FORTINET-NSE7-SPECIALTY Nse7 Enterprise Firewall System Configuration Practice Test 2 — 15 Questions

Question 1

A FortiGate is operating in transparent mode. What is the default behavior when the device receives a frame with an unknown MAC address?

Accepted Answer

Flood to all ports. In transparent mode, a FortiGate acts as a Layer 2 bridge and learns MAC addresses from incoming frames. When it receives a frame destined for a MAC address not present in its forwarding table (unknown unicast), the default behavior is to flood the frame out all ports in the same broadcast domain except the ingress port — standard Ethernet bridge behavior. This ensures the frame reaches its destination even before the MAC is learned.

Answer

Drop the packet

Answer

Forward to the management interface

Answer

Send an ICMP unreachable message

Question 2

A network administrator is configuring an HA cluster with two FortiGates in Active-Passive mode. Which parameter must be identical on both devices to ensure a successful cluster formation?

Accepted Answer

HA Group ID. In a FortiGate HA cluster, the HA Group ID (also called group-id) must be identical on all devices for them to form a cluster. The group ID is used to distinguish clusters on the same network and ensures that only devices with the same group ID can join the same cluster. Without a matching group ID, the devices will not form an HA cluster even if other settings match.

Answer

Device Hostname

Answer

Serial Number

Answer

Priority value

Question 3

What is the purpose of 'dedicated HA' interfaces?

Accepted Answer

To isolate heartbeat traffic. Dedicated HA interfaces are physical ports reserved exclusively for HA heartbeat and synchronization traffic between cluster members. By isolating heartbeat traffic on its own link, the cluster avoids contention with user data and prevents heartbeat packets from being delayed or dropped by heavy production traffic, which could trigger false failovers. This separation is why Fortinet recommends dedicated heartbeat ports in Active-Passive and Active-Active deployments.

Answer

To provide extra management access

Answer

To increase throughput

Answer

To act as a backup WAN port

Question 4

You need to inspect traffic between two VDOMs. Which mechanism is required?

Accepted Answer

Inter-VDOM Link. An Inter-VDOM Link is the virtual interface pair that connects two VDOMs on the same FortiGate, allowing traffic to pass between them. Each VDOM gets one end of the link, and firewall policies on both VDOMs control what traffic is permitted. Without an Inter-VDOM Link, VDOMs are fully isolated and cannot exchange traffic. Policy-based routing, physical loopback cables, and static NAT do not provide inter-VDOM connectivity.

Answer

Policy-based routing

Answer

Physical loopback cable

Answer

Static NAT

Question 5

Which parameter, when modified in a policy, causes a session flush for all active connections hitting that policy?

Accepted Answer

Action (Accept to Deny). Changing the Action of a policy from Accept to Deny alters the fundamental handling of traffic that matches the policy. FortiOS must immediately tear down existing sessions that were permitted under the previous Accept action, because they are no longer authorized. This forces all active connections hitting that policy to be flushed and re-evaluated against the new Deny action.

Answer

Schedule

Answer

Comments field

Answer

Policy Name

Question 6

When using SD-WAN, how does the 'member' configuration interact with physical interfaces?

Accepted Answer

Members are logical groups of interfaces. In FortiGate SD-WAN, a 'member' is a logical construct that binds a physical (or VLAN) interface into the SD-WAN virtual interface (virtual-wan-link). The member does not replace the interface's IP configuration — it references the underlying interface, which retains its own IP, gateway, and DHCP settings. Members are essentially logical groupings that let the SD-WAN engine treat multiple WAN links as a single logical egress.

Answer

Members replace the IP configuration

Answer

Members require a separate VDOM

Answer

Members must have DHCP enabled

Question 7

You are troubleshooting high CPU usage on a FortiGate. Which process would you check to see if the IPS engine is the cause?

Accepted Answer

diag sys top. The 'diagnose sys top' command displays real-time CPU and memory usage per process on the FortiGate, allowing you to identify if the IPS engine (often shown as 'ipsengine') is consuming excessive CPU. This is the standard tool for process-level CPU troubleshooting.

Answer

get system status

Answer

diagnose hardware status

Answer

show sys resource

Question 8

What is the default behavior for 'override' in FortiGate HA?

Accepted Answer

Disabled. In FortiGate HA, the 'override' setting is disabled by default. When disabled, the primary unit is selected based on the highest priority value, but if a higher-priority unit joins later it will not automatically preempt the current primary. Enabling override allows a unit with a higher priority to take over the primary role when it comes online.

