NSE7_EFW System Configuration — 10 Questions

Question 1

An administrator notices that hardware acceleration (NP6) is failing to offload traffic for a specific policy. Which command is best used to verify if hardware offloading is actually occurring for a specific session?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

diagnose sys session list. The command `diagnose sys session list` displays the full session table, including per-session flags that indicate whether a session is being offloaded to the NP6 network processor. When hardware acceleration is active, the session entry will show the `offload` flag (e.g., `offload=0x0` or `offload=0x1` depending on state) or a similar indicator in the session details. This is the most direct way to verify offloading for a specific session, as it ties the session state to the hardware acceleration status.

Answer

get hardware npu np6

Answer

get system performance status

Answer

diagnose npu np6 status

Question 2

An administrator is troubleshooting an issue where hardware acceleration is not working after upgrading firmware. Which command identifies if the NP configuration has changed?

Accepted Answer

diag hardware npu np6 port-list. The command 'diag hardware npu np6 port-list' displays the current NP6 port configuration and status, allowing the administrator to compare it with the expected configuration after a firmware upgrade. If hardware acceleration is not working, this command can reveal whether the NP6 ports are properly mapped or if the configuration has changed.

Answer

config system npu

Answer

diagnose firewall npu

Answer

get hardware status

Question 3

You are configuring VDOMs on a FortiGate. Which operation requires the VDOMs to be in 'Split-Task' VDOM mode compared to 'Multi-VDOM' mode?

Accepted Answer

Enabling administrative separation. Split-Task mode is specifically used to divide management and data plane traffic tasks, often required for specific compliance or architecture isolation.

Answer

Applying firewall policies

Answer

Adding a new VDOM

Answer

Inter-VDOM routing

Question 4

You need to ensure that session synchronization between HA nodes is as efficient as possible. Which parameter should be tuned in the HA configuration?

Accepted Answer

session-pickup-delay. The session-pickup-delay parameter controls how long a secondary HA node waits before picking up sessions after a failover. Tuning this delay ensures that session synchronization is efficient by preventing the secondary node from prematurely taking over sessions that may still be active on the primary, thus avoiding unnecessary session re-establishment and reducing synchronization overhead. A shorter delay can speed up failover but may cause session flapping, while a longer delay can reduce synchronization traffic but increase failover time. Therefore, adjusting session-pickup-delay directly impacts the efficiency of session synchronization between HA nodes.

Answer

monitor-interface

Answer

override

Answer

heartbeat-interval

Question 5

A network administrator is configuring an HA cluster with two FortiGates in Active-Passive mode. Which parameter must be identical on both devices to ensure a successful cluster formation?

Accepted Answer

HA Group ID. For two FortiGates to form an HA cluster, the HA Group ID (also called group name) must match on both devices. This identifier ensures the devices recognize each other as members of the same cluster. Other parameters like hostname, serial number, and priority can differ — priority actually determines which device becomes primary.

Answer

Device Hostname

Answer

Serial Number

Answer

Priority value

Question 6

When configuring an aggregate interface (LACP) on a FortiGate, which mode must be set to ensure traffic is distributed across links based on source and destination IP?

Accepted Answer

Hash algorithm L4. On a FortiGate aggregate (LACP) interface, the hash algorithm determines how egress traffic is distributed across member links. Setting the hash algorithm to L4 distributes traffic based on Layer 4 information combined with source/destination IP, ensuring flows are spread across links rather than pinned to one. This is configured under the aggregate interface settings.

Answer

VLAN tagging

Answer

Interface mirroring

Answer

LACP mode active

Question 7

Which CLI command shows the current HA synchronization status and the checksums of the configurations?

Accepted Answer

get system ha status. The command 'get system ha status' displays the current HA cluster status, including which unit is primary/secondary, uptime, and configuration synchronization checksums. It is the standard CLI command to verify HA health and detect configuration drift between cluster members.

Answer

diag hardware ha

Answer

show system ha

Answer

diagnose sys ha sync

Question 8

Which administrative access type is recommended to be disabled on public-facing interfaces for security best practices?

Accepted Answer

HTTP. HTTP should be disabled on public-facing interfaces because it transmits administrative credentials and session data in cleartext, making it trivially interceptable by anyone on the path. Fortinet and general security best practices recommend using HTTPS (encrypted) instead, and disabling HTTP entirely on WAN-facing interfaces.

Answer

SSH

Answer

HTTPS

Answer

SNMP

Question 9

If a FortiGate is in Active-Passive HA mode, what happens to the secondary device if the heartbeat is lost?

Accepted Answer

It initiates a master election. In Active-Passive HA, if the secondary device loses heartbeat from the primary, it assumes the primary has failed and initiates a master election to become the new primary. This ensures high availability by taking over the active role.

Answer

It shuts down its interfaces

Answer

It enters standalone mode

Answer

It ignores the loss

Question 10

Which parameter, when modified in a policy, causes a session flush for all active connections hitting that policy?

Accepted Answer

Action (Accept to Deny). Changing critical security profile settings or specific policy parameters that affect the session tuple typically triggers a session flush to ensure consistent security enforcement.

Answer

Schedule

Answer

Comments field

Answer

Policy Name