Fortinet NSE 7 SASE Architect Exam Guide: Format, Fees, Renewal

What changed on 15 July 2026 and why the exam names look confusing#

If you've been reading about Fortinet certifications for a while, you've seen two naming systems. Until mid-2026 Fortinet used the FCP and FCSS names. On 15 July 2026 the NSE Certification Program moved to eight levels, with four training tracks across some of them: Secure Networking, Security Operations, Cloud Security and SASE. Fortinet also states that all certifications are now valid for two years.

Fortinet issued new certificates rather than asking anyone to start over. Everyone holding an active FCP or FCSS certification was issued an NSE certification on 15 July 2026, based on the exams they had passed, and the expiry date carried over from the old certification. For the SASE track, the transition maps the old exams as follows:

This matters for study planning. Older forum threads, videos and books often describe the FCSS exams, which are not the same exam as the NSE 7 SASE Architect. Check the date and the exam name on anything you rely on, and use official exam documentation as the reference for what the current exam covers.

The exam at a glance#

Official exam documentation for the NSE 7 SASE Architect describes an exam that evaluates your knowledge of designing, deploying and operating advanced Fortinet FortiSASE and SD-WAN solutions. Official certification documentation frames the same thing from the career side: it validates your ability to design, administer, monitor and troubleshoot advanced Fortinet SASE deployments, with the exam focused on FortiSASE and Fortinet SD-WAN. In Fortinet's words, that includes the design and troubleshooting of complex SASE infrastructures that bring secure access services and SD-WAN together for distributed users, applications and network edge locations.

The published exam details are short:

Two points follow from that table. First, Fortinet publishes the question count as a range, so you cannot plan around a fixed number of questions. Second, Fortinet reports the result as pass or fail rather than a scaled number, so a passing score is not something you can aim for in practice tests. With 40 to 50 questions in 75 minutes, you're working at roughly a minute and a half per question at the top of the range.

Official exam documentation includes sections for the audience, exam topics, training resources, recommended experience and sample questions. Read those sections directly before you book, because they are the authoritative version and Fortinet can update them.

What the topic list tells you#

Official exam documentation lists weights as ranges. Two of them are visible in the material: SD-WAN architecture and deployment is listed at 10 to 20 percent, and SD-WAN traffic control and IPsec starts at 20 percent. Official exam documentation lists the other topics. Consult it directly for current weights. This guide does not print a single-number domain table, because Fortinet itself publishes ranges. Be wary of any resource that prints exact percentages for every domain.

What you can take from this is the scope: SD-WAN is not a side topic on this exam. Two of the topic areas named above are SD-WAN topics, and one of them starts at 20 percent. If your background is FortiSASE administration only, plan time for SD-WAN architecture, traffic control and IPsec as well.

The certification path: NSE 4, then NSE 5 or NSE 6 in SASE, then NSE 7#

Official certification documentation sets out the route. All of the prerequisite certifications must be active, not merely earned at some point.

Notice that NSE 5 and NSE 6 are alternatives for the NSE 7 prerequisite, not two steps you must both complete. If you are choosing between them, the descriptions above are a useful guide. NSE 5 in SASE is about small and medium-sized SASE infrastructures, while NSE 6 in SASE is about endpoint protection and data security.

Prerequisites come into play when you renew as well. Fortinet states that if a certification has prerequisites, they must be fulfilled before a renewal is granted, and that certifications earned out of sequence need every prerequisite to be completed or active before the renewed certification is issued.

Recommended training#

The NSE 7 SASE Architect is listed as exam-only, with Fortinet naming two recommended courses:

• FortiSASE Enterprise Administrator
• SD-WAN Enterprise Administrator

The pairing is the most useful official signal about how to prepare. It says Fortinet expects an architect to know both FortiSASE and SD-WAN, which matches the exam scope described above. Official exam documentation includes training resources and experience sections, so check what it currently recommends before you build a plan.

For hands-on practice, work through scenarios rather than only reading. The exam page describes the exam as testing design, deployment and operation, which are skills you build by configuring things and then working out why they behave as they do.

How to think through an NSE 7 SASE Architect question#

An architect-level question rarely asks what a feature is. It describes a deployment, adds constraints, and asks which design or configuration satisfies all of them. The question below comes from our bank and shows the pattern: read for the constraints first, then test each option against every one of them, not just the one that stands out.

