NSE7 Enterprise Firewall and VDOMs Practice Test 3 — 15 Questions

Question 1

An administrator is configuring a FortiGate HA cluster and wants to ensure that the cluster can tolerate a failure of one unit without administrative intervention. The cluster must also support upgrading firmware with minimal downtime. Which HA mode should the administrator select?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Active-passive HA. Active-passive HA (option C) is correct because it provides automatic failover without administrative intervention when a unit fails, and it supports hitless firmware upgrades by upgrading the standby unit first, then performing a failover to make it active, followed by upgrading the original active unit. This mode uses a single management IP and synchronizes configuration and session state between the primary and backup units, ensuring minimal downtime during both failure and upgrade scenarios.

Answer

Standalone mode

Answer

Active-active HA

Answer

FGCP mode

Question 2

A FortiGate HA cluster is configured with two units in active-passive mode. The administrator needs to perform a firmware upgrade on the cluster with minimal downtime. The current firmware version is 7.2.5 and the target is 7.2.7. The cluster uses FGCP with session synchronization enabled. Which procedure should the administrator follow?

Accepted Answer

Upgrade the passive unit first, perform a graceful failover, then upgrade the new passive unit. It follows the recommended upgrade procedure for an active-passive FGCP cluster with session synchronization. By upgrading the passive unit first, then performing a graceful failover (which preserves existing sessions via FGCP session sync), and finally upgrading the new passive unit, the administrator ensures that the cluster remains operational throughout the process with minimal traffic disruption. This method avoids a full cluster outage and maintains session continuity.

Answer

Upgrade only the primary unit and let the secondary synchronize automatically

Answer

Disable HA, upgrade both units, then re-enable HA

Answer

Upgrade both units at the same time by connecting to each via console

Question 3

An administrator has configured a FortiGate HA cluster with two units. The cluster uses a virtual cluster for load balancing in active-active mode. The administrator notices that traffic from one VDOM is not being load-balanced and is only handled by one unit. What is the most likely cause?

Accepted Answer

The VDOM is not assigned to any virtual cluster. In an active-active HA cluster with virtual clusters, each VDOM must be explicitly assigned to a virtual cluster to participate in load balancing. If a VDOM is not assigned to any virtual cluster, it defaults to being handled only by the primary unit, regardless of the cluster mode. This explains why traffic from that VDOM is not load-balanced.

Answer

Session pickup is disabled

Answer

The HA priority is set to 0 on the secondary unit

Answer

The management interface is not configured on the VDOM

Question 4

An administrator is troubleshooting an HA cluster issue. The cluster consists of two FortiGate units in active-passive mode. The passive unit is showing a 'heartbeat lost' error in the logs. Which TWO configuration checks should the administrator perform to resolve this issue?

Accepted Answer

Ensure the heartbeat interface is physically connected and has a valid IP address in the same subnet. The heartbeat interface must be physically connected and have a valid IP address on the same subnet for the two FortiGates to exchange HA heartbeat packets (typically UDP port 703). If the interface is down or the IPs are not in the same subnet, the passive unit will log 'heartbeat lost' and fail to maintain cluster synchronization.

Answer

Check that the HA password is the same on both units

Answer

Verify that HA override is enabled on both units

Answer

Confirm that the management interface IP addresses are on the same subnet

Question 5

A FortiGate HA cluster is configured in active-passive mode with VDOMs. The administrator wants to ensure that a specific VDOM (VDOM1) always runs on the primary unit unless that unit fails. Additionally, the administrator wants to minimize disruption during a failover. Which THREE configuration steps should be taken?

Accepted Answer

Set the HA priority of the primary unit to a higher value (e.g., 200) than the secondary unit. In an active-passive HA cluster, setting a higher HA priority (e.g., 200) on the primary unit ensures it is elected as the active unit. This guarantees that VDOM1, which is not load-balanced, will run on the primary unit under normal conditions, as the higher priority value makes the primary unit preferred during the election process.

Answer

Disable session pickup to speed up failover

Answer

Enable active-active HA mode

Question 6

Refer to the exhibit. An administrator has configured an active-passive HA cluster. After reviewing the configuration and status, the administrator wants to ensure that the management interface (port2) is accessible on both units using the same IP address. What additional configuration is required?

Accepted Answer

Configure a virtual management IP under the cluster settings. In an active-passive HA cluster, the management interface (port2) must be reachable on both units using the same IP address. This is achieved by configuring a virtual management IP (also known as a management IP address) under the cluster settings. The virtual management IP is assigned to the active unit and, upon failover, is automatically moved to the new active unit, ensuring continuous management access without requiring separate IP addresses per unit.

