NSE7_EFW-7.2 Exam Preparation Material | Fortinet NSE 7 - Enterprise Firewall 7.2

Explanation:
To ensure that only one remote site is connected at any given time in an IPsec VPN scenario, you should use route-overlap with the option to either use-new or use-old. This setting dictates which routes are preferred and how overlaps in routes are handled, allowing for one connection to take precedence over the other (C).
Reference: FortiOS Handbook - IPsec VPN

Explanation:
From the OSPF interface command output, we can conclude that the port3 network has more than one OSPF router because the Neighbor Count is 2, indicating the presence of another OSPF router besides NGFW-1. Additionally, we can deduce that the interfaces of the OSPF routers match the MTU value configured as 1500, which is necessary for OSPF neighbors to form adjacencies. The MTU mismatch would prevent OSPF from forming a neighbor relationship.
Reference: Fortinet FortiOS Handbook: OSPF Configuration

Explanation:
Option A is correct because the address object on the tool FortiGate will not be synchronized with the downstream devices if it has fabric-object set to disable. This option controls whether the address object is shared with other FortiGate devices in the Security Fabric or not1.
Option C is correct because the downstream FortiGate will not receive the address object from the tool FortiGate if it has fabric-object-unification set to local. This option controls whether the downstream FortiGate uses the address objects from the root FortiGate or its own local address objects2.
Option B is incorrect because the root FortiGate has configuration-sync set to enable by default, which means that it will synchronize the address objects with the downstream devices unless they are disabled by the fabric-object option3.
Option D is incorrect because the downstream FortiGate has configuration-sync set to local by default, which means that it will receive the address objects from the root FortiGate unless they are overridden by the fabric-object-unification option4.
Reference: =
1: Group address objects synchronized from FortiManager5
2: Security Fabric address object unification6
3: Configuration synchronization7
4: Configuration synchronization7
: Security Fabric - Fortinet Documentation

Explanation:
From the partial interface configuration of two FortiGate devices:
On failover, the new primary device uses the same MAC address as the old primary.
The configuration line set vrrp-virtual-mac enable suggests that Virtual Router Redundancy Protocol (VRRP) is being used with a virtual MAC address. This ensures that if a failover occurs, the new primary device will use the same virtual MAC address that was used by the previous primary, preventing the need for ARP cache updates on downstream devices.
By default, FortiGate B is the primary virtual router.
The priority setting in VRRP determines which device will be the master. The device with the higher priority will become the master router. In this configuration, FortiGate B has a higher priority (50) than FortiGate A (priority 255, which is a lower priority in VRRP terms).