NSE7 Enterprise Firewall and VDOMs Practice Test 2 — 15 Questions

Question 1

A network engineer is designing a FortiGate HA cluster with two units operating in active-active mode. The cluster will be placed in a VDOM-enabled environment. The engineer wants to ensure that traffic from a specific VDOM is load-balanced across both units based on source IP address. Which setting must be configured on the cluster to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a virtual cluster with load-balance method source IP. In a VDOM-enabled active-active HA cluster, per-VDOM load balancing is achieved by configuring a virtual cluster and setting the load-balance method to source IP. This allows the cluster to distribute traffic for that specific VDOM across both units based on the source IP hash, ensuring session persistence while balancing the load.

Answer

Configure randomize-vip under config system ha

Answer

Configure vdom-load-balance under config system ha

Answer

Enable session pickup and set session-pickup-delay to 0

Question 2

An administrator is configuring a FortiGate HA cluster and wants to ensure that the cluster can tolerate a failure of one unit without administrative intervention. The cluster must also support upgrading firmware with minimal downtime. Which HA mode should the administrator select?

Accepted Answer

Active-passive HA. Active-passive HA (option C) is correct because it provides automatic failover without administrative intervention when a unit fails, and it supports hitless firmware upgrades by upgrading the standby unit first, then performing a failover to make it active, followed by upgrading the original active unit. This mode uses a single management IP and synchronizes configuration and session state between the primary and backup units, ensuring minimal downtime during both failure and upgrade scenarios.

Answer

Standalone mode

Answer

Active-active HA

Answer

FGCP mode

Question 3

An administrator is troubleshooting an HA cluster issue. The cluster consists of two FortiGate units in active-passive mode. The passive unit is showing a 'heartbeat lost' error in the logs. Which TWO configuration checks should the administrator perform to resolve this issue?

Accepted Answer

Ensure the heartbeat interface is physically connected and has a valid IP address in the same subnet. The heartbeat interface must be physically connected and have a valid IP address on the same subnet for the two FortiGates to exchange HA heartbeat packets (typically UDP port 703). If the interface is down or the IPs are not in the same subnet, the passive unit will log 'heartbeat lost' and fail to maintain cluster synchronization.

Answer

Check that the HA password is the same on both units

Answer

Verify that HA override is enabled on both units

Answer

Confirm that the management interface IP addresses are on the same subnet

Question 4

A FortiGate HA cluster is configured in active-passive mode with VDOMs. The administrator wants to ensure that a specific VDOM (VDOM1) always runs on the primary unit unless that unit fails. Additionally, the administrator wants to minimize disruption during a failover. Which THREE configuration steps should be taken?

Accepted Answer

Set the HA priority of the primary unit to a higher value (e.g., 200) than the secondary unit. In an active-passive HA cluster, setting a higher HA priority (e.g., 200) on the primary unit ensures it is elected as the active unit. This guarantees that VDOM1, which is not load-balanced, will run on the primary unit under normal conditions, as the higher priority value makes the primary unit preferred during the election process.

Answer

Disable session pickup to speed up failover

Answer

Enable active-active HA mode

Question 5

Refer to the exhibit. An administrator has configured an active-passive HA cluster. After reviewing the configuration and status, the administrator wants to ensure that the management interface (port2) is accessible on both units using the same IP address. What additional configuration is required?

Accepted Answer

Configure a virtual management IP under the cluster settings. In an active-passive HA cluster, the management interface (port2) must be reachable on both units using the same IP address. This is achieved by configuring a virtual management IP (also known as a management IP address) under the cluster settings. The virtual management IP is assigned to the active unit and, upon failover, is automatically moved to the new active unit, ensuring continuous management access without requiring separate IP addresses per unit.

Answer

Set the gateway to 0.0.0.0

Answer

Enable ha-mgmt-status on the secondary unit

Answer

Disable session-pickup to free resources

Question 6

A company has two FortiGate firewalls in an HA active-passive cluster. They want to separate network traffic for different departments using VDOMs. After configuring VDOMs on both units, the HA status shows 'synchronized' but traffic for one VDOM is not passing through the active unit. What is the most likely cause?

