NSE7_FSN_AR-7.6 Practice Test Questions

Explanation
In SD-WAN architecture, the distinction between underlay and overlay is fundamental. Underlays are the physical or logical transport networks provided by ISPs, while overlays are virtual tunnels built on top of these underlays to create a secure, logical network. This layered approach is what gives SD-WAN its flexibility and intelligence.

Correct Options

B. Overlay links provide routing flexibility.
This is correct because overlay links are VPN tunnels (typically IPsec) that create logical connections over one or more physical underlay networks. This abstraction allows the SD-WAN solution to steer traffic across different available underlay paths based on performance, policies, and application requirements, providing significant routing flexibility.

D. Wireless connections can be used to build overlay links.
This is correct. Overlay links are virtual tunnels that can be built on top of any type of underlay transport, including wireless connections. The document specifically mentions that "Wireless connections can be used to build overlay links" along with wired Internet, MPLS, or cellular links.

Incorrect Options

A. A FortiLink interface is considered an underlay link.
While FortiLink is mentioned in the context of underlay options, the question asks which statements are correct about underlay and overlay links in general. The document also defines underlay links specifically as "data links rented or bought from an ISP," such as Internet, MPLS, and 3G/LTE links. The context indicates FortiLink support relates to broader underlay device settings rather than being a defining characteristic of underlay links themselves.

C. Only wired connections can be used as underlay links.
This is incorrect. Underlay links can be wireless as well. The official Fortinet documentation explicitly states that underlay links consist of "Internet, MPLS, and 3G/LTE links," confirming that cellular (wireless) connections are valid underlay options.

E. A VLAN is a type of overlay link.
This is incorrect. A VLAN is a Layer 2 segmentation mechanism used within a network, not an SD-WAN overlay link. Overlay links in SD-WAN are VPN tunnels that provide secure connectivity between sites, which is fundamentally different from VLAN segmentation.

Reference

Fortinet SD-WAN Underlay and Overlay Links Definition

SD-WAN Components and Design Principles

Exam Discussion on Underlay and Overlay Link Concepts

Explanation
In the SAML authentication process, the Identity Provider (IdP) delivers the user's attributes to the Service Provider (SP) within a SAML assertion . This is the core security token that the SP consumes to make access decisions. In FortiGate diagnostics, when troubleshooting SAML authentication, you can inspect this attribute data by viewing the "Assertion dump" in the debug logs .

The assertion containing the user attributes (e.g., username, group-name, email) is embedded within the Authentication Response that the IdP sends to the SP via the user's browser .

Correct Option

B. Assertion dump
This statement is correct. The SAML assertion, which carries the actual user attributes utilized in the authentication process, is seen in a FortiGate debug as an "Assertion dump" .

Incorrect Options

A. Bindings HTTP post
This is incorrect. "Bindings HTTP post" refers to a mechanism for conveying SAML protocol messages, such as the authentication request and response, between the parties . It is not the section of the message where the attributes themselves are located.

C. Authentication request
This is incorrect. The "Authentication Request" (AuthnRequest) is the initial message sent from the SP to the IdP to initiate the login flow . It does not contain any user attributes, as the user has not yet authenticated with the IdP .

D. Authentication response
This is incorrect. While the user attributes are indeed carried inside the "Authentication Response" message, the specific part of that message is the SAML assertion. The "Authentication Response" itself is the broader container that includes the assertion . The "Assertion dump" more precisely identifies the section containing the attributes.

Explanation
A router's Link-State Database (LSDB) contains all the Link-State Advertisements (LSAs) it has learned. Type 5 LSAs, also known as AS External LSAs, are used to advertise external routes that have been redistributed into OSPF from another routing protocol or a static route . These LSAs are originated by an Autonomous System Border Router (ASBR) . A router will not have any Type 5 LSAs in its database if there is no ASBR in the network to generate them, or if the router is in a stub area that is designed to block Type 5 LSAs by default.

Correct Options

A. There is no autonomous system border router (ASBR) in the network.
This is correct. A Type 5 LSA is exclusively generated by an ASBR to advertise external routes into the OSPF domain . If the OSPF network does not contain an ASBR, then no Type 5 LSAs will be generated, and consequently, no router in the network will have them in its LSDB.

