FORTINET-NSE7-SPECIALTY Hard Questions — 25 Difficult Questions

Question 1

In a BGP deployment, your FortiGate is receiving routes from two different ISPs. You want to influence outbound traffic to prefer ISP1 for specific destinations. Which BGP attribute should you modify?

Accepted Answer

Local Preference. Local Preference is used to influence outbound traffic selection within an AS.

Answer

Weight

Answer

AS-Path

Answer

Multi-Exit Discriminator (MED)

Question 2

You are configuring BGP and need to advertise a summary route to your ISP. How do you ensure only the summary route is advertised?

Accepted Answer

Use an aggregate-address with summary-only. The 'aggregate-address' command with the 'summary-only' option is the correct way to advertise only the summary and suppress specific component routes.

Answer

Use a distribute-list

Answer

Set the weight to 0

Answer

Configure a route map with a prefix list

Question 3

What is the effect of changing the IPS 'buffer' size on a FortiGate device?

Accepted Answer

It determines the maximum size of data packets to hold for inspection. Adjusting the IPS buffer affects how much data is held in memory for inspection, which can prevent packet drops during heavy traffic but increases memory load.

Answer

It disables the hardware acceleration engine

Answer

It changes the signature timeout

Answer

It increases the number of concurrent IPS connections

Question 4

A FortiManager administrator needs to ensure that logs from all enterprise FortiGates are aggregated and purged based on storage thresholds. Where is this configured?

Accepted Answer

FortiAnalyzer/Log Settings under Device Manager. The log retention and storage settings are managed in the FortiManager's 'FortiView' or 'Device Settings' regarding log management, specifically under 'Log Settings' where disk quota and retention policies are defined.

Answer

System settings under 'Network' tab

Answer

Global Policy settings

Answer

ADOM management settings

Question 5

In an OSPF setup, you have a redundant path. You want to ensure traffic prefers one link over another based on cost. Which OSPF command is used?

Accepted Answer

set ospf-cost. The OSPF cost is configured on the interface level to influence link preference.

Answer

set metric-type

Answer

set bandwidth-reference

Answer

set priority

Question 6

An administrator notices that logs are not appearing in FortiManager for a specific FortiGate. What is the first thing to check to ensure log forwarding is active?

Accepted Answer

Log forwarding configuration on the FortiGate. Checking the 'Log Settings' on the FortiGate to ensure the 'Remote Logging' feature is enabled and pointing to the correct FortiManager/FortiAnalyzer IP.

Answer

The FortiManager license

Answer

The device's physical connection

Answer

The firmware version of the FortiGate

Question 7

Which THREE features are specific to the FortiManager 'Enterprise Firewall' management workflow?

Accepted Answer

Object database management. Centralized policy management, object database management, and revision control are key parts of the enterprise workflow.

Answer

Traffic shaping on routers

Answer

Web filter database updates

Question 8

What happens if you modify an SD-WAN template that is already applied to a FortiGate?

Accepted Answer

The configuration status shows 'Modified' and requires an installation task. The change creates a configuration difference, which must be pushed to the device to take effect.

Answer

The changes take effect immediately without a push

Answer

The FortiGate automatically pulls the new config

Answer

The FortiGate configuration is reverted

Question 9

Which THREE items are included in the configuration file of a FortiGate?

Accepted Answer

User certificates. The configuration file contains system settings, policy rules, and interface definitions.

Answer

FortiGuard cached updates

Answer

Real-time session tables

Question 10

An administrator is troubleshooting an issue where hardware acceleration is not working after upgrading firmware. Which command identifies if the NP configuration has changed?

Accepted Answer

diag hardware npu np6 port-list. 'diag hardware npu np6 port-list' or similar status commands help verify the current operational state and mapping of physical ports to NPU cores.

Answer

config system npu

Answer

diagnose firewall npu

Answer

get hardware status

Question 11

You are troubleshooting a high CPU issue on a FortiGate. Which utility should you use to identify which process is consuming the most resources?

Accepted Answer

diagnose sys top. The 'get system performance status' command is the primary tool to see process-level CPU usage.

Answer

get system hardware status

Answer

diagnose sniffer packet

Answer

get router info memory

Question 12

Which THREE factors influence log storage efficiency on a FortiAnalyzer/FortiManager?

Accepted Answer

Log compression settings. Log compression, log retention settings, and disk quota management determine how long logs persist and how much space they consume.

Answer

The firewall firmware version

Answer

The number of active users

Question 13

In a high availability (HA) cluster, which THREE settings are synchronized between the primary and secondary units?

Accepted Answer

Address objects. HA synchronization ensures that policies, objects, and configurations are mirrored to provide seamless failover.

Answer

Hardware serial numbers

Answer

Management IP address

Question 14

An administrator needs to perform a firmware upgrade on 100 FortiGates. Which feature in FortiManager allows this to be done securely with a rollback option?

Accepted Answer

Firmware Management in Device Manager. The 'Firmware Management' feature in Device Manager allows for scheduled upgrades and provides options for managing firmware versions across groups.

Answer

Automated patch management

Answer

Manual script pushing

Answer

Global Policy upgrade task

Question 15

Which THREE steps are involved in the 'Policy Package Installation' workflow?

Accepted Answer

Select the target device. The workflow involves selecting the package, choosing the target device, and executing the installation (with a preview).

Answer

Perform a factory reset

Answer

Reboot the target device

Question 16

Which THREE items are included in a Policy Package when it is pushed from FortiManager?

Accepted Answer

Service Objects. Policy packages include firewall policies, address objects, and services used within those policies.

Answer

System interface settings

Answer

Routing tables

Question 17

You are managing FortiGates across multiple ADOMs. How can you share common firewall objects (e.g., mail servers, common IP ranges) across these ADOMs?

Accepted Answer

Create objects in the Global Database. Using the 'Global Database' or 'Global Policy' objects allows administrators to define objects once and share them across multiple ADOMs.

Answer

Manually copy objects to each ADOM

Answer

Use the API to script the creation in every ADOM

Answer

Enable 'Object Sharing' in system settings

Question 18

A FortiGate is performing OSPF routing. You want to redistribute connected routes into OSPF, but only for a specific subnet. How can this be achieved?

Accepted Answer

Use a route map in the OSPF redistribute configuration. A route map must be applied during redistribution to filter the prefixes being injected.

Answer

Configure a distribute-list in the OSPF process

Answer

Use an IP prefix list under the OSPF area command

Answer

Use an access list under the interface configuration

Question 19

Which THREE aspects of the FortiGate system are affected by changing the global 'set vdom-mode' to 'multi-vdom'?

Accepted Answer

CLI command hierarchy. Changing the VDOM mode affects the CLI hierarchy, the available memory for VDOMs, and how system resources are partitioned.

Answer

The HA cluster size

Answer

The physical port order

Question 20

Which THREE of the following are mandatory for a BGP neighbor adjacency to establish?

Accepted Answer

Correct autonomous system numbers. BGP requires the correct AS numbers, reachable IPs, and matching timers or specific parameters to form a connection.

Answer

Identical prefix lists

Answer

Identical router IDs