Guide · free to read
The NSE 7 (Secure Networking 7.6 Architect) exam blueprint, domain by domain.
Fortinet’s exam description page for the Secure Networking 7.6 Architect exam lists five domains, a published weight band for each, and the tasks under every domain. What it doesn’t give you is a single number to plan study time against: the midpoints of the published bands add up to 115%, not 100%. So picking specific values is unavoidable if you want a budget that adds up. Here is one reasonable way to do it, with the reasoning shown.
The basics
40–50 questions, 75 minutes, English or Japanese. Fortinet names the products as FortiGate 7.6, FortiManager 7.6 and FortiAnalyzer 7.6. Fortinet does not publish a cut score on that page; it says only pass or fail, with a score report in your Pearson VUE account. Any specific percentage you see quoted is an estimate. Fortinet’s page doesn’t list an exam code, so we haven’t given one here.
| Domain | Weight (this budget) | Published band |
|---|---|---|
| Advanced IPsec | 30% | 25–35% |
| Rules and routing | 26% | 25–35% |
| System configuration and SD-WAN setup | 22% | 20–30% |
| Central management | 15% | 15–25% |
| Security profiles | 7% | 5–15% |
The picks are ours, not Fortinet’s. Three of the five bands start at 20% or higher, and the two largest, Advanced IPsec and Rules and routing, share the same 25–35% band. We put IPsec a little higher because its detail list on the page is the longest and the heaviest on design judgment. Central management sits at the floor of its band, because a good deal of the FortiManager material (IPsec templates, the SD-WAN overlay template) is also tested through the IPsec domain. If your own reading of the page differs, move a few points; the point is that the budget adds up to 100.
1. Advanced IPsec: 30%, the largest domain
Three tasks, all about running VPNs at scale rather than getting one tunnel up:
- Implement IPsec VPN IKE version 2. Topology design, and the operational details that decide whether a design behaves: dead peer detection, MTU and MSS problems, overlapping routes, and FortiManager IPsec templates.
- Configure IPsec multihub, multiregion, and large deployments. Dual-hub and multiregion designs, and how routing and SD-WAN self-healing behave across them.
- Implement ADVPN to enable on-demand VPN tunnels between sites. Shortcut negotiation and the routing that supports it. The page distinguishes ADVPN 1.0 from ADVPN 2.0, so make sure your study material says which one it’s describing.
Primary sources: the FortiOS 7.6.0 Administration Guide (IPsec VPN and ADVPN chapters), the FortiManager 7.6.0 Administration Guide (IPsec templates and the SD-WAN overlay template), and Fortinet’s SD-WAN Architecture for Enterprise (7.6.0) guide for multihub and multiregion design.
Worth knowing: a real share of this domain is FortiManager behavior, not FortiOS. Reading only the FortiGate documentation will leave gaps.
2. Rules and routing: 26%
Four tasks:
- Implement OSPF to route enterprise traffic.
- Implement BGP to route enterprise traffic.
- Design SD-WAN rules.
- Configure SD-WAN routing.
Two of the four are classic dynamic routing; the other two are SD-WAN rule and route lookup, which is where this exam goes well past NSE 4’s SD-WAN coverage. Know how SD-WAN rules are matched and how a member is chosen, and how that interacts with the routing table.
Primary sources: the FortiOS 7.6.0 Administration Guide (OSPF, BGP and SD-WAN chapters) and the SD-WAN Architecture for Enterprise guide.
3. System configuration and SD-WAN setup: 22%
Four tasks:
- Implement the Fortinet Security Fabric.
- Configure different operation modes for a high availability (HA) cluster.
- Implement enterprise networks using VLANs and VDOMs.
- Deploy an enterprise SD-WAN setup.
This is the broadest domain: Fabric, HA, segmentation and base SD-WAN in one. HA is where a careful read pays off, because the page lists more than one clustering mode (FGCP and FGSP both appear in the page’s detail list).
Primary sources: the FortiOS 7.6.0 Administration Guide and the FortiOS 7.6.0 Best Practices guide.
4. Central management: 15%
Two tasks, both FortiManager:
- Implement branch configuration deployments. Zero-touch provisioning of SD-WAN branches.
- Use SD-WAN Manager and overlay orchestration. Templates, template groups, metadata variables, and building an overlay from FortiManager.
Primary source: the FortiManager 7.6.0 Administration Guide. If you have worked with FortiManager for policy only, this is the domain that needs hands-on time; template-driven SD-WAN is a different workflow.
5. Security profiles: 7%, the smallest domain
Two tasks:
- Manage SSL/SSH inspection profiles.
- Use a combination of web filtering, application control, intrusion prevention system (IPS), and Internet Service Database (ISDB) to secure the network.
The band is the lowest on the exam, 5–15%. If you’re coming from NSE 4 this is the domain you already know best; treat it as a refresh rather than new ground.
Primary source: the FortiOS 7.6.0 Administration Guide.
How to actually use this
- Pull the exam description page yourself and check this breakdown, and the published bands, against it. That is the reason for citing a public source instead of asking you to trust a summary.
- Budget study time by the weight column, not by how interesting a domain is. IPsec and routing together are over half the exam on our budget, and NSE 4 only reaches the basics of them (static routes, simple SD-WAN, site-to-site IPsec). Central management is the one domain NSE 4 does not touch at all.
- Fortinet’s page points to existing courses rather than a dedicated one. At the time we checked it listed six: Enterprise Firewall 7.6 Administrator, SD-WAN 7.6 Enterprise Administrator, FortiOS 7.6 Administrator, FortiManager 7.6 Administrator, FortiAnalyzer 7.6 Administrator and FortiAnalyzer 7.6 Analyst.
- Pin your material to 7.6. The page’s reading list names specific 7.6 point releases, and docs.fortinet.com now serves newer releases by default, so check the version string at the top of any page you rely on.
Tell me when these questions change
FortiOS changes, and so does this bank. Leave an address and you will get one email when the questions are updated for a new release. Nothing else is sent, and a reply saying stop removes you.
Every practice question we publish carries the Fortinet page it was written from, the same way this guide does. How they are written is set out on the methodology page, and the catalog says which exams are on sale today. There is also a free readiness assessment — it is drawn from the NSE 4 bank rather than this one, but it is the fastest way to see how a question and its explanation are put together.