Answer

Depends on the model

Answer

Enabled

Answer

Always enabled

Question 9

What does the 'set tcp-rst-timeout' command control?

Accepted Answer

The time to wait after sending a reset. The 'set tcp-rst-timeout' command defines how long the FortiGate keeps a session entry alive after it sends a TCP RST (reset) packet to tear down the connection. This allows the firewall to continue matching any stray packets belonging to that session for the specified duration, preventing them from being treated as new sessions. It is a session-cleanup timer, not a handshake or idle timer.

Answer

The TCP handshake timeout

Answer

The maximum session duration

Answer

The time before an idle session is dropped

Question 10

Which FortiGate feature is used to group multiple physical interfaces for redundancy at Layer 2?

Accepted Answer

802.3ad Aggregate. 802.3ad Aggregate is the FortiGate feature that bundles multiple physical interfaces into a single logical link using the IEEE 802.3ad Link Aggregation Control Protocol (LACP). This provides Layer 2 redundancy and increased bandwidth: if one member link fails, traffic continues over the remaining links. Loopback, SD-WAN, and VLAN tagging do not provide Layer 2 link redundancy.

Answer

Loopback interface

Answer

SD-WAN

Answer

VLAN tagging

Question 11

Which command allows you to view the current routing table for a specific VDOM?

Accepted Answer

get router info routing-table all. On FortiGate, the routing table for a specific VDOM is inspected with 'get router info routing-table all' executed inside that VDOM context. This command dumps all routes (connected, static, and dynamic) in the RIB for the active VDOM, which is essential when troubleshooting inter-VDOM or per-VDOM routing issues.

Answer

get system routing

Answer

diag ip route

Answer

show router table

Question 12

In a VDOM-enabled environment, how are administrative accounts managed?

Accepted Answer

Admins can be scoped to specific VDOMs. In a VDOM-enabled FortiGate, administrative accounts can be scoped to specific VDOMs, allowing granular delegation of management. An admin can be assigned to a single VDOM, multiple VDOMs, or all VDOMs (global), depending on the profile and requirements. This enables multi-tenant or departmental separation of duties.

Answer

Only the root VDOM admin can change settings

Answer

Admins must be global

Answer

All admins see all VDOMs

Question 13

Which configuration mode allows you to define a virtual MAC address for an HA cluster to prevent ARP cache issues on switches?

Accepted Answer

Virtual MAC. In a FortiGate HA cluster, configuring a virtual MAC address ensures that the cluster's interfaces present a consistent MAC address to the network, regardless of which unit is active. This prevents ARP cache issues on switches and routers, as they see the same MAC for the cluster IP even after a failover. The virtual MAC is defined under the HA configuration and is used by the primary unit to send gratuitous ARP updates.

Answer

DHCP relay

Answer

Static ARP

Answer

Physical MAC

Question 14

Which TWO actions should be taken when preparing to upgrade a FortiGate HA cluster?

Accepted Answer

Review release notes. Option A (Review release notes) is correct because Fortinet release notes document the supported upgrade path, firmware version compatibility, and known issues that must be checked before upgrading an HA cluster to avoid breaking the cluster or losing configuration. Option C (Backup the configuration) is correct because a full configuration backup (e.g., via System > Backup or 'execute backup config') provides a rollback point in case the upgrade fails or the cluster does not re-form properly. Option B is not required because clearing all sessions is not a prerequisite for an HA upgrade and would disrupt traffic unnecessarily. Option D is incorrect because disabling heartbeat interfaces would break HA communication and cause a split-brain or cluster failure. Option E is incorrect because changing HA mode to Standalone is not part of the upgrade procedure and would defeat the purpose of upgrading an HA cluster.

Answer

Clear all sessions

Answer

Disable heartbeat interfaces

Answer

Change HA mode to Standalone

Question 15

Which TWO components are synchronized between HA members?

Accepted Answer

Active session table. In an HA (High Availability) cluster, the two members synchronize the active session table (option B) so that if a failover occurs, existing sessions can continue without being dropped, since session state is replicated to the standby unit. They also synchronize the configuration database (option E), ensuring both members share identical policy, object, and system settings so the standby can take over seamlessly. Administrator credentials are part of the configuration and are not synchronized as a separate component, local log files (option C) are not synchronized between HA peers, and firmware images (option D) are not synchronized as part of HA operation—each unit must be updated independently to matching versions.

Answer

Administrator credentials

Answer

Local log files

Answer

Firmware image