FORTINET-NSE7-SPECIALTY Nse7 Enterprise Firewall System Configuration — 20 Questions

Question 1

An administrator notices that hardware acceleration (NP6) is failing to offload traffic for a specific policy. Which command is best used to verify if hardware offloading is actually occurring for a specific session?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

diagnose sys session list. The command 'diagnose sys session list' displays the session table, including flags that indicate whether a session is offloaded to NP6 hardware. By inspecting the session entry, you can see if the 'offload' flag is set, confirming hardware acceleration for that specific session.

Answer

get hardware npu np6

Answer

get system performance status

Answer

diagnose npu np6 status

Question 2

You are configuring VDOMs on a FortiGate. Which operation requires the VDOMs to be in 'Split-Task' VDOM mode compared to 'Multi-VDOM' mode?

Accepted Answer

Enabling administrative separation. Split-Task mode is specifically used to divide management and data plane traffic tasks, often required for specific compliance or architecture isolation.

Answer

Applying firewall policies

Answer

Adding a new VDOM

Answer

Inter-VDOM routing

Question 3

You need to ensure that session synchronization between HA nodes is as efficient as possible. Which parameter should be tuned in the HA configuration?

Accepted Answer

session-pickup-delay. The session-pickup-delay parameter in HA configuration controls how long a secondary unit waits before taking over sessions after a failover, allowing the primary to potentially recover and preventing unnecessary session pickup. Tuning this delay optimizes session synchronization efficiency by avoiding premature takeover and reducing synchronization overhead during transient failures. The other parameters affect interface monitoring, failover override, and heartbeat frequency, but not session sync efficiency directly.

Answer

monitor-interface

Answer

override

Answer

heartbeat-interval

Question 4

When configuring an aggregate interface (LACP) on a FortiGate, which mode must be set to ensure traffic is distributed across links based on source and destination IP?

Accepted Answer

Hash algorithm L4. The 'LACP-mode' set to 'active' or 'passive' relates to negotiation, but the distribution algorithm is governed by the 'dst-mac' or 'ip' hash settings in the interface configuration.

Answer

VLAN tagging

Answer

Interface mirroring

Answer

LACP mode active

Question 5

An administrator is troubleshooting an issue where hardware acceleration is not working after upgrading firmware. Which command identifies if the NP configuration has changed?

Accepted Answer

diag hardware npu np6 port-list. The command `diag hardware npu np6 port-list` displays the current NP6 port configuration, including which ports are assigned to the NP6 and their operational status. After a firmware upgrade, NP configurations can be reset or altered, and this command directly shows if the NP6 port mapping has changed, which is critical for hardware acceleration. It is the correct diagnostic to identify such changes because it queries the NPU hardware state, not just the configuration file.

Answer

config system npu

Answer

diagnose firewall npu

Answer

get hardware status

Question 6

If a FortiGate is in Active-Passive HA mode, what happens to the secondary device if the heartbeat is lost?

Accepted Answer

It initiates a master election. In Active-Passive HA, if the secondary device loses heartbeat from the primary, it assumes the primary has failed and initiates a master election to take over the active role. This is the designed failover behavior: the secondary promotes itself to primary and begins forwarding traffic, ensuring continuity. It does not shut down interfaces, enter standalone mode, or ignore the loss.

Answer

It shuts down its interfaces

Answer

It enters standalone mode

Answer

It ignores the loss

Question 7

Which CLI command shows the current HA synchronization status and the checksums of the configurations?

Accepted Answer

get system ha status. The command 'get system ha status' displays the current HA synchronization status, including the cluster members, their priorities, and the configuration checksums that indicate whether the configurations are in sync. It is the standard CLI command for verifying HA health and sync state.

Answer

diag hardware ha

Answer

show system ha

Answer

diagnose sys ha sync

Question 8

Which administrative access type is recommended to be disabled on public-facing interfaces for security best practices?

Accepted Answer

HTTP. HTTP (plaintext, port 80) should be disabled on public-facing interfaces because it transmits credentials and session data in cleartext, making it vulnerable to interception. Fortinet best practice recommends using HTTPS (port 443) for administrative access instead, which encrypts the session.

