Real NSE7_FSN_AR-7.6 Exam PDF Test Engine Practice Test Questions [Q84-Q99]

November 3, 2026 admin 0 Comments

Rate this post

Real NSE7_FSN_AR-7.6 Exam PDF Test Engine Practice Test Questions

Fortinet NSE7_FSN_AR-7.6 Real 2026 Braindumps Mock Exam Dumps

Fortinet NSE7_FSN_AR-7.6 Exam Syllabus Topics:

Section	Weight	Objectives
Topic 1: Centralized Management	20%	– FortiAnalyzer logging & reporting – Policy packages & object templates – Configuration provisioning & version control – FortiManager 7.6 deployment & role assignment
Topic 2: Monitoring & Troubleshooting	10%	– Fabric synchronization issues – Connectivity & performance troubleshooting – Diagnostic tools & CLI analysis
Topic 3: System Architecture & Design	20%	– FortiOS 7.6 architecture & components – VDOM design & multi-tenant deployment – Hardware sizing & resource planning – Security Fabric integration & scaling
Topic 4: High Availability & Redundancy	15%	– Cross-data center redundancy – FGCP/FGSP/vCluster deployment – Session synchronization & failover
Topic 5: Security Policy & Services	10%	– NAT & IP pool optimization – Identity-based policies – Advanced firewall & security profile design
Topic 6: Advanced Routing & VPN	25%	– IPsec VPN & ADVPN architecture – Route redistribution & filtering – SD-WAN design & SLA management – OSPF, BGP, IS-IS configuration & optimization

QUESTION 84
Exhibit.

Refer to the exhibit, which shows a partial output of diagnose hardware aysinfo memory.
Which two statements about the output are true? (Choose two.)

There are 98908 kB of memory that will never be used.

The user space has 708880 kB of physical memory that is not used by the system.

The I/O cache, which has 641364 kB of memory allocated to it.

The value indicated next to the inactive heading represents the currently unused cache page.

The partial output from diagnose hardware sysinfo memory provides details on system RAM allocation.
According to Fortinet ‘ s technical documentation for memory troubleshooting and Linux memory management (which FortiOS is based on):
MemFree is the portion of physical memory not currently allocated to any running process or kernel function.
Thus, 708880 kB is available and can be immediately used by user-space programs or system operations.
Inactive refers to pages in the memory cache that were previously in use for I/O or file system buffering but are now not actively referenced. These pages are retained in memory for quick access if needed again, but can be reclaimed for other memory operations if demand increases. The value 98908 kB here represents currently unused cache pages (inactive pages), ready for repurposing or deletion if the system requires more RAM.
Cached represents the total amount of system memory allocated to cache, which includes both active and inactive cache pages. It does not, by itself, represent I/O cache exclusively, nor does ” inactive ” mean memory “will never be used” as the kernel can re-purpose inactive pages on demand.
References:
Fortinet Technical Tip: Explaining the ‘ diagnose hard sysinfo memory ‘ command FortiOS System Administration Guide: Linux Memory Reporting, Cached and Inactive Statistics

QUESTION 85
Refer to the exhibit.

The partial output of FortiOS kernel slabs is shown. Which statement about total slab size is true?

The total slab size of the ip_session Tlab is 14080 kB and is associated with the user space.

The total slab size of the tcp_session slab is 7500 kB and is associated with the kernel.

The total slab size of the ip6_session slab is 1472 kB and is associated with the kernel.

The total slab size of the UDPv6 slab is 14080 kB and is associated with the user space.

The correct answer is B.
The study guide explicitly states that slabs are used by the kernel: “The kernel memory slabs are collections of objects with a common purpose. The kernel uses them to store information in memory.” It also gives the exact calculation method: “Total slab size = available objects x object size” and explains that in the diagnose hardware sysinfo slab output, the columns are active objects, available objects, and object size From the exhibit:
tcp_session 3 5 1500 …
available objects = 5
object size = 1500
So:
Total slab size = 5 × 1500 = 7500
That matches option B.
Why the other options are wrong:
A: ip_session 10 10 1408 … gives 10 × 1408 = 14080, but slabs are associated with the kernel, not user space C: ip6_session 5 0 1472 … gives 0 × 1472 = 0, not 1472 D: UDPv6 15 10 1408 … gives 10 × 1408 = 14080, but again slabs are associated with the kernel, not user space So the verified answer is B.

QUESTION 86
Refer to the exhibit.