A network architect at Fabrikam is designing the management architecture for a hybrid deployment combining FortiGate SD-WAN branch offices with FortiSASE for remote users and thin-edge branches. The architect needs to define the management responsibility boundary between FortiManager and the FortiSASE portal. Which statement accurately describes the correct management responsibilities of each platform in this hybrid architecture? (Select one!)

• A. The FortiSASE portal manages cloud-delivered SASE policies including SIA profiles, ZTNA access rules, and endpoint compliance, while FortiManager manages FortiGate SD-WAN configuration, firmware updates, device templates, and network orchestration, both platforms are required in hybrid deployments
• B. FortiManager exclusively manages FortiSASE ZTNA policies through the fabric connector, while the FortiSASE portal handles SIA and SWG policy management for internet-bound traffic
• C. The FortiSASE portal serves as the single management plane for both FortiSASE cloud policies and FortiGate SD-WAN configurations in hybrid deployments, eliminating the need for a separate FortiManager deployment
• D. FortiManager fully replaces the FortiSASE portal and centrally manages all cloud-delivered SASE security policies, ZTNA rules, and endpoint compliance configurations through its ADOM framework

Show the answer and the reasoning

Correct answer: A. The FortiSASE portal manages cloud-delivered SASE policies including SIA profiles, ZTNA access rules, and endpoint compliance, while FortiManager manages FortiGate SD-WAN configuration, firmware updates, device templates, and network orchestration, both platforms are required in hybrid deployments

In hybrid deployments combining FortiGate SD-WAN with FortiSASE, both management platforms serve distinct and non-overlapping roles. The FortiSASE portal provides cloud-native management for SASE-specific configurations including SIA security profiles, ZTNA access policies, endpoint compliance rules, user authentication settings, and FortiSASE-specific monitoring and reporting. FortiManager manages the on-premises FortiGate infrastructure, handling SD-WAN configuration templates, device firmware management, security profile templates for branch appliances, and network-level orchestration. FortiManager cannot manage cloud-delivered FortiSASE policies and does not replace the FortiSASE portal. The FortiSASE portal manages only FortiSASE cloud components and cannot replace FortiManager for SD-WAN branch device management. There is no functional split where FortiManager manages only ZTNA while the portal handles only SIA; the division follows cloud-delivered versus on-premises components.

A common slip on this kind of question is to choose an answer that is true in general but breaks one of the stated constraints. Before you commit, list the requirements in the scenario and check each option against the whole list.

Booking: test center only, and what the fee notice says#

All Fortinet technical NSE written exams, NSE 4 to NSE 8, are booked through Pearson VUE. Normally candidates can choose a test center or remote delivery through OnVUE, but that has changed for this exam. Effective 21 September 2026, remote exam delivery for NSE 7 exams was discontinued, and NSE 7 exams are available only at Pearson VUE authorized testing centers. The NSE 7 SASE 26 Architect is among the affected exams. NSE 4, NSE 5 and NSE 6 remain available both remotely and at test centers.

Exam booking and payment details:

• You can pay by credit card when you book, or with an exam voucher.
• Vouchers bought through Fortinet are valid for 365 days, and you must apply the voucher before it expires.
• Test center appointments can be rescheduled or cancelled up to 24 hours before the appointment through your Pearson account.
• Vouchers bought for exams delivered by Pearson cannot be used for recertification assessments, and vouchers bought for recertification assessments cannot be used for Pearson exams.

The fee change on 2 November 2026#

As of 5 October 2026, NSE exam fees will be adjusted from 2 November 2026. That covers NSE exams, NSE recertification assessments and the Industry certification exams. Until then, the current price is $200 for NSE 4 to NSE 7 exams. Prices are in US dollars and exclude tax.

The new NSE 7 amount is not stated explicitly in official fee documentation, so do not assume a number. One more caution: Fortinet's own NSE ordering guide describes two voucher types, a $200 voucher for NSE 4, NSE 5 and NSE 6 exams and a $400 voucher for NSE 7 exams, which does not line up with the $200 figure for NSE 7 in the fee notice. The two documents disagree, so confirm the price shown at checkout before you pay, and book early if timing matters to you.

Failing, retaking and passing#

Candidates must wait 15 days between unsuccessful exam attempts, and Fortinet's policy says the same: a student who fails a proctored NSE exam can retake it 15 consecutive days after the failed attempt.