Answer

SSH

Answer

HTTPS

Answer

SNMP

Question 9

When using 'set session-ttl' globally, which sessions are affected?

Accepted Answer

Only new sessions. Global session TTL settings apply to all sessions that do not have a specific override or a policy-based setting.

Answer

All sessions

Answer

Only TCP sessions

Answer

Only existing sessions

Question 10

Which feature allows an administrator to offload SSL inspection to the hardware?

Accepted Answer

CP offloading. CP offloading refers to Content Processor offload, where the FortiGate's CP (Content Processor) ASIC handles SSL/TLS inspection tasks such as bulk encryption/decryption, freeing the main CPU. This is the feature that accelerates SSL inspection by moving cryptographic operations to dedicated hardware. NP6 offloading handles network-layer fast-path forwarding, not SSL inspection, and flow-based inspection is a mode, not an offload mechanism.

Answer

Flow-based inspection

Answer

IPS engine offloading

Answer

NP6 offloading

Question 11

Which TWO protocols are supported by the FortiGate for heartbeat synchronization between HA nodes?

Accepted Answer

IP (Non-UDP/TCP). Option C (IP (Non-UDP/TCP)) is correct because FortiGate HA heartbeat can be sent as raw IP protocol packets (protocol number 0 or a configured IP protocol) directly between HA members without using TCP or UDP transport, which is one of the supported heartbeat transport modes. Option E (Ethernet (Native)) is correct because FortiGate HA supports layer-2 native Ethernet heartbeat frames sent directly between HA interfaces, allowing heartbeat traffic without IP encapsulation. Options A (SNMP), B (TCP/443), and D (UDP/514) are incorrect because SNMP is a monitoring/management protocol, TCP/443 is HTTPS management traffic, and UDP/514 is syslog — none of these are FortiGate HA heartbeat synchronization protocols.

Answer

SNMP

Answer

TCP/443

Answer

UDP/514

Question 12

Which THREE factors influence the Master election in an HA cluster?

Accepted Answer

Uptime (if priority is equal). In an HA cluster, the Master election is determined first by Device Priority (D): the firewall with the lower numerical priority value becomes the Master, so this is a primary election factor. If priorities are equal, Uptime (C) breaks the tie, with the device that has been up longer winning the election. Monitor interface status (E) also influences the election because a device whose monitored interfaces are down can be forced to give up the Master role (failover), so link/interface health directly affects which device holds Master. CPU load (A) is not an election criterion, since HA does not compare processor utilization between peers. Device Hostname (B) is also not used, as the hostname has no bearing on priority, uptime, or monitored-interface state during Master selection.

Answer

CPU load

Answer

Device Hostname

Question 13

Which THREE conditions must be met for a successful Inter-VDOM link?

Accepted Answer

IP addresses in the same subnet. For a successful Inter-VDOM link, option A is correct because the two ends of the link (the virtual interfaces in each VDOM) must have IP addresses in the same subnet so they can communicate at Layer 3 without routing ambiguity. Option B is correct because an Inter-VDOM link by definition connects two different VDOMs; if both interfaces were in the same VDOM, it would not be an Inter-VDOM link. Option D is correct because after creating the link and assigning interfaces, firewall policies must be added on each VDOM to permit traffic to traverse the Inter-VDOM link, otherwise traffic is dropped by the implicit deny. Option C is not required: hardware acceleration (NP offload) does not need to be disabled for an Inter-VDOM link to function. Option E is not required: Inter-VDOM links operate in NAT/route mode with IP addressing, not transparent mode.

Answer

Hardware acceleration must be disabled

Answer

The link must be in transparent mode

Question 14

A FortiGate 600E is deployed in a multi-VDOM configuration. The administrator needs to completely isolate the management plane of the 'root' VDOM from a 'tenant1' VDOM so that an administrator logged into 'tenant1' cannot view or modify 'root' interfaces, even if they have super_admin profile. Which action accomplishes this?