The health-check configuration on a FortiGate device used as a spoke is shown.
You notice that the hub FortiGate does not prioritize the traffic as expected.
Which two configuration elements should you check on the hub? (Choose two.)

The performance SLA uses the same criteria.

The performance SLA has the parameter priority-out-sla configured.

The performance SLA uses the same members.

The performance SLA is configured with set embedded-measure accept.

Comprehensive and Detailed 100 to 150 words of Explanation From Secure Networking Architect Study Guides topics:
The spoke configuration enables embed-measured-health, which causes SD-WAN SLA status to be embedded in ICMP probes sent toward the hub. For the hub to use this information correctly, Fortinet requires a remote- mode health check and appropriate IKE-route priorities.
The SD-WAN 7.6 Enterprise Administrator Study Guide states that the hub must define priority-in-sla and priority-out-sla, so B is correct. It also explicitly requires the same link-cost factor and metric on the spoke and hub when remote detection is used. In this exhibit, the spoke evaluates latency with a threshold of 100, making the matching SLA criteria on the hub essential and A correct. The hub does not need identical member identifiers because its local SD-WAN members are independently defined. set embedded-measure accept is not the required FortiOS hub configuration for receiving embedded SLA information.

QUESTION 87
Which two statements about application-layer test commands are true? (Choose two answers)

Some of them display statistics and configuration information about a feature or process.

Some of them display real-time application debugs.

Some of them display output only after you run the diagnose debug console enable command.

Some of them can be used to restart an application.

The correct answers are A and D .
The study guide states:
“Application layer test commands do not display information in real time. They display statistics and configuration information about a feature or process. You can also use some of these commands to restart a process or execute a change in its operation.” This directly proves:
* A is correct because they can display statistics and configuration information
* D is correct because some of them can restart a process/application
Why the other options are wrong:
* B is wrong because the study guide explicitly says application-layer test commands do not display information in real time . Real-time output is done with diagnose debug application … commands instead.
* C is wrong because diagnose debug console enable is related to debug output behavior, not a requirement for application-layer test commands to display output. The study guide does not describe test commands that way.
====

QUESTION 88
Refer to the exhibit.

The output of the command diagnose vpn tunnels liar is shown.
Which two statements accurately describe the status of the tunnel? (Choose two.)

Phase 2 is down

Phase 1 is down.

There is currently no traffic traversing the tunnel

Both Phase 1 and Phase 2 were negotiated successfully.

Based on the Fortinet FCSS – Network Security 7.6 documents and the analysis of the VPN tunnel exhibit, here is the verified answer.
Questions no: 91
Verified answer: A, C
Comprehensive and Detailed Explanation with all FCSS – Network Security 7.6 documents:
To determine the status of the VPN tunnel, we must examine the specific counters and fields in the diagnose vpn tunnel list output provided in the exhibit.
Analyze Phase 2 Status (Option A):
The output displays child_num=0.
In IKEv2 (and IKEv1 implementations in FortiOS), ” Child SAs ” refer to the Phase 2 (IPsec) Security Associations that carry the actual data traffic.
A value of 0 indicates that no Phase 2 tunnels are established. If Phase 2 were up, child_num would be at least
1.
Additionally, under the proxyid section, the field sa=0 confirms there is no active Security Association for that traffic selector.
Analyze Traffic Status (Option C):
The stat line shows: rxp=0 txp=0 rxb=0 txb=0.
rxp (Received Packets) and txp (Transmitted Packets) are both zero. This definitively confirms that no traffic is traversing the tunnel currently. This is expected since Phase 2 is down.
Analyze Phase 1 Status (Why B is incorrect):
The tunnel entry exists in the list with a valid tun_id, and NAT-Traversal is active (natt: mode=keepalive).
The presence of the tunnel in this command output, along with active Keepalive mechanisms, typically indicates that Phase 1 (IKE SA) is established and the peers are communicating on port 4500 (NAT-T), even though the data tunnels (Phase 2) failed to negotiate. If Phase 1 were down, the tunnel would often not appear in this ” list ” view or would show different status flags indicating a complete connection failure.
Conclusion: The exhibit shows a scenario where the Phase 1 control channel is likely up (evidenced by the entry existence and NATT keepalives), but the Phase 2 data channel is down (child_num=0), resulting in zero traffic flow (rxp=0/txp=0).

QUESTION 89
Refer to the exhibit, which a network topology and a partial routing table.

FortiGate has already been configured with a firewall policy that allows all ICMP traffic to flow from port1 to port3.
Which changes must the administrator perform to ensure the server at 10.4.0.1/24 receives the echo reply from the laptop at 10.1.0.1/24?