Answer

Set the gateway to 0.0.0.0

Answer

Enable ha-mgmt-status on the secondary unit

Answer

Disable session-pickup to free resources

Question 7

A large enterprise operates two FortiGate 600E firewalls in an HA active-passive cluster. They have enabled VDOMs to isolate traffic for different business units: Finance, HR, and Engineering. Each VDOM has its own internet connection through separate ISPs. The cluster has been running smoothly for months. Recently, the IT team noticed that users in the Finance VDOM experience intermittent connectivity drops to their cloud-based ERP system. The drops last 30-60 seconds and occur several times a day. During these drops, ping to the ERP IP address fails. The HA cluster status shows 'synchronized' and no failover events are logged. The Finance VDOM uses a static default route pointing to the primary ISP gateway. The other VDOMs are unaffected. What is the most likely cause of the issue?

Accepted Answer

The VDOM link configuration is not synchronized between the two units, causing asymmetric routing for the Finance VDOM.. VDOM link configurations are stored per-VDOM and must be synchronized independently. If the VDOM link configuration is not synchronized between the HA units, the passive unit may have a different or missing VDOM link, causing asymmetric routing when traffic is processed by the passive unit during a transient state (e.g., session ownership change or link flap). This leads to intermittent connectivity drops for the Finance VDOM only, as its traffic is isolated and uses a static default route.

Answer

The HA cluster is in active-active mode, causing routing loops for the Finance VDOM.

Answer

The heartbeat interface is oversubscribed, causing intermittent HA synchronization failures.

Answer

The 'set ha-mgmt-status enable' command is configured on the passive unit, preventing route synchronization.

Question 8

A network engineer is configuring a FortiGate HA cluster with two FortiGate 100F units in active-passive mode. The engineer wants to use VDOMs to separate guest and corporate traffic. After initial setup, the engineer configures two VDOMs: 'guest' and 'corp'. Both VDOMs have interfaces assigned. The HA status shows 'synchronized'. However, the engineer notices that traffic from the corporate network is not being forwarded correctly. Pings from the corporate LAN to the internet fail. The guest network works fine. The engineer checks the routing table on the active unit and sees that the default route is present in the 'corp' VDOM. What is the most likely cause of the issue?

Accepted Answer

The default route in the corp VDOM has an incorrect gateway IP address.. The most likely cause is an incorrect gateway IP address in the default route for the 'corp' VDOM. Since the guest VDOM works correctly, the HA cluster and VDOM configuration are functional, and the issue is isolated to the corporate VDOM's routing. A misconfigured next-hop IP would prevent traffic from reaching the internet, even though the route itself is present in the routing table.

Answer

The interface assigned to the corp VDOM is administratively down.

Answer

The HA cluster must be in active-active mode for VDOMs to work.

Answer

The VDOM link between the root VDOM and corp VDOM is not configured.

Question 9

An administrator is configuring a FortiGate HA cluster and wants to ensure that the cluster can tolerate a failure of one unit without administrative intervention. The cluster must also support upgrading firmware with minimal downtime. Which HA mode should the administrator select?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the HA priority of the primary to 1 and the secondary to 0, and enable link-fail-signal on both ISP interfaces on the primary, then set 'set ha-priority 1' on the primary and 'set ha-priority 0' on the secondary.. It uses link-fail-signal on both ISP interfaces of the primary FortiGate to detect physical link loss, and sets HA priorities (primary=1, secondary=0) so that failover occurs only when both ISP links are down. Link-fail-signal triggers an HA failover only when the monitored interface loses carrier, and since both ISP1 and ISP2 interfaces are monitored, the primary will only relinquish control when both links fail, meeting the requirement.

Answer

Use gateway monitoring with virtual router failover, and set the failure threshold to 2.

Answer

Configure gateway monitoring on the primary for ISP1 only, and set the HA failover threshold to 1.

Answer

Set the HA priority of the primary to 1 and the secondary to 0, and enable link-fail-signal on both ISP interfaces on the primary.

Question 10

A FortiGate HA cluster is configured with VDOMs. Each VDOM is assigned to different physical interfaces. The cluster is in active-passive mode. Which TWO statements about VDOM synchronization in HA are correct?

Accepted Answer

VDOM configuration, including interfaces and policies, is synchronized between cluster members.. In a FortiGate HA cluster, VDOM configuration—including interfaces, policies, and other settings—is fully synchronized between cluster members. This ensures that both the active and passive units have identical VDOM configurations, enabling seamless failover without manual reconfiguration.

Answer

In active-passive HA, traffic for each VDOM can be distributed across cluster members.

Answer

Each VDOM can have its own HA mode (active-passive or active-active) independent of the global HA mode.

Answer

If one VDOM fails, the entire HA cluster fails over to the standby unit.

