NSE7_EFW System Configuration Practice Test 3 — 15 Questions

Question 1

An administrator is configuring a FortiGate HA cluster in Active-Passive mode. The administrator wants to reduce the time it takes for the secondary node to take over if the primary fails. Which TWO parameters can be adjusted to achieve faster failover? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Decrease the heartbeat interval.. To reduce HA failover time in an Active-Passive cluster, you can decrease the heartbeat interval and decrease the number of missed heartbeats required before failover. These two parameters directly control how quickly the secondary node detects that the primary is unresponsive. Other options either do not affect failover speed or could introduce additional overhead.

Answer

Configure the HA priority to be higher on the secondary node.

Answer

Enable session synchronization for all protocols.

Answer

Increase the number of heartbeat interfaces.

Question 2

A network administrator is deploying a FortiGate 600E cluster in a data center. The security policy requires that management access to the FortiGate be restricted to a dedicated out-of-band management network. The administrator configures a new VLAN interface named 'mgmt-vlan' and assigns it an IP address. After applying the configuration, the administrator notices that the FortiGate is still reachable via the original management IP on port1. What is the most likely cause?

Accepted Answer

The dedicated management interface must be configured with 'set dedicated-management enable' to disable management access on all other interfaces.. The dedicated management interface feature is designed to restrict administrative access to a single interface. When enabled, all other interfaces cannot be used for management, regardless of their allowaccess settings. In this scenario, the administrator created a VLAN interface but did not enable the dedicated management setting, so port1 still permits management access. Enabling this feature ensures that only the designated interface is used for management, satisfying the security policy.

Answer

The management interface is still enabled on port1; it must be disabled using 'set allowaccess' to remove administrative access.

Answer

The FortiGate requires a reboot after creating a new VLAN interface for management to take effect.

Answer

The administrator must configure a static route to the management network and remove the default gateway on port1.

Question 3

A network administrator manages a FortiGate 600E that processes several high-bandwidth TCP backup streams. The administrator notices that hardware acceleration is consuming excessive session table entries, and the session count is approaching the platform limit. The administrator wants to disable NP6 offloading for a specific traffic type to free session resources. Which CLI command should the administrator use to disable NP6 offloading for a specific protocol?

Accepted Answer

config system npu-offload. The 'config system npu-offload' branch provides protocol-level toggles that determine whether the NP6 processor accelerates TCP or UDP traffic. Disabling offload for a specific protocol prevents those sessions from consuming accelerated session table entries, which is exactly what the administrator needs to free NP6 session resources.

Answer

config system interface

Answer

config system session-ttl

Answer

config system npu

Question 4

A network administrator needs to configure a FortiGate to send syslog messages to a remote syslog server. The FortiGate must include the hostname of the FortiGate in the syslog messages. Which CLI command sequence should be used?

Accepted Answer

config log syslogd setting. The correct CLI path to configure a remote syslog server is under 'config log syslogd setting'. In this context, you set the server IP, port, and other parameters. The FortiGate includes its hostname in syslog messages by default when the format is set appropriately. The other options either do not exist, are for central management, or are for FortiAnalyzer, not generic syslog.

Answer

config log fortianalyzer setting

Answer

config system central-management

Answer

config system syslog

Question 5

A network administrator is troubleshooting a FortiGate in NAT/route mode. The FortiGate has two interfaces: port1 (WAN, IP 203.0.113.1/24) and port2 (LAN, IP 192.168.1.1/24). A firewall policy allows traffic from port2 to port1 with NAT enabled. Users on the LAN can access the internet, but they cannot reach a web server at 198.51.100.10 on the internet. The administrator runs a debug flow and sees that traffic from the LAN is being dropped with the message 'iprope_in_check() check failed, drop'. What is the most likely cause?

Accepted Answer

The return path for the traffic is not through the same interface, causing a reverse path forwarding check failure.. The error 'iprope_in_check() check failed' is typically caused by a reverse path forwarding (RPF) check failure. The FortiGate checks if the packet's source IP is reachable via the same interface it arrived on. If the routing table points to a different interface for the return path, the packet is dropped. This can happen if there is an asymmetric route or if the default route is not correct.

Answer

The NAT configuration is incorrect, causing the source IP to be translated to an invalid address.

Answer

There is no route on the FortiGate for the destination network 198.51.100.0/24.

Answer

The firewall policy is missing a service definition for HTTP/HTTPS.

