FORTINET-NSE7-SPECIALTY Nse7 Enterprise Firewall System Configuration — 10 Questions

Question 1

An administrator notices that hardware acceleration (NP6) is failing to offload traffic for a specific policy. Which command is best used to verify if hardware offloading is actually occurring for a specific session?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

diagnose sys session list. The command 'diagnose sys session list' displays the session table, including flags that indicate whether a session is offloaded to NP6 hardware. By inspecting the session entry, you can see if the 'offload' flag is set, confirming hardware acceleration for that specific session.

Answer

get hardware npu np6

Answer

get system performance status

Answer

diagnose npu np6 status

Question 2

You are configuring VDOMs on a FortiGate. Which operation requires the VDOMs to be in 'Split-Task' VDOM mode compared to 'Multi-VDOM' mode?

Accepted Answer

Enabling administrative separation. Split-Task mode is specifically used to divide management and data plane traffic tasks, often required for specific compliance or architecture isolation.

Answer

Applying firewall policies

Answer

Adding a new VDOM

Answer

Inter-VDOM routing

Question 3

You need to ensure that session synchronization between HA nodes is as efficient as possible. Which parameter should be tuned in the HA configuration?

Accepted Answer

session-pickup-delay. The session-pickup-delay parameter in HA configuration controls how long a secondary unit waits before taking over sessions after a failover, allowing the primary to potentially recover and preventing unnecessary session pickup. Tuning this delay optimizes session synchronization efficiency by avoiding premature takeover and reducing synchronization overhead during transient failures. The other parameters affect interface monitoring, failover override, and heartbeat frequency, but not session sync efficiency directly.

Answer

monitor-interface

Answer

override

Answer

heartbeat-interval

Question 4

When configuring an aggregate interface (LACP) on a FortiGate, which mode must be set to ensure traffic is distributed across links based on source and destination IP?

Accepted Answer

Hash algorithm L4. The 'LACP-mode' set to 'active' or 'passive' relates to negotiation, but the distribution algorithm is governed by the 'dst-mac' or 'ip' hash settings in the interface configuration.

Answer

VLAN tagging

Answer

Interface mirroring

Answer

LACP mode active

Question 5

An administrator is troubleshooting an issue where hardware acceleration is not working after upgrading firmware. Which command identifies if the NP configuration has changed?

Accepted Answer

diag hardware npu np6 port-list. The command `diag hardware npu np6 port-list` displays the current NP6 port configuration, including which ports are assigned to the NP6 and their operational status. After a firmware upgrade, NP configurations can be reset or altered, and this command directly shows if the NP6 port mapping has changed, which is critical for hardware acceleration. It is the correct diagnostic to identify such changes because it queries the NPU hardware state, not just the configuration file.

Answer

config system npu

Answer

diagnose firewall npu

Answer

get hardware status

Question 6

If a FortiGate is in Active-Passive HA mode, what happens to the secondary device if the heartbeat is lost?

Accepted Answer

It initiates a master election. In Active-Passive HA, if the secondary device loses heartbeat from the primary, it assumes the primary has failed and initiates a master election to take over the active role. This is the designed failover behavior: the secondary promotes itself to primary and begins forwarding traffic, ensuring continuity. It does not shut down interfaces, enter standalone mode, or ignore the loss.

Answer

It shuts down its interfaces

Answer

It enters standalone mode

Answer

It ignores the loss

Question 7

Which CLI command shows the current HA synchronization status and the checksums of the configurations?

Accepted Answer

get system ha status. The command 'get system ha status' displays the current HA synchronization status, including the cluster members, their priorities, and the configuration checksums that indicate whether the configurations are in sync. It is the standard CLI command for verifying HA health and sync state.

Answer

diag hardware ha

Answer

show system ha

Answer

diagnose sys ha sync

Question 8

Which administrative access type is recommended to be disabled on public-facing interfaces for security best practices?

Accepted Answer

HTTP. HTTP (plaintext, port 80) should be disabled on public-facing interfaces because it transmits credentials and session data in cleartext, making it vulnerable to interception. Fortinet best practice recommends using HTTPS (port 443) for administrative access instead, which encrypts the session.

Answer

SSH

Answer

HTTPS

Answer

SNMP

Question 9

When using 'set session-ttl' globally, which sessions are affected?

Accepted Answer

Only new sessions. Global session TTL settings apply to all sessions that do not have a specific override or a policy-based setting.

Answer

All sessions

Answer

Only TCP sessions

Answer

Only existing sessions

Question 10

Which feature allows an administrator to offload SSL inspection to the hardware?

Accepted Answer

CP offloading. CP offloading refers to Content Processor offload, where the FortiGate's CP (Content Processor) ASIC handles SSL/TLS inspection tasks such as bulk encryption/decryption, freeing the main CPU. This is the feature that accelerates SSL inspection by moving cryptographic operations to dedicated hardware. NP6 offloading handles network-layer fast-path forwarding, not SSL inspection, and flow-based inspection is a mode, not an offload mechanism.

Answer

Flow-based inspection

Answer

IPS engine offloading

Answer

NP6 offloading