened the pinhole port for the expected return traffic” and also shows that the firewall “creates an expected (pinhole) session to allow the traffic”

That makes D correct.

For B, the study guide explains the gwy= field in session output: the first value is the gateway to the destination, and the second is the gateway to the source

In the exhibit, the original-direction traffic is DNATed here:

hook=pre dir=org act=dnat 10.171.121.38:0- > 10.200.1.1:60426(10.0.1.10:50365)

So the destination after DNAT is the internal host 10.0.1.10, and the session’s first gwy value corresponds to the next hop toward that destination. That makes B correct.

Why the other options are wrong:

A is wrong because this is an expectation/session-helper behavior, not an IPS-engine-created session. The study guide ties expectation sessions to helpers such as FTP, not IPS.

C is wrong because 10.200.1.1 is the translated address used before DNAT, not the next hop used to forward the original-direction traffic after translation to the internal destination.

So the verified answers are: B,

D.  

The study guide identifies this exact output as an expectation session created by the FTP session helper:

“run helper-ftp” indicates the FTP helper is in use.

“FortiGate created an expectation session and opened the pinhole port for the expected return traffic”

It also explains why this exists:

“Another important function of the session helper is to temporarily create an expected session (or pinhole) for the data channel connection that comes from the server.”

“The session helper automatically creates the session and opens the door for the incoming connection.”

“These incoming TCP sessions use random TCP port numbers.”

That directly proves C is correct.

For A, the exhibit shows expire=23. The study guide explains the expire field as the length of time until the session expires if no matching traffic arrives, and the FortiOS guide states for expectation sessions:

“Expectation sessions usually have a timeout value of 30 seconds. If the communication from the server is not initiated within 30 seconds the expectation session times out and traffic will be denied.”

So with expire=23, FortiGate will allow that expected traffic only for the remaining 23 seconds; after that, it times out and the traffic is denied. That makes A correct.

Why the other options are wrong:

B is not supported. The study guide describes expectation sessions as being created by the session helper from the control-session negotiation, not as independent objects unaffected by the master session.

D is wrong as stated. Even though the output contains policy_id=25, the study guide explicitly says the incoming expected connection is allowed by the expected session itself, “even when no firewall policy allows it.”

The output explicitly states This router is an ABR. An OSPF area border router has interfaces participating in multiple OSPF areas and provides connectivity between those areas and the backbone. Therefore, A is correct.

The output also states that the RFC1583Compatibility flag is enabled. The Enterprise Firewall 7.6 Administrator Study Guide explains that FortiGate can use RFC 1583-compatible OSPF path selection for ECMP, where eligible external routes of equal cost can be installed concurrently. This makes D correct.

Nothing in the displayed status identifies the FortiGate as a backup designated router, so B cannot be concluded. Option C describes an autonomous system boundary router (ASBR), which originates external LSAs when redistributing routes into OSP

F.  

================