91 questions total · 2pages · All types, answers revealed
Page 2 of 2
Which THREE aspects of the FortiGate system are affected by changing the global 'set vdom-mode' to 'multi-vdom'?
The 'config vdom' context becomes available.
Why this answer
Changing the VDOM mode affects the CLI hierarchy, the available memory for VDOMs, and how system resources are partitioned.
What does the 'FortiGuard' service provide to the FortiGate?
This allows the FortiGate to block the latest threats.
Why this answer
FortiGuard provides real-time updates for security signatures, including IPS, Antivirus, and Web Filtering.
Which THREE actions can be performed by the FortiGate when a policy match occurs?
Limits bandwidth usage.
Why this answer
Firewall policies can accept, deny, or perform traffic shaping and logging depending on the configured profile settings.
When using SD-WAN, how does the 'member' configuration interact with physical interfaces?
You add physical ports to the SD-WAN zone to utilize them for load balancing.
Why this answer
SD-WAN members are physical interfaces (or tunnels) added to the SD-WAN zone, allowing the FortiGate to manage them as a single logical pool.
Which THREE factors influence log storage efficiency on a FortiAnalyzer/FortiManager?
Compression reduces storage footprint.
Why this answer
Log compression, log retention settings, and disk quota management determine how long logs persist and how much space they consume.
Which FortiManager feature allows an administrator to test policy changes in a sandbox environment before applying them to production FortiGates?
Cloning allows for safe testing of changes.
Why this answer
The 'Revision History' or 'Policy Package cloning' allows admins to modify and verify changes before pushing them to the production devices.
Which TWO settings are modified to reduce the impact of a failover event in an HA cluster?
Faster interval leads to faster detection.
Why this answer
'hb-interval' and 'hb-lost-threshold' determine how quickly the cluster reacts to heartbeat loss.
A trusted certificate is required for secure handshakes.
Why this answer
Tunnel mode requires a configured portal and a policy allowing the VPN tunnel interface to the internal network.
You are configuring BGP and need to advertise a summary route to your ISP. How do you ensure only the summary route is advertised?
This command effectively suppresses specific routes.
Why this answer
The 'aggregate-address' command with the 'summary-only' option is the correct way to advertise only the summary and suppress specific component routes.
An administrator notices that hardware acceleration (NP6) is failing to offload traffic for a specific policy. Which command is best used to verify if hardware offloading is actually occurring for a specific session?
The session list output includes flags like 'offload' which indicate if the NP is handling the session.
Why this answer
The command 'diag sys session filter' combined with 'diag sys session list' allows the administrator to view session flags, specifically looking for the 'offload' flag.
A FortiGate is performing OSPF routing. You want to redistribute connected routes into OSPF, but only for a specific subnet. How can this be achieved?
Route maps provide the necessary granularity to filter prefixes during redistribution.
Why this answer
A route map must be applied during redistribution to filter the prefixes being injected.
You are troubleshooting high CPU usage on a FortiGate. Which process would you check to see if the IPS engine is the cause?
This shows all running processes and their resource consumption.
Why this answer
The 'diag sys top' command displays real-time resource utilization, allowing the admin to identify specific processes like 'ipsengine' consuming CPU.
Which CLI command shows the current HA synchronization status and the checksums of the configurations?
This command provides the cluster state and configuration synchronization verification.
Why this answer
'get system ha status' provides the overall cluster health, including checksum comparison between nodes.
What is the default behavior of a FortiGate firewall policy when no explicit policy matches the traffic?
The implicit deny policy is the default safety catch-all.
Why this answer
The implicit deny policy is the last rule in the firewall policy list and drops all non-matching traffic.
Which TWO of the following are valid methods for user authentication on a FortiGate?
RADIUS is a standard for enterprise authentication.
Why this answer
FortiGate supports both local user databases and integration with external enterprise servers like RADIUS and LDAP.
Which feature allows an administrator to offload SSL inspection to the hardware?
The Content Processor (CP) offloads encryption/decryption.
Why this answer
The FortiASIC CP (Content Processor) hardware chips are specifically designed to offload CPU-intensive tasks like SSL/TLS decryption.
Page 2 of 2
Practice NSE7_EFW by domain
Target a specific domain to shore up weak areas.
See all domains with question counts →