Accepted Answer

The administrator account used to configure VDOMs lacks permission.. In an HA active-passive cluster, traffic forwarding on the active unit depends entirely on its own configuration. A missing VDOM link on the passive unit does not affect active traffic forwarding. The most likely cause for traffic not passing for a specific VDOM is a misconfiguration within that VDOM on the active unit, such as missing routes or firewall policies. This could stem from the administrator account lacking sufficient permissions to apply complete VDOM configurations, leading to incomplete settings.

Answer

The HA mode must be active-active to use VDOMs.

Answer

A VDOM link is missing on the passive unit.

Answer

HA is not compatible with VDOMs.

Question 7

A large enterprise operates two FortiGate 600E firewalls in an HA active-passive cluster. They have enabled VDOMs to isolate traffic for different business units: Finance, HR, and Engineering. Each VDOM has its own internet connection through separate ISPs. The cluster has been running smoothly for months. Recently, the IT team noticed that users in the Finance VDOM experience intermittent connectivity drops to their cloud-based ERP system. The drops last 30-60 seconds and occur several times a day. During these drops, ping to the ERP IP address fails. The HA cluster status shows 'synchronized' and no failover events are logged. The Finance VDOM uses a static default route pointing to the primary ISP gateway. The other VDOMs are unaffected. What is the most likely cause of the issue?

Accepted Answer

The VDOM link configuration is not synchronized between the two units, causing asymmetric routing for the Finance VDOM.. VDOM link configurations are stored per-VDOM and must be synchronized independently. If the VDOM link configuration is not synchronized between the HA units, the passive unit may have a different or missing VDOM link, causing asymmetric routing when traffic is processed by the passive unit during a transient state (e.g., session ownership change or link flap). This leads to intermittent connectivity drops for the Finance VDOM only, as its traffic is isolated and uses a static default route.

Answer

The HA cluster is in active-active mode, causing routing loops for the Finance VDOM.

Answer

The heartbeat interface is oversubscribed, causing intermittent HA synchronization failures.

Answer

The 'set ha-mgmt-status enable' command is configured on the passive unit, preventing route synchronization.

Question 8

A network engineer is configuring a FortiGate HA cluster with two FortiGate 100F units in active-passive mode. The engineer wants to use VDOMs to separate guest and corporate traffic. After initial setup, the engineer configures two VDOMs: 'guest' and 'corp'. Both VDOMs have interfaces assigned. The HA status shows 'synchronized'. However, the engineer notices that traffic from the corporate network is not being forwarded correctly. Pings from the corporate LAN to the internet fail. The guest network works fine. The engineer checks the routing table on the active unit and sees that the default route is present in the 'corp' VDOM. What is the most likely cause of the issue?

Accepted Answer

The default route in the corp VDOM has an incorrect gateway IP address.. The most likely cause is an incorrect gateway IP address in the default route for the 'corp' VDOM. Since the guest VDOM works correctly, the HA cluster and VDOM configuration are functional, and the issue is isolated to the corporate VDOM's routing. A misconfigured next-hop IP would prevent traffic from reaching the internet, even though the route itself is present in the routing table.

Answer

The interface assigned to the corp VDOM is administratively down.

Answer

The HA cluster must be in active-active mode for VDOMs to work.

Answer

The VDOM link between the root VDOM and corp VDOM is not configured.

Question 9

An administrator is configuring a FortiGate HA cluster in active-passive mode. The company has two ISPs, and the primary FortiGate is connected to ISP1 and ISP2. The secondary FortiGate is connected only to ISP2. The administrator wants to ensure that failover occurs only if both ISP1 and ISP2 connections are lost on the primary device. Which configuration approach should be used?

Accepted Answer

Set the HA priority of the primary to 1 and the secondary to 0, and enable link-fail-signal on both ISP interfaces on the primary, then set 'set ha-priority 1' on the primary and 'set ha-priority 0' on the secondary.. It uses link-fail-signal on both ISP interfaces of the primary FortiGate to detect physical link loss, and sets HA priorities (primary=1, secondary=0) so that failover occurs only when both ISP links are down. Link-fail-signal triggers an HA failover only when the monitored interface loses carrier, and since both ISP1 and ISP2 interfaces are monitored, the primary will only relinquish control when both links fail, meeting the requirement.

Answer

Use gateway monitoring with virtual router failover, and set the failure threshold to 2.

