Fortinet’s current first-party exam page uses the name Fortinet NSE 7 – Secure Networking 7.6 Architect. The title is important because it describes the scope more accurately than a narrow firewall-administration label. Fortinet now frames the exam around designing, administering, and supporting secure SD-WAN and an enterprise security infrastructure composed of multiple FortiGate devices, with FortiManager and FortiAnalyzer appearing as operational parts of the design rather than optional side products.
The current official exam page lists FortiGate 7.6, FortiManager 7.6, and FortiAnalyzer 7.6 as the product versions and says the exam uses operational, incident-analysis, integration, and troubleshooting scenarios. Candidates preparing within the broader Fortinet certification program should therefore treat this as an advanced architecture-and-operations exam. It assumes that basic FortiGate concepts are already familiar enough that the candidate can spend time on multi-device behavior, routing convergence, overlays, centralized deployment, inspection trade-offs, and failure analysis.
The blueprint is organized around five connected engineering systems
The exam topics are divided into system configuration and SD-WAN setup, central management, security profiles, rules and routing, and advanced IPsec. The percentage ranges overlap because Fortinet publishes them as approximate domain bands rather than a rigid point allocation: system configuration and SD-WAN setup is 20–30%, central management 15–25%, security profiles 5–15%, rules and routing 25–35%, and advanced IPsec 25–35%. Those numbers immediately show why a simple configuration checklist is not enough. Routing and encrypted overlays occupy a large part of the blueprint, while management and SD-WAN connect those features across branches.
A useful way to interpret the five groups is to ask what state each one controls. System configuration defines the participating devices and their resilience. Central management defines how many devices receive consistent intent. Security profiles define how traffic is inspected. Rules and routing determine where sessions go and why. Advanced IPsec builds the encrypted transport that allows distributed sites to operate as one network. When candidates understand those state transitions, an exam scenario becomes a dependency problem rather than a memory exercise.
System configuration begins with resilience, segmentation, and the Security Fabric
The first domain includes Security Fabric integrations, automation stitches, HA operation modes, VLANs, VDOMs, and the basic construction of enterprise SD-WAN. Fortinet explicitly includes FGCP, FGSP, active-active behavior, virtual clustering, virtual MAC concepts, and session synchronization. Those topics should be studied in terms of failure boundaries. A redundant pair can be healthy while the path beyond it is broken, and session continuity can depend on what state is synchronized and how asymmetric traffic reaches the cluster.
Segmentation is equally important. VLANs separate Layer 2 broadcast domains, while VDOMs can create stronger administrative or routing separation inside a FortiGate deployment. Candidates who still hesitate over prefix boundaries should refresh IPv4 subnetting and CIDR before attempting advanced SD-WAN scenarios. The exam is not testing arithmetic for its own sake; it expects engineers to recognize which prefixes should be reachable, redistributed, summarized, or isolated when a topology changes.
SD-WAN is tested as a traffic-engineering system, not a checkbox
The official objectives include direct internet access, SD-WAN members, member health, widgets, logs, rules, route lookup, and multiple routing designs. That means the candidate should be able to explain the relationship among routing information, health checks, service rules, application steering, and the actual member selected for a session. A policy can match correctly and still produce an unwanted path if the routing table or member state does not support the intended decision.
Separate SD-WAN Engineer material can reinforce the subject, but this Secure Networking exam goes beyond introductory SD-WAN. It expects candidates to connect SD-WAN to BGP, IPsec, centralized templates, dual-hub designs, multiregion topologies, and self-healing behavior. The practical question is rarely “what does SD-WAN do?” It is “why did this session take that path, and what should change when a member or overlay fails?”
Central management turns one working firewall into a repeatable estate
FortiManager is central to the second domain. The blueprint includes zero-touch provisioning, device blueprints, CSV-based imports, metadata variables, template groups, IPsec templates, SD-WAN Manager, and overlay orchestration. These features should be understood as mechanisms for separating reusable design intent from per-site values. A branch should not require a completely hand-built configuration merely because its WAN addresses, local networks, or device identity differ from another branch.
That distinction also explains why centralized management is not simply about convenience. A template error can be multiplied across many sites, while a local exception can undermine standardization if it is not modeled deliberately. Study how a new branch moves from registration to managed state, how templates resolve variables, how overlays are generated, and how an engineer verifies the result. Central management becomes meaningful only when candidates can trace what FortiManager is expected to create on the FortiGate and how they would diagnose a mismatch.
