NSE7 Enterprise Firewall and VDOMs — 50 Questions

Question 1

A network engineer wants to deploy a FortiGate in transparent mode and have it managed by FortiManager. The FortiGate should not participate in routing, but must be able to send logs to FortiAnalyzer. Which two settings must be configured on the FortiGate to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a management IP address on the FortiGate. In transparent mode, a FortiGate forwards traffic at Layer 2 without participating in routing, so it needs a dedicated management IP address (Option B) to allow FortiManager and FortiAnalyzer to reach it for management and log transmission. Because the FortiGate does not run a routing protocol or act as a router in transparent mode, it also requires a static route (Option D) pointing to the next-hop gateway so it can reach FortiManager and FortiAnalyzer on remote subnets. Option A is unnecessary because DHCP client on the management interface is not required for FortiManager management or FortiAnalyzer logging. Option C is incorrect because NAT is not needed for management or logging traffic in transparent mode. Option E is not required because the management IP does not have to be in the same subnet as the upstream router as long as a static route provides reachability.

Answer

Enable DHCP client on the management interface

Answer

Enable NAT on the management interface

Answer

Set the interface IP address in the same subnet as the upstream router

Question 2

An organization is deploying multiple FortiGate devices across different geographic locations. The central IT team manages all devices from a single FortiManager. The remote FortiGates connect to FortiManager over a WAN link. Which feature should be enabled on FortiManager to ensure that configuration changes are applied consistently and without interruption to the remote FortiGates?

Accepted Answer

Use the 'Install on Next Reboot' option in the install wizard. The 'Install on Next Reboot' option ensures that configuration changes are staged on the remote FortiGate and applied atomically when the device reboots. This prevents partial or inconsistent application over an unreliable WAN link, as the FortiManager pushes the full configuration revision to the device, which then applies it during the boot process without requiring a persistent management session.

Answer

Enable auto-link configuration on the FortiManager

Answer

Use 'Install Wizard' with 'Immediate Install' option

Answer

Enable 'Configuration Override' on the managed FortiGates

Question 3

A network administrator is troubleshooting a FortiGate that is not appearing in the Security Fabric topology on FortiManager. The FortiGate is reachable from FortiManager via ping. What is the most likely cause?

Accepted Answer

The FortiGate is not authorized in FortiManager. For a FortiGate to appear in the Security Fabric topology on FortiManager, it must first be authorized in FortiManager. Even if the FortiGate is reachable via ping, without authorization, FortiManager will not accept its registration or include it in the topology view. This is a prerequisite step that must occur before any fabric communication can be established.

Answer

FortiAnalyzer is not configured on the FortiGate

Answer

SNMP community string is mismatched

Answer

The FortiGate firewall policy is blocking traffic to FortiManager

Question 4

An organization uses FortiManager to manage multiple FortiGate devices in a Security Fabric. The administrator wants to push a new firewall policy that includes an FQDN address object. Which statement is true regarding FQDN objects in FortiManager policies?

Accepted Answer

FortiManager resolves the FQDN to IP addresses at installation time and updates the policy accordingly. When an administrator pushes a policy containing an FQDN address object from FortiManager, FortiManager resolves the FQDN to its current IP addresses at installation time. The resolved IPs are then written into the policy on the managed FortiGate, ensuring the policy is immediately effective without requiring the FortiGate to perform DNS resolution. This behavior is specific to FortiManager-managed policies and differs from locally configured FQDN objects on FortiGate.

Answer

FQDN objects must be defined on each managed FortiGate individually

Answer

The FQDN resolution is done automatically every 60 seconds by FortiManager

Answer

FQDN objects cannot be used in policies pushed from FortiManager

Question 5

Which TWO statements about the Security Fabric and FortiManager are correct? (Choose two.)

Accepted Answer

FortiManager can manage multiple Security Fabrics.. FortiManager can manage multiple Security Fabrics because it is designed as a centralized management platform that can oversee multiple independent FortiGate clusters or fabric topologies. Each Security Fabric is a logical grouping of FortiGate devices that share a common root FortiGate, and FortiManager can be configured to manage several such fabrics simultaneously, each with its own root and member devices, without requiring separate management servers. Additionally, when a Security Fabric is formed, the first FortiGate added to the fabric automatically becomes the root FortiGate, which serves as the central point for fabric communication and policy enforcement. This root FortiGate is responsible for coordinating fabric-wide operations and sharing information with other member devices.

