Fortinet Certified Solution Specialist - Enterprise Firewall 7.4 Administrator Free Sample Questions

The most efficient method is to use a single policy package for consistency and apply per-device mapping for the specific objects that need to be unique, such as the URL filter entry. This avoids the massive overhead of managing 50 separate policy packages and leverages FortiManager's dynamic object capabilities.

To achieve hub redundancy in an ADVPN setup, you can either use a standard FortiGate HA cluster for the hub role, which provides device-level failover, or deploy two independent hubs and configure spokes to establish tunnels to both. The latter provides greater resiliency, including against ISP or site failure at the primary hub location.

This statement is false. While session pickup synchronizes TCP sessions, it does not synchronize connectionless sessions like UDP and ICMP by default. These sessions will be dropped and must be re-established after a failover. For some specific protocols like SIP, session helpers can assist, but it is not a universal guarantee for all session types.

The correct and most direct method is to add the fully qualified domain names (FQDNs) of the problematic services to the exemption list within the SSL/SSH Inspection profile itself. This allows the firewall policy to remain simple while giving granular control over which destinations are bypassed by the deep inspection engine.

In FortiOS, when two static routes have the same destination and administrative distance, the route with the lower priority value is considered superior and will be installed as the active route in the routing table. The higher priority route will only be used if the lower priority route becomes inactive.

On FortiGate models with multiple NP7 processors, you can dedicate specific processors to particular VDOMs. By using the config global and config system npu CLI commands to set vdom-npu-affinity, the administrator can bind the 'Guest-WiFi' VDOM to a specific NP7, ensuring its traffic is prioritized for hardware acceleration by that processor.

In FortiManager, permissions are granular. Even with Super_User rights within an ADOM, the administrator's overall access profile must explicitly grant permissions for 'Script Management'. Without this specific permission, the administrator cannot create, edit, or run scripts, resulting in a 'permission denied' error.

When auto-negotiate is disabled, the FortiGate will not attempt to bring the tunnel up automatically after it goes down (for example, due to lifetime expiration). It will wait for interesting traffic to trigger the negotiation. Since the disconnection happens overnight when traffic is low, the tunnel remains down. Enabling auto-negotiate ensures the FortiGate proactively re-establishes the tunnel.

The best approach is to use a FortiAnalyzer event handler. An event handler can be configured to automatically process incoming logs that match specific criteria (like the IPS signature ID). It can then perform an action, such as marking the event as acknowledged or changing its severity, which effectively hides it from the default alert views without deleting the log data. This preserves visibility for forensic purposes while cleaning up the active monitoring console.

Traffic between VDOMs on the same device can be routed either virtually using an inter-VDOM link (a software or hardware-accelerated connection) or physically by connecting two ports with a cable and assigning each port to a different VDOM. The inter-VDOM link is the more common and efficient method.