Fortinet Enterprise Firewall 7.6 FCSS_EFW_AD-7.6 FortiGate Hardware Acceleration Practice Test

 

This practice test focuses on fortigate hardware acceleration and performance paths through original applied scenarios aligned to the final published Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator 7.6 blueprint. It is intended for study and does not reproduce live exam content. For broader exam preparation, review the Fortinet FCSS_EFW_AD-7.6 Exam Dumps page.

Question 1

While troubleshooting at Humongous Insurance, the network operations engineer needs to verify whether eligible firewall sessions are being offloaded rather than assuming high CPU always means no acceleration. What is the best next step? Use normal enterprise Fortinet administration practice. Only one site is affected; peer sites are healthy.

• Compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing
• Inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use
• Use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls
• Keep the policy and session features compatible with hardware offload and confirm offload status after the change
• Check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability

Correct answer: B

Explanation

1. Deep inspection can change the processing path and resource profile even when routing is unchanged. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to verify whether eligible firewall sessions are being offloaded rather than assuming high CPU always means no acceleration.
2. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded. This directly addresses the stated requirement.
3. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to verify whether eligible firewall sessions are being offloaded rather than assuming high CPU always means no acceleration.
4. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to verify whether eligible firewall sessions are being offloaded rather than assuming high CPU always means no acceleration.
5. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to verify whether eligible firewall sessions are being offloaded rather than assuming high CPU always means no acceleration.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded.

Question 2

Margie Travel is standardizing a FortiOS 7.6 enterprise deployment. Which approach should it use to preserve NPU offload for a high-throughput policy where no inspection feature requires the CPU path? Assume the platform versions are compatible with the feature. The change must be validated on a pilot device before broader rollout.

• Keep the policy and session features compatible with hardware offload and confirm offload status after the change
• Use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls
• Inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use
• Compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing
• Check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability

Correct answer: A

Explanation

1. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware. This directly addresses the stated requirement.
2. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to preserve NPU offload for a high-throughput policy where no inspection feature requires the CPU path.
3. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to preserve NPU offload for a high-throughput policy where no inspection feature requires the CPU path.
4. Deep inspection can change the processing path and resource profile even when routing is unchanged. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to preserve NPU offload for a high-throughput policy where no inspection feature requires the CPU path.
5. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to preserve NPU offload for a high-throughput policy where no inspection feature requires the CPU path.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, keep the policy and session features compatible with hardware offload and confirm offload status after the change. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware.

Question 3

A change ticket for Northwind Health states that administrators must troubleshoot throughput loss that began after deep inspection was enabled. Which choice is correct? No unrelated control should be weakened. Existing production IP addressing must remain unchanged.

• Inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use
• Compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing
• Use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls
• Check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability
• Keep the policy and session features compatible with hardware offload and confirm offload status after the change

Correct answer: B

Explanation

1. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot throughput loss that began after deep inspection was enabled.
2. Deep inspection can change the processing path and resource profile even when routing is unchanged. This directly addresses the stated requirement.
3. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot throughput loss that began after deep inspection was enabled.
4. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot throughput loss that began after deep inspection was enabled.
5. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot throughput loss that began after deep inspection was enabled.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing. Deep inspection can change the processing path and resource profile even when routing is unchanged.

Question 4

The security team at Blue Yonder Airlines wants to determine whether a platform-specific acceleration feature is available before designing around it. Which configuration or operational action most directly satisfies that goal? The team will validate the result immediately after the change. The resulting configuration must remain centrally auditable.

• Keep the policy and session features compatible with hardware offload and confirm offload status after the change
• Use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls
• Check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability
• Inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use
• Compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing

Correct answer: C

Explanation

1. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to determine whether a platform-specific acceleration feature is available before designing around it.
2. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to determine whether a platform-specific acceleration feature is available before designing around it.
3. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities. This directly addresses the stated requirement.
4. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to determine whether a platform-specific acceleration feature is available before designing around it.
5. Deep inspection can change the processing path and resource profile even when routing is unchanged. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to determine whether a platform-specific acceleration feature is available before designing around it.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities.

