31 questions · Nse7 Enterprise Firewall System Configuration · All types, answers revealed
Which command allows you to view the current routing table for a specific VDOM?
This displays the routing table for the current context.
Why this answer
The 'get router info' command is context-aware and must be prefixed with the VDOM scope or executed within the VDOM context.
Which TWO methods are used to achieve traffic separation in a multi-VDOM environment?
Logical separation on a single port.
Why this answer
Physical port assignment and VLAN tagging are the standard methods for segmenting traffic at the network edge in VDOMs.
Which CLI command shows the current HA synchronization status and the checksums of the configurations?
This command provides the cluster state and configuration synchronization verification.
Why this answer
'get system ha status' provides the overall cluster health, including checksum comparison between nodes.
When using SD-WAN, how does the 'member' configuration interact with physical interfaces?
You add physical ports to the SD-WAN zone to utilize them for load balancing.
Why this answer
SD-WAN members are physical interfaces (or tunnels) added to the SD-WAN zone, allowing the FortiGate to manage them as a single logical pool.
You need to inspect traffic between two VDOMs. Which mechanism is required?
This is the native FortiGate feature for VDOM-to-VDOM communication.
Why this answer
Inter-VDOM links are virtual interfaces used to route traffic between distinct VDOMs, essentially creating a 'cable' between them.
Which parameter, when modified in a policy, causes a session flush for all active connections hitting that policy?
Changing the action forces the existing session to be dropped/re-evaluated.
Why this answer
Changing critical security profile settings or specific policy parameters that affect the session tuple typically triggers a session flush to ensure consistent security enforcement.
An administrator notices that hardware acceleration (NP6) is failing to offload traffic for a specific policy. Which command is best used to verify if hardware offloading is actually occurring for a specific session?
The session list output includes flags like 'offload' which indicate if the NP is handling the session.
Why this answer
The command 'diag sys session filter' combined with 'diag sys session list' allows the administrator to view session flags, specifically looking for the 'offload' flag.
Which TWO components are synchronized between HA members?
Essential for seamless failover.
Why this answer
The configuration and the session table are the primary elements that must be synchronized for transparent failover.
Which TWO protocols are supported by the FortiGate for heartbeat synchronization between HA nodes?
HA heartbeats use a dedicated EtherType.
Why this answer
FortiGate uses proprietary HA keepalive packets over the configured HA interfaces.
What is the default behavior for 'override' in FortiGate HA?
The default setting is disabled to ensure stability.
Why this answer
Override is disabled by default to prevent unnecessary failbacks and flapping in the cluster.
If a FortiGate is in Active-Passive HA mode, what happens to the secondary device if the heartbeat is lost?
The loss of heartbeat triggers the election process.
Why this answer
If heartbeat is lost, the secondary assumes the master is down and attempts to promote itself to primary if it has the higher priority or preemption settings configured.
What is the impact of changing the 'set vdom-mode' from 'no-vdom' to 'multi-vdom'?
The configuration migration requires a system reload.
Why this answer
Changing the VDOM mode triggers a system reboot because it fundamentally changes how the kernel handles memory allocation and resource segmentation.
A FortiGate is operating in transparent mode. What is the default behavior when the device receives a frame with an unknown MAC address?
Standard bridging behavior for unknown unicast/broadcast frames.
Why this answer
In transparent mode, the FortiGate acts as a Layer 2 bridge and will flood the unknown frame to all interfaces in the bridge domain except the incoming port.
Which configuration mode allows you to define a virtual MAC address for an HA cluster to prevent ARP cache issues on switches?
Using a virtual MAC ensures the downstream switches do not need to relearn the MAC address during failover.
Why this answer
The 'ha-mgmt-status' and virtual MAC features ensure that the cluster presents a consistent MAC regardless of which node is master.
You are troubleshooting high CPU usage on a FortiGate. Which process would you check to see if the IPS engine is the cause?
This shows all running processes and their resource consumption.
Why this answer
The 'diag sys top' command displays real-time resource utilization, allowing the admin to identify specific processes like 'ipsengine' consuming CPU.