Question 11

A company has deployed two FortiGate-600Es in an active-passive HA cluster. The cluster is configured with three VDOMs: VDOM-A (corporate LAN), VDOM-B (guest Wi-Fi), and VDOM-C (DMZ). Each VDOM has its own set of interfaces and policies. The cluster is also configured to use FGCP with session pickup enabled. Recently, the network team noticed that after a failover event, some user sessions in VDOM-B are not being picked up, causing disruption for guest users. The session pickup feature is enabled globally. The administrator checks the configuration and finds the following settings on the primary FortiGate:

- config system ha
  set session-pickup enable
  set session-pickup-connectionless enable
  end

- config vdom
  edit VDOM-A
    config system ha
      set session-pickup enable
    end
  next
  edit VDOM-B
    config system ha
      set session-pickup disable
    end
  next
  edit VDOM-C
    config system ha
      set session-pickup enable
    end
  next

Based on this configuration, what is the most likely reason that sessions in VDOM-B are not being picked up?

Accepted Answer

Session pickup is disabled specifically for VDOM-B in the per-VDOM HA configuration.. The per-VDOM HA configuration for VDOM-B explicitly disables session pickup with 'set session-pickup disable'. Even though the global HA settings enable session pickup, the per-VDOM setting overrides the global setting for that VDOM. As a result, after a failover, sessions in VDOM-B are not synchronized to the standby FortiGate and are not picked up, causing disruption for guest users.

Answer

The HA priority of the cluster is set too low, causing session pickup to fail for VDOM-B.

Answer

Session pickup for connectionless protocols is not enabled, so UDP sessions in VDOM-B are not picked up.

Answer

The interfaces assigned to VDOM-B do not have session pickup enabled.

Question 12

Drag and drop the steps to configure a site-to-site IPsec VPN on a FortiGate firewall into the correct order.

Accepted Answer

Phase 1, then Phase 2, then Routing, then Policies. Phase 1 establishes the IKE SA, Phase 2 creates the IPsec SA, then routing and policies are applied to allow traffic through the tunnel.

Answer

Phase 2, then Phase 1, then Routing, then Policies

Answer

Phase 1, then Policies, then Phase 2, then Routing

Answer

Policies, then Routing, then Phase 1, then Phase 2

Question 13

Drag and drop the steps to configure an HA cluster on FortiGate into the correct order.

Accepted Answer

1. Set HA mode and priority, 2. Connect heartbeat interfaces, 3. Configure management IP and VIP, 4. Verify. First set HA mode and priority, then connect heartbeat, then configure management IP and VIP, and finally verify.

Answer

1. Connect heartbeat interfaces, 2. Set HA mode and priority, 3. Configure management IP and VIP, 4. Verify

Answer

1. Set HA mode and priority, 2. Configure management IP and VIP, 3. Connect heartbeat interfaces, 4. Verify

Answer

1. Configure management IP and VIP, 2. Set HA mode and priority, 3. Connect heartbeat interfaces, 4. Verify

Question 14

Drag and drop the steps to configure a FortiGate to send logs to a FortiAnalyzer into the correct order.

Accepted Answer

Add log device, then set IP and authentication, then choose log types, then apply filters, then test connectivity. The correct sequence to configure a FortiGate to send logs to FortiAnalyzer is: first add the FortiAnalyzer as a log device, then configure its IP address and shared key for authentication, then choose which log types (e.g., traffic, event, etc.) to forward, optionally apply filters to refine the logs, and finally test the connectivity to verify the configuration. This order ensures that each step builds upon the previous one, avoiding errors such as trying to configure a device that hasn't been added yet or testing before all settings are in place.

Answer

Set IP and authentication, then choose log types, then add log device, then apply filters, then test connectivity

Answer

Choose log types, then add log device, then set IP and authentication, then test connectivity, then apply filters

Answer

Apply filters, then add log device, then set IP and authentication, then choose log types, then test connectivity

Question 15

Drag and drop the steps to configure a FortiGate as a DNS server (DNS proxy) into the correct order.

Accepted Answer

Enable DNS proxy → Set interface and port → Configure upstream DNS servers → Set caching → Allow DNS traffic in firewall policies. Enable DNS proxy, set interface and port, configure upstream, set caching, then allow traffic.

Answer

Set interface and port → Enable DNS proxy → Configure upstream DNS servers → Set caching → Allow DNS traffic in firewall policies

Answer

Enable DNS proxy → Set interface and port → Set caching → Configure upstream DNS servers → Allow DNS traffic in firewall policies

Answer

Enable DNS proxy → Set interface and port → Allow DNS traffic in firewall policies → Configure upstream DNS servers → Set caching