NSE7_EFW System Configuration Practice Test 1 — 15 Questions

Question 1

An administrator notices that hardware acceleration (NP6) is failing to offload traffic for a specific policy. Which command is best used to verify if hardware offloading is actually occurring for a specific session?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

diagnose sys session list. The command `diagnose sys session list` displays the full session table, including per-session flags that indicate whether a session is being offloaded to the NP6 network processor. When hardware acceleration is active, the session entry will show the `offload` flag (e.g., `offload=0x0` or `offload=0x1` depending on state) or a similar indicator in the session details. This is the most direct way to verify offloading for a specific session, as it ties the session state to the hardware acceleration status.

Answer

get hardware npu np6

Answer

get system performance status

Answer

diagnose npu np6 status

Question 2

An administrator is troubleshooting an issue where hardware acceleration is not working after upgrading firmware. Which command identifies if the NP configuration has changed?

Accepted Answer

diag hardware npu np6 port-list. The command 'diag hardware npu np6 port-list' displays the current NP6 port configuration and status, allowing the administrator to compare it with the expected configuration after a firmware upgrade. If hardware acceleration is not working, this command can reveal whether the NP6 ports are properly mapped or if the configuration has changed.

Answer

config system npu

Answer

diagnose firewall npu

Answer

get hardware status

Question 3

You are configuring VDOMs on a FortiGate. Which operation requires the VDOMs to be in 'Split-Task' VDOM mode compared to 'Multi-VDOM' mode?

Accepted Answer

Enabling administrative separation. Split-Task mode is specifically used to divide management and data plane traffic tasks, often required for specific compliance or architecture isolation.

Answer

Applying firewall policies

Answer

Adding a new VDOM

Answer

Inter-VDOM routing

Question 4

You need to ensure that session synchronization between HA nodes is as efficient as possible. Which parameter should be tuned in the HA configuration?

Accepted Answer

session-pickup-delay. The session-pickup-delay parameter controls how long a secondary HA node waits before picking up sessions after a failover. Tuning this delay ensures that session synchronization is efficient by preventing the secondary node from prematurely taking over sessions that may still be active on the primary, thus avoiding unnecessary session re-establishment and reducing synchronization overhead. A shorter delay can speed up failover but may cause session flapping, while a longer delay can reduce synchronization traffic but increase failover time. Therefore, adjusting session-pickup-delay directly impacts the efficiency of session synchronization between HA nodes.

Answer

monitor-interface

Answer

override

Answer

heartbeat-interval

Question 5

A network administrator is configuring an HA cluster with two FortiGates in Active-Passive mode. Which parameter must be identical on both devices to ensure a successful cluster formation?

Accepted Answer

HA Group ID. For two FortiGates to form an HA cluster, the HA Group ID (also called group name) must match on both devices. This identifier ensures the devices recognize each other as members of the same cluster. Other parameters like hostname, serial number, and priority can differ — priority actually determines which device becomes primary.

Answer

Device Hostname

Answer

Serial Number

Answer

Priority value

Question 6

When configuring an aggregate interface (LACP) on a FortiGate, which mode must be set to ensure traffic is distributed across links based on source and destination IP?

Accepted Answer

Hash algorithm L4. On a FortiGate aggregate (LACP) interface, the hash algorithm determines how egress traffic is distributed across member links. Setting the hash algorithm to L4 distributes traffic based on Layer 4 information combined with source/destination IP, ensuring flows are spread across links rather than pinned to one. This is configured under the aggregate interface settings.

Answer

VLAN tagging

Answer

Interface mirroring

Answer

LACP mode active

Question 7

Which CLI command shows the current HA synchronization status and the checksums of the configurations?

Accepted Answer

get system ha status. The command 'get system ha status' displays the current HA cluster status, including which unit is primary/secondary, uptime, and configuration synchronization checksums. It is the standard CLI command to verify HA health and detect configuration drift between cluster members.

