Courseiva

CCNA Nse7 Enterprise Firewall System Configuration Questions

21 questions · Nse7 Enterprise Firewall System Configuration topic · All types, answers revealed

Practice these questionsExam hubAll questions
1
MCQmedium

Which command allows you to view the current routing table for a specific VDOM?

A.get router info routing-table all
B.get system routing
C.diag ip route
D.show router table
AnswerA

The command get router info routing-table all displays the complete routing table, and within a specific VDOM context it shows only that VDOM's routes. This satisfies the requirement to view the current routing table for a chosen VDOM.

Why this answer

On FortiGate, the routing table for a specific VDOM is inspected with 'get router info routing-table all' executed inside that VDOM context. This command dumps all routes (connected, static, and dynamic) in the RIB for the active VDOM, which is essential when troubleshooting inter-VDOM or per-VDOM routing issues.

Exam trap

FORTINET-NSE7-SPECIALTY often tests whether candidates know the exact FortiOS command tree — 'get router info routing-table' versus plausible-sounding but non-existent commands like 'show router table' or 'diag ip route'.

How to eliminate wrong answers

Option B is wrong because 'get system routing' is not a valid FortiOS command — routing information is exposed through the 'get router info' command tree, not 'get system'. Option C is wrong because 'diag ip route' is not a FortiOS syntax; diagnostic IP commands exist but not in this form for viewing the routing table. Option D is wrong because 'show router table' is not a FortiOS command — 'show' is used for configuration objects, not runtime routing tables.

Practice this question →
2
Multi-Selectmedium

Which TWO methods are used to achieve traffic separation in a multi-VDOM environment?

Select 2 answers
A.Using VLAN sub-interfaces
B.Enabling SSL inspection globally
C.Assigning physical ports to VDOMs
D.Using different HA clusters
E.Using different firmware versions
AnswersA, C

VLAN sub-interfaces let a single physical port carry multiple tagged VLANs, each mapped to a different VDOM, so traffic is logically separated at layer 2 while sharing the same hardware interface. This satisfies multi-VDOM traffic separation without dedicating physical ports.

Why this answer

In a multi-VDOM FortiGate environment, traffic separation is achieved by assigning physical ports to VDOMs (option C), which places each interface in its own virtual domain so that traffic entering one VDOM cannot reach another VDOM unless an inter-VDOM link is explicitly configured. VLAN sub-interfaces (option A) also achieve traffic separation because each VLAN tag creates a distinct logical interface that can be bound to a specific VDOM, keeping tagged traffic isolated per VDOM. Options B, D, and E do not provide traffic separation: SSL inspection is a security inspection feature, different HA clusters relate to device redundancy rather than VDOM traffic isolation, and different firmware versions are irrelevant to VDOM traffic separation.

Exam trap

The trap is selecting security or redundancy features (SSL inspection, HA clusters) as traffic separation methods — candidates confuse 'isolation' with 'inspection' or 'redundancy,' but only interface/port assignment and VLAN sub-interfaces actually partition traffic.

Practice this question →
3
MCQmedium

When using SD-WAN, how does the 'member' configuration interact with physical interfaces?

A.Members replace the IP configuration
B.Members require a separate VDOM
C.Members are logical groups of interfaces
D.Members must have DHCP enabled
AnswerC

SD-WAN members are logical groupings that reference underlying physical interfaces, rather than being physical interfaces themselves. This abstraction lets multiple links be bundled into one SD-WAN zone, so traffic steering and health checks apply to the logical member while the physical interface carries the traffic.

Why this answer

In FortiGate SD-WAN, a 'member' is a logical construct that binds a physical (or VLAN) interface into the SD-WAN virtual interface (virtual-wan-link). The member does not replace the interface's IP configuration — it references the underlying interface, which retains its own IP, gateway, and DHCP settings. Members are essentially logical groupings that let the SD-WAN engine treat multiple WAN links as a single logical egress.

Exam trap

FORTINET-NSE7-SPECIALTY often tests whether candidates understand that SD-WAN members are logical references to existing interfaces, not replacements — the misconception that members reconfigure or replace interface IP settings leads to wrong answers.