C. The local router is located in a stub area.
This is correct. A stub area is a specific OSPF area designed to reduce the size of the routing table and the number of LSAs flooded within it. By design, Type 5 LSAs are not flooded into stub areas . The Area Border Router (ABR) for the stub area blocks these LSAs and instead injects a default route (Type 3 LSA) to allow routers in the area to reach external destinations .

Incorrect Options

B. The peer of the local router is using a prefix-list-out configuration to prevent all type 5 LSAs from being advertised.
This is incorrect. A prefix list is a mechanism used to filter routes based on their network prefix. However, it cannot be used to filter specific LSA types (like Type 5) . A prefix list can deny specific routes, but the LSA type is an inherent property of the LSA and is not controlled by prefix-list policies. Furthermore, Type 5 LSAs flood across an OSPF domain unchanged, not regenerated by an ABR .

D. IP protocol 89 is blocked between the local router and its peer.
This is incorrect. While blocking IP protocol 89 would indeed prevent OSPF from establishing an adjacency, it would cause a complete failure of the OSPF routing process, not just the absence of Type 5 LSAs . If OSPF adjacencies are up and other LSAs (like Type 1) are present in the database, then IP protocol 89 is not blocked.

Reference
OSPF LSA types and their functions, specifically Type 5 External LSAs and their flooding behavior in stub areas .

Explanation
When an IKEv2 tunnel comes up but later goes down, it typically points to an issue that occurs after the initial IKE_SA_INIT and IKE_AUTH exchanges have completed. The CREATE_CHILD_SA exchange is responsible for creating and rekeying IPsec Security Associations (Child SAs) . A mismatch in this exchange, such as conflicting traffic selectors or Perfect Forward Secrecy (PFS) parameters, can cause the tunnel to fail during rekey without affecting the initial establishment .

Correct Option

D. Mismatched quick-mode selectors were detected during the CREATE_CHILD_SA exchange.
A mismatch during the CREATE_CHILD_SA exchange is the most common reason for a tunnel to fail after a successful initial bring-up. For example, a mismatch in the PFS (Perfect Forward Secrecy) Diffie-Hellman group is not validated during the initial IKE_AUTH exchange, but it will be checked during a rekey using CREATE_CHILD_SA, causing the tunnel to fail at that later stage .

Incorrect Options

A. A mismatched proposal was detected during the IKE_AUTH exchange.
This would prevent the tunnel from establishing initially because the IKE_AUTH exchange is required for the first Child SA to be created . A mismatch here would prevent the tunnel from coming up at all.

B. A mismatched Diffie-Hellman group was detected during the IKE_SA_INIT exchange.
This is also an early-stage failure. The IKE_SA_INIT exchange negotiates cryptographic parameters for the IKE SA, and a DH group mismatch here would prevent the first exchange from completing successfully .

C. A mismatched pre-shared key was detected during the IKE_AUTH exchange.
A mismatched PSK is detected during the IKE_AUTH exchange, which is required to authenticate the peers and establish the first Child SA. This would cause the initial tunnel setup to fail, not a later failure .

Reference

Fortinet Community: Troubleshooting Tip on IKEv2 IPsec tunnel flaps at every IPsec rekey

ExamTopics Discussion on NSE7_FSN_AR-7.6 IKEv2 failure scenarios

Japanese Exam Discussion on IKEv2 IPsec Tunnel Failure During Rekey

✅ Correct Option: B
Without NAT traversal (NAT-T), all encrypted IPsec data traffic is encapsulated directly in the IP protocol header using protocol number 50. The sniffer filter ip proto 50 or simply esp is designed to capture this exact traffic . Because there is no NAT device, the traffic remains as native ESP packets and does not get encapsulated in UDP .

❌ Incorrect Options

A. diagnose sniffer packet any 'udp port 500'
This command captures IKE control plane traffic used for Phase 1 negotiation, not the encrypted data packets of Phase 2 .

C. diagnose sniffer packet any 'udp port 4500'
This port is used by IPsec only when NAT Traversal (NAT-T) is enabled. Since the question specifies there is no NAT device, the VPN will not switch to encapsulating ESP traffic in UDP port 4500, making this filter ineffective for capturing the data traffic .