Answer

diag hardware ha

Answer

show system ha

Answer

diagnose sys ha sync

Question 8

Which administrative access type is recommended to be disabled on public-facing interfaces for security best practices?

Accepted Answer

HTTP. HTTP should be disabled on public-facing interfaces because it transmits administrative credentials and session data in cleartext, making it trivially interceptable by anyone on the path. Fortinet and general security best practices recommend using HTTPS (encrypted) instead, and disabling HTTP entirely on WAN-facing interfaces.

Answer

SSH

Answer

HTTPS

Answer

SNMP

Question 9

If a FortiGate is in Active-Passive HA mode, what happens to the secondary device if the heartbeat is lost?

Accepted Answer

It initiates a master election. In Active-Passive HA, if the secondary device loses heartbeat from the primary, it assumes the primary has failed and initiates a master election to become the new primary. This ensures high availability by taking over the active role.

Answer

It shuts down its interfaces

Answer

It enters standalone mode

Answer

It ignores the loss

Question 10

Which parameter, when modified in a policy, causes a session flush for all active connections hitting that policy?

Accepted Answer

Action (Accept to Deny). Changing critical security profile settings or specific policy parameters that affect the session tuple typically triggers a session flush to ensure consistent security enforcement.

Answer

Schedule

Answer

Comments field

Answer

Policy Name

Question 11

When using 'set session-ttl' globally, which sessions are affected?

Accepted Answer

Only new sessions. Global session TTL settings apply to all sessions that do not have a specific override or a policy-based setting.

Answer

All sessions

Answer

Only TCP sessions

Answer

Only existing sessions

Question 12

What does the 'set tcp-rst-timeout' command control?

Accepted Answer

The time to wait after sending a reset. It specifies how long the FortiGate waits after sending a TCP RST packet before clearing the session from the session table.

Answer

The TCP handshake timeout

Answer

The maximum session duration

Answer

The time before an idle session is dropped

Question 13

Which TWO protocols are supported by the FortiGate for heartbeat synchronization between HA nodes?

Accepted Answer

Ethernet (Native). FortiGate uses proprietary HA keepalive packets over the configured HA interfaces.

Answer

SNMP

Answer

TCP/443

Answer

IP (Non-UDP/TCP)

Answer

UDP/514

Question 14

Which THREE factors influence the Master election in an HA cluster?

Accepted Answer

Uptime (if priority is equal). In an HA cluster, the Master election is governed by three deterministic factors: Device Priority (D), where the firewall with the lower numeric priority value wins the election; Monitor interface status (E), where a device whose monitored interfaces are all up is preferred over one with failed monitored links, allowing failover to a healthier peer; and Uptime (C), which acts as the tiebreaker when priorities are equal, with the device having the longer uptime becoming Master. CPU load (A) is not a factor in the election algorithm, since HA election is based on configured priority, link health, and uptime rather than real-time resource utilization. Device Hostname (B) is also irrelevant to the election process; it is used for identification and management, not for determining which device becomes Master.

Answer

CPU load

Answer

Device Hostname

Question 15

Which TWO settings are modified to reduce the impact of a failover event in an HA cluster?

Accepted Answer

hb-interval. In an HA cluster, the heartbeat interval (B, hb-interval) and the heartbeat lost threshold (C, hb-lost-threshold) directly control how quickly a failover is detected and triggered: a shorter hb-interval makes heartbeats more frequent, and a lower hb-lost-threshold reduces the number of missed heartbeats required before the peer is declared dead, thereby shortening the outage window and reducing the impact of a failover event. These two settings are the standard tuning knobs for failover sensitivity and convergence time in HA deployments. The other options do not serve this purpose: group-password (A) is an authentication credential for cluster communication, priority (D) determines which node becomes primary/active but does not tune failover timing, and monitored-interfaces (E) specifies which interfaces are tracked for link failure rather than controlling failover detection speed.

Answer

group-password

Answer

priority

Answer

monitored-interfaces