Free Fortinet NSE5_SSE_AD-7.6 Practice Test Questions and Answers (2026)

The FortiSASE security dashboard provides comprehensive vulnerability management for endpoints running FortiClient. It displays a centralized vulnerability summary categorized by severity (e.g., Critical, High, Medium), identifies the specific endpoints affected by each vulnerability, and supports automatic patching for eligible software vulnerabilities when configured in the endpoint profile. This allows administrators to efficiently monitor endpoint risks and automate remediation processes without requiring manual intervention from the end users.

A: FortiSASE categorizes vulnerabilities by severity and requires specific profile configurations to enable automatic patching; it does not patch everything blindly. B: The dashboard centrally identifies affected endpoints, eliminating the need for endpoint users to manually check for vulnerabilities. C: The dashboard displays vulnerabilities across all severity levels, allows administrators to view affected endpoints, and supports automatic patching.

- Fortinet, "FortiSASE 7.4 Administration Guide," Endpoint Vulnerability Management, pp. 180-185.

- Fortinet, "NSE 5 FortiSASE 7.2 Study Guide," Security Dashboard and Vulnerabilities, p. 210.

To implement SD-WAN with high network availability and cost control, the administrator must configure at least two WAN links. SD-WAN relies on multiple physical or logical interfaces to monitor link quality and dynamically steer business-critical application traffic. Having at least two links allows the administrator to use a primary cost-effective broadband connection while keeping a pay-per-use cellular or backup link in standby. This fulfills both the high availability and cost-limitation requirements for a small site without requiring expensive hardware upgrades.

A. Purchasing a mid-range FortiGate increases hardware costs unnecessarily for a small site, violating the strict cost-limitation requirement.
B. Dynamic routing facilitates route updates but does not inherently provide the physical network availability or cost-controlled backup connections required for SD-WAN.
C. An HA cluster requires purchasing two devices, which significantly increases the overall capital expenditure for a small site.

1. Fortinet Document Library. (2023). FortiOS 7.4 SD-WAN Administration Guide. Section: "SD-WAN overview" and "SD-WAN members".

2. Fortinet Document Library. (2023). Fortinet Secure SD-WAN Architecture Guide. Section: "Small Branch Deployment".

When configuring SD-WAN rules in FortiOS, the Maximize Bandwidth (SLA) strategy is designed to load balance traffic across all participating SD-WAN members that meet the configured SLA target. Furthermore, for

When an SD-WAN performance SLA is configured with the probe mode set to 'Prefer Passive', FortiGate relies on existing TCP traffic to passively measure latency, jitter, and packet loss, eliminating the overhead of active probes. Therefore, passive monitoring occurs only if TCP traffic is actively passing through the SD-WAN member. If TCP traffic ceases, FortiGate automatically switches to active monitoring (sending active probes) to ensure the link's health is still tracked. Once in active mode, FortiGate will continue active probing for a default period of 3 minutes before attempting to fall back to passive monitoring again.

A: Traffic subject to passive monitoring cannot be offloaded to hardware (NP processors) because the CPU must inspect the TCP packets to calculate SLA metrics. B: Passive monitoring relies exclusively on TCP traffic (analyzing sequence numbers and acknowledgments to measure latency and loss), not ICMP traffic. C: While passive monitoring relies on traffic, the system automatically switches to active monitoring when traffic stops, ensuring dead members are still detected by the SLA rule.

1. Fortinet FortiOS 7.2 Administration Guide. Section: SD-WAN > Performance SLA > Performance SLA probe modes (Passive WAN measurement).

2. Fortinet NSE 7 SD-WAN 7.2 Courseware. Module: SD-WAN Performance SLA and Health Checks.

The on/off-net rule setting in FortiSASE is designed to detect the endpoint's network location. It determines whether an endpoint is connected to a trusted corporate network (on-net) or an untrusted external network (off-net). When an endpoint is deemed off-net, FortiClient automatically establishes a secure connection to FortiSASE to ensure traffic is inspected and secured. If the endpoint is on-net, it relies on the local FortiGate for security, preventing redundant tunneling and optimizing network performance.

A. This setting does not control user authentication; it strictly controls network location detection and tunnel establishment behavior.
B. It does not define traffic routing rules for cloud resources; it dictates whether the endpoint connects to FortiSASE based on its physical or logical network location.
D. The detection is based on network criteria (such as DHCP, DNS, or default gateway MAC addresses), not the user's geographical location.

