FORTINET-NSE7-SPECIALTY Practice Questions 2 — 50 Questions

Question 1

When creating an SD-WAN template, what must be defined before you can add an SD-WAN interface to the template?

Accepted Answer

Individual SD-WAN member interfaces. You must define the member interfaces within the template before referencing them in SD-WAN zones or rules.

Answer

The SD-WAN health check probes

Answer

Global firewall policies

Answer

The virtual domain (VDOM) settings

Question 2

Which THREE of the following are mandatory for a BGP neighbor adjacency to establish?

Accepted Answer

Correct autonomous system numbers. BGP requires the correct AS numbers, reachable IPs, and matching timers or specific parameters to form a connection.

Answer

Identical prefix lists

Answer

Identical router IDs

Question 3

What does the 'FortiGuard' service provide to the FortiGate?

Accepted Answer

Real-time threat intelligence and database updates. FortiGuard provides real-time updates for security signatures, including IPS, Antivirus, and Web Filtering.

Answer

User management and authentication

Answer

Local firmware storage

Answer

Hardware acceleration support

Question 4

Which administrative access type is recommended to be disabled on public-facing interfaces for security best practices?

Accepted Answer

HTTP. HTTP and Telnet are unencrypted protocols and should always be disabled on external interfaces.

Answer

SSH

Answer

HTTPS

Answer

SNMP

Question 5

In a VDOM-enabled environment, how are administrative accounts managed?

Accepted Answer

Admins can be scoped to specific VDOMs. Administrative accounts can be restricted to specific VDOMs (Global admin vs. VDOM admin) for granular access control.

Answer

Only the root VDOM admin can change settings

Answer

Admins must be global

Answer

All admins see all VDOMs

Question 6

You are configuring an IPsec VPN tunnel between two FortiGates. Phase 2 fails to come up. What is the most likely cause?

Accepted Answer

Mismatched Phase 2 selectors. Phase 2 failure is usually due to mismatched selectors (proxy IDs) or mismatched encryption/authentication algorithms.

Answer

Incorrect IKE version

Answer

Expired certificate

Answer

Mismatched pre-shared key

Question 7

Which TWO of the following are necessary to successfully deploy an SSL VPN in tunnel mode?

Accepted Answer

A valid SSL certificate for the VPN portal. Tunnel mode requires a configured portal and a policy allowing the VPN tunnel interface to the internal network.

Answer

An IPSec phase 1 configuration

Answer

A BGP session with the client

Answer

A dedicated hardware switch

Question 8

What is the default behavior for 'override' in FortiGate HA?

Accepted Answer

Disabled. Override is disabled by default to prevent unnecessary failbacks and flapping in the cluster.

Answer

Depends on the model

Answer

Enabled

Answer

Always enabled

Question 9

Which TWO of the following can be used to optimize IPsec VPN performance?

Accepted Answer

Ensure the configuration uses AES-NI supported ciphers. Hardware acceleration (ASIC) and selecting efficient encryption algorithms like AES-NI (hardware-accelerated AES) improve VPN throughput.

Answer

Increase the Phase 1 lifetime to 24 hours

Answer

Use DES encryption for speed

Answer

Disable NAT-Traversal

Question 10

When using an IPS sensor, what is the difference between 'Protect' and 'Monitor' mode?

Accepted Answer

Protect drops traffic; Monitor only logs it. 'Protect' drops the traffic if a signature matches, whereas 'Monitor' logs the hit without dropping the traffic.

Answer

Protect applies only to WAN; Monitor applies to LAN

Answer

Protect requires SSL inspection; Monitor does not

Answer

Protect logs traffic; Monitor drops it

Question 11

Which TWO settings are modified to reduce the impact of a failover event in an HA cluster?

Accepted Answer

hb-interval. 'hb-interval' and 'hb-lost-threshold' determine how quickly the cluster reacts to heartbeat loss.

Answer

group-password

Answer

priority

Answer

monitored-interfaces

Question 12

When configuring an IPsec tunnel using IKEv2, which THREE parameters are commonly negotiated during Phase 1?

Accepted Answer

Encryption algorithm (e.g., AES-256). IKEv2 negotiates encryption, integrity, and Diffie-Hellman groups during the initial exchange.

Answer

TCP port selection

Answer

Firewall policy ID

Question 13

What is the purpose of 'dedicated HA' interfaces?

Accepted Answer

To isolate heartbeat traffic. They isolate heartbeat traffic from data traffic to prevent jitter and ensure cluster stability.

Answer

To provide extra management access

Answer

To increase throughput

Answer

To act as a backup WAN port

Question 14

Which feature allows an administrator to offload SSL inspection to the hardware?

Accepted Answer

CP offloading. The FortiASIC CP (Content Processor) hardware chips are specifically designed to offload CPU-intensive tasks like SSL/TLS decryption.

Answer

Flow-based inspection

Answer

IPS engine offloading

Answer

NP6 offloading

Question 15

Which TWO methods are used to achieve traffic separation in a multi-VDOM environment?

Accepted Answer

Using VLAN sub-interfaces. Physical port assignment and VLAN tagging are the standard methods for segmenting traffic at the network edge in VDOMs.

Answer

Enabling SSL inspection globally

Answer

Using different HA clusters

Answer

Using different firmware versions

Question 16

If a FortiGate is in Active-Passive HA mode, what happens to the secondary device if the heartbeat is lost?

Accepted Answer

It initiates a master election. If heartbeat is lost, the secondary assumes the master is down and attempts to promote itself to primary if it has the higher priority or preemption settings configured.

Answer

It shuts down its interfaces

Answer

It enters standalone mode

Answer

It ignores the loss

Question 17

Which FortiGate feature is used to group multiple physical interfaces for redundancy at Layer 2?

Accepted Answer

802.3ad Aggregate. 802.3ad Link Aggregation (LACP) is the standard for binding physical ports into a single logical interface.

Answer

Loopback interface

Answer

SD-WAN

Answer

VLAN tagging

Question 18

You need to inspect traffic between two VDOMs. Which mechanism is required?

Accepted Answer

Inter-VDOM Link. Inter-VDOM links are virtual interfaces used to route traffic between distinct VDOMs, essentially creating a 'cable' between them.

Answer

Policy-based routing

Answer

Physical loopback cable

Answer

Static NAT

Question 19

Which command allows you to view the current routing table for a specific VDOM?

Accepted Answer

get router info routing-table all. The 'get router info' command is context-aware and must be prefixed with the VDOM scope or executed within the VDOM context.

Answer

get system routing

Answer

diag ip route

Answer

show router table

Question 20

Which THREE actions can be performed by the FortiGate when a policy match occurs?

Accepted Answer

Traffic Shaping. Firewall policies can accept, deny, or perform traffic shaping and logging depending on the configured profile settings.

Answer

Re-route to a specific switch port

Answer

Disable hardware acceleration