How to eliminate wrong answers

Option A is wrong because SD-WAN members reference existing interfaces and do not replace or override their IP configuration; the physical interface keeps its addressing. Option B is wrong because SD-WAN members do not require a separate VDOM — they operate within the same VDOM as the SD-WAN interface. Option D is wrong because DHCP is not a requirement for SD-WAN membership; members can use static IPs, PPPoE, or DHCP depending on the WAN link type.

Practice this question →
4
MCQhard

You need to inspect traffic between two VDOMs. Which mechanism is required?

A.Policy-based routing
B.Physical loopback cable
C.Inter-VDOM Link
D.Static NAT
AnswerC

An inter-VDOM link creates a dedicated virtual connection between two VDOMs, allowing traffic to traverse and be inspected by firewall policies. Without it, VDOMs remain isolated, so this mechanism satisfies the requirement to inspect inter-VDOM traffic.

Why this answer

An Inter-VDOM Link is the virtual interface pair that connects two VDOMs on the same FortiGate, allowing traffic to pass between them. Each VDOM gets one end of the link, and firewall policies on both VDOMs control what traffic is permitted. Without an Inter-VDOM Link, VDOMs are fully isolated and cannot exchange traffic.

Policy-based routing, physical loopback cables, and static NAT do not provide inter-VDOM connectivity.

Exam trap

The trap is choosing a physical workaround (loopback cable) or a routing feature (PBR) instead of the purpose-built virtual interface — candidates overlook that FortiGate provides Inter-VDOM Links specifically for this requirement.

How to eliminate wrong answers

Option A is wrong because policy-based routing (PBR) influences path selection based on policy, but it does not create a connection between VDOMs — there must already be an interface path. Option B is wrong because a physical loopback cable would require two physical ports (one in each VDOM) cabled together, which is inefficient and not the intended mechanism; the Inter-VDOM Link is the virtual equivalent. Option D is wrong because static NAT translates addresses but does not bridge two isolated VDOMs — NAT requires an existing routed path.

Practice this question →
5
MCQhard

Which parameter, when modified in a policy, causes a session flush for all active connections hitting that policy?

A.Schedule
B.Action (Accept to Deny)
C.Comments field
D.Policy Name
AnswerB

Changing a policy's action from Accept to Deny alters the policy's identity, so FortiGate tears down every session matching it, forcing re-evaluation against the new action. Other edits, such as logging or comments, leave established sessions intact.

Why this answer

Changing the Action of a policy from Accept to Deny alters the fundamental handling of traffic that matches the policy. FortiOS must immediately tear down existing sessions that were permitted under the previous Accept action, because they are no longer authorized. This forces all active connections hitting that policy to be flushed and re-evaluated against the new Deny action.

Exam trap

The trap here is assuming that any policy modification causes a session flush, but only changes that affect traffic handling (like Action) do so; cosmetic changes like Comments or Name do not.

How to eliminate wrong answers

Option A is wrong because modifying the Schedule only affects when the policy is active; existing sessions are not flushed immediately, and the change takes effect based on time constraints. Option C is wrong because the Comments field is purely informational metadata and has no impact on session handling or policy enforcement. Option D is wrong because renaming a policy does not change its matching criteria or action, so active sessions remain unaffected and continue without a flush.

Practice this question →
6
Multi-Selectmedium

Which TWO components are synchronized between HA members?

Select 2 answers
A.Administrator credentials
B.Active session table
C.Local log files
D.Firmware image
E.Configuration database
AnswersB, E

Synchronising the active session table lets the standby FortiGate inherit established flows, so traffic already in progress continues without renegotiation or re-authentication when failover occurs. This satisfies the HA requirement for seamless session continuity, since the primary unit continuously replicates its session entries to the subordinate member.

Why this answer

In an HA (High Availability) cluster, the two members synchronize the active session table (option B) so that if a failover occurs, existing sessions can continue without being dropped, since session state is replicated to the standby unit. They also synchronize the configuration database (option E), ensuring both members share identical policy, object, and system settings so the standby can take over seamlessly. Administrator credentials are part of the configuration and are not synchronized as a separate component, local log files (option C) are not synchronized between HA peers, and firmware images (option D) are not synchronized as part of HA operation—each unit must be updated independently to matching versions.

Exam trap

Candidates might think that administrator credentials are synchronized separately, but they are part of the configuration database; the trap is selecting them as a separate component.

