Fortinet NSE 7 - SASE 26 Architect NSE7_SSE_AR-26 Exam Questions

Answer : B

The SD-WAN monitor's table view in FortiManager provides a donut visualization plus a detailed table that shows each SD-WAN member's status and SLA pass/miss, giving the per-member health view you're after. FortiManager templates reduce repetitive work but must resolve to valid, device-specific configurations at installation time. Device assignments, metadata mappings, ADOM scope, policy-package interfaces and provisioning order should be inspected together rather than troubleshooting any one object in isolation. A successful management connection does not guarantee a successful configuration installation. Review the installation preview and task log, then validate the resulting device configuration and operational diagnostics. This separates a deployment-time validation failure from a live tunnel, routing or SLA fault. In the relevant Fortinet FortiManager documentation, the applicable feature should be verified against the deployed software version, the selected configuration mode and the live operational state before the answer is treated as a definitive implementation requirement. The status of individual overlay interfaces can be inspected separately.

==========

Answer : A, D

ADVPN enables dynamic spoke-to-spoke IPsec shortcuts that eliminate unnecessary transit through hub devices after the initial discovery and negotiation process. In this scenario, spokes A1 and B2 belong to separate hub-and-spoke groups, interconnected through redundant IPsec tunnels.

Option A is correct because spoke devices use auto-discovery-receiver on their hub-facing IPsec Phase 1 interfaces. This enables the spokes to receive ADVPN shortcut discovery information needed to establish a direct tunnel to another spoke. Fortinet's ADVPN configuration examples explicitly demonstrate this receiver role.

Option D is correct because the interconnected hubs must forward the relevant ADVPN discovery messages across their inter-hub IPsec tunnels. Enabling auto-discovery-forwarder allows discovery signaling to traverse the hub-to-hub connections so that spokes belonging to different regions can discover one another.

Option B reverses the standard spoke and hub discovery roles. The hub normally performs the sender role on its spoke-facing tunnels, whereas the spoke uses the receiver role.

Option C similarly assigns the receiver role to the wrong side of the hub-to-spoke relationship.

The essential distinction is between receiving shortcut discovery at the spokes and forwarding discovery information between the hubs.

==========

Answer : B

In an SD-WAN rule, you can steer application traffic by using Internet Service Database (ISDB) entries. Facebook and LinkedIn are predefined ISDB objects in FortiGate, so the correct way is to select them in the Internet service field under Destination. This ensures that all traffic to these applications is matched and routed through the chosen (less costly) link. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow. When troubleshooting, correlate the configured SD-WAN service with diagnose sys sdwan service4, the live session entry and the routing table. An application signature, an IP route and a health-check result describe different decision stages; treating them as interchangeable can produce incorrect conclusions about the egress interface.

==========

Answer : A, B

FortiSASE proxy-based secure internet access allows managed and unmanaged endpoints to use cloud-delivered security controls without requiring the FortiClient endpoint agent.

Option A is correct because a proxy auto-configuration file can define how browsers and operating systems redirect eligible HTTP and HTTPS requests to the FortiSASE secure web gateway.

A PAC file allows automatic proxy selection based on destination URLs, hostnames, and other conditions. FortiSASE supports hosted and downloadable PAC file configurations, simplifying deployment across large endpoint populations.

Option B is correct because endpoints should install and trust the FortiSASE certificate authority certificate when SSL deep inspection is required. During TLS inspection, FortiSASE decrypts permitted traffic for security analysis and presents certificates that must be trusted by the endpoint.

Without the appropriate certificate, browsers and applications may reject inspected HTTPS connections because the signing authority is untrusted.

Option C is incorrect because FortiClient is associated with agent-based endpoint connectivity. Proxy-based deployment can operate without installing FortiClient.

Option D is incorrect because a tunnel policy applies to tunnel-based traffic handling rather than constituting an endpoint onboarding component for explicit proxy access.

PAC configuration provides traffic steering, while CA certificate installation establishes the certificate trust needed for SSL inspection.

==========

Answer : A, C

Hosting the hub at the MSSP centralizes installation, security, and ongoing management while each site (spoke) keeps local DIA. This can be done multi-tenant with a shared hub using a dedicated VDOM or with a fully dedicated hub per customer for stricter isolation and control, both meeting the requirement to delegate administration to the MSSP and support high inter-site traffic. A deployment should preserve the distinction between the physical or logical WAN underlay, the IPsec overlay and the SD-WAN zone that groups forwarding members. These layers can have different routing and security-policy requirements. The configured architecture must also allow the required traffic paths and failover behavior rather than assuming every available interface is interchangeable. Before applying a topology change, review the interface dependencies, static and dynamic routing, security policies and provisioning templates. FortiGate can support multiple transport types, but routing and tunnel compatibility still determine whether the intended member is operationally eligible.

==========

Answer : D

From the exhibit, both branches have an SD-WAN zone named overlay with set advpn-select enable, and each SD-WAN member in that zone is assigned a transport-group value. Branch-A members: Branch-B members: In FCSS SD-WAN 7.6 ADVPN design, transport-group is used to constrain which underlays are allowed to form ADVPN shortcuts with each other. A spoke can establish an ADVPN shortcut only between interfaces that belong to the same transport-group on both sides. This prevents building shortcuts across dissimilar transports. Evaluating the options: Therefore, the valid shortcut pairing listed is between T2 on Branch-A and TA on Branch-B, which corresponds to Option D. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow.

==========

Answer : A, B

FortiSASE integrates FortiClient with its Endpoint Management Service (EMS) to provide centralized configuration, security enforcement, and remote-access connectivity. Managed endpoints receive configuration information through the Zero Trust Telemetry communication channel.

Option A is correct. FortiSASE supports automatic installation of its certificate authority certificate on managed FortiClient endpoints when SSL deep inspection is enabled. This allows endpoints to validate certificates issued during TLS inspection without requiring administrators to distribute the CA certificate manually. The important qualification is that automatic certificate deployment is associated with deep inspection; the default inspection mode is certificate inspection.

Option B is correct because FortiSASE centrally manages endpoint connection profiles, including the FortiSASE Cloud Security tunnel. FortiClient obtains the relevant connection parameters from its assigned endpoint profile, providing consistent VPN configuration and reducing administrative overhead.

Option C is incorrect because FortiSandbox integration requires appropriate endpoint-protection settings and licensing. The question does not establish that sandbox configuration is automatically deployed.

Option D is incorrect in the stated default configuration. Security posture tagging rules can be distributed to endpoints, but they must first be defined and enabled; their creation is not an automatic default onboarding action.

This distinguishes the standard connectivity provisioning workflow from optional advanced endpoint security configuration.

==========