Answer

Configure gateway monitoring on the primary for ISP1 only, and set the HA failover threshold to 1.

Answer

Set the HA priority of the primary to 1 and the secondary to 0, and enable link-fail-signal on both ISP interfaces on the primary.

Question 10

A FortiGate HA cluster is configured with VDOMs. Each VDOM is assigned to different physical interfaces. The cluster is in active-passive mode. Which TWO statements about VDOM synchronization in HA are correct?

Accepted Answer

VDOM configuration, including interfaces and policies, is synchronized between cluster members.. In a FortiGate HA cluster, VDOM configuration—including interfaces, policies, and other settings—is fully synchronized between cluster members. This ensures that both the active and passive units have identical VDOM configurations, enabling seamless failover without manual reconfiguration.

Answer

In active-passive HA, traffic for each VDOM can be distributed across cluster members.

Answer

Each VDOM can have its own HA mode (active-passive or active-active) independent of the global HA mode.

Answer

If one VDOM fails, the entire HA cluster fails over to the standby unit.

Question 11

Drag and drop the steps to configure an HA cluster on FortiGate into the correct order.

Accepted Answer

1. Set HA mode and priority, 2. Connect heartbeat interfaces, 3. Configure management IP and VIP, 4. Verify. First set HA mode and priority, then connect heartbeat, then configure management IP and VIP, and finally verify.

Answer

1. Connect heartbeat interfaces, 2. Set HA mode and priority, 3. Configure management IP and VIP, 4. Verify

Answer

1. Set HA mode and priority, 2. Configure management IP and VIP, 3. Connect heartbeat interfaces, 4. Verify

Answer

1. Configure management IP and VIP, 2. Set HA mode and priority, 3. Connect heartbeat interfaces, 4. Verify

Question 12

Match each Fortinet security feature to its primary function.

Accepted Answer

IPS: Inspects traffic for malicious patterns and exploits. Fortinet security features have distinct functions: IPS inspects network traffic for exploits, Application Control identifies applications, Web Filtering controls web access, and Antivirus scans for malware. Common confusions involve swapping these roles.

Answer

IPS: Scans files and content for malware

Answer

Application Control: Blocks access to malicious websites

Question 13

Match each FortiGate authentication method to its protocol.

Accepted Answer

LDAP: Lightweight Directory Access Protocol. FortiGate supports multiple authentication methods, each using a specific protocol. LDAP uses LDAP, RADIUS uses RADIUS, TACACS+ uses TACACS+, and SAML uses SAML. Common confusions include swapping LDAP and RADIUS definitions.

Answer

LDAP: Remote Authentication Dial-In User Service

Answer

RADIUS: Lightweight Directory Access Protocol

Question 14

A FortiGate in transparent mode with multiple VDOMs is deployed at a customer site. The customer reports that traffic between two VLANs on the same physical segment is not being forwarded. The administrator verifies that the firewall policies are configured correctly. What is the most likely cause?

Accepted Answer

The FortiGate is in transparent mode and does not route between VLANs without a VLAN interface. In transparent mode, a FortiGate acts as a Layer 2 bridge and does not perform IP routing. To forward traffic between VLANs on the same physical segment, you must create VLAN subinterfaces on the FortiGate and assign them to the appropriate VDOMs. Without these VLAN interfaces, the FortiGate cannot distinguish or forward traffic between the VLANs, even if firewall policies are correctly configured.

Answer

The VDOMs are not configured with management IP addresses

Answer

The VDOM limit has been exceeded

Answer

Inter-VDOM routing is disabled between the VDOMs

Question 15

An administrator runs the command 'diagnose sys session filter dport 443' on a FortiGate and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is in SYN_SENT state, meaning the three-way handshake is incomplete. The output shows `proto=6` (TCP), `proto_state=01`, `duration=3600`, and `expire=3599`. In FortiGate's session table, `proto_state=01` represents the TCP state `SYN_SENT`, which means the session has sent a SYN but has not yet received a SYN-ACK, so the three-way handshake is incomplete. The `expire=3599` indicates the session will time out in 3599 seconds if the handshake does not complete, but the session is not yet established.

Answer

The session is fully established and will expire in about 3599 seconds

Answer

The traffic is being blocked by the firewall policy

Answer

The session is using HTTPS and has been inspected