D. diagnose sniffer packet any 'ah'
This captures Authentication Header (AH) traffic (protocol 51), which is rarely used and does not encapsulate data. Encrypted IPsec data uses ESP (protocol 50) .

🔗 Reference

Fortinet Technical Support documentation: IPsec troubleshooting guide (no NAT environment)

Exam discussion on identifying correct sniffer filters for ESP traffic

Explanation
Heartbeat messages are a crucial part of the FSSO communication process. They are periodically sent from the Collector Agent to the FortiGate to maintain session awareness and confirm connectivity . If these heartbeats stop, the FortiGate will eventually time out and remove the user logons . The communication of these heartbeats can be monitored on both ends of the connection.

Correct Options

B. The heartbeat messages can be seen in the collector agent logs.
The Collector Agent logs events directly related to its operation, and connection status and heartbeat events are specifically recorded there. This allows an administrator to check the agent's perspective on connectivity to the FortiGate units .

C. The heartbeat messages can be seen on FortiGate using the real-time FSSO debug.
This is correct and is a standard troubleshooting method. On the FortiGate CLI, you can use real-time debug commands (such as diagnose debug application authd 8256 or diagnose debug application authd -1 alongside diagnose debug enable) to see the incoming heartbeat messages from the Collector Agent. The debug output will show entries like received heartbeat 100032 .

Incorrect Options

A. The heartbeat messages can be seen using the command diagnose debug authd fsso list.
This command is used to list the current active FSSO logons on the FortiGate . It does not display real-time heartbeat messages from the Collector Agent .

D. The heartbeat messages must be manually enabled on FortiGate.
This is incorrect. Once the FSSO configuration is set up, the Collector Agent will automatically start sending heartbeat messages to the FortiGate. No additional manual configuration is required to enable this feature .

Reference

Fortinet Community: Technical Tip - Useful FSSO Commands

Fortinet Administration Guide: Configuring FSSO timeout

Exam discussion and study materials

Explanation
The all-zero phase 2 selectors (0.0.0.0/0) create a VPN tunnel that permits any traffic to traverse it, which introduces ambiguity during network migrations. This broad permission can cause routing decisions to direct traffic through the VPN unintentionally, leading to invalid paths. To prevent this, you must establish clear rules for what traffic is allowed to use the tunnel.

Correct Options

A. Configure an IP address on the IPsec interface of each firewall to establish unique peer connections and avoid impacting network operations.
When using route-based IPsec VPNs, the IPsec tunnel has a dedicated interface. Assigning an IP address to this interface on each firewall creates a unique endpoint for the VPN connection, which is necessary for routing protocols and enables the firewall to distinguish VPN traffic from other traffic. This is particularly important when establishing unique peer connections to ensure traffic is sent to the correct tunnel.

D. Configure routing protocols to specify allowed subnets over the tunnel.
This is the most effective method to prevent invalid paths. Routing protocols (like OSPF or BGP) can be configured to advertise only the specific subnets that should be reachable over the VPN tunnel. This ensures that only the intended networks are routed through the VPN, eliminating the risk of all-zero selectors creating unintended paths. Using routing protocols to specify allowed subnets over the tunnel is a key recommendation to mitigate these issues.

Incorrect Options

B. Configure the VPN with the exact network segments that will be encrypted in the phase 2 selectors.
While this recommendation is generally considered best practice, the question asks for two valid recommendations, and the search results explicitly emphasize that the correct pair of answers are A and D. Configuring exact phase 2 selectors is a security measure, but routing protocols are the more effective tool for preventing routing path issues during migrations.

C. Configure an IPsec aggregate to create redundancy between each firewall peer.
IPsec aggregates are used to provide redundancy and load balancing across multiple VPN tunnels, not to prevent invalid path issues during migrations. This option addresses availability, not routing path control.

Reference

Exam discussions for FCSS_EFW_AD-7.6 confirm that the correct answers are A and D, referencing page 199 of the Enterprise Firewall Admin 7.6 study guide.

Fortinet documentation explains that assigning IP addresses to IPsec interfaces is necessary for dynamic routing and unique peer connections.

Fortinet documentation describes IPsec aggregates as a solution for redundancy and traffic load-balancing.