NSE7_FSN_AR-7.6 Exam Dumps - Fortinet NSE 7 Network Security Architect Questions and Answers

The correct answer is B.

The study guide explicitly states that slabs are used by the kernel: “The kernel memory slabs are collections of objects with a common purpose. The kernel uses them to store information in memory.”

It also gives the exact calculation method: “Total slab size = available objects x object size” and explains that in the diagnose hardware sysinfo slab output, the columns are active objects, available objects, and object size

From the exhibit:

tcp_session 3 5 1500 ...

available objects = 5

object size = 1500

So:

Total slab size = 5 × 1500 = 7500

That matches option B.

Why the other options are wrong:

A: ip_session 10 10 1408 ... gives 10 × 1408 = 14080, but slabs are associated with the kernel, not user space

C: ip6_session 5 0 1472 ... gives 0 × 1472 = 0, not 1472

D: UDPv6 15 10 1408 ... gives 10 × 1408 = 14080, but again slabs are associated with the kernel, not user space

So the verified answer is B.

The correct answer is A.

The study guide explicitly explains the diagnose debug rating table and says that for each server IP, the output shows “The round trip delay”

That means the RTT value represents the time it takes for FortiGate to send a request and receive the reply from that FortiGuard server.

The FortiOS administration guide also confirms this by stating:

“Each server is probed for Round Trip Time (RTT) every two minutes.”

Why the other options are wrong:

B is wrong because packet loss is shown separately by Curr Lost and Total Lost, while RTT is the round-trip delay

C is wrong because license-validation behavior is indicated by flags such as I = Initial, not by the RTT value itself

D is wrong because the documents do not say RTT starts at a fixed value of 10; it is measured dynamically as round-trip delay

So the verified answer is: A.

" The result is that the gateway address will not be updated, unless the existing gateway is no longer valid "

The study guide identifies preserve-session-route as the configuration responsible for this behavior.

Technical Explanation:

The exhibit shows two WAN interfaces, port1 and port2, with static default routes.

Originally, both interfaces participate in routing with equal priority. The administrator changes the priority of port2 to 20, making port1 the preferred interface for new route selections.

However, the existing sessions were established using port2, and its interface configuration includes:

config system interface

edit " port2 "

set preserve-session-route enable

next

end

Option A is correct: The preserve-session-route setting enables interface stickiness for sessions using port2.

Because the original gateway and route remain valid, FortiGate preserves the existing sessions ' routing information and continues forwarding them through port2.

Option B is correct: Increasing the priority value on port2 makes it less preferred than port1. Consequently, new sessions that use the relevant default route are directed through port1.

Why the other options are incorrect:

Option C: FortiGate does not automatically update existing SNAT session gateway information merely because a more preferred path becomes available. The guide identifies snat-route-change as a separate setting used to permit appropriate SNAT route updates.

Option D: A route change can cause affected sessions to be marked dirty and reevaluated, but it is not accurate to conclude that every session is necessarily marked dirty or that dirty status overrides interface stickiness.

Option E: SNAT session dirty-state handling does not depend exclusively on using an IP pool. Interface-based SNAT sessions can also be affected by routing changes.

Architectural Consideration:

This distinction is important for SD-WAN failback design. Preserving established sessions can help maintain connection continuity, but it can also prevent traffic from returning to a preferred WAN interface until the session ends or the preserved route becomes invalid.

The correct answers are A and B.

For UDP, the study guide states this directly: “For UDP, the session state can have only two values: 00 when traffic is only one way, and 01 when traffic is two ways. For ICMP, the protocol state is always 00.”

That makes B correct and D incorrect.

For TCP, the study guide explains that the protocol state is a two-digit number, where the first digit is the server-side state and the second digit is the client-side state. It also states that the first digit is 0 when the session is not subject to any inspection, and the TCP state table shows that value 1 = ESTABLISHED

So, for a normal non-proxied/non-inspected TCP session, proto_state=01 means the TCP session is in the ESTABLISHED state. An established TCP session means the three-way handshake has completed, which requires traffic in both directions. That is why A is correct.

The study guide also says: “proto_state=11 means that the TCP three-way handshake for both server-side and client-side is completed (ESTABLISHED).”

This confirms that TCP state value 1 represents an established state.

Why C is not selected: the study guide defines value 5 as TIME_WAIT and says: “When a session is closed by both the sender and receiver, FortiGate keeps that session in the session table for a few seconds… This is the state value 5.”

So proto_state=05 represents a closing/closed TCP session in TIME_WAIT, not the normal bidirectional state the question is testing.

Therefore, the verified answers are A and B.

Comprehensive and Detailed 100 to 150 words of Explanation From Secure Networking Architect Study Guides topics:

Fortinet documents three values for the phase 2 route-overlap setting: use-new, use-old, and allow. The required value for simultaneous VPNs advertising overlapping remote subnets is allow.

With route-overlap allow, FortiGate keeps the existing dial-up VPN active and also accepts the newly connected VPN. The Enterprise Firewall 7.6 Administrator Study Guide explicitly states that traffic from the central FortiGate is then load-balanced using equal-cost multipath across both VPNs. This directly satisfies the scenario and makes C correct.

The default use-new setting disconnects the existing VPN and accepts the new one, while use-old keeps the existing VPN and rejects the new connection. Neither produces ECMP. multipath enable and net-device ecmp are not the phase 2 commands FortiOS uses to permit overlapping dial-up VPN routes.

================

FortiManager template groups allow administrators to combine provisioning templates and assign the resulting group to managed devices. A template group can contain different applicable template categories, including system and SD-WAN templates, making E correct.

FortiManager also supports standard CLI and Jinja CLI templates. CLI template groups can contain a mixture of these template types, so C is correct. When multiple CLI templates are grouped, FortiManager processes them in their configured top-to-bottom sequence, making D correct.

Option B is incorrect because FortiManager uses standard CLI scripts and Jinja scripts; Perl is not the supported alternative scripting type described by the FortiManager 7.6 study material. Option A is also incorrect because FortiManager does not impose the stated three-IPsec-template-per-group rule. Template groups are intended to simplify consistent, reusable device provisioning.

================

The correct answer is D.

The study guide shows the ipsmonitor test usage exactly:

1: Display IPS engine information

2: Toggle IPS engine enable/disable status

5: Toggle bypass status

99: Restart all IPS engines and monitor

So diagnose test application ipsmonitor 5 is used to toggle bypass status, which corresponds to enabling IPS bypass mode.

Why the other options are wrong:

A is wrong because disabling the IPS engine is option 2, not 5.

B is wrong because the study guide does not define option 5 as IPS session information.

C is wrong because restarting all IPS engines and monitors is option 99, not 5.

So the verified answer is: D.