View all questions & answers for the NSE 7 - Enterprise Firewall 7.6 Administrator Exam Materials exam


Question 37 Discussion

An administrator is checking an enterprise network and sees a suspicious packet with the MAC address e0:23:ff:fc:00:86. What two conclusions can the administrator draw? (Choose two answers)

  • A. The suspicious packet is related to a cluster that has VDOMs enabled.
  • B. The network includes FortiGate devices configured with the FGSP protocol.
  • C. The suspicious packet is related to a cluster with a group-id value lower than 255.
  • D. The suspicious packet corresponds to port 7 on a FortiGate device.
Correct Answer: A,D

Brave-Dump Clients Votes

AD 71.43%
AC 28.57%

Comments



Fatma Salih 2025-11-26 22:46:04

Selected Answers: A, C


logic 2
  • Fatma Salih 2025-11-26 22:48:04
    wrong explanation

Shabeeb Kunhipocker 2025-11-27 09:53:42

Selected Answers: A, D


Admin Guide , Page 98. This MAC comes under logic 1

Hasan Ahmed 2025-11-27 17:31:03

Selected Answers: A, C


correct answer A & C
  • Brave-Dumps Admin 2025-11-27 22:14:21
    A,D is the correct

Brave-Dumps Admin 2025-11-27 22:14:28

Selected Answers: A, D


A,D is the correct

Mike 2025-12-06 12:27:57

Selected Answers: A, D


logic 1, port is 7 because phyindex 6 = port7

Anonymous User 2025-12-26 18:46:47

Selected Answers: A, D


A is correct because the last byte 86 contains 0x80 (0x86 = 0x80 + 0x06). The 0x80 part indicates virtual-cluster 2 (vcluster2), which is used in HA when VDOMs / virtual clustering is enabled.

D is correct because the remaining 0x06 is the interface index, and index 6 corresponds to port7 (port1=0, port2=1, …, port7=6).

Adam 2026-01-19 09:58:07

Selected Answers: A, D


There are 4 logics for virtual MAC address of FortiGate HA
Logic 1: virtual MAC address = e0:23:ff + 111111 + 10 bits for (Group ID - 256) + 1 bit for vCluster ID + 7 bits for physical index
Logic 4: virtual MAC address = e0:23:ff + 111111 + 10 bits for physical index + 5 bits for vCluster ID + 3 bits for Group ID

MAC = e2:23:ff: 1111 1100 : 0000 0000 : 1000 0110
If it's Logic 1 -> Group ID = 256 & vCluster ID = 1 (edit vcluster -> edit 2) & physical index = 6 (port 7) -> D is correct
If it's logic 4 -> physical index = 0 (port 1) & vCluster ID = 16 (edit vcluster -> edit 17) & Group ID = 6 -> C is correct

Virtual Clustering is extension of FGCP for a cluster of FortiGate devices with multiple VDOMs enabled -> A is correct

Any idea why logic 4 is not applicable in this example?