NSE7 Practice Test 32 — 15 Questions

Question 1

A FortiGate is configured with OSPF in a multi-area design. An administrator needs to redistribute static routes from another router into OSPF on the FortiGate, but only for prefixes that match a route map. The administrator has configured 'config router ospf' with 'redistribute static route-map RM_STATIC'. However, the static routes are not appearing in the OSPF database. Which THREE troubleshooting steps should the administrator take?

Accepted Answer

Verify that the route map 'RM_STATIC' exists and has appropriate match and set statements. Common issues: The route map may not exist, might not have the correct match conditions, or the redistribute command might be missing 'set metric' or 'set metric-type' parameters (though not always required, missing them can cause routes not to be advertised). More importantly, OSPF redistribution must be enabled at the process level (option B). Option D is needed to verify the route map contents. Option A is irrelevant because the OSPF process must be enabled. Option C is about prefix-lists which may be used but is not the most direct step. Option E is a valid step to check if the static routes are actually redistributed.

Answer

Verify that OSPF is enabled on at least one interface (config router ospf -> network)

Answer

Check if a prefix-list is applied that filters the redistributed routes

Question 2

A network administrator is troubleshooting a BGP session between a FortiGate and an ISP router. The administrator runs 'get router info bgp summary' and sees that the BGP state is 'Active'. What does this state indicate?

Accepted Answer

The BGP speaker is trying to establish a TCP connection with the peer. In BGP, the 'Active' state means that the router is trying to initiate a TCP connection to the peer but has not yet established it. This usually indicates a connectivity issue between the peers, such as a firewall blocking port 179 or incorrect IP addressing. Option A is correct. Option B describes 'Established' state. Option C describes 'Connect' state. Option D is not a BGP state.

Answer

The BGP session is administratively down due to a configuration error

Answer

The BGP speaker is waiting for a routing update from the peer

Answer

The BGP session is fully established and exchanging routes

Question 3

A FortiGate is configured with ECMP routing to balance traffic across two default routes via two ISPs. The administrator wants to ensure that traffic from the same source-destination pair always uses the same ISP. Which ECMP load balancing method should be configured?

Accepted Answer

source-dest-ip. ECMP in FortiGate supports several load balancing methods, including source-destination IP hash. To keep traffic from the same source-destination pair consistent, use source-dest-ip hashing. Option A is correct. Option B is for source-only. Option C is session-based. Option D is per-packet (not typical).

Answer

source-ip

Answer

per-packet

Answer

session

Question 4

A FortiGate administrator sees the following output:

"diagnose sys session filter dport 443
diagnose sys session list
session info: proto=6 proto_state=01 duration=3600 expire=3599"

What does this session duration and expire time indicate?

Accepted Answer

The session has a timeout of 7200 seconds (2 hours). Duration 3600 seconds (1 hour) and expire 3599 seconds means the session has been active for 1 hour and will expire in about 1 hour, total timeout 2 hours, which matches the default TCP session timeout.

Answer

The session is about to be torn down

Answer

The session is newly established

Answer

The session is using UDP protocol

Question 5

A FortiGate is configured with multiple VRF instances. The administrator needs to ensure that traffic from VRF 10 can reach a server in VRF 20. Which configuration is required?

Accepted Answer

Use static routes with the appropriate VRF tags to leak routes between VRFs. To route between VRFs, you must configure route leaking. This is done using 'config router leak' or by using route redistribution with VRF tags. Without route leaking, VRFs are isolated.

Answer

Enable inter-VRF routing by setting 'vrf-leak enable' on the VRF instances

Answer

Configure a firewall policy that allows traffic between the VRFs

Answer

Place both interfaces in the same VRF

Question 6

A FortiGate is configured with ECMP load balancing for multiple equal-cost routes. The administrator wants to ensure that all packets belonging to the same session go out the same interface. Which ECMP load balancing method should be used?

Accepted Answer

Source-dest-IP-based. For ECMP, FortiGate supports source-dest-ip hashing to keep sessions on the same path. Other methods like round-robin may break sessions.

Answer

Weighted

Answer

Source-IP-based

Answer

Spillover

Question 7

A FortiGate is configured with two VRF instances (VRF1 and VRF2). The admin needs to allow traffic from VRF1 to reach a server in VRF2. The server is directly connected to the FortiGate on an interface in VRF2. What configuration is required?

Accepted Answer

Use VRF route leaking with route maps to export necessary routes between VRFs. Option D is correct. VRF leaking (route leaking) between VRFs is required to enable communication. Without leaking, VRFs are isolated. A route map or policy can be used to export routes between VRFs.