Answer

FortiGate devices must be in transparent mode to join the fabric.

Answer

FortiAnalyzer must be deployed to use the Security Fabric.

Answer

A FortiGate can be part of multiple Security Fabrics simultaneously.

Question 6

Refer to the exhibit. A FortiGate is configured with the above settings. The FortiManager at 192.168.1.100 cannot establish a management connection to the FortiGate. What is the most likely cause?

Accepted Answer

The FortiGate's port1 IP is not in the same subnet as the FortiManager. The FortiGate's port1 IP (10.0.1.1/24) is on a different subnet (10.0.1.0/24) than the FortiManager's IP (192.168.1.100), which is on the 192.168.1.0/24 subnet. For a management connection to be established, the FortiGate and FortiManager must be able to route to each other, typically requiring them to be on the same subnet unless a gateway or static route is configured. Since no routing is mentioned, the subnet mismatch is the most likely cause of the failure.

Answer

HTTPS access is not enabled on port1

Answer

The admin user 'admin' is not configured correctly

Answer

The trusthost configuration does not include the FortiManager IP

Question 7

A network engineer is troubleshooting a Security Fabric where a downstream FortiGate (model 60F) is not appearing in the Fabric topology of the root FortiGate (model 600E). Both devices are running FortiOS 7.4. The root FortiGate shows the downstream device as 'Unreachable' in the Security Fabric widget. The engineer has verified that the downstream FortiGate can ping the root FortiGate's management IP. What is the most likely cause of this issue?

Accepted Answer

The downstream FortiGate has insufficient memory to support Security Fabric features.. The FortiGate 60F has limited memory (typically 512 MB or less), and FortiOS 7.4 enforces a minimum memory requirement for downstream devices to participate in the Security Fabric. When the downstream device has insufficient memory, the root FortiGate marks it as 'Unreachable' even though basic IP connectivity (ping) works. This is a known hardware limitation for lower-end models like the 60F when running newer FortiOS versions.

Answer

The root FortiGate does not have HTTPS access to the downstream FortiGate.

Answer

The downstream FortiGate's management interface is configured on a different VLAN.

Answer

The administrator account on the downstream FortiGate does not have 'super_admin' privileges.

Question 8

A company is deploying a Security Fabric with multiple FortiGate devices managed by FortiManager. The administrator wants to apply a policy package to multiple FortiGate devices in the Fabric. However, after assigning the policy package to the devices in FortiManager and installing the configuration, the policies are not applied consistently across all devices. The administrator notices that some devices have local policies that override the policy package. What is the best practice to ensure that the policy package is enforced on all devices?

Accepted Answer

Enable 'Central Management' in FortiManager and use 'Install On Policy Package' to push policies.. Enabling 'Central Management' in FortiManager ensures that the policy package is the authoritative source for all managed FortiGate devices. When 'Install On Policy Package' is used, FortiManager overwrites any local policies on the devices, enforcing consistent policy application across the Security Fabric. Without central management, local policies can persist and override the pushed policy package, leading to inconsistencies.

Answer

Disable the 'Auto Update' feature on the managed devices.

Answer

Use the same policy package name on all devices and manually sync them.

Answer

Ensure that the Security Fabric is fully established and all devices are visible in the topology.

Question 9

Which TWO statements about Security Fabric deployment are correct? (Choose two.)

Accepted Answer

The root FortiGate must have a management IP address that is reachable from all downstream devices.. Options B and C are correct. Option B is correct because the root FortiGate acts as the central coordination point for the Security Fabric; all downstream devices must be able to reach its management IP to establish and maintain communication, which uses TCP port 8013 (HTTPS) for the initial handshake and keepalive messages. Option C is correct because each FortiGate device in the Fabric must have a unique serial number to ensure proper identification and avoid conflicts within the Fabric topology.

Answer

A Security Fabric can contain a maximum of 50 FortiGate devices.

Answer

All FortiGate devices in the Fabric must be managed by the same FortiManager.

Answer

A FortiGate can only belong to one Security Fabric at a time.