Question 5

An incident at Trey Research requires the network security architect to avoid disabling security profiles merely to recover throughput during diagnosis. What should be done first? The change is taking place in a controlled maintenance window. A known-good rollback point is available before the change.

• Compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing
• Inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use
• Check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability
• Use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls
• Keep the policy and session features compatible with hardware offload and confirm offload status after the change

Correct answer: D

Explanation

1. Deep inspection can change the processing path and resource profile even when routing is unchanged. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid disabling security profiles merely to recover throughput during diagnosis.
2. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid disabling security profiles merely to recover throughput during diagnosis.
3. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid disabling security profiles merely to recover throughput during diagnosis.
4. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause. This directly addresses the stated requirement.
5. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid disabling security profiles merely to recover throughput during diagnosis.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause.

Question 6

For a FortiGate/FortiManager/FortiAnalyzer 7.6 deployment at Apex Retail, which option correctly addresses the need to verify whether eligible firewall sessions are being offloaded rather than assuming high CPU always means no acceleration? Choose the smallest targeted change. The design must preserve the current segmentation boundaries.

• Keep the policy and session features compatible with hardware offload and confirm offload status after the change
• Use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls
• Inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use
• Check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability
• Compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing

Correct answer: C

Explanation

1. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to verify whether eligible firewall sessions are being offloaded rather than assuming high CPU always means no acceleration.
2. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to verify whether eligible firewall sessions are being offloaded rather than assuming high CPU always means no acceleration.
3. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded. This directly addresses the stated requirement.
4. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to verify whether eligible firewall sessions are being offloaded rather than assuming high CPU always means no acceleration.
5. Deep inspection can change the processing path and resource profile even when routing is unchanged. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to verify whether eligible firewall sessions are being offloaded rather than assuming high CPU always means no acceleration.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded.

Question 7

Proseware Media has verified basic IP reachability. The remaining requirement is to preserve NPU offload for a high-throughput policy where no inspection feature requires the CPU path. Which action should the team take? The answer must address the stated cause rather than a different feature. The team is not allowed to disable the security feature globally.

• Compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing
• Inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use
• Use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls
• Check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability
• Keep the policy and session features compatible with hardware offload and confirm offload status after the change

Correct answer: E

Explanation

1. Deep inspection can change the processing path and resource profile even when routing is unchanged. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to preserve NPU offload for a high-throughput policy where no inspection feature requires the CPU path.
2. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to preserve NPU offload for a high-throughput policy where no inspection feature requires the CPU path.
3. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to preserve NPU offload for a high-throughput policy where no inspection feature requires the CPU path.
4. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to preserve NPU offload for a high-throughput policy where no inspection feature requires the CPU path.
5. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware. This directly addresses the stated requirement.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, keep the policy and session features compatible with hardware offload and confirm offload status after the change. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware.

Question 8

At City Power & Light, the security infrastructure engineer must troubleshoot throughput loss that began after deep inspection was enabled. Which action best addresses the requirement? Preserve the existing design unless the requirement says otherwise. The symptom appeared immediately after a planned configuration change.

• Inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use
• Use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls
• Check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability
• Keep the policy and session features compatible with hardware offload and confirm offload status after the change
• Compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing

Correct answer: E

Explanation

1. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot throughput loss that began after deep inspection was enabled.
2. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot throughput loss that began after deep inspection was enabled.
3. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot throughput loss that began after deep inspection was enabled.
4. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot throughput loss that began after deep inspection was enabled.
5. Deep inspection can change the processing path and resource profile even when routing is unchanged. This directly addresses the stated requirement.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing. Deep inspection can change the processing path and resource profile even when routing is unchanged.

Question 9

During an enterprise firewall change at VanArsdel, the team needs to determine whether a platform-specific acceleration feature is available before designing around it. What should it do? Prefer a change that is reversible and easy to verify. Logs from the affected traffic are available for verification.

• Inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use
• Check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability
• Compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing
• Use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls
• Keep the policy and session features compatible with hardware offload and confirm offload status after the change

Correct answer: B

Explanation

1. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to determine whether a platform-specific acceleration feature is available before designing around it.
2. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities. This directly addresses the stated requirement.
3. Deep inspection can change the processing path and resource profile even when routing is unchanged. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to determine whether a platform-specific acceleration feature is available before designing around it.
4. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to determine whether a platform-specific acceleration feature is available before designing around it.
5. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to determine whether a platform-specific acceleration feature is available before designing around it.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities.

Question 10

A production review at Woodgrove Bank identifies this requirement: avoid disabling security profiles merely to recover throughput during diagnosis. Which Fortinet action is most appropriate? The team needs an auditable result. The equivalent configuration works correctly at a separate site.

• Use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls
• Check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability
• Compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing
• Inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use
• Keep the policy and session features compatible with hardware offload and confirm offload status after the change

Correct answer: A

Explanation

1. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause. This directly addresses the stated requirement.
2. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid disabling security profiles merely to recover throughput during diagnosis.
3. Deep inspection can change the processing path and resource profile even when routing is unchanged. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid disabling security profiles merely to recover throughput during diagnosis.
4. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid disabling security profiles merely to recover throughput during diagnosis.
5. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid disabling security profiles merely to recover throughput during diagnosis.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause.

Question 11

While troubleshooting at Alpine Ski House, the network security architect needs to verify whether eligible firewall sessions are being offloaded rather than assuming high CPU always means no acceleration. What is the best next step? Use normal enterprise Fortinet administration practice. The change must be reversible within the same maintenance window.

• Inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use
• Check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability
• Keep the policy and session features compatible with hardware offload and confirm offload status after the change
• Use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls
• Compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing

Correct answer: A

Explanation

1. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded. This directly addresses the stated requirement.
2. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to verify whether eligible firewall sessions are being offloaded rather than assuming high CPU always means no acceleration.
3. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to verify whether eligible firewall sessions are being offloaded rather than assuming high CPU always means no acceleration.
4. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to verify whether eligible firewall sessions are being offloaded rather than assuming high CPU always means no acceleration.
5. Deep inspection can change the processing path and resource profile even when routing is unchanged. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to verify whether eligible firewall sessions are being offloaded rather than assuming high CPU always means no acceleration.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded.

Question 12

Datum Corporation is standardizing a FortiOS 7.6 enterprise deployment. Which approach should it use to preserve NPU offload for a high-throughput policy where no inspection feature requires the CPU path? Assume the platform versions are compatible with the feature. The device is already synchronized with its central-management database.

• Use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls
• Compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing
• Inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use
• Keep the policy and session features compatible with hardware offload and confirm offload status after the change
• Check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability

Correct answer: D

Explanation

1. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to preserve NPU offload for a high-throughput policy where no inspection feature requires the CPU path.
2. Deep inspection can change the processing path and resource profile even when routing is unchanged. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to preserve NPU offload for a high-throughput policy where no inspection feature requires the CPU path.
3. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to preserve NPU offload for a high-throughput policy where no inspection feature requires the CPU path.
4. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware. This directly addresses the stated requirement.
5. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to preserve NPU offload for a high-throughput policy where no inspection feature requires the CPU path.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, keep the policy and session features compatible with hardware offload and confirm offload status after the change. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware.

Question 13

A change ticket for Contoso Finance states that administrators must troubleshoot throughput loss that began after deep inspection was enabled. Which choice is correct? No unrelated control should be weakened. The current routing table contains the expected connected networks.