Fortinet also states that once an exam has been passed it cannot be taken again, and that Pearson VUE blocks registration for exams you have already passed. That means you cannot sit a passed exam again to improve a result.

Because the result is pass or fail, use a failed attempt as information about what to study next. The score report in your Pearson VUE account is the record Fortinet makes available.

Validity and renewal#

Fortinet states that NSE 1 to NSE 8 and Industry certifications expire two years from the date they are issued, and that expiry dates cannot be extended. Fortinet sends reminders 90, 45 and 5 days before expiry and keeps your status in your Training Institute account. If a certification expires, you must meet all of the initial requirements again.

For NSE 7 there are two ways to renew:

1. Recertification assessment. Available if your proctored exam is less than two years old, if the assessment is a higher version than the exam you passed, and if your certification has not yet expired. It consists of self-paced training on what changed over the last two releases, plus an online test.
2. A newer proctored exam. Pass the subsequent version of the proctored exam, or a different NSE 7 exam.

The recertification assessment is optional. Fortinet says the fee covers three test attempts, and that the cost varies. Assessments were introduced on 15 July 2026, and the NSE 7 SASE Architect was among the exams that had one from that date. Fortinet adds that assessments are not offered for new exams and become available after at least two versions of an exam exist, so an assessment may not exist yet for the version you hold. If none is available, you renew by passing the next version of the proctored exam.

Renewing an active NSE 7 also renews the active lower-level certifications in the same track: NSE 4, plus NSE 5 and NSE 6 in the same track. If you renew while the certification is still active, the certificate keeps its original issue date, and if you renew after it has expired, it shows a new issue date.

Frequently Asked Questions#

What is the exam called, and what is its code? Official exam documentation names it Fortinet NSE 7 - FortiSASE 26 Architect, also listed as NSE 7 - SASE 26 Architect. Third-party resellers list the exam under the code NSE7_SSE_AR-26. Search by the name Fortinet uses when you need the official page.

How long is the exam and how many questions are there? Fortinet publishes 75 minutes and 40 to 50 questions. The exam is scored pass or fail, and a score report is available in your Pearson VUE account.

Can I take the NSE 7 SASE Architect exam online? No. Fortinet discontinued remote delivery for NSE 7 exams on 21 September 2026, so the exam is only available at Pearson VUE authorized testing centers. NSE 4, NSE 5 and NSE 6 exams are still available both remotely and at test centers.

What do I need before I can take it? An active NSE 4 certification, and an active NSE 5 or NSE 6 certification in SASE, followed by passing the NSE 7 proctored exam. NSE 5 and NSE 6 are alternatives, and you need only one of them.

Which training does Fortinet recommend? Official certification documentation lists the exam as exam-only and names two recommended courses: FortiSASE Enterprise Administrator and SD-WAN Enterprise Administrator.

How much does the exam cost? Official fee documentation, updated 5 October 2026, gives $200 for NSE 4 to NSE 7 exams until 2 November 2026, when fees change. The NSE ordering guide lists a $400 voucher for NSE 7 exams, so the two documents disagree. Confirm the price at checkout.

If I fail, how soon can I retake it? Fifteen days after the failed attempt. A passed exam cannot be retaken.

How long does the certification last? Two years from the date it is issued. Expiry dates cannot be extended, and an expired certification means meeting all the initial requirements again.

How do I renew it? Complete the recertification assessment if one is available for your exam version and your proctored exam is less than two years old, or pass the next version of the proctored exam. Renewing an active NSE 7 also renews the active NSE 4 and the same-track NSE 5 and NSE 6 certifications.

The practical takeaway#

The NSE 7 SASE Architect is built around one idea: a SASE architect has to be fluent in both secure access and SD-WAN. Official recommendations, the exam topic list and the certification description all point the same way. Build your plan around the two recommended courses, check the exam page for the current topic weights, and treat anything that quotes exact percentages for every domain with caution.

Then sort out the logistics early: an active prerequisite chain, a test center booking, and a price check at checkout. Because remote delivery is gone, test center availability is the part of the plan most likely to cost you time.

Test your architect-level reasoning with the CertCompanion NSE 7 SASE Architect practice question bank, where each answer comes with an explanation. Fortinet's other certifications are listed on the Fortinet exam hub.

Checked against official Fortinet NSE7_SAR exam documentation and current candidate reports. Last verified 2026-11-01.