NSE7_EFW System Configuration — Timed 20 Questions

Question 1

An administrator notices that hardware acceleration (NP6) is failing to offload traffic for a specific policy. Which command is best used to verify if hardware offloading is actually occurring for a specific session?

20 minute time limit — choose an answer to begin.

Accepted Answer

diagnose sys session list. The command `diagnose sys session list` displays the full session table, including per-session flags that indicate whether a session is being offloaded to the NP6 network processor. When hardware acceleration is active, the session entry will show the `offload` flag (e.g., `offload=0x0` or `offload=0x1` depending on state) or a similar indicator in the session details. This is the most direct way to verify offloading for a specific session, as it ties the session state to the hardware acceleration status.

Answer

get hardware npu np6

Answer

get system performance status

Answer

diagnose npu np6 status

Question 2

An administrator is troubleshooting an issue where hardware acceleration is not working after upgrading firmware. Which command identifies if the NP configuration has changed?

Accepted Answer

diag hardware npu np6 port-list. The command 'diag hardware npu np6 port-list' displays the current NP6 port configuration and status, allowing the administrator to compare it with the expected configuration after a firmware upgrade. If hardware acceleration is not working, this command can reveal whether the NP6 ports are properly mapped or if the configuration has changed.

Answer

config system npu

Answer

diagnose firewall npu

Answer

get hardware status

Question 3

You are configuring VDOMs on a FortiGate. Which operation requires the VDOMs to be in 'Split-Task' VDOM mode compared to 'Multi-VDOM' mode?

Accepted Answer

Enabling administrative separation. Split-Task mode is specifically used to divide management and data plane traffic tasks, often required for specific compliance or architecture isolation.

Answer

Applying firewall policies

Answer

Adding a new VDOM

Answer

Inter-VDOM routing

Question 4

You need to ensure that session synchronization between HA nodes is as efficient as possible. Which parameter should be tuned in the HA configuration?

Accepted Answer

session-pickup-delay. The session-pickup-delay parameter controls how long a secondary HA node waits before picking up sessions after a failover. Tuning this delay ensures that session synchronization is efficient by preventing the secondary node from prematurely taking over sessions that may still be active on the primary, thus avoiding unnecessary session re-establishment and reducing synchronization overhead. A shorter delay can speed up failover but may cause session flapping, while a longer delay can reduce synchronization traffic but increase failover time. Therefore, adjusting session-pickup-delay directly impacts the efficiency of session synchronization between HA nodes.

Answer

monitor-interface

Answer

override

Answer

heartbeat-interval

Question 5

A network administrator is configuring an HA cluster with two FortiGates in Active-Passive mode. Which parameter must be identical on both devices to ensure a successful cluster formation?

Accepted Answer

HA Group ID. For two FortiGates to form an HA cluster, the HA Group ID (also called group name) must match on both devices. This identifier ensures the devices recognize each other as members of the same cluster. Other parameters like hostname, serial number, and priority can differ — priority actually determines which device becomes primary.

Answer

Device Hostname

Answer

Serial Number

Answer

Priority value

Question 6

When configuring an aggregate interface (LACP) on a FortiGate, which mode must be set to ensure traffic is distributed across links based on source and destination IP?

Accepted Answer

Hash algorithm L4. On a FortiGate aggregate (LACP) interface, the hash algorithm determines how egress traffic is distributed across member links. Setting the hash algorithm to L4 distributes traffic based on Layer 4 information combined with source/destination IP, ensuring flows are spread across links rather than pinned to one. This is configured under the aggregate interface settings.

Answer

VLAN tagging

Answer

Interface mirroring

Answer

LACP mode active

Question 7

Which CLI command shows the current HA synchronization status and the checksums of the configurations?

Accepted Answer

get system ha status. The command 'get system ha status' displays the current HA cluster status, including which unit is primary/secondary, uptime, and configuration synchronization checksums. It is the standard CLI command to verify HA health and detect configuration drift between cluster members.

Answer

diag hardware ha

Answer

show system ha

Answer

diagnose sys ha sync

Question 8

Which administrative access type is recommended to be disabled on public-facing interfaces for security best practices?

