FORTINET-NSE7-SPECIALTY Practice Test 3 — 30 Questions

Question 1

Which TWO settings are modified to reduce the impact of a failover event in an HA cluster?

Accepted Answer

hb-interval. 'hb-interval' and 'hb-lost-threshold' determine how quickly the cluster reacts to heartbeat loss.

Answer

group-password

Answer

priority

Answer

monitored-interfaces

Question 2

When configuring an IPsec tunnel using IKEv2, which THREE parameters are commonly negotiated during Phase 1?

Accepted Answer

Encryption algorithm (e.g., AES-256). IKEv2 negotiates encryption, integrity, and Diffie-Hellman groups during the initial exchange.

Answer

TCP port selection

Answer

Firewall policy ID

Question 3

What is the purpose of 'dedicated HA' interfaces?

Accepted Answer

To isolate heartbeat traffic. They isolate heartbeat traffic from data traffic to prevent jitter and ensure cluster stability.

Answer

To provide extra management access

Answer

To increase throughput

Answer

To act as a backup WAN port

Question 4

Which feature allows an administrator to offload SSL inspection to the hardware?

Accepted Answer

CP offloading. The FortiASIC CP (Content Processor) hardware chips are specifically designed to offload CPU-intensive tasks like SSL/TLS decryption.

Answer

Flow-based inspection

Answer

IPS engine offloading

Answer

NP6 offloading

Question 5

Which TWO methods are used to achieve traffic separation in a multi-VDOM environment?

Accepted Answer

Using VLAN sub-interfaces. Physical port assignment and VLAN tagging are the standard methods for segmenting traffic at the network edge in VDOMs.

Answer

Enabling SSL inspection globally

Answer

Using different HA clusters

Answer

Using different firmware versions

Question 6

If a FortiGate is in Active-Passive HA mode, what happens to the secondary device if the heartbeat is lost?

Accepted Answer

It initiates a master election. If heartbeat is lost, the secondary assumes the master is down and attempts to promote itself to primary if it has the higher priority or preemption settings configured.

Answer

It shuts down its interfaces

Answer

It enters standalone mode

Answer

It ignores the loss

Question 7

Which FortiGate feature is used to group multiple physical interfaces for redundancy at Layer 2?

Accepted Answer

802.3ad Aggregate. 802.3ad Link Aggregation (LACP) is the standard for binding physical ports into a single logical interface.

Answer

Loopback interface

Answer

SD-WAN

Answer

VLAN tagging

Question 8

You need to inspect traffic between two VDOMs. Which mechanism is required?

Accepted Answer

Inter-VDOM Link. Inter-VDOM links are virtual interfaces used to route traffic between distinct VDOMs, essentially creating a 'cable' between them.

Answer

Policy-based routing

Answer

Physical loopback cable

Answer

Static NAT

Question 9

Which command allows you to view the current routing table for a specific VDOM?

Accepted Answer

get router info routing-table all. The 'get router info' command is context-aware and must be prefixed with the VDOM scope or executed within the VDOM context.

Answer

get system routing

Answer

diag ip route

Answer

show router table

Question 10

Which THREE actions can be performed by the FortiGate when a policy match occurs?

Accepted Answer

Traffic Shaping. Firewall policies can accept, deny, or perform traffic shaping and logging depending on the configured profile settings.

Answer

Re-route to a specific switch port

Answer

Disable hardware acceleration

Question 11

Which THREE factors influence the Master election in an HA cluster?

Accepted Answer

Uptime (if priority is equal). The election process considers the monitor status, the override setting, and the priority values of the devices.

Answer

CPU load

Answer

Device Hostname

Question 12

What is the benefit of using 'SD-WAN Zones' in templates when managing 100+ branches?

Accepted Answer

They allow for easier mapping to physical ports across different hardware models. Zones allow you to assign generic names to interfaces, so the template can refer to 'WAN_ZONE' rather than specific port names.

Answer

They allow for multiple internet service providers

Answer

They automatically configure static routes

Answer

They increase the speed of the internet connection

Question 13

An administrator notices that hardware acceleration (NP6) is failing to offload traffic for a specific policy. Which command is best used to verify if hardware offloading is actually occurring for a specific session?

Accepted Answer

diagnose sys session list. The command 'diag sys session filter' combined with 'diag sys session list' allows the administrator to view session flags, specifically looking for the 'offload' flag.

Answer

get hardware npu np6

Answer

get system performance status

Answer

diagnose npu np6 status

Question 14

Which parameter, when modified in a policy, causes a session flush for all active connections hitting that policy?

Accepted Answer

Action (Accept to Deny). Changing critical security profile settings or specific policy parameters that affect the session tuple typically triggers a session flush to ensure consistent security enforcement.

Answer

Schedule

Answer

Comments field

Answer

Policy Name

Question 15

Which configuration mode allows you to define a virtual MAC address for an HA cluster to prevent ARP cache issues on switches?

Accepted Answer

Virtual MAC. The 'ha-mgmt-status' and virtual MAC features ensure that the cluster presents a consistent MAC regardless of which node is master.

Answer

DHCP relay

Answer

Static ARP

Answer

Physical MAC

Question 16

During SD-WAN template deployment, what is the role of 'Dynamic Mapping'?

Accepted Answer

To map a single template object to different physical settings on different devices. Dynamic mapping allows you to map a single template object to different physical values (like interface names) on different FortiGate devices.

Answer

To automate firmware updates

Answer

To monitor bandwidth usage

Answer

To dynamically change the SD-WAN rule based on time

Answer

To calculate the latency of paths

Question 17

What is required before FortiManager can display SD-WAN monitoring data?

Accepted Answer

The FortiGate must be sending logs to FortiManager. FortiManager must be configured to receive logs from the FortiGate, and 'Log to FortiManager' must be enabled on the FortiGate.

Answer

The FortiGate must have a cloud license

Answer

The FortiGate must be running a specific firmware

Answer

The FortiGate must be in Transparent mode

Question 18

An IPsec VPN tunnel used as an SD-WAN member is experiencing intermittent flapping due to DPD (Dead Peer Detection) timeout issues over a high-latency satellite link. How should the administrator adjust the Phase 1 IPsec settings on FortiOS to stabilize the tunnel without completely disabling failure detection?

Accepted Answer

Increase the DPD retry count and interval settings under the IPsec Phase 1 configuration. On high-latency or high-jitter links like satellite connections, the default DPD retry count and interval may be too aggressive. Increasing the DPD retry count and/or interval or switching the DPD mode to 'on-idle' or 'on-demand' helps prevent false drops.

Answer

Disable DPD entirely so the FortiGate never tears down the tunnel

Answer

Enable NP6/NP7 hardware offloading for Phase 1 SA renegotiation

Answer

Change the IPsec phase 1 mode from Main mode to Aggressive mode

Question 19

Which TWO of the following can be used as a 'Source' in an SD-WAN rule?

Accepted Answer

Source IP address object.. SD-WAN rules can match traffic based on source IP addresses or specific user groups.

Answer

SLA target name.

Answer

Interface MAC address.

Answer

Firewall policy ID.

Question 20

When using SD-WAN, how does the 'member' configuration interact with physical interfaces?

Accepted Answer

Members are logical groups of interfaces. SD-WAN members are physical interfaces (or tunnels) added to the SD-WAN zone, allowing the FortiGate to manage them as a single logical pool.

Answer

Members replace the IP configuration

Answer

Members require a separate VDOM

Answer

Members must have DHCP enabled