Fortinet NSE5_SSE_AD-7.6 Online Practice Questions and Exam Preparation

Fortinet NSE5_SSE_AD-7.6 Online Questions & Answers

• Question 1:

  DRAG DROP

  In which order does a FortiGate device consider the following elements shown in the left column during the route lookup process?

  Select the element in the left column, hold and drag it to a blank position in the column on the right. Place the four correct elements in order, placing the first element in the first position at the top of the column.

  Once you place an element, you can move it again if you want to change your answer before moving to the next question. You need to drop four elements in the work area.

  Select and drag the screen divider to change the viewable area of the source and work areas.

  Select and Place:

  

  

  ---

  FortiGate first checks regular policy routes. If a matching policy route exists and the selected path is valid, FortiGate uses it before normal routing.

  Next, FortiGate checks ISDB routes. ISDB routes are implemented as policy routes and are evaluated before SD-WAN rules.

  Then FortiGate evaluates SD-WAN rules. SD-WAN rules are also policy-route-based, but regular policy routes and ISDB routes have higher precedence.

  If none of those policy-based mechanisms select a path, FortiGate falls back to the regular routing table/ FIB. A connected route is preferred over a default route because it is more specific and directly reachable.

  Default routes are not selected in this drag-drop answer because they are the last fallback route and the question requires only four elements.

• Question 2:

  How does the FortiSASE security dashboard facilitate vulnerability management for FortiClient endpoints? (Choose one answer)

  A. It automatically patches all vulnerabilities without user intervention and does not categorize vulnerabilities by severity.
  B. It shows vulnerabilities only for applications and requires endpoint users to manually check for affected endpoints.
  C. It displays only critical vulnerabilities, requires manual patching for all endpoints, and does not allow viewing of affected endpoints.
  D. It provides a vulnerability summary, identifies affected endpoints, and supports automatic patching for eligible vulnerabilities.
  D. It provides a vulnerability summary, identifies affected endpoints, and supports automatic patching for eligible vulnerabilities.

  ---

  Explanation

  The FortiSASE vulnerability dashboard summarizes endpoint vulnerabilities, lets administrators identify affected endpoints, and supports automatic patching workflows for eligible vulnerabilities. It does not automatically patch every vulnerability without administrator control, and it is not limited to only critical items or application-only views. The useful operational value is that the dashboard connects vulnerability summary, affected endpoint drilldown, and controlled remediation.

• Question 3:

  Which statement about security posture tags in FortiSASE is correct?

  A. Multiple tags can be assigned to an endpoint, but only one is used for evaluation.
  B. Multiple tags can be assigned to an endpoint and used for evaluation.
  C. Tags are static and do not change with endpoint status.
  D. Only one tag can be assigned to an endpoint.
  B. Multiple tags can be assigned to an endpoint and used for evaluation.

  ---

  Explanation

  FortiSASE security posture tags are dynamic labels that can be assigned based on endpoint conditions and then used in policy evaluation. Multiple tags can apply to an endpoint, and those tags can be evaluated together by FortiSASE policy logic. They are not static-only labels, and FortiSASE is not limited to assigning or evaluating a single tag per endpoint.

• Question 4:

  A company needs FortiSASE Secure Internet Access for contractors on unmanaged devices and cannot install FortiClient. The requirement is to secure web browsing only.

  Which deployment behavior matches FortiSASE SIA agentless proxy mode?

  A. A PAC file configures the browser to use the FortiSASE proxy as an explicit web proxy for HTTP and HTTPS traffic.
  B. FortiClient creates an IPsec tunnel that forwards all endpoint traffic to FortiSASE.
  C. A static route on the contractor device sends every protocol through a FortiGate SD-WAN zone.
  D. ZTNA tags from FortiClient are required before any web traffic can be proxied.
  A. A PAC file configures the browser to use the FortiSASE proxy as an explicit web proxy for HTTP and HTTPS traffic.

  ---

  Explanation

  FortiSASE SIA agentless proxy mode uses a PAC file so the browser sends HTTP and HTTPS traffic to the FortiSASE SWG explicit proxy. This fits unmanaged contractor devices because FortiClient is not required. FortiClient tunnel mode is agent-based, static routing all protocols through SD-WAN is not agentless browser proxy behavior, and ZTNA tags require endpoint agent context that is not available on unmanaged devices without FortiClient.

• Question 5:

  Refer to the exhibit.

  

  The exhibit shows output of the command diagnose sys sdwan service collected on a FortiGate device.

  The administrator wants to know through which interface FortiGate will steer traffic from local users on subnet 10.0.1.0/255.255.255.192 and with a destination of the social media application Facebook.

  Based on the exhibits, which two statements are correct? (Choose two.)

  A. FortiGate steers traffic for social media applications according to the service rule 2 and steers traffic through port2.
  B. There is no service defined for the Facebook application, so FortiGate applies service rule 3 and directs the traffic to headquarters.
  C. When FortiGate cannot recognize the application of the flow, it load balances the traffic through the tunnels HQ_T1, HQ_T2, HQ_T3.
  D. When FortiGate cannot recognize the application of the flow, it steers the traffic through the preferred member of rule 3, HQ_T1.
  A. FortiGate steers traffic for social media applications according to the service rule 2 and steers traffic through port2.
  C. When FortiGate cannot recognize the application of the flow, it load balances the traffic through the tunnels HQ_T1, HQ_T2, HQ_T3.

