NSE7_EFW System Configuration — Timed 20 Questions

Question 1

You are configuring VDOMs on a FortiGate. Which operation requires the VDOMs to be in 'Split-Task' VDOM mode compared to 'Multi-VDOM' mode?

Accepted Answer

Enabling administrative separation. Split-Task mode is specifically used to divide management and data plane traffic tasks, often required for specific compliance or architecture isolation.

Answer

Applying firewall policies

Answer

Adding a new VDOM

Answer

Inter-VDOM routing

Question 2

Which parameter, when modified in a policy, causes a session flush for all active connections hitting that policy?

Accepted Answer

Action (Accept to Deny). Changing critical security profile settings or specific policy parameters that affect the session tuple typically triggers a session flush to ensure consistent security enforcement.

Answer

Schedule

Answer

Comments field

Answer

Policy Name

Question 3

When using 'set session-ttl' globally, which sessions are affected?

Accepted Answer

Only new sessions. Global session TTL settings apply to all sessions that do not have a specific override or a policy-based setting.

Answer

All sessions

Answer

Only TCP sessions

Answer

Only existing sessions

Question 4

What does the 'set tcp-rst-timeout' command control?

Accepted Answer

The time to wait after sending a reset. It specifies how long the FortiGate waits after sending a TCP RST packet before clearing the session from the session table.

Answer

The TCP handshake timeout

Answer

The maximum session duration

Answer

The time before an idle session is dropped

Question 5

Which TWO protocols are supported by the FortiGate for heartbeat synchronization between HA nodes?

Accepted Answer

Ethernet (Native). FortiGate uses proprietary HA keepalive packets over the configured HA interfaces.

Answer

SNMP

Answer

TCP/443

Answer

IP (Non-UDP/TCP)

Answer

UDP/514

Question 6

An administrator notices that hardware acceleration (NP6) is failing to offload traffic for a specific policy. Which command is best used to verify if hardware offloading is actually occurring for a specific session?

Accepted Answer

diagnose sys session list. The command 'diag sys session filter' combined with 'diag sys session list' allows the administrator to view session flags, specifically looking for the 'offload' flag.

Answer

get hardware npu np6

Answer

get system performance status

Answer

diagnose npu np6 status

Question 7

An administrator is troubleshooting an issue where hardware acceleration is not working after upgrading firmware. Which command identifies if the NP configuration has changed?

Accepted Answer

diag hardware npu np6 port-list. 'diag hardware npu np6 port-list' or similar status commands help verify the current operational state and mapping of physical ports to NPU cores.

Answer

config system npu

Answer

diagnose firewall npu

Answer

get hardware status

Question 8

What is the impact of changing the 'set vdom-mode' from 'no-vdom' to 'multi-vdom'?

Accepted Answer

System reboot required. Changing the VDOM mode triggers a system reboot because it fundamentally changes how the kernel handles memory allocation and resource segmentation.

Answer

Automatic disablement of HA

Answer

Loss of all firewall policies

Answer

No impact, immediate change

Question 9

You need to ensure that session synchronization between HA nodes is as efficient as possible. Which parameter should be tuned in the HA configuration?

Accepted Answer

session-pickup-delay. The 'session-pickup' setting, specifically 'session-pickup-delay', helps manage the timing and load of session synchronization to prevent CPU spikes.

Answer

monitor-interface

Answer

override

Answer

heartbeat-interval

Question 10

A network administrator is configuring an HA cluster with two FortiGates in Active-Passive mode. Which parameter must be identical on both devices to ensure a successful cluster formation?

Accepted Answer

HA Group ID. In an HA cluster, devices must share identical HA group IDs, passwords, and heartbeats to form a cluster.

Answer

Device Hostname

Answer

Serial Number

Answer

Priority value

Question 11

A FortiGate is operating in transparent mode. What is the default behavior when the device receives a frame with an unknown MAC address?

Accepted Answer

Flood to all ports. In transparent mode, the FortiGate acts as a Layer 2 bridge and will flood the unknown frame to all interfaces in the bridge domain except the incoming port.

Answer

Drop the packet

Answer

Forward to the management interface

Answer

Send an ICMP unreachable message

Question 12

When configuring an aggregate interface (LACP) on a FortiGate, which mode must be set to ensure traffic is distributed across links based on source and destination IP?

Accepted Answer

Hash algorithm L4. The 'LACP-mode' set to 'active' or 'passive' relates to negotiation, but the distribution algorithm is governed by the 'dst-mac' or 'ip' hash settings in the interface configuration.

Answer

VLAN tagging

Answer

Interface mirroring

Answer

LACP mode active

Question 13

What is the purpose of 'dedicated HA' interfaces?

Accepted Answer

To isolate heartbeat traffic. They isolate heartbeat traffic from data traffic to prevent jitter and ensure cluster stability.

Answer

To provide extra management access

Answer

To increase throughput

Answer

To act as a backup WAN port

Question 14

Which CLI command shows the current HA synchronization status and the checksums of the configurations?

Accepted Answer

get system ha status. 'get system ha status' provides the overall cluster health, including checksum comparison between nodes.

Answer

diag hardware ha

Answer

show system ha

Answer

diagnose sys ha sync

Question 15

When using SD-WAN, how does the 'member' configuration interact with physical interfaces?

Accepted Answer

Members are logical groups of interfaces. SD-WAN members are physical interfaces (or tunnels) added to the SD-WAN zone, allowing the FortiGate to manage them as a single logical pool.

Answer

Members replace the IP configuration

Answer

Members require a separate VDOM

Answer

Members must have DHCP enabled

Question 16

You need to inspect traffic between two VDOMs. Which mechanism is required?

Accepted Answer

Inter-VDOM Link. Inter-VDOM links are virtual interfaces used to route traffic between distinct VDOMs, essentially creating a 'cable' between them.

Answer

Policy-based routing

Answer

Physical loopback cable

Answer

Static NAT

Question 17

Which administrative access type is recommended to be disabled on public-facing interfaces for security best practices?

Accepted Answer

HTTP. HTTP and Telnet are unencrypted protocols and should always be disabled on external interfaces.

Answer

SSH

Answer

HTTPS

Answer

SNMP

Question 18

If a FortiGate is in Active-Passive HA mode, what happens to the secondary device if the heartbeat is lost?

Accepted Answer

It initiates a master election. If heartbeat is lost, the secondary assumes the master is down and attempts to promote itself to primary if it has the higher priority or preemption settings configured.

Answer

It shuts down its interfaces

Answer

It enters standalone mode

Answer

It ignores the loss

Question 19

You are troubleshooting high CPU usage on a FortiGate. Which process would you check to see if the IPS engine is the cause?

Accepted Answer

diag sys top. The 'diag sys top' command displays real-time resource utilization, allowing the admin to identify specific processes like 'ipsengine' consuming CPU.

Answer

get system status

Answer

diagnose hardware status

Answer

show sys resource

Question 20

What is the default behavior for 'override' in FortiGate HA?

Accepted Answer

Disabled. Override is disabled by default to prevent unnecessary failbacks and flapping in the cluster.

Answer

Depends on the model

Answer

Enabled

Answer

Always enabled