Free Fortinet NSE 7 - FortiSASE 26 Architect Practice Questions

FortiManager provisioning templates provide centralized, standardized, and scalable configuration management across FortiGate devices. They are particularly valuable in Secure SD-WAN deployments involving multiple branches, hubs, and overlay networks.

Option C is correct because a provisioning template group can contain both a system template and an SD-WAN template. System templates configure device-level settings, while SD-WAN templates define interfaces, zones, performance SLAs, and traffic-steering rules. FortiManager coordinates their installation according to configuration dependencies.

Option D is correct because CLI template groups support different template types, specifically standard CLI scripts and Jinja scripts. CLI scripts contain FortiOS commands, while Jinja templates support dynamic configuration generation using variables and conditional logic.

Option E is correct because CLI templates within a group are processed sequentially, from top to bottom. Administrators can organize their execution order to ensure prerequisite configurations are established before dependent settings.

Option A is incorrect because current FortiManager releases support CLI and Jinja scripts, not Perl scripts as a provisioning-template type.

Option B is incorrect because a standard template group supports one IPsec tunnel template assignment, not three separate IPsec templates.

The hub must send additional paths to spokes (set additional-path send). The hub must treat each spoke as a route-reflector client so spoke routes are reflected to other spokes. The hub must specify how many additional paths to advertise (set adv-additional-path < n > ). An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow. When troubleshooting, correlate the configured SD-WAN service with diagnose sys sdwan service4, the live session entry and the routing table. An application signature, an IP route and a health-check result describe different decision stages; treating them as interchangeable can produce incorrect conclusions about the egress interface. In the relevant Fortinet FortiOS documentation, the applicable feature should be verified against the deployed software version, the selected configuration mode and the live operational state before the answer is treated as a definitive implementation requirement.

The exhibit combines static-route priority changes with interface-specific session-route preservation.

Initially, port2 provides the preferred default route with priority 1, while port1 has priority 10. Increasing port2 ' s route priority to 20 makes port1 the preferred path for new route selections.

Option C is correct because newly created sessions use the current routing table. Since port1 now has the better route priority, traffic matching the default route is forwarded through port1.

Option E is correct because the port2 interface has preserve-session-route enable configured. This setting preserves the original egress routing information associated with existing sessions, allowing them to continue through port2 while the previously selected route remains valid.

The global setting snat-route-change enable enables reevaluation of SNAT session routing when applicable routing changes occur. However, the configured session-route preservation requires special consideration and prevents the simplistic assumption that all established sessions must immediately migrate.

Option A incorrectly assumes that every SNAT session is necessarily moved to port1. Option B introduces an IP-pool dependency that does not determine the stated behavior. Option D incorrectly assumes all sessions are marked dirty and rerouted regardless of session preservation.

The key architectural distinction is between forwarding new sessions according to the revised route priority and preserving eligible established sessions on their original egress path.

FortiSASE Branch On-ramp extends cloud-delivered security services to users located behind branch routers or firewalls through IPsec tunnel connectivity.

Option A is correct because FortiSASE supports deployment of multiple branch on-ramp locations. A branch device can establish connections to multiple provisioned on-ramp locations, subject to the supported device type, licensing, and tunnel configuration. This facilitates geographic resilience and alternative connectivity paths.

Option D is correct because Branch On-ramp and Secure Private Access share important Border Gateway Protocol (BGP) configuration settings. These include FortiSASE autonomous system information and BGP router ID subnet allocation.

Fortinet specifies that the SPA network configuration must be established before deploying branch on-ramp locations, although individual SPA service connections can be configured afterward.

Option B is incorrect because SSL deep inspection requires endpoints to trust the certificate authority used by FortiSASE to inspect and re-sign intercepted TLS connections. Without the appropriate trusted CA certificate, users can experience certificate validation errors.

Option C is incorrect because Branch On-ramp supports IPsec-capable branch devices, including supported FortiGate and third-party devices. FortiAP and FortiExtender are associated primarily with thin-edge deployments.

Before FortiGate can steer traffic according to SD-WAN rules, certain configuration elements must be present. Fortinet SD-WAN design guidance describes the required elements: " SD-WAN is not a standalone feature and interacts with several fundamental FortiGate configurations. Specifically, you must: (1) Define the interfaces (physical, VLAN, or IPsec) that will act as SD-WAN members, (2) Create firewall policies to allow traffic to be steered by SD-WAN, and (3) Set up routing so that traffic has valid routes via SD-WAN members. Without these, SD-WAN rules will not be able to match or steer any traffic. " Security profiles and traffic shaping are not mandatory for basic SD-WAN steering but can be layered on for enhanced security and QoS once foundational elements are present.References: A deployment should preserve the distinction between the physical or logical WAN underlay, the IPsec overlay and the SD-WAN zone that groups forwarding members. These layers can have different routing and security-policy requirements. The configured architecture must also allow the required traffic paths and failover behavior rather than assuming every available interface is interchangeable.

The line sdwan_mbr_seq=1 sdwan_service_id=4 indicates that this session is part of an SD-WAN rule. sdwan_service_id=4 confirms that the session is being handled by SD-WAN rule ID 4. This directly links the flow to the SD-WAN configuration. The line no_offload_reason: redir-to-ips denied-by-nturbo shows that the session is not offloaded to the NPU (Network Processing Unit) and is being processed by the main CPU. A session that is not offloaded can be re-evaluated. If the outgoing interface (the one currently being used) goes down, the FortiGate will re-evaluate the session against the SD-WAN rules to find a new active member to steer the traffic through. This is a fundamental behavior of SD-WAN, which ensures network resilience. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow.