View all questions & answers for the NSE 7 - Enterprise Firewall 7.6 Administrator Exam Materials exam


Question 5 Discussion

You are checking an enterprise network and see a suspicious packet with the MAC address 00:09:0f:09:18:81. Which two statements about the suspicious packet are correct? (Choose two answers)

  • A. The suspicious packet is related to a cluster configured with the FortiGate Session Life Protocol (FGSP).
  • B. The suspicious packet is related to a cluster that has VDOMs enabled.
  • C. The suspicious packet corresponds to a port with a physical index equal to 2.
  • D. The suspicious packet is related to a cluster with a group-id value lower than 255.
Correct Answer: B,D

Brave-Dump Clients Votes

BD 100%

Comments



Brave-Dumps Admin 2025-09-16 17:16:28

Selected Answers: B, D


EFW 7.6 pages 94-99

Adam 2026-01-18 05:52:26

Selected Answers: B, D


Selected Answer: B, D
There are 4 logics for virtual MAC address of FortiGate HA
Logic 2 -> Vcluster ID = 0 or 1 & Group ID < 256 & Physical index < 128
Logic 2 : The virtual MAC address starts with 00:09:0f:09 + 8 bits for Group ID + 1 bit for Vcluster ID + 7 bits for physical NIC index
Group ID = 18 in Hex = 24 in decimal so D is correct and that's one of Logic 2 conditions anyway
Vcluster ID (Vcluster number that the interface belongs to minus one) = 1
If Vcluster ID = 0, then it's either virtual cluster with entry number 1 or virtual clustering is disabled, but here it's one so it must be enabled/configured with entry number 2
Virtual Clustering is extension of FGCP for a cluster of FortiGate devices with multiple VDOMs enabled, so B is correct
Physical NIC index = 1 so C is wrong