Practice this question →
7
MCQeasy

What is the default behavior for 'override' in FortiGate HA?

A.Depends on the model
B.Enabled
C.Always enabled
D.Disabled
AnswerD

FortiGate HA leaves override disabled by default, so a rebooted unit does not automatically reclaim the primary role. The cluster keeps its current primary unless override is enabled on the higher-priority member, avoiding unnecessary failovers.

Why this answer

In FortiGate HA, the 'override' setting is disabled by default. When disabled, the primary unit is selected based on the highest priority value, but if a higher-priority unit joins later it will not automatically preempt the current primary. Enabling override allows a unit with a higher priority to take over the primary role when it comes online.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the misconception that override is enabled by default or that it is required for HA to function, when in fact it is disabled by default and only controls preemption behavior.

How to eliminate wrong answers

Option A is wrong because the default value of override is consistent across FortiGate models and is not model-dependent. Option B is wrong because override is not enabled by default; it must be explicitly configured. Option C is wrong because override is never 'always enabled' — it is a configurable toggle that defaults to disabled.

Practice this question →
8
MCQeasy

What is the impact of changing the 'set vdom-mode' from 'no-vdom' to 'multi-vdom'?

A.Automatic disablement of HA
B.Loss of all firewall policies
C.No impact, immediate change
D.System reboot required
AnswerD

Switching from no-vdom to multi-vdom restructures the entire configuration hierarchy, so the FortiGate must reboot to reinitialise interfaces and routing tables under the new mode. This satisfies the stem's constraint that the change cannot apply at runtime.

Why this answer

Changing 'set vdom-mode' from 'no-vdom' to 'multi-vdom' requires a reboot because the FortiGate must reinitialize its configuration database and process architecture to support multiple virtual domains. VDOM mode is a global system setting that affects how interfaces, policies, routing tables, and admin domains are partitioned, so the change cannot be applied live. After the reboot, the default 'root' VDOM is created and the previous global configuration is migrated into it.

Exam trap

FORTINET-NSE7-SPECIALTY often tests whether candidates assume VDOM mode changes are hot-applied like most FortiGate settings — the trap is forgetting that this specific global setting mandates a reboot.

How to eliminate wrong answers

Option A is wrong because HA is not automatically disabled by enabling multi-vdom; HA can operate in either mode, though VDOM partitioning interacts with HA configuration and must be planned. Option B is wrong because existing firewall policies are not lost — they are migrated into the root VDOM during the mode change. Option C is wrong because the change is not immediate; the CLI explicitly warns that a reboot is required and prompts for confirmation.

Practice this question →
9
MCQmedium

A FortiGate is operating in transparent mode. What is the default behavior when the device receives a frame with an unknown MAC address?

A.Drop the packet
B.Flood to all ports
C.Forward to the management interface
D.Send an ICMP unreachable message
AnswerB

In transparent mode the FortiGate forwards frames by MAC address; an unknown destination MAC triggers flooding out all ports except the ingress, mirroring switch behaviour. This satisfies the stem's default-behaviour constraint for unrecognised MAC addresses.

Why this answer

In transparent mode, a FortiGate acts as a Layer 2 bridge and learns MAC addresses from incoming frames. When it receives a frame destined for a MAC address not present in its forwarding table (unknown unicast), the default behavior is to flood the frame out all ports in the same broadcast domain except the ingress port — standard Ethernet bridge behavior. This ensures the frame reaches its destination even before the MAC is learned.

Exam trap

The trap is assuming transparent mode behaves like a router (dropping or sending ICMP for unknown destinations) — candidates forget that transparent mode is fundamentally a Layer 2 bridge, so flooding is the correct default for unknown MACs.

How to eliminate wrong answers

Option A is wrong because dropping unknown unicast frames would break basic Layer 2 connectivity; bridges must flood unknown destinations to discover where hosts reside. Option C is wrong because forwarding to the management interface would be a security risk and is not how transparent-mode bridging works — the management interface is separate from the data plane. Option D is wrong because ICMP unreachable is a Layer 3 mechanism; transparent mode operates at Layer 2 and does not generate ICMP messages for unknown MAC addresses.

Practice this question →
10
MCQeasy

Which configuration mode allows you to define a virtual MAC address for an HA cluster to prevent ARP cache issues on switches?

