FCSS-EFW-AD-7-4 Sample Questions & Answers

On FortiGate models with multiple NP7 processors, you can dedicate specific processors to particular VDOMs. By using the config global and config system npu CLI commands to set vdom-npu-affinity, the administrator can bind the 'Guest-WiFi' VDOM to a specific NP7, ensuring its traffic is prioritized for hardware acceleration by that processor.

In FortiManager, permissions are granular. Even with Super_User rights within an ADOM, the administrator's overall access profile must explicitly grant permissions for 'Script Management'. Without this specific permission, the administrator cannot create, edit, or run scripts, resulting in a 'permission denied' error.

When auto-negotiate is disabled, the FortiGate will not attempt to bring the tunnel up automatically after it goes down (for example, due to lifetime expiration). It will wait for interesting traffic to trigger the negotiation. Since the disconnection happens overnight when traffic is low, the tunnel remains down. Enabling auto-negotiate ensures the FortiGate proactively re-establishes the tunnel.

The best approach is to use a FortiAnalyzer event handler. An event handler can be configured to automatically process incoming logs that match specific criteria (like the IPS signature ID). It can then perform an action, such as marking the event as acknowledged or changing its severity, which effectively hides it from the default alert views without deleting the log data. This preserves visibility for forensic purposes while cleaning up the active monitoring console.

Traffic between VDOMs on the same device can be routed either virtually using an inter-VDOM link (a software or hardware-accelerated connection) or physically by connecting two ports with a cable and assigning each port to a different VDOM. The inter-VDOM link is the more common and efficient method.

Metadata variables act as placeholders in a provisioning template. They allow you to create a single, generic configuration template that can be applied to many devices, while the variables are dynamically replaced with unique values (such as IP address, hostname, location) defined for each specific device in FortiManager.

The IKE_SA_INIT message is the very first packet in the IKEv2 exchange, sent over UDP port 500. If the remote peer does not respond at all, it almost always indicates a connectivity issue. The most common cause is a firewall policy on the local or remote side, or an upstream network device (like an ISP router), blocking the IKE (UDP 500) or NAT-T (UDP 4500) ports.

For a downstream FortiGate to join a Security Fabric, an interface on that device must be dedicated to this purpose. This is done by editing the interface and setting its role to 'Security Fabric Connection'. This allows the device to listen for and respond to authorization requests from the upstream (root) FortiGate.

For the lowest resource impact, flow-based inspection combined with a DNS filter profile is the most efficient choice. DNS filtering inspects only the DNS query itself to determine the category of the requested domain, blocking access before an HTTP session is even established. This is significantly less CPU-intensive than flow-based web filtering (which inspects HTTP headers) or proxy-based filtering (which buffers the entire content).

When an object (like an address or service) or a policy package that is assigned to a device is modified, FortiManager flags the device's configuration status as 'modified'. This indicates that the configuration stored on FortiManager for that device no longer matches the last installed configuration, even if the change was to a shared object rather than a direct device setting.