NSE7_EFW System Configuration Practice Test 2 — 15 Questions

Question 1

You need to inspect traffic between two VDOMs. Which mechanism is required?

Accepted Answer

Inter-VDOM Link. Inter-VDOM links are virtual interfaces used to route traffic between distinct VDOMs, essentially creating a 'cable' between them.

Answer

Policy-based routing

Answer

Physical loopback cable

Answer

Static NAT

Question 2

Which administrative access type is recommended to be disabled on public-facing interfaces for security best practices?

Accepted Answer

HTTP. HTTP and Telnet are unencrypted protocols and should always be disabled on external interfaces.

Answer

SSH

Answer

HTTPS

Answer

SNMP

Question 3

If a FortiGate is in Active-Passive HA mode, what happens to the secondary device if the heartbeat is lost?

Accepted Answer

It initiates a master election. If heartbeat is lost, the secondary assumes the master is down and attempts to promote itself to primary if it has the higher priority or preemption settings configured.

Answer

It shuts down its interfaces

Answer

It enters standalone mode

Answer

It ignores the loss

Question 4

You are troubleshooting high CPU usage on a FortiGate. Which process would you check to see if the IPS engine is the cause?

Accepted Answer

diag sys top. The 'diag sys top' command displays real-time resource utilization, allowing the admin to identify specific processes like 'ipsengine' consuming CPU.

Answer

get system status

Answer

diagnose hardware status

Answer

show sys resource

Question 5

What is the default behavior for 'override' in FortiGate HA?

Accepted Answer

Disabled. Override is disabled by default to prevent unnecessary failbacks and flapping in the cluster.

Answer

Depends on the model

Answer

Enabled

Answer

Always enabled

Question 6

Which feature allows an administrator to offload SSL inspection to the hardware?

Accepted Answer

CP offloading. The FortiASIC CP (Content Processor) hardware chips are specifically designed to offload CPU-intensive tasks like SSL/TLS decryption.

Answer

Flow-based inspection

Answer

IPS engine offloading

Answer

NP6 offloading

Question 7

Which configuration mode allows you to define a virtual MAC address for an HA cluster to prevent ARP cache issues on switches?

Accepted Answer

Virtual MAC. The 'ha-mgmt-status' and virtual MAC features ensure that the cluster presents a consistent MAC regardless of which node is master.

Answer

DHCP relay

Answer

Static ARP

Answer

Physical MAC

Question 8

Which FortiGate feature is used to group multiple physical interfaces for redundancy at Layer 2?

Accepted Answer

802.3ad Aggregate. 802.3ad Link Aggregation (LACP) is the standard for binding physical ports into a single logical interface.

Answer

Loopback interface

Answer

SD-WAN

Answer

VLAN tagging

Question 9

Which command allows you to view the current routing table for a specific VDOM?

Accepted Answer

get router info routing-table all. The 'get router info' command is context-aware and must be prefixed with the VDOM scope or executed within the VDOM context.

Answer

get system routing

Answer

diag ip route

Answer

show router table

Question 10

In a VDOM-enabled environment, how are administrative accounts managed?

Accepted Answer

Admins can be scoped to specific VDOMs. Administrative accounts can be restricted to specific VDOMs (Global admin vs. VDOM admin) for granular access control.

Answer

Only the root VDOM admin can change settings

Answer

Admins must be global

Answer

All admins see all VDOMs

Question 11

Which TWO actions should be taken when preparing to upgrade a FortiGate HA cluster?

Accepted Answer

Review release notes. A configuration backup is mandatory, and checking the release notes for firmware-specific HA behavior is critical for a smooth upgrade.

Answer

Clear all sessions

Answer

Disable heartbeat interfaces

Answer

Change HA mode to Standalone

Question 12

Which TWO components are synchronized between HA members?

Accepted Answer

Active session table. The configuration and the session table are the primary elements that must be synchronized for transparent failover.

Answer

Administrator credentials

Answer

Local log files

Answer

Firmware image

Question 13

Which THREE factors influence the Master election in an HA cluster?

Accepted Answer

Uptime (if priority is equal). The election process considers the monitor status, the override setting, and the priority values of the devices.

Answer

CPU load

Answer

Device Hostname

Question 14

Which THREE items are included in the configuration file of a FortiGate?

Accepted Answer

User certificates. The configuration file contains system settings, policy rules, and interface definitions.

Answer

FortiGuard cached updates

Answer

Real-time session tables

Question 15

Which TWO settings are modified to reduce the impact of a failover event in an HA cluster?

Accepted Answer

hb-interval. 'hb-interval' and 'hb-lost-threshold' determine how quickly the cluster reacts to heartbeat loss.

Answer

group-password

Answer

priority

Answer

monitored-interfaces