A.DHCP relay
B.Static ARP
C.Virtual MAC
D.Physical MAC
AnswerC

Virtual MAC mode assigns a cluster-wide MAC shared by both units, so connected switches never see a changed source MAC after failover and their ARP caches stay valid. This directly satisfies the stem's requirement to prevent ARP cache issues.

Why this answer

In a FortiGate HA cluster, configuring a virtual MAC address ensures that the cluster's interfaces present a consistent MAC address to the network, regardless of which unit is active. This prevents ARP cache issues on switches and routers, as they see the same MAC for the cluster IP even after a failover. The virtual MAC is defined under the HA configuration and is used by the primary unit to send gratuitous ARP updates.

Exam trap

The trap is confusing virtual MAC with static ARP or physical MAC; candidates might think static ARP solves HA ARP issues, but it's the virtual MAC that provides seamless failover.

How to eliminate wrong answers

Option A is wrong because DHCP relay is used to forward DHCP requests between subnets and has no role in HA MAC addressing. Option B is wrong because static ARP entries are manually configured on hosts or switches and do not provide a dynamic, cluster-wide virtual MAC for HA. Option D is wrong because using the physical MAC of the active unit would cause ARP caches to become stale upon failover, leading to connectivity issues.

Practice this question →
11
MCQmedium

You are troubleshooting high CPU usage on a FortiGate. Which process would you check to see if the IPS engine is the cause?

A.diag sys top
B.get system status
C.diagnose hardware status
D.show sys resource
AnswerA

'diag sys top' lists running processes with their CPU consumption, letting you identify whether the IPS engine (ipsengine) is consuming excessive CPU. This directly confirms or rules out the IPS engine as the cause of the high utilisation.

Why this answer

The 'diagnose sys top' command displays real-time CPU and memory usage per process on the FortiGate, allowing you to identify if the IPS engine (often shown as 'ipsengine') is consuming excessive CPU. This is the standard tool for process-level CPU troubleshooting.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the correct diagnostic command for process-level CPU analysis, causing candidates to choose general status commands like 'get system status' instead of the process-monitoring 'diagnose sys top'.

How to eliminate wrong answers

Option B is wrong because 'get system status' shows firmware version, serial number, and uptime — not per-process CPU usage. Option C is wrong because 'diagnose hardware status' reports hardware health (fans, power supplies, temperature), not process CPU consumption. Option D is wrong because 'show sys resource' is not a valid FortiGate command for real-time process CPU monitoring; resource usage is viewed via 'diagnose sys top' or 'get system performance status'.

Practice this question →
12
Multi-Selecthard

Which THREE items are included in the configuration file of a FortiGate?

Select 3 answers
A.User certificates
B.Network interface settings
C.FortiGuard cached updates
D.Real-time session tables
E.Firewall policies
AnswersA, B, E

User certificates are stored in the FortiGate configuration, so they are backed up and restored with it. This satisfies the stem's requirement for items contained in the configuration file, since certificate objects are defined and referenced within the config itself.

Why this answer

The FortiGate configuration file is a plain-text dump of the device's persistent configuration, so it includes user certificates (A), which are stored under config vpn certificate local/remote and referenced by name in the config; network interface settings (B), stored under config system interface with IP addresses, masks, and administrative access; and firewall policies (E), stored under config firewall policy with source/destination, services, and actions. These are all configuration objects that survive a reboot and are restored by commands such as execute restore config or execute backup config. FortiGuard cached updates (C) are not part of the configuration file; they are downloaded content (e.g., antivirus/IPS signatures) stored in the FortiGuard cache and managed via execute update-now or automatic updates.

Real-time session tables (D) are dynamic runtime state held in memory and shown by diagnose sys session list, not persisted in the configuration file.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the boundary between persistent configuration and runtime/signature data — candidates incorrectly assume that anything the FortiGate 'knows' (like cached FortiGuard updates or session tables) must be in the config file.

Practice this question →
13
Multi-Selectmedium

Which TWO settings are modified to reduce the impact of a failover event in an HA cluster?

Select 2 answers
A.group-password
B.hb-interval
C.hb-lost-threshold
D.priority
E.monitored-interfaces
AnswersB, C

Shortening hb-interval makes heartbeat packets transmit more frequently, so a failed peer is detected sooner and the standby takes over faster. This directly reduces failover impact by cutting the outage window, satisfying the scenario's requirement to minimise disruption during an HA cluster failover event.