Answer

Add both VRFs to the same VDOM

Answer

Configure a static route in VRF1 pointing to the server's IP via the VRF2 interface

Answer

Configure a firewall policy with source VRF1 and destination VRF2

Question 8

A FortiGate is running OSPF in a multi-area topology. The administrator needs to redistribute connected routes from area 0 into area 1 but does not want to leak any other routes. Which configuration is correct?

Accepted Answer

Configure route redistribution under OSPF with 'redistribute connected' and apply a route map that permits only the desired connected networks.

Answer

Use policy-based routing to forward traffic to the connected networks.

Answer

Add the connected networks as networks in area 1 using 'network x.x.x.x 255.255.255.0 area 1'.

Answer

Use 'set redistribute connected' under the OSPF interface configuration for the connected interface in area 0.

Question 9

Which feature allows a FortiGate to maintain separate routing tables for different customers or departments on the same device?

Accepted Answer

VRF (Virtual Routing and Forwarding)

Answer

Route maps

Answer

VDOM

Answer

Policy-based routing

Question 10

An administrator configures a route map named RMAP_EXPORT that sets a community for routes redistributed into BGP. The route map is applied to the 'redistribute connected' statement under BGP. However, the connected routes are not being advertised to BGP peers. What is the most likely cause?

Accepted Answer

The route map does not have a 'match ip address' statement. Route maps used for redistribution require a 'match' statement to select routes. If the route map has only a 'set' action without a 'match', it may not match any routes, resulting in no redistribution. A common mistake is omitting the 'match' clause.

Answer

The BGP neighbor is not configured with 'route-map in'

Answer

Connected routes are not in the routing table

Answer

The route map is missing a 'set community' action

Question 11

Which feature allows a FortiGate to use multiple VRFs to separate routing tables for different customers or departments on the same physical device?

Accepted Answer

VRF. VRF (Virtual Routing and Forwarding) enables multiple independent routing table instances on a single FortiGate, allowing traffic separation without additional hardware.

Answer

SD-WAN

Answer

VDOM

Answer

Policy-based routing

Question 12

A network administrator configures SD-WAN on a FortiGate with two WAN members (port1, port2). They set up a performance SLA to measure latency to 8.8.8.8. The SLA shows both members are 'alive'. However, traffic matching an SD-WAN rule with 'best quality' strategy is not using the lowest-latency link. What is the MOST likely cause?

Accepted Answer

The performance SLA does not have 'latency' as the first metric in the priority order. The 'best quality' strategy selects based on the highest priority metric. By default, latency is not the highest priority; jitter and packet loss are considered first. The admin must configure the SLA to prioritize latency or adjust the SD-WAN rule strategy.

Answer

Both WAN members have the same cost in the SD-WAN configuration

Answer

The SD-WAN rule is configured with 'manual' strategy

Answer

The SD-WAN rule has 'set-match' enabled for source IP

Question 13

An administrator runs 'get router info bgp summary' and sees that the BGP session to a neighbor is in the 'Idle' state. The neighbor IP is reachable via ping. The BGP configuration uses loopback interfaces with 'update-source loopback1'. What is the MOST likely reason for the Idle state?

Accepted Answer

There is no route on the neighbor back to the FortiGate's loopback IP. BGP Idle state often indicates a TCP connection issue. If the update source is a loopback, the neighbor must have a route to that loopback IP, or the update-source must match the neighbor's configured remote-as and reachability.

Answer

The loopback interface is down or has no IP address assigned

Answer

The BGP neighbor's remote-as is misconfigured

Answer

The BGP timer values (keepalive/hold) are mismatched

Question 14

You have configured a route map named 'RM-BGP' to filter routes redistributed from OSPF into BGP. The route map uses 'set community 65000:100' and 'set metric 50'. After applying the route map under 'config router bgp' with 'redistribute ospf route-map RM-BGP', you see that routes are being redistributed but without the community and metric. What is wrong?

Accepted Answer

The route map does not have any 'match' criteria, so it never applies. Route-map statements require 'match' conditions; if no match is specified, the route map may not match any routes. Also, the route map must have a sequence number with 'match ip address' or similar.

Answer

The route map is missing a 'set community' statement with 'additive' option

Answer

The BGP neighbor requires 'soft-reconfiguration inbound' to see the changes

Answer

The 'set metric' command is not supported for BGP redistribution

Question 15

An administrator configures a performance SLA to monitor a remote server. The SLA status shows 'dead' for one WAN member. The administrator checks the interface and sees that it is up and passing other traffic. What is the most likely cause?

Accepted Answer

The SLA probe is using TCP port 80 but the server is only responding to ICMP. Performance SLA probes may fail due to firewall rules blocking ICMP or the probe port, or the server not responding to the probe type.

Answer

The FortiGate's routing table does not have a route to the probe target

Answer

The interface is not added as an SD-WAN member

Answer

The SLA probe interval is set too high