NSE7 Practice Test 30 — 15 Questions

Question 1

A FortiGate is integrated with FortiSwitch and FortiAP. The administrator wants to manage both devices from the FortiGate GUI using the LAN edge management features. Which THREE conditions must be met for this integration to work?

Accepted Answer

FortiAP must be in CAPWAP mode to connect to the FortiGate.. FortiSwitch and FortiAP management via FortiGate (LAN edge) requires: the FortiGate must be in NAT mode (transparent mode does not support this), a CAPWAP connection is used for FortiAP, and the devices must be in the same broadcast domain or reachable via the management VLAN. Option A is incorrect because FortiGate can manage them without VDOM. Option D is required for Layer 2 adjacency.

Answer

The FortiGate must operate in transparent mode.

Answer

The FortiGate must have a separate VDOM for each managed device.

Question 2

An administrator configures an SD-WAN rule to steer traffic from a specific subnet to an SD-WAN member with the lowest cost. Which load balancing algorithm should be selected in the SD-WAN rule to achieve this behavior?

Accepted Answer

Lowest-cost. Lowest-cost algorithm selects the member with the lowest cost (from performance SLA) for each session. Other algorithms do not consider cost.

Answer

Volume

Answer

Sessions

Answer

Source-dest-IP

Question 3

You run 'diagnose sys session filter dport 179' on a FortiGate and see many sessions with proto=6 and proto_state=01. What does this indicate about the BGP sessions?

Accepted Answer

BGP sessions are in the process of being established, but not yet fully up.. proto_state=01 indicates TCP session establishment (SYN_SENT). Persistent sessions in this state suggest BGP peers are not reaching Established state, possibly due to misconfiguration or firewall blocking.

Answer

BGP sessions are fully established and exchanging routes.

Answer

BGP sessions are being actively torn down.

Answer

BGP sessions are using TCP port 179 but are idle.

Question 4

Which FortiGate feature allows multiple independent routing tables on a single device, enabling traffic separation for different departments or customers?

Accepted Answer

VRF. VRF (Virtual Routing and Forwarding) partitions the routing table into multiple instances, each with its own routing table and forwarding decisions.

Answer

ECMP

Answer

VDOM

Answer

Policy-based routing

Question 5

A FortiGate is configured with an SD-WAN rule using 'spillover' algorithm. The primary member has a spillover threshold of 100 Mbps. Traffic of 80 Mbps is currently flowing through the primary member. A new session requiring 30 Mbps arrives. What will happen?

Accepted Answer

The new session is sent to the secondary member because the primary threshold would be exceeded.. Spillover algorithm will direct the new session to the secondary member because the primary's current load (80 Mbps) plus the new session (30 Mbps) would exceed the threshold (100 Mbps).

Answer

The new session is sent to the primary member because the current load is below the threshold.

Answer

The new session is dropped because no member can handle it.

Answer

The primary member's threshold is dynamically increased.

Question 6

A FortiGate is configured with ECMP load balancing. What is the default behavior when multiple routes have equal cost?

Accepted Answer

Traffic is load balanced across the routes using a hash algorithm. ECMP (Equal-Cost Multi-Path) by default uses a hash-based method to distribute traffic across the equal-cost paths.

Answer

The route with the lowest metric is always preferred

Answer

The administrator must enable per-packet load balancing

Answer

All traffic is sent over the first route until it fails

Question 7

An administrator needs to apply different routing policies for traffic based on source IP address, overriding the normal routing table. Which feature should be configured?

Accepted Answer

Policy-based routing. Policy-based routing (PBR) allows routing decisions based on criteria like source IP, protocol, etc., overriding the routing table.

Answer

Prefix list

Answer

SD-WAN rule

Answer

Route map

Question 8

An administrator wants to integrate a FortiExtender into an existing SD-WAN deployment. Which TWO steps are required for proper integration?

Accepted Answer

Authorize the FortiExtender on the FortiGate. The FortiExtender must be authorized and added as an SD-WAN member to participate in SD-WAN.

Answer

Disable all other WAN interfaces

Answer

Enable NAT on the FortiExtender interface

Answer

Configure a separate VDOM for the FortiExtender

Question 9

A network administrator wants to configure SD-WAN on a FortiGate with two internet connections (port1 and port2). The requirement is to use the link with the lowest cost as the primary path for all traffic, unless it exceeds a threshold. Which SD-WAN load balancing algorithm should the administrator choose?