1. Fortinet Document Library. (2023). FortiSASE 7.4 Administration Guide. Section: "Endpoint on-net and off-net status".

2. Fortinet Document Library. (2023). FortiClient 7.2 Administration Guide. Section: "On-net and off-net rules".

https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/NSE5_SSE_AD-7.6/page_11_img_2.jpg

In FortiSASE, security posture tags (ZTNA tags) are dynamically applied to endpoints based on continuous posture checks (e.g., OS version, running processes, registry keys, antivirus status). An endpoint can simultaneously match multiple tagging rules, resulting in multiple tags being assigned. All assigned tags can then be used concurrently for evaluation in ZTNA policies to grant or deny access to specific applications, allowing for highly granular, multi-condition access control.

A: All assigned tags are actively used for evaluation in ZTNA policies, not just a single tag. C: Tags are highly dynamic and change automatically as the endpoint's compliance status or posture changes. D: Endpoints can have multiple tags assigned simultaneously based on matching multiple posture rules.

1. Fortinet FortiSASE 23.4 Administration Guide, Section: "Endpoint Posture Check and ZTNA Tags", pp. 130-135.

2. Fortinet FortiClient EMS 7.2 Administration Guide, Section: "Zero Trust Network Access (ZTNA) Tagging".

FortiSASE provides several predefined report templates to analyze network traffic, security events, and user activities. The valid predefined report types explicitly included in FortiSASE Analytics are the Web Usage Summary Report (often listed as Web Usage Report), the Shadow IT Report, and the Cyber Threat Assessment (CTAP) report. These reports help administrators gain visibility into web browsing habits, unauthorized cloud application usage, and overall security threats across the SASE environment.

B: Endpoint Compliance Deviation Report is not a standard predefined report template available in FortiSASE Analytics. C: Vulnerability Assessment Report is typically managed and viewed within FortiClient EMS directly, rather than being a primary predefined FortiSASE report template.

1. Fortinet FortiSASE 23.4 Administration Guide, Section: "Analytics > Reports", pp. 210-215.

2. Fortinet FortiSASE 23.2 Administration Guide, Section: "Predefined Report Templates".

FortiSASE provides straightforward methods for onboarding remote users with the FortiClient agent. Administrators can download the pre-configured FortiClient installer directly from the FortiSASE portal's onboarding dashboard to distribute manually or via Mobile Device Management (MDM) solutions. Alternatively, administrators can use the portal to send an automated invitation email to selected users. This email contains direct links to download the appropriate FortiClient installers (Windows, macOS, etc.) along with the necessary connection details and invitation codes.

A: FortiClient for desktop operating systems (Windows/macOS) is not deployed via zero-touch third-party app stores; it requires direct installation or MDM deployment. D: FortiSASE does not push automatic installations directly to a user's laptop via a native API; it relies on manual downloads, email links, or external MDM tools.

1. Fortinet, Inc. "FortiSASE Administration Guide 7.x", Section: Onboarding users.

2. Fortinet, Inc. "FortiSASE Administration Guide 7.x", Section: Sending invitation emails to users.

In FortiOS, SD-WAN rules are implemented as policy routes. When traffic is evaluated, it is checked against the policy route table. If traffic does not match any configured SD-WAN rules (or regular policy routes), it falls through to the implicit SD-WAN rule. Therefore, matching the implicit rule means the traffic did not match any entries in the policy route table. The implicit rule then relies on the standard routing table (FIB). If there are multiple equal-cost routes available, the traffic is load-balanced across them using the global ECMP load balancing algorithm defined by the v4-ecmp-mode setting.

C: The session is not flagged with vwldefault; instead, it typically shows vwlservice=0 to indicate that the implicit rule was used. D: Traffic distribution respects route weights and priorities; it is not distributed regardless of weight across all static routes. E: The session information output does display an SD-WAN service ID, specifically vwlservice=0, when traffic matches the implicit rule.

- Fortinet, "FortiOS 7.4 Administration Guide," SD-WAN Implicit Rule and ECMP, pp. 1460-1465.

- Fortinet, "NSE 7 SD-WAN 7.2 Study Guide," Implicit Rule Routing, p. 118.