Question 10

A company has deployed a Security Fabric with a root FortiGate 600E and two downstream FortiGate 200E devices. The network also includes a FortiAnalyzer and a FortiManager. The administrator notices that the Security Fabric topology in FortiGate is not showing the downstream devices. The root FortiGate can ping the management IPs of the downstream devices. Additionally, the administrator has configured the downstream devices with the correct root IP and authorization mode is set to 'none'. However, when running 'diagnose sys fabric list' on the root, it shows the downstream devices with status 'Pending'. The root FortiGate's firewall policy allows all traffic from the downstream subnets. What is the most likely cause of the issue?

Accepted Answer

The downstream devices are missing the root FortiGate's serial number in the 'downstream-authorization' configuration.. The 'Pending' status in the output of 'diagnose sys fabric list' indicates that the root FortiGate has discovered the downstream devices but they have not completed the authorization handshake. Even though the authorization mode is set to 'none', each downstream FortiGate must still have the root FortiGate's serial number explicitly listed in its 'downstream-authorization' configuration to be accepted into the Security Fabric. Without this entry, the root will not finalize the adjacency, leaving the downstream devices in a pending state.

Answer

The FortiAnalyzer is not configured to receive logs from the downstream devices.

Answer

The downstream devices are using a different management port than the root.

Answer

The root FortiGate's firewall policy is blocking the downstream devices' Fabric traffic.

Question 11

A network engineer is configuring an HA pair of FortiGate firewalls. They want to ensure that session failover occurs for UDP-based voice traffic with minimal interruption. Which HA configuration setting is most important for achieving this goal?

Accepted Answer

Enable session-pickup. Session-pickup is the correct setting because it enables the secondary FortiGate to synchronize UDP session state information from the primary, allowing seamless failover of voice traffic without requiring new session establishment. UDP is connectionless, so without session-pickup, the secondary would drop the traffic as unknown, causing noticeable interruption in real-time voice streams.

Answer

Enable session-pickup-delay

Answer

Set ha-pickup-delay to 0

Answer

Configure ha-mgmt-interfaces

Question 12

An organization has two FortiGate firewalls in an HA active-passive cluster. They notice that after a failover event, some users cannot access external resources. The administrator checks the HA configuration and finds that failover occurred correctly. What is the most likely cause of the connectivity issue?

Accepted Answer

VDOM links are not synchronized. In an HA active-passive cluster, VDOM links are not automatically synchronized between peers. After a failover, the new primary FortiGate may lack the VDOM link configurations required to route traffic between VDOMs, causing connectivity loss for users relying on inter-VDOM routing. This is a common misconfiguration because VDOM links are treated as local objects and must be explicitly replicated or re-created on the peer.

Answer

session-pickup is disabled

Answer

HA override is enabled

Answer

Gratuitous ARP is disabled

Question 13

A FortiGate administrator is designing a VDOM configuration for a multi-tenant environment. Each tenant requires its own routing table and firewall policies. Which VDOM type should be used for each tenant?

Accepted Answer

NAT mode VDOM. In a multi-tenant VDOM environment where each tenant requires its own routing table and firewall policies, NAT mode VDOM (option D) is the correct choice because it operates as a Layer 3 routing entity with its own independent routing table, interfaces, and firewall policies. This mode allows each tenant VDOM to perform NAT, route between subnets, and enforce security policies autonomously, which is essential for tenant isolation and policy control.

Answer

TP mode VDOM

Answer

Router mode VDOM

Answer

Transparent mode VDOM

Question 14

An HA cluster is configured with two FortiGates in active-passive mode. The administrator wants to ensure that the secondary unit automatically takes over if the primary unit fails. Which TWO settings must be configured?

Accepted Answer

Set ha-mode to active-passive. Setting ha-mode to active-passive (Option A) defines the failover model where the secondary unit remains in standby until the primary fails, enabling automatic takeover. Enabling configuration synchronization (Option D) ensures that the secondary unit has the same configuration as the primary, which is necessary for it to function correctly when it takes over. Without synchronization, the secondary may lack the proper configuration to handle traffic. Options B, C, and E are not required for automatic takeover: priority influences but does not guarantee takeover, active-active mode does not provide a clear secondary takeover role, and session-pickup preserves sessions but does not enable the takeover mechanism itself.

Answer

Set ha-priority to 100 on primary

Answer

Set ha-mode to active-active

Answer

Enable session-pickup

Question 15

A FortiGate with multiple VDOMs is experiencing high CPU usage. The administrator suspects that one VDOM is consuming excessive resources. Which THREE methods can be used to limit resource usage per VDOM?