Question 6

A FortiGate is configured with two VDOMs: 'root' and 'vdom1'. The administrator needs to allow HTTP traffic from a user on the internet (connected to the root VDOM) to reach a web server located in vdom1. The web server's IP is 10.1.1.10, and the public IP is 203.0.113.5. Which configuration is required to accomplish this?

Accepted Answer

Create a firewall policy in the root VDOM from the internet-facing interface to an inter-VDOM link interface, and another policy in vdom1 from the inter-VDOM link to the web server. Also configure a VIP in the root VDOM to map 203.0.113.5 to 10.1.1.10.. Inter-VDOM traffic requires an inter-VDOM link (IVL) and firewall policies in both VDOMs. The root VDOM policy allows traffic from the internet to the IVL, and the vdom1 policy allows traffic from the IVL to the web server. A VIP in the root VDOM performs destination NAT, translating the public IP to the web server's private IP. This combination ensures proper routing and address translation across VDOMs.

Answer

Create a single firewall policy in the root VDOM that includes both the internet-facing interface and the vdom1 interface as source and destination. Configure a VIP in vdom1.

Answer

Place the web server in the root VDOM and use a policy route to forward traffic to vdom1. Configure a VIP in vdom1.

Answer

Configure a VIP in the root VDOM and enable 'set inter-vdom enable' on the internet-facing interface. No additional policies are needed because VDOMs share the same routing table by default.

Question 7

A network engineer is troubleshooting a FortiGate 3000D cluster where sessions are not being synchronized between the primary and secondary nodes for traffic passing through a VDOM named 'VDOM_A'. The engineer has verified that HA is up and that session synchronization is enabled globally. Which configuration parameter must be checked to ensure that session synchronization occurs for VDOM_A?

Accepted Answer

config vdom edit VDOM_A config system settings set session-sync enable. Session synchronization is controlled at both the global HA level and per VDOM. Even with global synchronization enabled, a VDOM can have its own session synchronization disabled. To synchronize sessions for a specific VDOM, that VDOM's system settings must have session synchronization enabled.

Answer

set session-sync-dev <interface>

Answer

config system ha set session-sync enable

Answer

config system ha set vdom <VDOM_A>

Question 8

An administrator is configuring a FortiGate HA cluster in Active-Passive mode. The administrator wants to reduce the time it takes for the secondary node to take over if the primary fails. Which TWO parameters can be adjusted to achieve faster failover? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a remote LDAP server under 'config user ldap', create a user group with the LDAP server, then configure the administrator account with 'set remote-auth enable' and 'set remote-group <group>'. Ensure 'set password' is also set for local fallback.. Administrator authentication against a remote LDAP server is configured by creating the LDAP server object, a user group, and then enabling remote authentication on the admin account with the remote group specified. The local password remains as a fallback, so if the LDAP server is down, the administrator can still log in locally. The other options use incorrect syntax or wrong protocols and do not provide the required fallback.

Answer

Create an LDAP server object and a user group that includes the LDAP server. Then, in the administrator account, set the type to 'ldap' and specify the user group.

Answer

Configure the LDAP server as a RADIUS server and use 'set auth-type radius' for the administrator account.

Answer

Enable two-factor authentication for the administrator and configure the LDAP server as the primary factor.

Question 9

A network administrator is configuring a FortiGate to support a new VoIP deployment. The administrator needs to ensure that SIP traffic is inspected and that the FortiGate can handle the embedded IP addresses in the SIP signaling. Which two actions must be taken to achieve this? (Choose two.)

Accepted Answer

Configure a SIP session helper to inspect SIP traffic and modify embedded IP addresses.. To inspect SIP traffic and handle embedded IP addresses, the SIP session helper must be enabled and correctly configured. The session helper performs the necessary NAT modifications within the SIP payload. Simply creating a firewall policy with NAT or enabling application control does not achieve this. Thus, configuring the SIP session helper and ensuring it is active on the correct ports are the required actions.

Answer

Create a firewall policy that allows SIP traffic from the VoIP provider to the internal PBX, ensuring the policy has NAT enabled.

Answer

Enable the SIP application control signature in the firewall policy to detect and fix embedded IP addresses.

Answer

Enable SIP ALG on the firewall policy that permits the VoIP traffic.

Question 10

A network administrator is troubleshooting a FortiGate HA cluster in Active-Passive mode. The administrator notices that the primary unit is processing all traffic, while the secondary unit is idle. The administrator wants to verify that the HA heartbeat interfaces are correctly configured and that the cluster is synchronized. Which command should the administrator use to check the HA status and synchronization?