Accepted Answer

Create a restricted administrative profile scoped to 'tenant1' and assign it to the tenant1 administrator account.. Management plane isolation in multi-VDOM mode is enforced by administrative profiles that are scoped to specific VDOMs. A profile scoped to tenant1 grants rights only within that VDOM, so the tenant1 administrator cannot see or change root VDOM objects. Global-scoped profiles or global settings like management-vdom do not restrict an administrator's view across VDOMs.

Answer

Enable 'set vdom-admin enable' under system global to enforce strict VDOM separation for administrators.

Answer

Configure an administrative profile with 'set scope global' and assign it only to the tenant1 administrator.

Answer

Enable 'set management-vdom enable' under system global and assign a dedicated management VDOM.

Question 15

What is the impact of changing the 'set vdom-mode' from 'no-vdom' to 'multi-vdom'?

Accepted Answer

System reboot required. Changing 'set vdom-mode' from 'no-vdom' to 'multi-vdom' requires a reboot because the FortiGate must reinitialize its configuration database and process architecture to support multiple virtual domains. VDOM mode is a global system setting that affects how interfaces, policies, routing tables, and admin domains are partitioned, so the change cannot be applied live. After the reboot, the default 'root' VDOM is created and the previous global configuration is migrated into it.

Answer

Automatic disablement of HA

Answer

Loss of all firewall policies

Answer

No impact, immediate change

Question 16

A FortiGate is operating in transparent mode. What is the default behavior when the device receives a frame with an unknown MAC address?

Accepted Answer

Flood to all ports. In transparent mode, a FortiGate acts as a Layer 2 bridge and learns MAC addresses from incoming frames. When it receives a frame destined for a MAC address not present in its forwarding table (unknown unicast), the default behavior is to flood the frame out all ports in the same broadcast domain except the ingress port — standard Ethernet bridge behavior. This ensures the frame reaches its destination even before the MAC is learned.

Answer

Drop the packet

Answer

Forward to the management interface

Answer

Send an ICMP unreachable message

Question 17

A network administrator is configuring an HA cluster with two FortiGates in Active-Passive mode. Which parameter must be identical on both devices to ensure a successful cluster formation?

Accepted Answer

HA Group ID. In a FortiGate HA cluster, the HA Group ID (also called group-id) must be identical on all devices for them to form a cluster. The group ID is used to distinguish clusters on the same network and ensures that only devices with the same group ID can join the same cluster. Without a matching group ID, the devices will not form an HA cluster even if other settings match.

Answer

Device Hostname

Answer

Serial Number

Answer

Priority value

Question 18

What is the purpose of 'dedicated HA' interfaces?

Accepted Answer

To isolate heartbeat traffic. Dedicated HA interfaces are physical ports reserved exclusively for HA heartbeat and synchronization traffic between cluster members. By isolating heartbeat traffic on its own link, the cluster avoids contention with user data and prevents heartbeat packets from being delayed or dropped by heavy production traffic, which could trigger false failovers. This separation is why Fortinet recommends dedicated heartbeat ports in Active-Passive and Active-Active deployments.

Answer

To provide extra management access

Answer

To increase throughput

Answer

To act as a backup WAN port

Question 19

You need to inspect traffic between two VDOMs. Which mechanism is required?

Accepted Answer

Inter-VDOM Link. An Inter-VDOM Link is the virtual interface pair that connects two VDOMs on the same FortiGate, allowing traffic to pass between them. Each VDOM gets one end of the link, and firewall policies on both VDOMs control what traffic is permitted. Without an Inter-VDOM Link, VDOMs are fully isolated and cannot exchange traffic. Policy-based routing, physical loopback cables, and static NAT do not provide inter-VDOM connectivity.

Answer

Policy-based routing

Answer

Physical loopback cable

Answer

Static NAT

Question 20

Which parameter, when modified in a policy, causes a session flush for all active connections hitting that policy?

Accepted Answer

Action (Accept to Deny). Changing the Action of a policy from Accept to Deny alters the fundamental handling of traffic that matches the policy. FortiOS must immediately tear down existing sessions that were permitted under the previous Accept action, because they are no longer authorized. This forces all active connections hitting that policy to be flushed and re-evaluated against the new Deny action.

Answer

Schedule

Answer

Comments field

Answer

Policy Name