Accepted Answer

Apply per-VDOM traffic shaping policies. Per-VDOM traffic shaping policies allow the administrator to apply bandwidth limits and QoS policies specifically to traffic within a particular VDOM, preventing that VDOM from monopolizing the FortiGate's CPU resources. This is achieved by configuring shaping policies under the VDOM's firewall policy that match traffic and apply a traffic shaper, which can limit bandwidth and prioritize traffic, thereby reducing CPU load from that VDOM.

Answer

Enable HA resource reservation

Answer

Enable VDOM logging

Question 16

A network engineer is designing a FortiGate HA cluster with two units operating in active-active mode. The cluster will be placed in a VDOM-enabled environment. The engineer wants to ensure that traffic from a specific VDOM is load-balanced across both units based on source IP address. Which setting must be configured on the cluster to achieve this?

Accepted Answer

Configure a virtual cluster with load-balance method source IP. In a VDOM-enabled active-active HA cluster, per-VDOM load balancing is achieved by configuring a virtual cluster and setting the load-balance method to source IP. This allows the cluster to distribute traffic for that specific VDOM across both units based on the source IP hash, ensuring session persistence while balancing the load.

Answer

Configure randomize-vip under config system ha

Answer

Configure vdom-load-balance under config system ha

Answer

Enable session pickup and set session-pickup-delay to 0

Question 17

An administrator is configuring a FortiGate HA cluster and wants to ensure that the cluster can tolerate a failure of one unit without administrative intervention. The cluster must also support upgrading firmware with minimal downtime. Which HA mode should the administrator select?

Accepted Answer

Active-passive HA. Active-passive HA (option C) is correct because it provides automatic failover without administrative intervention when a unit fails, and it supports hitless firmware upgrades by upgrading the standby unit first, then performing a failover to make it active, followed by upgrading the original active unit. This mode uses a single management IP and synchronizes configuration and session state between the primary and backup units, ensuring minimal downtime during both failure and upgrade scenarios.

Answer

Standalone mode

Answer

Active-active HA

Answer

FGCP mode

Question 18

An administrator is troubleshooting an HA cluster issue. The cluster consists of two FortiGate units in active-passive mode. The passive unit is showing a 'heartbeat lost' error in the logs. Which TWO configuration checks should the administrator perform to resolve this issue?

Accepted Answer

Ensure the heartbeat interface is physically connected and has a valid IP address in the same subnet. The heartbeat interface must be physically connected and have a valid IP address on the same subnet for the two FortiGates to exchange HA heartbeat packets (typically UDP port 703). If the interface is down or the IPs are not in the same subnet, the passive unit will log 'heartbeat lost' and fail to maintain cluster synchronization.

Answer

Check that the HA password is the same on both units

Answer

Verify that HA override is enabled on both units

Answer

Confirm that the management interface IP addresses are on the same subnet

Question 19

A FortiGate HA cluster is configured in active-passive mode with VDOMs. The administrator wants to ensure that a specific VDOM (VDOM1) always runs on the primary unit unless that unit fails. Additionally, the administrator wants to minimize disruption during a failover. Which THREE configuration steps should be taken?

Accepted Answer

Set the HA priority of the primary unit to a higher value (e.g., 200) than the secondary unit. In an active-passive HA cluster, setting a higher HA priority (e.g., 200) on the primary unit ensures it is elected as the active unit. This guarantees that VDOM1, which is not load-balanced, will run on the primary unit under normal conditions, as the higher priority value makes the primary unit preferred during the election process.

Answer

Disable session pickup to speed up failover

Answer

Enable active-active HA mode

Question 20

Refer to the exhibit. An administrator has configured an active-passive HA cluster. After reviewing the configuration and status, the administrator wants to ensure that the management interface (port2) is accessible on both units using the same IP address. What additional configuration is required?

Accepted Answer

Configure a virtual management IP under the cluster settings. In an active-passive HA cluster, the management interface (port2) must be reachable on both units using the same IP address. This is achieved by configuring a virtual management IP (also known as a management IP address) under the cluster settings. The virtual management IP is assigned to the active unit and, upon failover, is automatically moved to the new active unit, ensuring continuous management access without requiring separate IP addresses per unit.

Answer

Set the gateway to 0.0.0.0

Answer

Enable ha-mgmt-status on the secondary unit

Answer

Disable session-pickup to free resources