NSE7 Enterprise Firewall and VDOMs Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. An administrator has configured an active-passive HA cluster. After reviewing the configuration and status, the administrator wants to ensure that the management interface (port2) is accessible on both units using the same IP address. What additional configuration is required?

Accepted Answer

Configure a virtual management IP under the cluster settings. In an active-passive HA cluster, the management interface (port2) must be reachable on both units using the same IP address. This is achieved by configuring a virtual management IP (also known as a management IP address) under the cluster settings. The virtual management IP is assigned to the active unit and, upon failover, is automatically moved to the new active unit, ensuring continuous management access without requiring separate IP addresses per unit.

Answer

Set the gateway to 0.0.0.0

Answer

Enable ha-mgmt-status on the secondary unit

Answer

Disable session-pickup to free resources

Question 2

A company has two FortiGate firewalls in an HA active-passive cluster. They want to separate network traffic for different departments using VDOMs. After configuring VDOMs on both units, the HA status shows 'synchronized' but traffic for one VDOM is not passing through the active unit. What is the most likely cause?

Accepted Answer

A VDOM link is missing on the passive unit.. In an HA active-passive cluster, VDOM configurations must be identical on both units for synchronization to be complete. A missing VDOM link on the passive unit means the inter-VDOM routing path is not fully replicated, so even though HA status shows 'synchronized' (which may only reflect global or non-VDOM-specific settings), traffic for that VDOM cannot be forwarded correctly by the active unit because the passive unit's configuration is incomplete, breaking the expected redundancy and traffic flow.

Answer

The administrator account used to configure VDOMs lacks permission.

Answer

The HA mode must be active-active to use VDOMs.

Answer

HA is not compatible with VDOMs.

Question 3

A large enterprise operates two FortiGate 600E firewalls in an HA active-passive cluster. They have enabled VDOMs to isolate traffic for different business units: Finance, HR, and Engineering. Each VDOM has its own internet connection through separate ISPs. The cluster has been running smoothly for months. Recently, the IT team noticed that users in the Finance VDOM experience intermittent connectivity drops to their cloud-based ERP system. The drops last 30-60 seconds and occur several times a day. During these drops, ping to the ERP IP address fails. The HA cluster status shows 'synchronized' and no failover events are logged. The Finance VDOM uses a static default route pointing to the primary ISP gateway. The other VDOMs are unaffected. What is the most likely cause of the issue?

Accepted Answer

The VDOM link configuration is not synchronized between the two units, causing asymmetric routing for the Finance VDOM.. Option D is correct because VDOM link configurations are stored per-VDOM and must be synchronized independently. If the VDOM link configuration is not synchronized between the HA units, the passive unit may have a different or missing VDOM link, causing asymmetric routing when traffic is processed by the passive unit during a transient state (e.g., session ownership change or link flap). This leads to intermittent connectivity drops for the Finance VDOM only, as its traffic is isolated and uses a static default route.

Answer

The HA cluster is in active-active mode, causing routing loops for the Finance VDOM.

Answer

The heartbeat interface is oversubscribed, causing intermittent HA synchronization failures.

Answer

The 'set ha-mgmt-status enable' command is configured on the passive unit, preventing route synchronization.

Question 4

A network engineer is configuring a FortiGate HA cluster with two FortiGate 100F units in active-passive mode. The engineer wants to use VDOMs to separate guest and corporate traffic. After initial setup, the engineer configures two VDOMs: 'guest' and 'corp'. Both VDOMs have interfaces assigned. The HA status shows 'synchronized'. However, the engineer notices that traffic from the corporate network is not being forwarded correctly. Pings from the corporate LAN to the internet fail. The guest network works fine. The engineer checks the routing table on the active unit and sees that the default route is present in the 'corp' VDOM. What is the most likely cause of the issue?

Accepted Answer

The default route in the corp VDOM has an incorrect gateway IP address.. The most likely cause is an incorrect gateway IP address in the default route for the 'corp' VDOM. Since the guest VDOM works correctly, the HA cluster and VDOM configuration are functional, and the issue is isolated to the corporate VDOM's routing. A misconfigured next-hop IP would prevent traffic from reaching the internet, even though the route itself is present in the routing table.

Answer

The interface assigned to the corp VDOM is administratively down.

Answer

The HA cluster must be in active-active mode for VDOMs to work.

Answer

The VDOM link between the root VDOM and corp VDOM is not configured.