Why this answer

In an HA cluster, the heartbeat interval (B, hb-interval) controls how frequently heartbeat packets are exchanged between cluster members, so tuning it determines how quickly a node is detected as unreachable and thus how fast a failover is triggered. The heartbeat lost threshold (C, hb-lost-threshold) defines how many consecutive missed heartbeats are tolerated before the peer is declared dead, directly governing failover sensitivity and the resulting disruption window. Together, hb-interval and hb-lost-threshold are the two settings that shape failover timing and therefore reduce the impact of a failover event.

The group-password (A) is only an authentication secret for cluster communication and does not affect failover behavior, priority (D) influences which node becomes primary but not the failover impact itself, and monitored-interfaces (E) specifies which links are watched rather than tuning the failover event's impact.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the misconception that priority or monitored interfaces reduce failover impact, when the actual timing is controlled by heartbeat interval and lost threshold.

Practice this question →
14
Multi-Selecthard

Which THREE aspects of the FortiGate system are affected by changing the global 'set vdom-mode' to 'multi-vdom'?

Select 3 answers
A.CLI command hierarchy
B.The HA cluster size
C.Management of system resources
D.The physical port order
E.How firewall policies are applied
AnswersA, C, E

Switching to multi-vdom restructures the CLI command hierarchy, since configuration commands become scoped per VDOM under `config vdom`, and global settings move to `config global`. This directly satisfies the stem's constraint that the change affects the CLI command hierarchy, alongside routing and administrative domains.

Why this answer

Changing the global 'set vdom-mode' to 'multi-vdom' alters the CLI command hierarchy (A), because configuration commands become nested under 'config vdom' and you must enter a VDOM with 'config vdom / edit <name>' before configuring most objects. It also changes management of system resources (C), since interfaces, routing tables, firewall objects, and administrators can be partitioned and assigned per-VDOM, enabling independent resource and policy administration. It additionally changes how firewall policies are applied (E), because policies are defined and processed within each VDOM rather than globally, so traffic matching and policy lookup occur in the context of the VDOM that owns the ingress interface.

The HA cluster size (B) is not affected by VDOM mode, as HA membership and cluster limits are independent of VDOM configuration. The physical port order (D) is also unaffected, since interface naming and hardware port numbering remain the same regardless of VDOM mode.

Exam trap

The trap is assuming VDOM mode affects hardware or HA characteristics; Fortinet exams test that multi-VDOM changes CLI structure, resource management, and policy application scope.

Practice this question →
15
MCQhard

In a VDOM-enabled environment, how are administrative accounts managed?

A.Admins can be scoped to specific VDOMs
B.Only the root VDOM admin can change settings
C.Admins must be global
D.All admins see all VDOMs
AnswerA

In a VDOM-enabled environment, administrator accounts can be scoped to specific VDOMs, restricting each admin's visibility and configuration rights to assigned virtual domains. This satisfies least-privilege management, letting a super-admin retain global access while other admins operate only within their VDOM.

Why this answer

In a VDOM-enabled FortiGate, administrative accounts can be scoped to specific VDOMs, allowing granular delegation of management. An admin can be assigned to a single VDOM, multiple VDOMs, or all VDOMs (global), depending on the profile and requirements. This enables multi-tenant or departmental separation of duties.

Exam trap

The trap is that candidates assume VDOM admins must be global or that only root can manage, when in fact FortiGate supports fine-grained VDOM-scoped administrative accounts.

How to eliminate wrong answers

Option B is wrong because while the root (global) admin has the broadest privileges, other scoped admins can also change settings within their assigned VDOMs. Option C is wrong because admins do not have to be global — scoped admins are a core feature of VDOMs. Option D is wrong because admins only see the VDOMs they are assigned to, not all VDOMs, unless they are global admins.

Practice this question →
16
MCQeasy

Which FortiGate feature is used to group multiple physical interfaces for redundancy at Layer 2?

A.Loopback interface
B.802.3ad Aggregate
C.SD-WAN
D.VLAN tagging
AnswerB

An 802.3ad aggregate bundles multiple physical interfaces into one logical link using LACP, providing Layer 2 redundancy and increased bandwidth. This satisfies the requirement to group physical interfaces for redundancy at Layer 2, unlike static or standalone interface configurations.

