Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
Refer to the exhibit, which shows a partial output of the real-time LDAP debug.
What two actions can the administrator take to resolve this issue? (Choose two.)
The exhibit showing the real-time LDAP debug output is not visible. LDAP issues typically involve authentication failures, connectivity problems, or configuration mismatches. Two actions to resolve an LDAP issue might include: verifying LDAP server connectivity and port accessibility, checking LDAP bind credentials, confirming proper LDAP search base configuration, validating LDAP schema or user/group mappings, or adjusting timeout values.
Exhibit 1.
Exhibit 2.
Refer to the exhibits, which show the configuration on FortiGate and partial internet session information from a user on the internal network.
An administrator would like to lest session failover between the two service provider connections.
Which two changes must the administrator make to force this existing session to immediately start using the other interface? (Choose two.)
FortiOS Admin Guide: Static Routing, SNAT Route Change Feature
Refer to the exhibit.
A network topology and the routing table of a FortiGate device are shown.
What must the administrator configure in the BGP section to add only the subnet 100.64.2.0/24 to the routing table of FortiGate_A? (Choose one answer.)
The Enterprise Firewall 7.6 Administrator Study Guide states: ''You can also use the network command to configure FortiGate BGP to advertise prefixes.'' Therefore, FortiGate_C must originate the required prefix by adding 100.64.2.0/24 under config router bgp config network.
By default, the configured prefix must exactly match an active route in FortiGate_C's routing table. The topology indicates that 100.64.2.0/24 is directly connected to FortiGate_C, so the network-import check succeeds and FortiGate_C advertises that specific prefix to FortiGate_B. FortiGate_B can then advertise the learned BGP route to FortiGate_A through the existing eBGP adjacency.
Connected-route redistribution on FortiGate_C would be too broad because it would redistribute all eligible connected routes, including the other connected subnet 100.65.3.0/24. A route-map-in on FortiGate_A can filter routes that FortiGate_A receives, but it cannot originate a route that FortiGate_C has not advertised. FortiGate_B does not need to redistribute BGP into BGP; normal BGP route propagation handles the advertisement between autonomous systems.
Example configuration on FortiGate_C:
config router bgp
config network
edit 1
set prefix 100.64.2.0 255.255.255.0
next
end
end
Refer to the exhibit, which shows the modified output of the routing kernel.
Which statement is true?
Refer to the exhibit.
The output of a BGO debug command is shown.
What is the most likely reason that the local FortiGate is not receiving any prefixes from its neighbors?
To identify the reason for the lack of prefixes, we must interpret the State/PfxRcd and Up/Down columns in the get router info bgp summary exhibit.
Analyze Neighbor Status:
Neighbor 10.125.0.60: State is OpenSent. This session is not established. It is stuck in the negotiation phase.
Neighbor 100.64.3.1: State is Active. This session is not established. The router is actively trying to initiate a TCP connection.
Neighbor 10.127.0.75:
Up/Down: 02:45:55. This indicates the BGP session has been Up (Established) for almost 3 hours.
State/PfxRcd: 0. This number represents the count of prefixes received. The session is fully established, but the neighbor has sent zero routes.
Determine the Cause:
Since the session with 10.127.0.75 is established, connectivity and handshakes (Options A, B, C) are not the issue for this neighbor.
The fact that it is Up but sending 0 prefixes strongly implies that the neighbor is configured to filter out its routes before sending them to the local FortiGate.
Option D correctly identifies this as a RIB-OUT (Routing Information Base - Outbound) configuration issue on the neighbor (Router 10.127.0.75), which prevents it from advertising its routes.
FortiGate Security 7.6 Study Guide (BGP): 'In the BGP summary, if the State/PfxRcd shows a number (e.g., 0), the session is Established. A value of 0 means the peering is up, but no routes have been received, often due to route-map or prefix-list filtering on the remote peer.'
164 questions covering all exam domains, starting from $20
Exam domains verified against: Official Fortinet NSE7_FSN_AR-7.6 exam guide, last checked September 2026.
Design and implement enterprise SD-WAN deployments using FortiGate devices, including Security Fabric integration, HA clustering modes, VLAN and VDOM segmentation. Understand FGCP and FGSP synchronization strategies for session preservation across distributed sites.
Sample question from this domain above: Q2
Deploy SD-WAN branches using zero-touch provisioning with device blueprints and CSV imports. Configure FortiManager for SD-WAN oversight including metadata variables, overlay templates, and IPsec template-based hub-and-spoke topologies.
Implement SSL/SSH inspection with certificate validation and SNI checks. Apply web filtering, application control, IPS and ISDB together to protect network endpoints while tuning firewall performance and managing false positives.
Configure OSPF and BGP for enterprise routing, including ECMP, route reflectors, and graceful restart. Design SD-WAN rules with traffic matching, application steering and member priority election. Implement policy routes, static routes and member probe routes in SD-WAN topology.
Design and deploy IPsec VPN topologies with IKE v2, DPD modes and hardware offload. Implement ADVPN for on-demand shortcut tunnels between branch sites. Configure dual-hub and multiregion deployments with VRF-aware overlays for large enterprise and MSSP scenarios.
Sample question from this domain above: Q4
Common questions about the exam itself