• Use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls
• Keep the policy and session features compatible with hardware offload and confirm offload status after the change
• Compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing
• Check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability
• Inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use

Correct answer: C

Explanation

1. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot throughput loss that began after deep inspection was enabled.
2. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot throughput loss that began after deep inspection was enabled.
3. Deep inspection can change the processing path and resource profile even when routing is unchanged. This directly addresses the stated requirement.
4. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot throughput loss that began after deep inspection was enabled.
5. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot throughput loss that began after deep inspection was enabled.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing. Deep inspection can change the processing path and resource profile even when routing is unchanged.

Question 14

The security team at Litware Logistics wants to determine whether a platform-specific acceleration feature is available before designing around it. Which configuration or operational action most directly satisfies that goal? The team will validate the result immediately after the change. Basic IP reachability to the remote endpoint has already been verified.

• Use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls
• Inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use
• Keep the policy and session features compatible with hardware offload and confirm offload status after the change
• Check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability
• Compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing

Correct answer: D

Explanation

1. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to determine whether a platform-specific acceleration feature is available before designing around it.
2. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to determine whether a platform-specific acceleration feature is available before designing around it.
3. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to determine whether a platform-specific acceleration feature is available before designing around it.
4. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities. This directly addresses the stated requirement.
5. Deep inspection can change the processing path and resource profile even when routing is unchanged. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to determine whether a platform-specific acceleration feature is available before designing around it.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities.

Question 15

An incident at Wide World Importers requires the NOC engineer to avoid disabling security profiles merely to recover throughput during diagnosis. What should be done first? The change is taking place in a controlled maintenance window. Hardware replacement is outside the approved change scope.

• Compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing
• Keep the policy and session features compatible with hardware offload and confirm offload status after the change
• Check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability
• Inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use
• Use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls

Correct answer: E

Explanation

1. Deep inspection can change the processing path and resource profile even when routing is unchanged. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid disabling security profiles merely to recover throughput during diagnosis.
2. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid disabling security profiles merely to recover throughput during diagnosis.
3. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid disabling security profiles merely to recover throughput during diagnosis.
4. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid disabling security profiles merely to recover throughput during diagnosis.
5. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause. This directly addresses the stated requirement.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause.

Question 16

For a FortiGate/FortiManager/FortiAnalyzer 7.6 deployment at Relecloud, which option correctly addresses the need to verify whether eligible firewall sessions are being offloaded rather than assuming high CPU always means no acceleration? Choose the smallest targeted change. The requirement applies only to one policy, peer, or managed device group.

• Compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing
• Check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability
• Keep the policy and session features compatible with hardware offload and confirm offload status after the change
• Use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls
• Inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use

Correct answer: E

Explanation

1. Deep inspection can change the processing path and resource profile even when routing is unchanged. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to verify whether eligible firewall sessions are being offloaded rather than assuming high CPU always means no acceleration.
2. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to verify whether eligible firewall sessions are being offloaded rather than assuming high CPU always means no acceleration.
3. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to verify whether eligible firewall sessions are being offloaded rather than assuming high CPU always means no acceleration.
4. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to verify whether eligible firewall sessions are being offloaded rather than assuming high CPU always means no acceleration.
5. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded. This directly addresses the stated requirement.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded.

Question 17

Adventure Works has verified basic IP reachability. The remaining requirement is to preserve NPU offload for a high-throughput policy where no inspection feature requires the CPU path. Which action should the team take? The answer must address the stated cause rather than a different feature. The team must avoid broadening administrative trust or permissions.

• Use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls
• Inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use
• Keep the policy and session features compatible with hardware offload and confirm offload status after the change
• Check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability
• Compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing

Correct answer: C

Explanation

1. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to preserve NPU offload for a high-throughput policy where no inspection feature requires the CPU path.
2. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to preserve NPU offload for a high-throughput policy where no inspection feature requires the CPU path.
3. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware. This directly addresses the stated requirement.
4. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to preserve NPU offload for a high-throughput policy where no inspection feature requires the CPU path.
5. Deep inspection can change the processing path and resource profile even when routing is unchanged. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to preserve NPU offload for a high-throughput policy where no inspection feature requires the CPU path.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, keep the policy and session features compatible with hardware offload and confirm offload status after the change. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware.

Question 18

At Fourth Coffee, the Fortinet administrator must troubleshoot throughput loss that began after deep inspection was enabled. Which action best addresses the requirement? Preserve the existing design unless the requirement says otherwise. The design must preserve existing centralized logging and telemetry.

• Inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use
• Use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls
• Compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing
• Check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability
• Keep the policy and session features compatible with hardware offload and confirm offload status after the change

Correct answer: C

Explanation

1. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot throughput loss that began after deep inspection was enabled.
2. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot throughput loss that began after deep inspection was enabled.
3. Deep inspection can change the processing path and resource profile even when routing is unchanged. This directly addresses the stated requirement.
4. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot throughput loss that began after deep inspection was enabled.
5. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot throughput loss that began after deep inspection was enabled.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing. Deep inspection can change the processing path and resource profile even when routing is unchanged.

Question 19

During an enterprise firewall change at Coho Winery, the team needs to determine whether a platform-specific acceleration feature is available before designing around it. What should it do? Prefer a change that is reversible and easy to verify. Production subnets cannot be renumbered as part of this change.

• Use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls
• Inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use
• Keep the policy and session features compatible with hardware offload and confirm offload status after the change
• Check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability
• Compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing

Correct answer: D

Explanation

1. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to determine whether a platform-specific acceleration feature is available before designing around it.
2. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to determine whether a platform-specific acceleration feature is available before designing around it.
3. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to determine whether a platform-specific acceleration feature is available before designing around it.
4. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities. This directly addresses the stated requirement.
5. Deep inspection can change the processing path and resource profile even when routing is unchanged. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to determine whether a platform-specific acceleration feature is available before designing around it.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities.

Question 20

A production review at Fabrikam Manufacturing identifies this requirement: avoid disabling security profiles merely to recover throughput during diagnosis. Which Fortinet action is most appropriate? The team needs an auditable result. A maintenance window is open, but service interruption must be minimized.

• Compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing
• Use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls
• Inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use
• Keep the policy and session features compatible with hardware offload and confirm offload status after the change
• Check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability

Correct answer: B

Explanation

1. Deep inspection can change the processing path and resource profile even when routing is unchanged. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid disabling security profiles merely to recover throughput during diagnosis.
2. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause. This directly addresses the stated requirement.
3. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid disabling security profiles merely to recover throughput during diagnosis.
4. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid disabling security profiles merely to recover throughput during diagnosis.
5. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid disabling security profiles merely to recover throughput during diagnosis.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause.

Question 21

While troubleshooting at Wingtip Energy, the NOC engineer needs to verify whether eligible firewall sessions are being offloaded rather than assuming high CPU always means no acceleration. What is the best next step? Use normal enterprise Fortinet administration practice. The team must preserve existing certificate-trust relationships unless the requirement explicitly changes them.

• Keep the policy and session features compatible with hardware offload and confirm offload status after the change
• Check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability
• Compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing
• Use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls
• Inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use

Correct answer: E

Explanation

1. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to verify whether eligible firewall sessions are being offloaded rather than assuming high CPU always means no acceleration.
2. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to verify whether eligible firewall sessions are being offloaded rather than assuming high CPU always means no acceleration.
3. Deep inspection can change the processing path and resource profile even when routing is unchanged. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to verify whether eligible firewall sessions are being offloaded rather than assuming high CPU always means no acceleration.
4. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to verify whether eligible firewall sessions are being offloaded rather than assuming high CPU always means no acceleration.
5. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded. This directly addresses the stated requirement.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded.

Question 22

Lucerne Publishing is standardizing a FortiOS 7.6 enterprise deployment. Which approach should it use to preserve NPU offload for a high-throughput policy where no inspection feature requires the CPU path? Assume the platform versions are compatible with the feature. The change will be reviewed later using the configuration and event audit trail.

• Inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use
• Keep the policy and session features compatible with hardware offload and confirm offload status after the change
• Use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls
• Compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing
• Check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability

Correct answer: B

Explanation

1. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to preserve NPU offload for a high-throughput policy where no inspection feature requires the CPU path.
2. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware. This directly addresses the stated requirement.
3. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to preserve NPU offload for a high-throughput policy where no inspection feature requires the CPU path.
4. Deep inspection can change the processing path and resource profile even when routing is unchanged. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to preserve NPU offload for a high-throughput policy where no inspection feature requires the CPU path.
5. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to preserve NPU offload for a high-throughput policy where no inspection feature requires the CPU path.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, keep the policy and session features compatible with hardware offload and confirm offload status after the change. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware.

Question 23

A change ticket for Bellows College states that administrators must troubleshoot throughput loss that began after deep inspection was enabled. Which choice is correct? No unrelated control should be weakened. The chosen approach must continue to work as additional branch sites are added.

• Keep the policy and session features compatible with hardware offload and confirm offload status after the change
• Compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing
• Inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use
• Check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability
• Use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls

Correct answer: B

Explanation

1. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot throughput loss that began after deep inspection was enabled.
2. Deep inspection can change the processing path and resource profile even when routing is unchanged. This directly addresses the stated requirement.
3. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot throughput loss that began after deep inspection was enabled.
4. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot throughput loss that began after deep inspection was enabled.
5. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot throughput loss that began after deep inspection was enabled.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing. Deep inspection can change the processing path and resource profile even when routing is unchanged.

Question 24

The security team at Tailspin Toys wants to determine whether a platform-specific acceleration feature is available before designing around it. Which configuration or operational action most directly satisfies that goal? The team will validate the result immediately after the change. A second engineer will verify the result using independent operational evidence.

• Compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing
• Inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use
• Keep the policy and session features compatible with hardware offload and confirm offload status after the change
• Use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls
• Check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability

Correct answer: E

Explanation

1. Deep inspection can change the processing path and resource profile even when routing is unchanged. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to determine whether a platform-specific acceleration feature is available before designing around it.
2. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to determine whether a platform-specific acceleration feature is available before designing around it.
3. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to determine whether a platform-specific acceleration feature is available before designing around it.
4. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to determine whether a platform-specific acceleration feature is available before designing around it.
5. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities. This directly addresses the stated requirement.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities.

Question 25

An incident at Humongous Insurance requires the network operations engineer to avoid disabling security profiles merely to recover throughput during diagnosis. What should be done first? The change is taking place in a controlled maintenance window. The team requires a deterministic rollback path if validation fails.

• Compare accelerated and non-accelerated session handling and measure the inspection workload before changing routing
• Use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls
• Inspect session and platform acceleration indicators for the affected traffic and compare them with the policy features in use
• Keep the policy and session features compatible with hardware offload and confirm offload status after the change
• Check the exact FortiGate model architecture and FortiOS support for the required NP or CP capability

Correct answer: B

Explanation

1. Deep inspection can change the processing path and resource profile even when routing is unchanged. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid disabling security profiles merely to recover throughput during diagnosis.
2. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause. This directly addresses the stated requirement.
3. FortiGate acceleration depends on platform capability and session features; session diagnostics show whether traffic is eligible and actually offloaded. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid disabling security profiles merely to recover throughput during diagnosis.
4. Unsupported inspection or proxy features can force sessions onto the CPU path, while eligible flows can be accelerated by NP hardware. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid disabling security profiles merely to recover throughput during diagnosis.
5. Acceleration features vary by model and FortiOS release; design must be bound to the actual hardware capabilities. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid disabling security profiles merely to recover throughput during diagnosis.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, use session and performance diagnostics to identify whether the bottleneck is inspection, CPU, memory, or non-offloaded traffic before tuning controls. Evidence-driven tuning preserves needed controls and prevents an unrelated configuration change from masking the cause.