Which THREE items are included in the configuration file of a FortiGate?
Stored in the config file.
Why this answer
The configuration file contains system settings, policy rules, and interface definitions.
Which administrative access type is recommended to be disabled on public-facing interfaces for security best practices?
HTTP sends credentials in cleartext and should be restricted.
Why this answer
HTTP and Telnet are unencrypted protocols and should always be disabled on external interfaces.
Which TWO settings are modified to reduce the impact of a failover event in an HA cluster?
Faster interval leads to faster detection.
Why this answer
'hb-interval' and 'hb-lost-threshold' determine how quickly the cluster reacts to heartbeat loss.
You need to ensure that session synchronization between HA nodes is as efficient as possible. Which parameter should be tuned in the HA configuration?
This setting allows delaying session pickup, which can reduce CPU utilization during high-frequency session creation.
Why this answer
The 'session-pickup' setting, specifically 'session-pickup-delay', helps manage the timing and load of session synchronization to prevent CPU spikes.
Which THREE aspects of the FortiGate system are affected by changing the global 'set vdom-mode' to 'multi-vdom'?
The 'config vdom' context becomes available.
Why this answer
Changing the VDOM mode affects the CLI hierarchy, the available memory for VDOMs, and how system resources are partitioned.
Which THREE factors influence the Master election in an HA cluster?
Longest uptime wins if priority matches.
Why this answer
The election process considers the monitor status, the override setting, and the priority values of the devices.
In a VDOM-enabled environment, how are administrative accounts managed?
This is the primary benefit of administrative VDOM access control.
Why this answer
Administrative accounts can be restricted to specific VDOMs (Global admin vs. VDOM admin) for granular access control.
Which FortiGate feature is used to group multiple physical interfaces for redundancy at Layer 2?
This provides port-channel functionality.
Why this answer
802.3ad Link Aggregation (LACP) is the standard for binding physical ports into a single logical interface.
Which feature allows an administrator to offload SSL inspection to the hardware?
The Content Processor (CP) offloads encryption/decryption.
Why this answer
The FortiASIC CP (Content Processor) hardware chips are specifically designed to offload CPU-intensive tasks like SSL/TLS decryption.
Which TWO actions should be taken when preparing to upgrade a FortiGate HA cluster?
Crucial for known issues and upgrade paths.
Why this answer
A configuration backup is mandatory, and checking the release notes for firmware-specific HA behavior is critical for a smooth upgrade.
Which THREE conditions must be met for a successful Inter-VDOM link?
Point-to-point links require an L3 subnet.
Why this answer
Inter-VDOM links require pairing, routing, and specific interface assignment within the relevant VDOMs.
An administrator is troubleshooting an issue where hardware acceleration is not working after upgrading firmware. Which command identifies if the NP configuration has changed?
This allows verification of the port-to-NPU mapping.
Why this answer
'diag hardware npu np6 port-list' or similar status commands help verify the current operational state and mapping of physical ports to NPU cores.
What is the purpose of 'dedicated HA' interfaces?
Dedicated interfaces prevent data traffic from interfering with HA signaling.
Why this answer
They isolate heartbeat traffic from data traffic to prevent jitter and ensure cluster stability.
What does the 'set tcp-rst-timeout' command control?
This helps clean up resources after a connection reset.
Why this answer
It specifies how long the FortiGate waits after sending a TCP RST packet before clearing the session from the session table.
Which THREE types of traffic are typically NOT offloaded by the NP6 processor?
Proxy modes are CPU-intensive and generally not NP-offloaded.
Why this answer
Traffic that requires complex inspection, such as encrypted traffic that hasn't been decrypted or specific types of tunnels without hardware support, is handled by the CPU.
A network administrator is configuring an HA cluster with two FortiGates in Active-Passive mode. Which parameter must be identical on both devices to ensure a successful cluster formation?
The HA Group ID must match to allow devices to discover each other.
Why this answer
In an HA cluster, devices must share identical HA group IDs, passwords, and heartbeats to form a cluster.
Ready to test yourself?
Try a timed practice session using only Nse7 Enterprise Firewall System Configuration questions.