Accepted Answer

HTTP. HTTP should be disabled on public-facing interfaces because it transmits administrative credentials and session data in cleartext, making it trivially interceptable by anyone on the path. Fortinet and general security best practices recommend using HTTPS (encrypted) instead, and disabling HTTP entirely on WAN-facing interfaces.

Answer

SSH

Answer

HTTPS

Answer

SNMP

Question 9

If a FortiGate is in Active-Passive HA mode, what happens to the secondary device if the heartbeat is lost?

Accepted Answer

It initiates a master election. In Active-Passive HA, if the secondary device loses heartbeat from the primary, it assumes the primary has failed and initiates a master election to become the new primary. This ensures high availability by taking over the active role.

Answer

It shuts down its interfaces

Answer

It enters standalone mode

Answer

It ignores the loss

Question 10

Which parameter, when modified in a policy, causes a session flush for all active connections hitting that policy?

Accepted Answer

Action (Accept to Deny). Changing critical security profile settings or specific policy parameters that affect the session tuple typically triggers a session flush to ensure consistent security enforcement.

Answer

Schedule

Answer

Comments field

Answer

Policy Name

Question 11

When using 'set session-ttl' globally, which sessions are affected?

Accepted Answer

Only new sessions. Global session TTL settings apply to all sessions that do not have a specific override or a policy-based setting.

Answer

All sessions

Answer

Only TCP sessions

Answer

Only existing sessions

Question 12

What does the 'set tcp-rst-timeout' command control?

Accepted Answer

The time to wait after sending a reset. It specifies how long the FortiGate waits after sending a TCP RST packet before clearing the session from the session table.

Answer

The TCP handshake timeout

Answer

The maximum session duration

Answer

The time before an idle session is dropped

Question 13

Which TWO protocols are supported by the FortiGate for heartbeat synchronization between HA nodes?

Accepted Answer

Ethernet (Native). FortiGate uses proprietary HA keepalive packets over the configured HA interfaces.

Answer

SNMP

Answer

TCP/443

Answer

IP (Non-UDP/TCP)

Answer

UDP/514

Question 14

Which THREE factors influence the Master election in an HA cluster?

Accepted Answer

Uptime (if priority is equal). In an HA cluster, the Master election is governed by three deterministic factors: Device Priority (D), where the firewall with the lower numeric priority value wins the election; Monitor interface status (E), where a device whose monitored interfaces are all up is preferred over one with failed monitored links, allowing failover to a healthier peer; and Uptime (C), which acts as the tiebreaker when priorities are equal, with the device having the longer uptime becoming Master. CPU load (A) is not a factor in the election algorithm, since HA election is based on configured priority, link health, and uptime rather than real-time resource utilization. Device Hostname (B) is also irrelevant to the election process; it is used for identification and management, not for determining which device becomes Master.

Answer

CPU load

Answer

Device Hostname

Question 15

Which TWO settings are modified to reduce the impact of a failover event in an HA cluster?

Accepted Answer

hb-interval. In an HA cluster, the heartbeat interval (B, hb-interval) and the heartbeat lost threshold (C, hb-lost-threshold) directly control how quickly a failover is detected and triggered: a shorter hb-interval makes heartbeats more frequent, and a lower hb-lost-threshold reduces the number of missed heartbeats required before the peer is declared dead, thereby shortening the outage window and reducing the impact of a failover event. These two settings are the standard tuning knobs for failover sensitivity and convergence time in HA deployments. The other options do not serve this purpose: group-password (A) is an authentication credential for cluster communication, priority (D) determines which node becomes primary/active but does not tune failover timing, and monitored-interfaces (E) specifies which interfaces are tracked for link failure rather than controlling failover detection speed.

Answer

group-password

Answer

priority

Answer

monitored-interfaces

Question 16

Which THREE types of traffic are typically NOT offloaded by the NP6 processor?

