VendorsExamsEnterprise
Support
Request an ExamContact UsFAQ

Fortinet NSE 5 - FortiSASE and SD-WAN 7.6 Core Administrator Free Sample Questions

Description

Covers SD-WAN deployment with zones and performance SLAs, FortiSASE administration and user onboarding, secure internet and SaaS access with endpoint compliance, and log analytics.

12 free sample questions180 in the full practice test

Try simulator

NSE5_SSE_AD-7.6 Sample Questions

  1. Question 1

    Advanced

    Rules and Routing · Configure SD-WAN rules

    A multinational retail corporation is deploying Fortinet Secure SD-WAN across 500 locations. Each location has two WAN links: a high-cost, low-latency MPLS link (Member A) and a low-cost, high-bandwidth Broadband link (Member B). The administrator creates an SD-WAN zone named 'Overlay' containing both members.

    The requirement is to route VoIP traffic over the MPLS link unless its latency exceeds 50ms, in which case it should fail over to Broadband. For all other traffic, the Broadband link should be used unless it is down.

    Which combination of SD-WAN Rule configurations fulfills this requirement?

    Answer and explanation

    Correct answer: C

    The 'Lowest Cost (SLA)' strategy is ideal here. It respects the interface preference (MPLS) as long as the SLA (50ms latency) is met. If the SLA fails, it switches to the next available member (Broadband) if configured in the preference list or based on cost. For the remaining traffic, a Manual or implicit rule preferring Broadband satisfies the second requirement.

  2. Question 2

    Intermediate

    Decentralized SD-WAN · Configure performance service-level agreements (SLA)

    An administrator is configuring a Performance SLA on a FortiGate SD-WAN device to monitor connectivity to a cloud-based CRM application. The application does not respond to ICMP pings, but it exposes a REST API health endpoint.

    Which protocol should the administrator select for the Health Check probe to accurately monitor the application's availability?

    Answer and explanation

    Correct answer: C

    The HTTP (or HTTPS) probe is designed to monitor web-based services. It can send a GET or HEAD request to a specific URL (the health endpoint) and validate the response code. Since the application blocks ICMP, Ping would fail even if the app is up.

  3. Question 3

    Intermediate

    SASE Deployment · Use available user onboarding methods

    A network architect is designing a FortiSASE solution for a remote workforce. The organization uses Microsoft Entra ID (formerly Azure AD) as their Identity Provider (IdP). The goal is to allow users to authenticate to FortiSASE using their existing credentials without requiring a separate user database on FortiSASE.

    Which configuration step is essential to achieve this integration?

    Answer and explanation

    Correct answer: B

    SAML SSO is the standard method for federating identity between FortiSASE and cloud IdPs like Entra ID. FortiSASE acts as the SP, redirecting authentication requests to the IdP, which validates credentials and returns a SAML assertion.

  4. Question 4

    Beginner

    Decentralized SD-WAN · Configure SD-WAN members and zones

    In a decentralized SD-WAN deployment using FortiOS 7.6, an administrator wants to ensure that firewall policies are applied efficiently to multiple WAN links. The administrator has grouped 'wan1' and 'wan2' into an SD-WAN Zone named 'Internet_Zone'.

    How does this zone configuration affect firewall policy creation?

    Answer and explanation

    Correct answer: B

    SD-WAN Zones simplify policy management. By referencing the Zone object in the firewall policy, the policy automatically applies to all members (interfaces) within that zone, reducing the number of policies needed.

  5. Question 5

    IntermediateMultiple answers

    Rules and Routing · Configure SD-WAN rules

    Which TWO statements accurately describe the behavior of the 'Maximize Bandwidth (SLA)' SD-WAN rule strategy in FortiOS? (Select TWO)

    Answer and explanation

    Correct answers: A, C

    If all members fail the SLA check, the strategy typically falls back to the preference order defined in the rule or the implicit rule behavior, depending on specific configuration options like 'packet loss' handling.

    Maximize Bandwidth (SLA) is designed for load balancing. It identifies the set of links that satisfy the SLA target and distributes sessions among them to aggregate capacity.

  6. Question 6

    Beginner

    Secure Internet Access (SIA) and Secure SaaS Access (SSA) · Implement security profiles to perform content inspection

    True or False: When configuring FortiSASE for Agentless Secure Web Gateway (SWG) access, installing the FortiSASE root CA certificate on the client browser is mandatory for successful SSL Deep Inspection.

    Answer and explanation

    Correct answer: A

    This is True. For SSL Deep Inspection to work without generating certificate warnings or errors in the browser, the client must trust the Certificate Authority (CA) that signs the re-encrypted traffic. In FortiSASE, this is the FortiSASE CA.

Register free for 6 more questions

Or unlock all 180 NSE5_SSE_AD-7.6 questions with explanations, timed mode and flashcards.

Related practice tests

All Fortinet practice exams