Enable asymmetric routing under config system settings.

Change the configuration from strict RPF check mode to feasible RPF check mode.

A firewall policy that allows all ICMP traffic from port3 to port1.

Modify the default gateway on the laptop from 10.1.0.2 to 10.2.0.2.

QUESTION 90
Refer to the exhibit, which shows the output of a diagnose command.

What two conclusions can you draw from the output shown in the exhibit? (Choose two answers)

This is an expected session created by the IPS engine.

Traffic in the original direction (coming from the IP address 10.171.121.38) will be routed to the next- hop IP address 10.0.1.10.

Traffic in the original direction (coming from the IP address 10.171.121.38) will be routed to the next- hop IP address 10.200.1.1.

This is a pinhole session created to allow traffic for a protocol that requires additional sessions to operate through FortiGate.

The correct answers are B and D.
The study guide explains that expectation sessions are pinhole sessions created by session helpers for protocols such as FTP that need additional negotiated connections. It states: “FortiGate created an expectation session and opened the pinhole port for the expected return traffic” and also shows that the firewall “creates an expected (pinhole) session to allow the traffic” That makes D correct.
For B, the study guide explains the gwy= field in session output: the first value is the gateway to the destination, and the second is the gateway to the source In the exhibit, the original-direction traffic is DNATed here:
hook=pre dir=org act=dnat 10.171.121.38:0- > 10.200.1.1:60426(10.0.1.10:50365) So the destination after DNAT is the internal host 10.0.1.10, and the session’s first gwy value corresponds to the next hop toward that destination. That makes B correct.
Why the other options are wrong:
A is wrong because this is an expectation/session-helper behavior, not an IPS-engine-created session. The study guide ties expectation sessions to helpers such as FTP, not IPS.
C is wrong because 10.200.1.1 is the translated address used before DNAT, not the next hop used to forward the original-direction traffic after translation to the internal destination.
So the verified answers are: B, D.

QUESTION 91
Refer to the exhibits.

An administrator Is expecting to receive advertised route 8.8.8.8/32 from FGT-A. On FGT-B, they confirm that the route is being advertised and received, however, the route is not being injected into the routing table.
What is the most likely cause of this issue?

A batter route to the 8.8.8.8/32 network exists in the routing table.

FGT-B is configured with a prefix list denying the 8.8.8.8/32 network to be injected into the routing table.

The administrator has misconfigured redistribution of routes on FGT-A.

FGT-B is configured with a distribution list denying the 8.8.8.8/32 network to be injected into the routing table.

The 8.8.8.8/32 route is visible in the OSPF database on FGT-B but not installed into the routing table-the most likely explanation is that FGT-B is filtering it from being installed.

QUESTION 92
During which phase of IKEv2 does the Diffie-Helman key exchange take place?

IKE_Req_INIT

Create_CHILD_SA

IKE_Auth

IKE_SA_INIT

QUESTION 93
Refer to the exhibits.

An administrator is testing application steering in SD-WAN. Before generating test traffic, the administrator collected the SD-WAN service and ISDB application-cache information shown in the first exhibit. After generating GoToMeeting test traffic, the administrator examined the corresponding traffic logs on FortiAnalyzer.
The administrator noticed that some traffic matched the implicit SD-WAN rule, but expected the traffic to match rule ID 1.
Which two reasons explain why some log messages show that the traffic matched the implicit SD-WAN rule?
(Choose two.)

No configured SD-WAN rule matches traffic related to the Collaboration application GoToMeeting.

The session 3-tuple did not match any existing entry in the ISDB application cache.

FortiGate could not refresh the routing information on the session after the application was detected.

Full SSL inspection is not enabled on the matching firewall policy.

Comprehensive and Detailed 100 to 150 words of Explanation From Secure Networking Architect Study Guides topics:
Application-based SD-WAN steering depends on FortiGate being able to associate the new session with an already identified application. The SD-WAN 7.6 guide explains that the ISDB application cache contains an application ID, ISDB application ID, and 3-tuple, and FortiGate uses these values when matching an SD- WAN rule. If the new session ‘ s 3-tuple is absent from the cache, FortiGate cannot initially identify it as GoToMeeting for rule 1, so normal processing can select the implicit rule.
Application identification can occur only after traffic has already entered the session. That identification does not retroactively change the initial routing decision for packets already associated with the session.
GoToMeeting belongs to the Collaboration criteria shown for rule 1, so A is false. Full SSL inspection is not intrinsically required for this SD-WAN application-cache mechanism, eliminating D.

