NSE7_EFW System Configuration — 10 Questions

Question 1

You are configuring VDOMs on a FortiGate. Which operation requires the VDOMs to be in 'Split-Task' VDOM mode compared to 'Multi-VDOM' mode?

Accepted Answer

Enabling administrative separation. Split-Task mode is specifically used to divide management and data plane traffic tasks, often required for specific compliance or architecture isolation.

Answer

Applying firewall policies

Answer

Adding a new VDOM

Answer

Inter-VDOM routing

Question 2

Which parameter, when modified in a policy, causes a session flush for all active connections hitting that policy?

Accepted Answer

Action (Accept to Deny). Changing critical security profile settings or specific policy parameters that affect the session tuple typically triggers a session flush to ensure consistent security enforcement.

Answer

Schedule

Answer

Comments field

Answer

Policy Name

Question 3

When using 'set session-ttl' globally, which sessions are affected?

Accepted Answer

Only new sessions. Global session TTL settings apply to all sessions that do not have a specific override or a policy-based setting.

Answer

All sessions

Answer

Only TCP sessions

Answer

Only existing sessions

Question 4

What does the 'set tcp-rst-timeout' command control?

Accepted Answer

The time to wait after sending a reset. It specifies how long the FortiGate waits after sending a TCP RST packet before clearing the session from the session table.

Answer

The TCP handshake timeout

Answer

The maximum session duration

Answer

The time before an idle session is dropped

Question 5

Which TWO protocols are supported by the FortiGate for heartbeat synchronization between HA nodes?

Accepted Answer

Ethernet (Native). FortiGate uses proprietary HA keepalive packets over the configured HA interfaces.

Answer

SNMP

Answer

TCP/443

Answer

IP (Non-UDP/TCP)

Answer

UDP/514

Question 6

An administrator notices that hardware acceleration (NP6) is failing to offload traffic for a specific policy. Which command is best used to verify if hardware offloading is actually occurring for a specific session?

Accepted Answer

diagnose sys session list. The command 'diag sys session filter' combined with 'diag sys session list' allows the administrator to view session flags, specifically looking for the 'offload' flag.

Answer

get hardware npu np6

Answer

get system performance status

Answer

diagnose npu np6 status

Question 7

An administrator is troubleshooting an issue where hardware acceleration is not working after upgrading firmware. Which command identifies if the NP configuration has changed?

Accepted Answer

diag hardware npu np6 port-list. 'diag hardware npu np6 port-list' or similar status commands help verify the current operational state and mapping of physical ports to NPU cores.

Answer

config system npu

Answer

diagnose firewall npu

Answer

get hardware status

Question 8

What is the impact of changing the 'set vdom-mode' from 'no-vdom' to 'multi-vdom'?

Accepted Answer

System reboot required. Changing the VDOM mode triggers a system reboot because it fundamentally changes how the kernel handles memory allocation and resource segmentation.

Answer

Automatic disablement of HA

Answer

Loss of all firewall policies

Answer

No impact, immediate change

Question 9

You need to ensure that session synchronization between HA nodes is as efficient as possible. Which parameter should be tuned in the HA configuration?

Accepted Answer

session-pickup-delay. The 'session-pickup' setting, specifically 'session-pickup-delay', helps manage the timing and load of session synchronization to prevent CPU spikes.

Answer

monitor-interface

Answer

override

Answer

heartbeat-interval

Question 10

A network administrator is configuring an HA cluster with two FortiGates in Active-Passive mode. Which parameter must be identical on both devices to ensure a successful cluster formation?

Accepted Answer

HA Group ID. In an HA cluster, devices must share identical HA group IDs, passwords, and heartbeats to form a cluster.

Answer

Device Hostname

Answer

Serial Number

Answer

Priority value