Accepted Answer

Traffic requiring proxy-based inspection. Option B is correct because the NP6 processor cannot perform proxy-based inspection, which requires the full TCP or UDP payload to be reassembled and examined by a higher-layer proxy (e.g., FortiGate's proxy inspection mode); such traffic must be handled by the CPU. Option C is correct because encrypted traffic (e.g., TLS/HTTPS) cannot be inspected or offloaded until it is decrypted, and decryption itself is performed by the CPU before any accelerated processing can occur. Option D is correct because the NP6 only offloads traffic for protocols it explicitly supports in its fast-path; traffic using unsupported protocols is punted to the CPU for processing. Option A is not correct because simple ICMP packets are commonly offloaded by the NP6 fast path. Option E is not correct because standard UDP traffic is typically offloaded by the NP6 when it matches supported session types.

Answer

Simple ICMP packets

Answer

Standard UDP traffic

Question 17

Which THREE conditions must be met for a successful Inter-VDOM link?

Accepted Answer

IP addresses in the same subnet. Option A is correct because the two ends of an inter-VDOM link must be assigned IP addresses in the same subnet so they can route traffic to each other as a point-to-point Layer 3 connection. Option B is correct because an inter-VDOM link only makes sense when the two endpoints reside in different VDOMs, allowing traffic to pass between isolated virtual domains. Option D is correct because the inter-VDOM link interface must be referenced in firewall policies on each VDOM to permit and control the traffic traversing the link. Option C is not required, since inter-VDOM links can operate with hardware acceleration enabled or disabled depending on the platform. Option E is not required, as inter-VDOM links function in NAT/route mode and are not tied to transparent mode operation.

Answer

Hardware acceleration must be disabled

Answer

The link must be in transparent mode

Question 18

An administrator must apply a specific UTM profile to traffic matching a custom application signature, but the signature is not recognized by the FortiGate. The administrator uploads a custom signature file via the CLI. Which command correctly loads the custom signature file into the IPS engine?

Accepted Answer

execute ips custom-signature import <filename>. Custom IPS signatures are loaded using the 'execute ips custom-signature import' command. This command reads a file from the FortiGate's local disk, parses the signatures, and adds them to the IPS engine. The other commands either do not exist or are not the correct method for importing a file. This ensures the custom signatures are available for use in IPS sensors and profiles.

Answer

config ips custom-signature; edit ; set signature ""; end

Answer

execute ips update custom-signature <filename>

Answer

config firewall custom-signature; edit ; set file ; end

Question 19

An administrator enables virtual clustering on a FortiGate HA pair with two VDOMs (root and vdom1). The primary unit is handling all traffic for both VDOMs. The administrator wants the secondary unit to actively process traffic for vdom1 while the primary continues processing root traffic. Which setting must be configured to achieve this?

Accepted Answer

Configure virtual clustering by assigning a priority and override setting for each VDOM in the HA configuration.. Virtual clustering in FortiGate HA enables per-VDOM primary selection. By configuring per-VDOM priority and override, the administrator can make the secondary unit the primary for vdom1 while the original primary remains primary for root. This provides load sharing and redundancy at the VDOM level, which is exactly what the scenario requires.

Answer

Enable session pickup and configure the secondary unit to forward traffic for vdom1 using a static route.

Answer

Set the HA mode to active-active and assign vdom1 to the secondary unit using the 'set vdom' command under the HA secondary configuration.

Answer

Set the HA mode to active-passive and use VDOM link to redirect traffic to the secondary unit.

Question 20

An administrator is configuring a FortiGate in transparent mode. They need to allow traffic between two VLANs that are on the same subnet but separated by the FortiGate. Which configuration is required to enable communication between these VLANs?

Accepted Answer

Add both VLANs to the same bridge group and create a firewall policy to allow traffic.. In transparent mode, the FortiGate forwards traffic at Layer 2. To allow communication between two VLANs on the same subnet, the FortiGate must bridge them. This is done by adding the VLAN interfaces to a bridge group. The bridge group acts as a virtual switch, and the FortiGate can then apply firewall policies to the bridged traffic. This configuration maintains the existing IP addressing and allows the FortiGate to inspect traffic without being a router.

Answer

Configure the FortiGate to operate in NAT/route mode instead of transparent mode.

Answer

Enable inter-VLAN routing on the FortiGate by creating a VLAN interface with an IP address.

Answer

Create a VLAN interface for each VLAN and assign them to the same VDOM, then create a firewall policy allowing traffic between them.