FORTINET-NSE7-SPECIALTY Practice Test 8 — 10 Questions

Question 1

Which THREE factors influence the Master election in an HA cluster?

Accepted Answer

Uptime (if priority is equal). The election process considers the monitor status, the override setting, and the priority values of the devices.

Answer

CPU load

Answer

Device Hostname

Question 2

What is the benefit of using 'SD-WAN Zones' in templates when managing 100+ branches?

Accepted Answer

They allow for easier mapping to physical ports across different hardware models. Zones allow you to assign generic names to interfaces, so the template can refer to 'WAN_ZONE' rather than specific port names.

Answer

They allow for multiple internet service providers

Answer

They automatically configure static routes

Answer

They increase the speed of the internet connection

Question 3

An administrator notices that hardware acceleration (NP6) is failing to offload traffic for a specific policy. Which command is best used to verify if hardware offloading is actually occurring for a specific session?

Accepted Answer

diagnose sys session list. The command 'diag sys session filter' combined with 'diag sys session list' allows the administrator to view session flags, specifically looking for the 'offload' flag.

Answer

get hardware npu np6

Answer

get system performance status

Answer

diagnose npu np6 status

Question 4

Which parameter, when modified in a policy, causes a session flush for all active connections hitting that policy?

Accepted Answer

Action (Accept to Deny). Changing critical security profile settings or specific policy parameters that affect the session tuple typically triggers a session flush to ensure consistent security enforcement.

Answer

Schedule

Answer

Comments field

Answer

Policy Name

Question 5

Which configuration mode allows you to define a virtual MAC address for an HA cluster to prevent ARP cache issues on switches?

Accepted Answer

Virtual MAC. The 'ha-mgmt-status' and virtual MAC features ensure that the cluster presents a consistent MAC regardless of which node is master.

Answer

DHCP relay

Answer

Static ARP

Answer

Physical MAC

Question 6

During SD-WAN template deployment, what is the role of 'Dynamic Mapping'?

Accepted Answer

To map a single template object to different physical settings on different devices. Dynamic mapping allows you to map a single template object to different physical values (like interface names) on different FortiGate devices.

Answer

To automate firmware updates

Answer

To monitor bandwidth usage

Answer

To dynamically change the SD-WAN rule based on time

Answer

To calculate the latency of paths

Question 7

What is required before FortiManager can display SD-WAN monitoring data?

Accepted Answer

The FortiGate must be sending logs to FortiManager. FortiManager must be configured to receive logs from the FortiGate, and 'Log to FortiManager' must be enabled on the FortiGate.

Answer

The FortiGate must have a cloud license

Answer

The FortiGate must be running a specific firmware

Answer

The FortiGate must be in Transparent mode

Question 8

An IPsec VPN tunnel used as an SD-WAN member is experiencing intermittent flapping due to DPD (Dead Peer Detection) timeout issues over a high-latency satellite link. How should the administrator adjust the Phase 1 IPsec settings on FortiOS to stabilize the tunnel without completely disabling failure detection?

Accepted Answer

Increase the DPD retry count and interval settings under the IPsec Phase 1 configuration. On high-latency or high-jitter links like satellite connections, the default DPD retry count and interval may be too aggressive. Increasing the DPD retry count and/or interval or switching the DPD mode to 'on-idle' or 'on-demand' helps prevent false drops.

Answer

Disable DPD entirely so the FortiGate never tears down the tunnel

Answer

Enable NP6/NP7 hardware offloading for Phase 1 SA renegotiation

Answer

Change the IPsec phase 1 mode from Main mode to Aggressive mode

Question 9

Which TWO of the following can be used as a 'Source' in an SD-WAN rule?

Accepted Answer

Source IP address object.. SD-WAN rules can match traffic based on source IP addresses or specific user groups.

Answer

SLA target name.

Answer

Interface MAC address.

Answer

Firewall policy ID.

Question 10

When using SD-WAN, how does the 'member' configuration interact with physical interfaces?

Accepted Answer

Members are logical groups of interfaces. SD-WAN members are physical interfaces (or tunnels) added to the SD-WAN zone, allowing the FortiGate to manage them as a single logical pool.

Answer

Members replace the IP configuration

Answer

Members require a separate VDOM

Answer

Members must have DHCP enabled