NSE7 Practice Test 28 — 15 Questions

Question 1

An administrator needs to ensure that traffic from the internal network (10.0.0.0/8) destined to the Internet is routed through a specific next-hop (192.168.1.1) only if a more specific route for the destination does not exist. Which routing feature should be used?

Accepted Answer

Use policy-based routing with a deny rule for the specific prefixes that have more specific routes.. Policy-based routing (PBR) allows traffic to be routed based on source/destination IP, port, etc., independent of the routing table. It can be configured to match traffic and set the next-hop, with a 'match' condition that can include the absence of a specific route. However, in FortiGate, policy-based routing rules are processed before the routing table, so if a more specific route exists, the PBR rule would still apply unless configured with the 'set match-vip' or other logic. Actually, the best way is to use a route map or prefix list with a deny statement for specific prefixes and then apply PBR. A simpler approach is to use default route with a higher distance, but that doesn't filter by destination. The correct answer is policy-based routing with a deny rule for specific prefixes.

Answer

Configure route redistribution from BGP to OSPF.

Answer

Enable ECMP load balancing.

Answer

Create a static default route with a higher administrative distance.

Question 2

During an SD-WAN health check, an administrator observes that a performance SLA for wan1 shows 'Status: dead' even though the interface is up and can ping the SLA server. The SLA configuration uses a TCP echo probe to 8.8.8.8 port 443. What is the most likely cause?

Accepted Answer

The probe protocol is TCP echo, but the server at 8.8.8.8 does not support TCP echo on port 443.. A TCP echo probe expects a TCP connection to the specified port, but the server must be configured to respond to TCP echo requests (RFC 862), which typically uses port 7. Using port 443 (HTTPS) would not result in a TCP echo response; the server would not send back the same data. The probe would fail, causing the SLA to show as dead.

Answer

The SLA server is blocking ICMP echo requests.

Answer

The performance SLA is configured with the wrong threshold.

Answer

The firewall policy allowing the probe traffic is missing.

Question 3

A FortiGate is configured with two SD-WAN members (wan1, wan2) and a performance SLA for each. The SD-WAN rule uses 'Maximize Bandwidth' strategy with volume-based load balancing. The administrator notices that traffic is only using wan1, even though both links have capacity. The SLA status for wan2 shows 'alive'. What could be the problem?

Accepted Answer

The SD-WAN rule has a 'set member' statement that lists only wan1.. The 'Maximize Bandwidth' strategy distributes traffic based on volume, but if the algorithm is set to 'Volume' and the bandwidth ratio settings (set bandwidth-weight) are imbalanced, one link might be preferred. However, the most common cause is that the SD-WAN rule's 'dst' or 'src' match criteria are restricting traffic to only wan1, or the rule's 'set member' includes only wan1. Another possibility: the rule might have 'set priority' or 'set input-device' that forces traffic to wan1.

Answer

The link cost for wan2 is too high.

Answer

The performance SLA for wan2 is not associated with the SD-WAN rule.

Answer

The bandwidth weight for wan2 is set to 0.

Question 4

An administrator wants to segment traffic between two departments (Engineering and Finance) using the same FortiGate. Each department must have its own routing table with overlapping IP addresses. Which feature should be enabled to achieve this without creating separate VDOMs?

Accepted Answer

VRF. VRF (Virtual Routing and Forwarding) allows multiple routing table instances within a single VDOM or global. It is ideal for network segmentation with overlapping IP spaces without the overhead of full VDOMs.

Answer

Policy-based routing

Answer

Virtual IP (VIP)

Answer

Multiple VDOMs

Question 5

A FortiGate is running OSPF in a multi-area network. The administrator notices that routes from area 1 are not being redistributed into area 0. The configuration includes 'redistribute connected' under OSPF. What is the most likely cause?

Accepted Answer

The 'redistribute connected' command is missing under the OSPF process. By default, OSPF only redistributes routes from other routing protocols or connected routes if configured. However, routes from other OSPF areas are not redistributed; they are learned via inter-area LSAs. If redistribution is not configured for connected or static routes, the issue might be that the routes are not being generated. Option C is a plausible cause: missing 'redistribute connected' under the OSPF process.

Answer

The OSPF network type is not broadcast

Answer

Area 1 is a stub area

Answer

The ABR is not configured with 'area 0'

Question 6

An administrator wants to integrate a FortiExtender with a FortiGate to provide cellular WAN connectivity. Which configuration step is required on the FortiGate to use the FortiExtender as an SD-WAN member?

Accepted Answer

Add the FortiExtender's interface to the SD-WAN zone. The FortiExtender must be registered and configured as an SD-WAN member, typically by enabling it as an interface and adding it to the SD-WAN zone.