  ---

  Explanation

  FortiGate evaluates matching SD-WAN service rules before falling back to later rules or the implicit rule.

  The Facebook flow matches the social media rule, so traffic is steered by that rule through port 2. If the application is not recognized, the flow no longer matches the application-based rule and can be handled by the later rule that load balances across the HQ tunnel members. The alternatives that deny a social media match or force only HQ_T1 do not match this rule behavior.

• Question 6:

  Refer to the exhibit, which shows the SD-WAN rule status and configuration.

  

  Based on the exhibit, which change in the measured packet loss will make HUB1-VPN3 the new preferred member? (Choose one answer)

  A. When all three members have the same packet loss
  B. When HUB1-VPN1 has 4% packet loss
  C. When HUB1-VPN1 has 12% packet loss
  D. When HUB1-VPN3 has 4% packet loss
  A. When all three members have the same packet loss

  ---

  Explanation

  For a Best Quality SD-WAN rule, measured SLA values such as packet loss are compared together with member priority and tie behavior. In this scenario, equal packet loss across the listed members removes the packet-loss advantage of the currently preferred member and allows HUB1-VPN3 to become the selected member according to the displayed rule ordering and priority. Raising loss only on HUB1-VPN1 or changing HUB1-VPN3 to 4 percent does not create the same first eligible preference condition.

• Question 7:

  Which configuration is a valid use case for FortiSASE features in supporting remote users?

  A. Enabling secure SaaS access through SD-WAN integration, protecting against web-based threats with data loss prevention, and monitoring user connectivity with shadow IT visibility.
  B. Monitoring SaaS application performance, isolating browser sessions for all websites, and integrating with SD-WAN for data loss prevention.
  C. Enabling secure web browsing to protect against threats, providing explicit application access with zero-trust or SD-WAN integration, and addressing shadow IT visibility with data loss prevention.
  D. Providing secure web browsing through remote browser isolation, addressing shadow IT with zero-trust access, and protecting data at rest only.
  C. Enabling secure web browsing to protect against threats, providing explicit application access with zero-trust or SD-WAN integration, and addressing shadow IT visibility with data loss prevention.

  ---

  Explanation

  FortiSASE supports remote-user use cases that combine secure web browsing, explicit application access through zero trust or SD-WAN integration, and visibility into shadow IT and data protection concerns. The stronger answer covers Secure Internet Access, Secure Private Access or ZTNA style access, and SaaS or shadow IT visibility. The other choices either overstate browser isolation for all websites, misuse SD-WAN for data loss prevention, or reduce the scope to data-at-rest protection only.

• Question 8:

  Refer to the exhibit.

  

  Which two statements about the Vulnerability summary dashboard in FortiSASE are correct? (Choose two.)

  A. The dashboard shows the vulnerability score for unknown applications.
  B. Vulnerability scan is disabled in the endpoint profile.
  C. The dashboard allows the administrator to drill down and view CVE data and severity classifications.
  D. Automatic vulnerability patching can be enabled for supported applications.
  C. The dashboard allows the administrator to drill down and view CVE data and severity classifications.
  D. Automatic vulnerability patching can be enabled for supported applications.

  ---

  Explanation

  The Vulnerability summary dashboard supports drilldown into vulnerability details such as CVE information and severity classifications, and automatic patching can be enabled or scheduled for supported applications or eligible vulnerabilities. A score for unknown applications is not the key behavior here, and a disabled vulnerability scan would prevent the dashboard from providing the shown vulnerability management value.

• Question 9:

  An SD-WAN rule uses the Lowest Cost (SLA) strategy. Two member links satisfy the measured SLA, but one member has a lower configured cost value.

  What is the expected forwarding behavior?

  A. FortiGate selects the link with the lower configured cost.
  B. FortiGate ignores the cost field and always selects the first configured member.
  C. FortiGate load balances equally across all links that satisfy the SLA.
  D. FortiGate disables the rule until all members have identical cost values.
  A. FortiGate selects the link with the lower configured cost.

  ---

  Explanation

  The Lowest Cost (SLA) strategy considers SLA eligibility and then prefers the eligible member with the lower configured cost value. It does not ignore the cost field, require identical costs, or automatically load balance equally across every in-SLA link. Equal balancing is a separate behavior that must be configured through a supported load balancing strategy rather than assumed from SLA success alone.

• Question 10:

  Refer to the exhibit.

  

  The SD-WAN rule status and configuration is shown.

  Based on the exhibit, which change in the measured latency will first make HUB1-VPN3 the new preferred member?

  A. When HUB1-VPN3 has a latency of 80 ms
  B. When HUB1-VPN3 has a lower latency than HUB1-VPN1 and HUB1-VPN2
  C. When HUB1-VPN1 has a latency of 200 ms
  D. When HUB1-VPN3 has a latency of 90 ms
  A. When HUB1-VPN3 has a latency of 80 ms

  ---

  Explanation

  For the displayed SD-WAN rule, HUB1-VPN3 becomes preferred only when its measured latency satisfies the rule condition strongly enough to beat the currently preferred members. A latency value of 80 ms is the first listed change that meets that condition. Merely saying that HUB1-VPN3 has lower latency is too general for the specific threshold question, and increasing HUB1-VPN1 latency or setting HUB1-VPN3 to 90 ms does not produce the earliest preferred-member change in this scenario.