Free Fortinet NSE7_SSE_AR-26 Practice Exam with Questions & Answers | Set: 4

The described design is a multi-region SD-WAN architecture, where: According to Fortinet’s SD-WAN Architecture for Enterprise guidance, when deploying multiple ADVPN regions, eBGP is the recommended routing protocol between regions. Each region operates as an independent routing domain (typically iBGP within the region), while eBGP is used to exchange routes between regional hubs. This approach: This is explicitly documented in Fortinet guidance for “Using eBGP between regions with intra-region ADVPN”, which confirms that the architecture described in the question is valid and recommended when eBGP is used between regions. Why the other options are incorrect: Therefore, the correct and documented conclusion is that the plan is possible and eBGP should be used as the routing protocol between regions, which corresponds to Answer A. A deployment should preserve the distinction between the physical or logical WAN underlay, the IPsec overlay and the SD-WAN zone that groups forwarding members. These layers can have different routing and security-policy requirements. The configured architecture must also allow the required traffic paths and failover behavior rather than assuming every available interface is interchangeable.

According to the FortiSASE 25 Enterprise Administrator Study Guide, page 88, FortiClient automatically exits network lockdown when the endpoint is detected as on-net or successfully establishes a FortiSASE tunnel.

Option A is correct: FortiSASE uses on-net detection rules to identify whether an endpoint is connected to a trusted corporate network. When the endpoint satisfies the configured on-net rules, FortiClient can release network lockdown because internet traffic can be protected by the organization ' s on-premises security infrastructure, such as FortiGate.

Option B is correct: Network lockdown prevents unrestricted LAN and internet access when an off-net endpoint fails to establish its required FortiSASE tunnel within the configured grace period. Once the tunnel is successfully established, FortiClient releases the lockdown, allowing internet traffic to be secured through FortiSASE.

Option C is incorrect: Rebooting the endpoint does not independently satisfy either release condition. FortiClient continues enforcing the configured security requirements.

Option D is incorrect: Security posture tags evaluate endpoint compliance and support conditional access policies. However, posture compliance alone is not identified as a network-lockdown release condition.

The two documented release conditions are on-net detection and successful FortiSASE tunnel establishment.

Exact Source References:

FortiSASE 25 Enterprise Administrator Study Guide, page 86 — On-Net Rule Sets.

FortiSASE 25 Enterprise Administrator Study Guide, page 88 — On-Net and Off-Net Features—Network Lockdown.

FortiSASE-Sovereign 26.2.a Administration Guide, page 67 — On/Off-Net Settings.

The matching router policy uses set action deny, which is not equivalent to a firewall security-policy deny. Within config router policy, the deny action stops policy-route processing and returns the packet to normal forwarding-information-base route evaluation. Both source 10.0.1.130 and destination 128.66.0.125 match the configured policy-route ranges. FortiGate therefore uses the FIB to select forwarding, subject to a valid route and an accepting firewall policy. The candidate answer key incorrectly claims SD-WAN load balancing, and its explanation incorrectly claims the traffic is dropped. Both contradict FortiOS policy-route semantics. Reference: FortiOS 7.6 CLI Reference — config router policy, action deny; Fortinet Technical Tip — Stop Policy Route. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow.