New Release NSE7_FSN_AR-7.6 NSE 7 Network Security Architect Questions

The SD-WAN 7.6 Enterprise Administrator Study Guide states: “For branches and hubs, it creates BGP, IPsec, and CLI templates to accommodate all required configuration changes.”

Accordingly, the overlay orchestrator generates the following templates for each spoke:

The IPsec tunnel template configures the spoke as an IPsec dial-up client and applies the tunnel parameters appropriate to the selected topology, authentication method, routing design, and ADVPN settings.

The BGP template configures the spoke’s BGP routing, including the autonomous system, neighbor relationships, and either BGP-per-overlay or BGP-on-loopback behavior selected in the wizard.

The CLI template supplies additional configuration that cannot be represented entirely by the dedicated IPsec and BGP templates.

The guide separately explains that, for branch devices, FortiManager adds the required members and zones to the defined SD-WAN template. It does not generate a separate rules template for the spoke. Static routes are also not delivered through a dedicated static-route template; routing for the overlay is configured using the generated BGP template. Therefore, options A and E are incorrect.

The traffic matches service 2’s address criteria: 10.0.1.125 belongs to the configured source range 10.0.1.0–10.0.1.255, and 128.66.0.125 belongs to the destination range 128.66.0.0–128.66.255.255. Service 2 lists port7 and port8 as selected SLA members and uses round-robin load balancing.

However, the SD-WAN guide states: “SD-WAN requires a valid route in the forwarding information base (FIB) so the member can be used to steer traffic.” The routing table contains routes through port7 and port8 only for 10.0.1.0/24. It contains no route to 128.66.0.125 through either member.

The only route covering the destination is the default route, which has equal-cost paths through port1 and port2. Consequently, port7 and port8 cannot be used for this flow despite being SLA-selected. FortiGate skips the unusable explicit SD-WAN rule and processes the traffic through the implicit rule using standard FIB routing. Therefore, option A is correct. Options B and C incorrectly assume that selected overrides route availability, while option D is incorrect because valid default routes exist.

The get router info bgp summary output lists BGP neighbor status:

Prefix Reception: The " State/PfxRcd " column shows the number of prefixes received from the neighbor—neighbor 100.64.1.254 has " 1 " , confirming option A.

Received Message Count: Under " MsgRcvd " , 18 packets have been received from neighbor 100.64.1.254. This matches option C.

The second neighbor 100.64.2.254 is in " Active " state and has received/sent 0 packets, indicating that its TCP connection is NOT established, disproving option B.

There is no indication anywhere that the router is " still calculating " prefixes; " Active " just means no session is established, so option D is incorrect.

FortiManager allows much of a large branch rollout to be prepared before the physical FortiGate devices are deployed. Model devices can be created in advance and associated with the appropriate policy packages, provisioning templates, device groups, and deployment settings. Therefore, D is correct.

Metadata variables provide the per-device customization required when otherwise identical templates contain values that differ between branches, such as interface names, gateways, addresses, and health-check servers. Their per-device mappings can also be prepared in advance, making C correct.

There is no dedicated provisioning object called a “ZTP template.” ZTP instead combines model devices, provisioning templates, device blueprints, metadata variables, and CSV-based onboarding. Similarly, FortiManager uses a device blueprint rather than an object called a policy blueprint. Consequently, A and B describe nonexistent or incorrectly named provisioning mechanisms.

================