Accepted Answer

Lowest-cost. The lowest-cost algorithm selects the member with the lowest cost value. If the cost exceeds a configurable threshold, traffic is sent to the next best member. This matches the requirement.

Answer

Spillover

Answer

Sessions

Answer

Volume

Question 10

An administrator is troubleshooting SD-WAN and runs the following CLI command:
 'execute sdwan-health-check status'
The output shows that one SD-WAN member has a status of 'dead'. What does this indicate?

Accepted Answer

The member has failed the health check probe to the target server. The SD-WAN health check monitors the connectivity to configured servers. A 'dead' status means the member is not passing the health check probes, indicating a connectivity failure.

Answer

The member interface is administratively down

Answer

The member is not meeting the performance SLA thresholds

Answer

The SD-WAN member is not included in any SD-WAN rule

Question 11

What is the function of a VRF (Virtual Routing and Forwarding) on a FortiGate?

Accepted Answer

To create multiple independent routing tables. VRF allows multiple independent routing tables to coexist on the same FortiGate, enabling traffic separation without separate physical devices.

Answer

To provide redundancy for routing protocols

Answer

To aggregate multiple physical interfaces into one logical interface

Answer

To encrypt traffic between different virtual domains

Question 12

An administrator wants to load-balance traffic across two WAN links using ECMP. The routes have equal distances and metrics. However, traffic is only using one of the links. What could be the cause?

Accepted Answer

The routes are learned via different routing protocols with different administrative distances.

Answer

ECMP is not enabled globally under config system settings.

Answer

The firewall policy is configured to use a specific egress interface.

Answer

The traffic is session-based and ECMP uses per-packet load balancing.

Question 13

An administrator wants to ensure that traffic from a specific source IP uses a particular SD-WAN member regardless of performance SLA results. Which SD-WAN configuration element should be used?

Accepted Answer

SD-WAN rule with manual strategy. SD-WAN rules allow matching traffic based on source/destination, and can set the 'strategy' to 'manual' or explicitly select a member, overriding SLA-based choices.

Answer

Route map

Answer

Policy-based routing on the firewall policy

Answer

Performance SLA

Question 14

A FortiGate is configured with OSPF multi-area. The administrator needs to ensure that routes from area 2 are advertised into area 0. Which TWO configurations are necessary?

Accepted Answer

Configure an Area Border Router (ABR) between area 2 and area 0. An Area Border Router (ABR) must be present, and route redistribution from area 2 into area 0 is required (or OSPF automatically advertises inter-area routes but only if the ABR has the routes in its OSPF database). Typically, OSPF automatically advertises routes between areas if the ABR has them, but redistribution may be needed if routes are from a different protocol or if filtering is applied. For simplicity, most common answer: ABR and redistribution or proper area configuration. However, the question asks for configurations necessary; OSPF automatically advertises intra-area routes to other areas via ABR, but if routes are from another protocol, redistribution is needed. Assuming OSPF routes within area 2, the ABR will advertise them to area 0 automatically. But since the question includes 'from area 2 into area 0', the ABR is the key. Also, a virtual-link might be needed if area 2 does not connect to area 0 directly. But the expected answers: ABR and redistribution. Alternatively, just ABR and proper area configuration. I'll go with ABR and redistribution as typical for exam.

Answer

Configure a virtual-link between area 2 and area 0

Answer

Set the OSPF network type to point-to-point

Answer

Disable OSPF on area 0

Question 15

A FortiGate is configured with SD-WAN using BGP. The administrator wants to influence outbound traffic to prefer one SD-WAN member over another based on BGP attributes. Which BGP attribute, when modified on the FortiGate, can achieve this for outbound traffic?

Accepted Answer

Local-preference. AS-Path prepending adds AS numbers to the path, making it longer and less preferred on the remote side. This influences outbound traffic by making the local route less attractive to downstream routers, but for outbound traffic from the FortiGate, local-preference (option C) is the correct attribute to influence outbound path selection within the local AS.

Answer

Weight

Answer

AS-Path prepending

Answer

MED