Accepted Answer

diagnose sys ha status. To check HA status and synchronization, the administrator should use 'diagnose sys ha status'. This command provides real-time information about the cluster's operation, including which unit is primary, the status of heartbeat interfaces, and synchronization state. Other commands like 'diagnose sys ha checksum' are for specific checks, and 'get system ha status' is invalid. Thus, the correct choice is the diagnose command.

Answer

get system ha status

Answer

execute ha manage 0

Answer

diagnose sys ha checksum

Question 11

An administrator is configuring a FortiGate HA cluster in Active-Passive mode. The administrator wants to reduce the time it takes for the secondary node to take over if the primary fails. Which TWO parameters can be adjusted to achieve faster failover? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Under 'config system dns', configure the domain suffix using 'set domain <suffix>'.. To use DHCP-provided DNS servers, ensure the WAN interface is a DHCP client and do not manually configure DNS servers under 'config system dns'; the FortiGate will automatically use the DHCP-provided servers. To resolve names with a specific domain suffix, configure the domain under 'config system dns' using 'set domain'. These two steps together meet the requirements. The other options either override the DHCP DNS, are unrelated security features, or are not required.

Answer

Under 'config system dns', set the primary and secondary DNS servers to the IP addresses provided by the DHCP server.

Answer

Enable 'set dns-over-https' under 'config system dns' to ensure secure DNS resolution.

Answer

Configure the WAN interface to obtain DNS settings via DHCP by enabling 'set dns-server-override'.

Question 12

A FortiGate is configured with a static route to 10.0.0.0/8 via 192.168.1.1. The administrator wants to ensure that if the primary route becomes unavailable, traffic automatically fails over to a backup route via 192.168.2.1. Which configuration should be used?

Accepted Answer

Configure a second static route with a higher distance and associate both routes with a link health monitor.. To achieve automatic failover, you need a backup route with a higher distance and a link health monitor on the primary route. The monitor detects failures and removes the primary route, allowing the backup to take over. Other options either use ECMP or do not include health checking, so they do not provide reliable failover.

Answer

Configure a second static route with the same distance and enable 'set priority' on both routes.

Answer

Configure a second static route with a lower distance and enable 'set priority' on both routes.

Answer

Configure a second static route with the same destination but a higher distance and enable 'set priority' on both routes.

Question 13

An administrator needs to configure a FortiGate to act as a DNS server for internal clients. The FortiGate should resolve internal hostnames and forward other queries to external DNS servers. Which feature must be configured?

Accepted Answer

DNS server. The FortiGate DNS server feature enables the device to act as a DNS server for clients, using a local DNS database for internal names and forwarding other queries to external DNS servers. Other options are either incomplete or not valid FortiGate features. This configuration centralizes DNS resolution and can improve performance and security.

Answer

DNS database

Answer

DNS forwarder

Answer

DNS zone

Question 14

An administrator wants to configure a FortiGate to act as a DHCP server for a VLAN interface. The DHCP server must provide IP addresses from a specific range and also assign a custom DHCP option 121 (Classless Static Route) to clients. Which configuration step is required?

Accepted Answer

Create a custom DHCP option using 'config system dhcp server' and then apply it to the server instance with 'set options'.. To assign a custom DHCP option such as option 121, you define it in the DHCP server configuration with the appropriate code, type, and value, then apply it to the server using 'set options'. This ensures clients receive the static route information. The other options either reference non-existent commands or place the configuration in the wrong context.

Answer

Configure the option under 'config system interface' for the VLAN interface using 'set dhcp-option'.

Answer

Use the 'config system dhcp server' command and set the option directly in the IP range with 'set custom-option'.

Answer

Define the DHCP option under 'config system dhcp server' and then reference it in the IP range configuration using 'set dhcp-option'.

Question 15

An administrator is configuring a FortiGate HA cluster in Active-Passive mode. The administrator wants to reduce the time it takes for the secondary node to take over if the primary fails. Which TWO parameters can be adjusted to achieve faster failover? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Transparent mode supports VLAN interfaces and can inspect VLAN-tagged traffic.. Transparent mode allows the FortiGate to act as a Layer 2 bridge, forwarding traffic based on MAC addresses without IP modification. Firewall policies can match on MAC addresses, and VLAN interfaces are supported for inspecting tagged traffic. Management is possible via a dedicated management IP on one interface, but not all interfaces. NAT is not performed in transparent mode.

Answer

The FortiGate requires a unique IP address on each interface to route traffic between networks.

Answer

The FortiGate can be managed via any interface, including those in the transparent VDOM, using the same IP address as the management interface.

Answer

In transparent mode, the FortiGate can perform NAT for outbound traffic.