Answer

Enable BGP on the FortiExtender interface

Answer

Create a firewall policy allowing traffic from the FortiExtender

Answer

Configure a static route pointing to the FortiExtender

Question 7

A network administrator is configuring SD-WAN on a FortiGate and wants to ensure that VoIP traffic uses the link with the lowest latency while bulk download traffic uses the link with the highest bandwidth. Which TWO configuration steps are required?

Accepted Answer

Create an SD-WAN rule for VoIP traffic with 'best quality' strategy. To achieve this, the administrator must create SD-WAN rules that match traffic types and assign appropriate strategies (best quality for VoIP, lowest cost for bulk).

Answer

Assign a static route for the VoIP subnet

Answer

Enable BFD on all WAN interfaces

Answer

Configure a route map for VoIP traffic

Question 8

What is the purpose of BFD (Bidirectional Forwarding Detection) in a FortiGate routing configuration?

Accepted Answer

To detect forwarding path failures quickly. BFD provides fast failure detection for routing protocols like OSPF and BGP, enabling sub-second convergence by detecting link failures faster than protocol hello timers.

Answer

To encrypt routing protocol traffic

Answer

To authenticate routing peers

Answer

To provide load balancing across multiple paths

Question 9

An administrator wants to integrate a FortiExtender with a FortiGate to provide WAN connectivity. Which interface type is used on the FortiGate to connect to the FortiExtender?

Accepted Answer

wan. FortiExtender connects via a WAN interface, typically configured as a 'wan' or 'vlan' interface. The FortiGate automatically detects the FortiExtender and creates a 'wwan' interface for the cellular link.

Answer

lan

Answer

dmz

Answer

loopback

Question 10

A FortiGate has multiple equal-cost routes to the same destination via two different interfaces. ECMP load balancing is enabled. What determines how traffic is distributed among the routes?

Accepted Answer

A hash of source and destination IP addresses. ECMP uses a hash algorithm based on source/destination IP and optionally ports to distribute sessions. The 'load-balance' setting in the routing configuration determines the method (e.g., source-dest-ip, source-dest-port).

Answer

The interface speed

Answer

Round-robin per packet

Answer

The route metric

Question 11

Which FortiGate feature is used to detect link failures within milliseconds, allowing rapid convergence for routing protocols like OSPF and BGP?

Accepted Answer

BFD. Bidirectional Forwarding Detection (BFD) provides sub-second link failure detection independent of the routing protocol. It is commonly used with OSPF, BGP, and SD-WAN to speed up convergence.

Answer

ECMP

Answer

OSPF Fast Hello

Answer

Route tagging

Question 12

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is a TCP session in established state that has been active for 1 hour and will expire in about 1 hour.. proto=6 indicates TCP. proto_state=01 means the session is in 'established' state (TCP state established). duration=3600 seconds means the session has been active for 1 hour. expire=3599 means it will expire in 3599 seconds (almost 1 hour more). This indicates a healthy long-lived TCP session that is still active.

Answer

The session is a UDP session with a short timeout.

Answer

The session is a UDP session that has been active for 1 hour.

Answer

The session is a TCP session that has timed out and is being removed.

Question 13

A network admin configures OSPF on a FortiGate with multiple areas. To ensure that routes from one area are advertised into another area, which OSPF feature must be properly configured?

Accepted Answer

OSPF route redistribution. Route redistribution is used to inject routes from one OSPF area into another or from other protocols. Without redistribution, routes stay within their own area.

Answer

OSPF passive interface

Answer

OSPF virtual-link

Answer

OSPF network type

Question 14

Which SD-WAN load balancing algorithm distributes traffic based on the number of active sessions per SD-WAN member?

Accepted Answer

Sessions. The sessions algorithm bases distribution on the current session count on each member.

Answer

Source-dest-IP

Answer

Spillover

Answer

Volume

Question 15

A FortiGate has two WAN interfaces (port1, port2) as SD-WAN members. The performance SLA monitor is configured for both with a latency threshold of 50 ms. The measured latency on port1 is 45 ms and on port2 is 55 ms. An SD-WAN rule uses 'lowest-cost' algorithm. Which interface will be selected for new sessions?

Accepted Answer

port1 because its latency is within threshold and lower than port2. Lowest-cost algorithm selects the member with the lowest cost, where cost is based on the performance SLA metric. Port1 has lower latency (45 ms < 55 ms) and is within threshold, so it has lower cost.

Answer

port2 because port1's latency is close to threshold

Answer

The session is dropped

Answer

Both interfaces are used equally