Question 5

An administrator is configuring a FortiGate HA cluster in active-passive mode. The company has two ISPs, and the primary FortiGate is connected to ISP1 and ISP2. The secondary FortiGate is connected only to ISP2. The administrator wants to ensure that failover occurs only if both ISP1 and ISP2 connections are lost on the primary device. Which configuration approach should be used?

Accepted Answer

Set the HA priority of the primary to 1 and the secondary to 0, and enable link-fail-signal on both ISP interfaces on the primary, then set 'set ha-priority 1' on the primary and 'set ha-priority 0' on the secondary.. Option D is correct because it uses link-fail-signal on both ISP interfaces of the primary FortiGate to detect physical link loss, and sets HA priorities (primary=1, secondary=0) so that failover occurs only when both ISP links are down. Link-fail-signal triggers an HA failover only when the monitored interface loses carrier, and since both ISP1 and ISP2 interfaces are monitored, the primary will only relinquish control when both links fail, meeting the requirement.

Answer

Use gateway monitoring with virtual router failover, and set the failure threshold to 2.

Answer

Configure gateway monitoring on the primary for ISP1 only, and set the HA failover threshold to 1.

Answer

Set the HA priority of the primary to 1 and the secondary to 0, and enable link-fail-signal on both ISP interfaces on the primary.

Question 6

A FortiGate HA cluster is configured with VDOMs. Each VDOM is assigned to different physical interfaces. The cluster is in active-passive mode. Which TWO statements about VDOM synchronization in HA are correct?

Accepted Answer

VDOM configuration, including interfaces and policies, is synchronized between cluster members.. Option A is correct because in a FortiGate HA cluster, VDOM configuration—including interfaces, policies, and other settings—is fully synchronized between cluster members. This ensures that both the active and passive units have identical VDOM configurations, enabling seamless failover without manual reconfiguration.

Answer

In active-passive HA, traffic for each VDOM can be distributed across cluster members.

Answer

Each VDOM can have its own HA mode (active-passive or active-active) independent of the global HA mode.

Answer

If one VDOM fails, the entire HA cluster fails over to the standby unit.

Question 7

A company has deployed two FortiGate-600Es in an active-passive HA cluster. The cluster is configured with three VDOMs: VDOM-A (corporate LAN), VDOM-B (guest Wi-Fi), and VDOM-C (DMZ). Each VDOM has its own set of interfaces and policies. The cluster is also configured to use FGCP with session pickup enabled. Recently, the network team noticed that after a failover event, some user sessions in VDOM-B are not being picked up, causing disruption for guest users. The session pickup feature is enabled globally. The administrator checks the configuration and finds the following settings on the primary FortiGate:

- config system ha
  set session-pickup enable
  set session-pickup-connectionless enable
  end

- config vdom
  edit VDOM-A
    config system ha
      set session-pickup enable
    end
  next
  edit VDOM-B
    config system ha
      set session-pickup disable
    end
  next
  edit VDOM-C
    config system ha
      set session-pickup enable
    end
  next

Based on this configuration, what is the most likely reason that sessions in VDOM-B are not being picked up?

Accepted Answer

Session pickup is disabled specifically for VDOM-B in the per-VDOM HA configuration.. Option C is correct because the per-VDOM HA configuration for VDOM-B explicitly disables session pickup with 'set session-pickup disable'. Even though the global HA settings enable session pickup, the per-VDOM setting overrides the global setting for that VDOM. As a result, after a failover, sessions in VDOM-B are not synchronized to the standby FortiGate and are not picked up, causing disruption for guest users.

Answer

The HA priority of the cluster is set too low, causing session pickup to fail for VDOM-B.

Answer

Session pickup for connectionless protocols is not enabled, so UDP sessions in VDOM-B are not picked up.

Answer

The interfaces assigned to VDOM-B do not have session pickup enabled.

Question 8

Drag and drop the steps to configure a site-to-site IPsec VPN on a FortiGate firewall into the correct order.

Question 9

Drag and drop the steps to configure an HA cluster on FortiGate into the correct order.

Question 10

Drag and drop the steps to configure a FortiGate to send logs to a FortiAnalyzer into the correct order.

Question 11

Drag and drop the steps to configure a FortiGate as a DNS server (DNS proxy) into the correct order.

Question 12

Match each Fortinet security feature to its primary function.

Question 13

Match each Fortinet component to its description.

Question 14

Match each FortiGate routing concept to its description.

Question 15

Match each FortiGate authentication method to its protocol.

NSE7 Enterprise Firewall and VDOMs Practice Test 3 — 15 Questions

Exhibit

NSE7 Enterprise Firewall and VDOMs Practice Test 3 — 15 Questions

Exhibit