Security profiles require inspection choices that respect performance and trust
The security-profile domain includes SSL/SSH inspection, web filtering, application control, IPS, and the Internet Service Database. The exam expects more than naming profiles. It expects candidates to reason about client-versus-server inspection, certificate inspection versus full inspection, SNI checking, false positives, code injection, CVE-oriented IPS behavior, and the effect of profiles on device performance. That is an architecture trade-off: deeper inspection can increase visibility, but it also changes trust requirements and consumes resources.
Candidates who need to rebuild certificate fundamentals should review SSL/TLS fundamentals before memorizing FortiGate-specific settings. A full-inspection design only works when endpoints trust the inspecting authority and when exceptions are handled intentionally. The same discipline applies to false positives. Disabling inspection broadly may remove the symptom but also removes protection. Strong preparation focuses on narrowing the failure, proving why the profile is responsible, and changing the smallest control necessary.
Rules and routing are a major part of the exam because overlays depend on them
The rules-and-routing objectives include OSPF, BGP, access lists, prefix lists, route maps, redistribution, ECMP, BFD, graceful restart, SD-WAN rules, local-out traffic, implicit behavior, policy routes, static routes, probe routes, session reevaluation, and protocol state. These are not isolated routing-protocol facts. They explain how a distributed Fortinet environment converges and how policy interacts with forwarding.
For BGP in particular, study why loopback sources, route reflectors, neighbor groups, BFD, and graceful restart can matter in large designs. For OSPF, understand how filtering and redistribution change which routes are present and how OSPF over IPsec differs operationally from a simple local adjacency. If the forwarding outcome seems surprising, candidates should be able to walk from the session to the policy, route lookup, SD-WAN decision, next hop, and overlay state instead of guessing from one configuration screen.
Advanced IPsec turns the exam into a topology and failure-analysis exercise
The largest technical concentration is advanced IPsec. Fortinet lists IKEv2, Dead Peer Detection, NAT effects on unnumbered interfaces, IPsec aggregation, overlapping routes, MTU and MSS issues, fragmentation, hardware offload, forward error correction, templates, dual hubs, multiregion designs, VRF-aware overlays, and ADVPN. A candidate who treats VPNs as a static pair of endpoints will miss most of the engineering depth.
ADVPN adds dynamic shortcut behavior on top of hub-and-spoke connectivity, while BGP can provide route distribution and self-healing. Dual-hub and multiregion designs then introduce availability and scale questions. Practice identifying what must remain reachable if a hub fails, which routes should move, when shortcuts should form, and what evidence would prove the overlay is healthy. The value of this domain is understanding how control-plane state, tunnel state, and forwarding state reinforce or contradict one another.
FortiAnalyzer belongs in the troubleshooting model even when it is not the largest domain
Fortinet states that the exam includes incident analysis and integration with FortiAnalyzer. That makes logs part of the evidence chain for routing and security decisions. A refresher on FortiAnalyzer can help candidates think beyond “turn on logging.” The useful questions are which device generated the event, whether the session matched the intended policy, how SD-WAN health changed, which security profile acted, and whether a centralized change preceded the incident.
This is also why experienced candidates often benefit from practicing failure reconstruction. Start with a user-visible symptom and work backward through logs, route state, session state, overlay status, and configuration history. The exam description explicitly includes troubleshooting scenarios, so the candidate should be prepared to use evidence to eliminate possibilities rather than treating every problem as a configuration syntax issue.
The current exam rewards operational architecture more than feature recall
A candidate who already has FortiGate administration experience can use FortiGate Administrator material as a foundation, but the current Secure Networking blueprint operates at a higher level of composition. It expects multiple devices, centralized management, encrypted overlays, routing protocols, inspection, and recovery behavior to be understood together. That is why Fortinet also recommends hands-on labs across Enterprise Firewall, SD-WAN, FortiOS, FortiManager, and FortiAnalyzer training resources.
Current program logistics reinforce that this is an advanced, actively maintained NSE 7 exam rather than a legacy page carried forward unchanged. Fortinet’s 2026 program notices list Secure Networking 7.6 Architect among the available NSE 7 exams, and from September 21, 2026 NSE 7 delivery moved to Pearson VUE-authorized test centers rather than remote OnVUE delivery. Candidates should separate those administrative changes from technical scope: the preparation priority remains the live FortiGate 7.6, FortiManager 7.6, FortiAnalyzer 7.6 blueprint and its applied enterprise scenarios.
The best readiness test is to take one branch-to-data-center flow and explain every decision that affects it: addressing, VLAN or VDOM context, route learning, SD-WAN rule, IPsec topology, hub selection, security inspection, failover behavior, central template ownership, and the logs you would use if the flow breaks. If that chain is clear, the blueprint stops looking like five separate domains and starts looking like the distributed security system Fortinet is actually asking candidates to operate.