QUESTION 94
Refer to the exhibit.
The exhibit shows the output from using the command diagnose debug application samld -1 to diagnose a SAML connection.

Based on this output, what can you conclude?

Active Directory is used for authentication.

The authentication request is for an SSL VPN connection.

The IdP IP address is 10.1.10.254.

The IdP IP address is 10.1.10.2.

QUESTION 95
Exhibit.

Refer to the exhibit, which shows a partial output of diagnose hardware aysinfo memory.
Which two statements about the output are true? (Choose two.)

There are 98908 kB of memory that will never be used.

The user space has 708880 kB of physical memory that is not used by the system.

The I/O cache, which has 641364 kB of memory allocated to it.

The value indicated next to the inactive heading represents the currently unused cache page.

QUESTION 96
Refer to the exhibit, which shows a partial output from the get router info routing-table database command.

The administrator wants to configure a default static route for port3 and assign a distance of 50 and a priority of 0.
What will happen to the port1 and port2 default static routes after the port3 default static route is created?

The port2 default static route will be injected into the forwarding information base (FIB).

The port1 default static route will be injected into the FIB.

Neither of the routes shown in the output will be injected into the FIB.

Both default static routes shown in the output will be injected into the FIB.

QUESTION 97
Refer to the exhibits.

An administrator Is expecting to receive advertised route 8.8.8.8/32 from FGT-A. On FGT-B, they confirm that the route is being advertised and received, however, the route is not being injected into the routing table.
What is the most likely cause of this issue?

A batter route to the 8.8.8.8/32 network exists in the routing table.

FGT-B is configured with a prefix list denying the 8.8.8.8/32 network to be injected into the routing table.

The administrator has misconfigured redistribution of routes on FGT-A.

FGT-B is configured with a distribution list denying the 8.8.8.8/32 network to be injected into the routing table.

The 8.8.8.8/32 route is visible in the OSPF database on FGT-B but not installed into the routing table-the most likely explanation is that FGT-B is filtering it from being installed.

QUESTION 98
A VPN tunnel is up. To monitor traffic flow, the administrator enters the following CLI commands on an SSH session on FortiGate:
# diagnose debug enable
# diagnose sniffer packet any ‘ udp and port 500 ‘ 4
However, the sniffer does not show any output. Assuming default configuration values, what are two possible reasons there is no output? (Choose two answers)

The filter should be modified to also capture packets for TCP port 443 or UDP port 4500 .

NAT Traversal is enabled.

The sniffer must be restricted to the remote peer IP address.

The sniffer output will be ignored because running diagnose debug enable shows only application real- time debugs.

The correct answers are A and B .
The study guide says:
“If NAT-T is enabled, and there is a FortiGate located in the middle that is running NAT, the sniffer command must use a different filter. In this case, IKE traffic uses UDP port 500, but switches to UDP port 4500 during the tunnel negotiation. Additionally, ESP traffic is encapsulated inside the UDP 4500 channel.” It also says:
“In some networks, UDP is blocked by firewalls or ISPs. In those cases, you can configure your VPN tunnel to use IKE over TCP in the phase 1 configuration. The default IKE TCP port is 443…” And the study guide gives the correct capture examples:
* No NAT: host < remote-gw > and udp port 500
* With NAT and NAT-T: host < remote-gw > and (udp port 500 or udp port 4500) So:
* B is correct because with NAT Traversal enabled , the tunnel may no longer be using only UDP 500 .
It can move to UDP 4500 , so the current filter may miss the traffic.
* A is correct because the filter may need to be expanded to include UDP 4500 for NAT-T, or TCP 443 when IKE over TCP is used.
Why the other options are wrong:
* C is wrong because restricting the filter to the remote peer IP can make the capture more precise, but it is not required for the sniffer to display output. The problem here is the port/protocol choice , not the lack of a host filter. The study guide examples use host filtering as an aid, not as a requirement.
* D is wrong because diagnose debug enable is used to enable real-time debug output for applications, but it does not suppress or invalidate sniffer output . Sniffer capture is a separate command path.
Fortinet documentation separately documents diagnose sniffer packet … for packet capture and diagnose debug enable for debug features.
So the verified answers are: A, B .

QUESTION 99
Refer to the exhibit, which shows the partial output of command diagnose debug rating.

In this exhibit, which FDS server will the FortiGate algorithm choose?