Why this answer

802.3ad Aggregate is the FortiGate feature that bundles multiple physical interfaces into a single logical link using the IEEE 802.3ad Link Aggregation Control Protocol (LACP). This provides Layer 2 redundancy and increased bandwidth: if one member link fails, traffic continues over the remaining links. Loopback, SD-WAN, and VLAN tagging do not provide Layer 2 link redundancy.

Exam trap

The trap is confusing Layer 2 link aggregation (802.3ad) with Layer 3 path selection (SD-WAN) — candidates pick SD-WAN because it also provides redundancy, but the question specifies Layer 2 physical interface grouping.

How to eliminate wrong answers

Option A is wrong because a loopback interface is a virtual interface used for management or routing stability, not for grouping physical links. Option C is wrong because SD-WAN operates at Layer 3 and manages multiple WAN links for path selection and failover, not Layer 2 link aggregation. Option D is wrong because VLAN tagging (802.1Q) adds VLAN identifiers to frames for logical segmentation, not physical link redundancy.

Practice this question →
17
Multi-Selectmedium

Which TWO actions should be taken when preparing to upgrade a FortiGate HA cluster?

Select 2 answers
A.Review release notes
B.Clear all sessions
C.Backup the configuration
D.Disable heartbeat interfaces
E.Change HA mode to Standalone
AnswersA, C

Release notes document the supported upgrade path, known issues and behaviour changes for the target firmware. Reviewing them first confirms the cluster can move directly to that build, satisfying the stem's requirement to prepare the HA cluster safely before upgrading.

Why this answer

Option A (Review release notes) is correct because Fortinet release notes document the supported upgrade path, firmware version compatibility, and known issues that must be checked before upgrading an HA cluster to avoid breaking the cluster or losing configuration. Option C (Backup the configuration) is correct because a full configuration backup (e.g., via System > Backup or 'execute backup config') provides a rollback point in case the upgrade fails or the cluster does not re-form properly. Option B is not required because clearing all sessions is not a prerequisite for an HA upgrade and would disrupt traffic unnecessarily.

Option D is incorrect because disabling heartbeat interfaces would break HA communication and cause a split-brain or cluster failure. Option E is incorrect because changing HA mode to Standalone is not part of the upgrade procedure and would defeat the purpose of upgrading an HA cluster.

Exam trap

FORTINET-NSE7-SPECIALTY often tests whether candidates confuse routine operational tasks (like clearing sessions or changing HA mode) with the specific documented pre-upgrade checklist, which centers on release notes review and configuration backup.

Practice this question →
18
MCQeasy

What is the purpose of 'dedicated HA' interfaces?

A.To provide extra management access
B.To isolate heartbeat traffic
C.To increase throughput
D.To act as a backup WAN port
AnswerB

Dedicated HA interfaces carry only heartbeat and synchronisation traffic between cluster members, separating it from data and management traffic. This satisfies the requirement to isolate heartbeat traffic, preventing session load or management access from disrupting HA failover communication.

Why this answer

Dedicated HA interfaces are physical ports reserved exclusively for HA heartbeat and synchronization traffic between cluster members. By isolating heartbeat traffic on its own link, the cluster avoids contention with user data and prevents heartbeat packets from being delayed or dropped by heavy production traffic, which could trigger false failovers. This separation is why Fortinet recommends dedicated heartbeat ports in Active-Passive and Active-Active deployments.

Exam trap

The trap is assuming HA interfaces carry user traffic or provide management access — candidates conflate the HA heartbeat link with data or management planes, when its sole purpose is cluster control traffic isolation.

How to eliminate wrong answers

Option A is wrong because management access is provided by the dedicated management interface (or out-of-band management port), not by HA heartbeat interfaces — mixing the two would expose the cluster to management-plane interference. Option C is wrong because HA interfaces carry only heartbeat and session-sync traffic, not user throughput; they do not increase forwarding capacity. Option D is wrong because a backup WAN port is a data-plane function handled by SD-WAN or link redundancy, not by the HA heartbeat link.

Practice this question →
19
MCQmedium

What does the 'set tcp-rst-timeout' command control?

