NSE7-EFW-7-2 Fortinet NSE 7 - Enterprise Firewall 7.2 Practice Questions

The auto-asic-offload setting, which is enabled by default on firewall policies, instructs the FortiGate to offload sessions that match the policy to hardware ASICs (like NP processors) if the session is eligible for acceleration. This significantly improves performance by moving packet processing from the main CPU to specialized hardware. Disabling this setting forces all matching traffic to be processed by the CPU, which might be necessary for troubleshooting or for features incompatible with offloading.

Route summarization is the correct feature to reduce the size of routing tables in adjacent areas. By configuring an area range (summarization) on the ABR for Area 0, the ABR will advertise a single summary route into Area 1 instead of multiple specific prefixes from Area 0. This directly reduces the number of LSAs and routing table entries within Area 1. While stubby areas also reduce routing table size, summarization provides more granular control.

The core benefit of ADVPN is its ability to create dynamic, direct tunnels (shortcuts) between spokes. If the hub is routing traffic between spokes, it implies that these shortcuts are not forming or are not being used. The most effective solution is to troubleshoot the ADVPN configuration (including routing and IKE settings) to ensure that spokes can establish direct tunnels for their traffic. Once the shortcut is established, the backup traffic will flow directly between the spokes, bypassing the hub and significantly reducing its CPU load.

When a script is run with the target set to 'Remote FortiGate Directly', FortiManager connects to the device and applies the configuration changes live. This bypasses the FortiManager's own database for that device. As a result, the live configuration on the FortiGate no longer matches the configuration stored in FortiManager's database, leading to an 'Out of Sync' status. To resolve this, the administrator must re-import the configuration from the device.

Application Control is the primary tool for identifying and controlling specific applications or categories of applications, such as cloud storage. Blocking the 'Storage.Backup' category will prevent access to most common cloud storage services. For a more granular approach, a Data Loss Prevention (DLP) sensor can be used to inspect traffic and block sessions that involve file uploads, regardless of the specific application, providing a second layer of enforcement.

The set configuration-sync-mode incremental command under config system ha ensures that any configuration changes, including those made via the CLI, are synchronized incrementally and immediately to the secondary unit. This is crucial for maintaining configuration parity for compliance and operational consistency. session-pickup relates to synchronizing session tables, not configuration. The other options are not valid FortiOS commands.

The Multi-Exit Discriminator (MED) is a non-transitive BGP attribute used to influence how a neighboring AS enters your AS when multiple entry points exist. A lower MED value is preferred. This makes it the ideal attribute for regional border routers to signal to other regions which entry point is optimal. Local Preference influences outbound traffic, AS Path Prepending also influences inbound traffic but is less granular, and Weight is local to the router.

For ADVPN to function, the hub must act as the central point for shortcut negotiation messages (IKE_CREATE_CHILD_SA). set auto-discovery-sender enable allows the hub to send shortcut offers to spokes. set auto-discovery-receiver enable allows the hub to receive shortcut requests from spokes and forward them to the correct destination spoke. Together, these settings enable the hub to facilitate the dynamic creation of spoke-to-spoke tunnels.

To capture the actual packet data that triggers an IPS signature, 'packet logging' must be enabled within the specific IPS sensor applied to the traffic. This feature saves a copy of the triggering packet(s) to the log, which is invaluable for forensic analysis to confirm the attack's nature and payload. Other logging settings, like extended logging or firewall policy logging, do not capture the packet payload for IPS events.

This statement is false. When FortiManager is configured as a local FDS, it can serve not only AV and IPS updates but also handle real-time web filtering and antispam rating requests. This allows managed FortiGates in a closed or bandwidth-constrained network to perform these lookups locally against the FortiManager, which then queries the public FortiGuard network on their behalf.