A.The TCP handshake timeout
B.The maximum session duration
C.The time to wait after sending a reset
D.The time before an idle session is dropped
AnswerC

The tcp-rst-timeout setting defines how long the FortiGate keeps a session entry alive after transmitting a TCP reset, before fully clearing it. This governs cleanup timing of torn-down sessions rather than idle timeouts or handshake behaviour.

Why this answer

The 'set tcp-rst-timeout' command defines how long the FortiGate keeps a session entry alive after it sends a TCP RST (reset) packet to tear down the connection. This allows the firewall to continue matching any stray packets belonging to that session for the specified duration, preventing them from being treated as new sessions. It is a session-cleanup timer, not a handshake or idle timer.

Exam trap

The trap is assuming tcp-rst-timeout is a general TCP timer like idle or handshake timeout — it specifically governs the post-RST session retention window, a narrow and easily confused behavior.

How to eliminate wrong answers

Option A is wrong because the TCP handshake timeout is governed by separate session timers (e.g., tcp-halfopen-timer, tcp-timewait-timer), not tcp-rst-timeout. Option B is wrong because maximum session duration is controlled by session-ttl or per-policy timeout settings, not the RST timer. Option D is wrong because idle session timeout is handled by tcp-idle-timer or the generic session idle timeout, whereas tcp-rst-timeout only applies after a RST is sent.

Practice this question →
20
Multi-Selecthard

Which THREE types of traffic are typically NOT offloaded by the NP6 processor?

Select 3 answers
A.Simple ICMP packets
B.Traffic requiring proxy-based inspection
C.Encrypted traffic before decryption
D.Traffic using unsupported protocols
E.Standard UDP traffic
AnswersB, C, D

Proxy-based inspection terminates and reassembles sessions for content scanning, which the NP6 cannot perform, so such traffic is handled by the CPU instead. This satisfies the scenario's constraint: offload requires flow-based processing, not proxy inspection.

Why this answer

Options B, C, and D are correct because the NP6 network processor in FortiGate appliances only offloads traffic it can fully parse and accelerate at the hardware level: proxy-based inspection (B) requires the full TCP/IP stack and application-layer processing in the CPU, so it cannot be offloaded; encrypted traffic before decryption (C) cannot be inspected or accelerated by the NP6 because the payload is opaque until the CPU/SSL engine decrypts it; and traffic using unsupported protocols (D) is not recognized by the NP6's fast-path parser, so it is punted to the CPU. By contrast, simple ICMP packets (A) and standard UDP traffic (E) are common, well-formed flows that the NP6 can parse and offload to its fast path, so they are not among the traffic types typically excluded from NP6 offloading.

Exam trap

The trap is assuming the NP6 offloads everything except 'complex' traffic — candidates often include ICMP or UDP as non-offloaded when in fact those are prime fast-path candidates.

Practice this question →
21
MCQeasy

A network administrator is configuring an HA cluster with two FortiGates in Active-Passive mode. Which parameter must be identical on both devices to ensure a successful cluster formation?

A.Device Hostname
B.Serial Number
C.HA Group ID
D.Priority value
AnswerC

The HA group ID must match on both members; it identifies which cluster a device joins, so mismatched values prevent the FortiGates from forming a single cluster. Identical group IDs satisfy the requirement for successful Active-Passive cluster formation.

Why this answer

In a FortiGate HA cluster, the HA Group ID (also called group-id) must be identical on all devices for them to form a cluster. The group ID is used to distinguish clusters on the same network and ensures that only devices with the same group ID can join the same cluster. Without a matching group ID, the devices will not form an HA cluster even if other settings match.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the parameters that must be identical for HA formation, and candidates may incorrectly assume that hostname or priority must match — the key is to remember that group ID is the critical matching parameter.

How to eliminate wrong answers

Option A is wrong because the device hostname does not need to be identical for HA formation; in fact, it is recommended that hostnames be unique to easily identify each unit, though they can be the same. Option B is wrong because the serial number is unique to each FortiGate and is never identical — it is used for licensing and identification, not for HA cluster formation. Option D is wrong because the priority value determines which device becomes the primary (higher priority wins) and can differ between devices; it is not required to be identical for cluster formation.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Nse7 Enterprise Firewall System Configuration questions.

Start 20-question session