NSE7 Practice Test 34 — 15 Questions

Question 1

An administrator configures an SD-WAN rule with the 'volume' load balancing algorithm. The two WAN members have bandwidth capacities: port1 = 100 Mbps, port2 = 50 Mbps. Traffic is HTTP and HTTPS from internal users to the internet. How will the traffic be distributed?

Accepted Answer

Traffic is sent to the member with the least number of bytes transmitted, resulting in a balanced distribution proportional to bandwidth. Option C is correct. The volume algorithm distributes traffic based on the volume of bytes processed. It sends new sessions to the member with the least amount of traffic volume sent. Over time, traffic is split proportionally to the bandwidth ratio (2:1).

Answer

All traffic uses port1 until it reaches 100 Mbps, then uses port2

Answer

Traffic is distributed evenly session-by-session (round-robin)

Answer

Source-destination IP pairs are hashed to a specific member

Question 2

An administrator notices that when a BGP session goes down, failover to the backup path takes about 30 seconds. The admin wants to reduce the failover time to less than 1 second. Which technology should the administrator implement?

Accepted Answer

Enable BFD on the BGP neighbor and the associated interface. Option B is correct. BFD (Bidirectional Forwarding Detection) provides sub-second failure detection. It can be configured to monitor the BGP session and trigger faster convergence.

Answer

Configure BGP fast external failover

Answer

Increase the BGP keepalive timer to 1 second

Answer

Use policy-based routing with SLA monitoring

Question 3

An administrator configures two SD-WAN members (port1, port2) with performance SLAs. The SD-WAN rule uses 'best-quality' strategy. During a failover test, the primary member port1 becomes unavailable but traffic does not switch to port2. What should the administrator check first?

Accepted Answer

The performance SLA's failover threshold is not met.

Answer

The SD-WAN rule is not configured to use the performance SLA.

Answer

The 'set status' on the performance SLA is 'passive'.

Answer

The 'update-static-route' is enabled on port1.

Question 4

An administrator wants to use policy-based routing to forward traffic from subnet 192.168.1.0/24 to a specific next-hop via port2. Which TWO configuration elements are needed?

Accepted Answer

A route-map that matches the source subnet and sets the next-hop.

Answer

An SD-WAN rule overriding the routing decision.

Answer

A static route with a higher administrative distance.

Answer

A firewall policy matching the traffic with action 'accept'.

Question 5

A FortiGate is configured with OSPF and BGP. The administrator wants to redistribute OSPF routes into BGP. Which TWO steps are required?

Accepted Answer

Use the 'redistribute ospf' command under the BGP configuration

Answer

Configure a route map to filter the routes being redistributed

Answer

Set the BGP table version to 2

Answer

Disable OSPF on the interface

Question 6

An administrator wants to use BFD to detect failures in an OSPF neighbor relationship faster than OSPF hello timers. They configure 'config router ospf' and 'set bfd enable'. However, BFD sessions are not coming up. What is a possible reason?

Accepted Answer

The interface has 'set bfd enable' missing under config system interface. BFD requires that the interface has BFD enabled at the interface level and that the OSPF neighbor also supports BFD.

Answer

OSPF is configured with 'network point-to-multipoint'

Answer

The FortiGate's BFD transmit interval is set too high

Question 7

What is the purpose of using a prefix list in route redistribution?

Accepted Answer

To match routes based on IP prefix and prefix length. Prefix lists are used to match specific IP prefixes and prefix lengths, commonly used in route maps to filter routes.

Answer

To define a list of allowed source IPs for management access

Answer

To specify the next-hop for a set of routes

Answer

To set BGP community values on matched prefixes

Question 8

A FortiGate is configured with two WAN members in an SD-WAN zone. The performance SLA monitors latency to a probe server. The rule uses 'best quality' strategy. After some time, one member fails the SLA. Which action does the FortiGate take for existing sessions that were using that member?

Accepted Answer

Existing sessions continue on the failed member until they timeout. When a member fails the SLA, only new sessions are redirected to other members that meet the SLA. Existing sessions continue on the failed member until they expire or are terminated. The 'best quality' strategy does not preemptively move existing sessions.

Answer

All sessions are dropped and the member is removed from the zone

Answer

Existing sessions are re-evaluated and may be moved based on policy

Answer

Existing sessions are immediately moved to another member

Question 9

Which BFD mode is used to detect forwarding path failures between two FortiGates that are directly connected?

Accepted Answer

Asynchronous mode. BFD operates in asynchronous mode by default, where both peers send hello packets. If a certain number of packets are missed, the session is considered down. This is the standard mode for directly connected FortiGates.

Answer

Synchronous mode

Answer

Echo mode

Answer

Demand mode

Question 10

A network administrator is configuring SD-WAN on a FortiGate with two WAN links (port1 and port2). They want traffic to destination 10.0.0.0/8 to use port1 as long as its latency is below 50ms and jitter below 10ms; otherwise, fail over to port2. Which SD-WAN configuration components are required?

Accepted Answer

SD-WAN members, one performance SLA, one SD-WAN rule with the performance SLA as a strategy. To implement failover based on link quality, you need SD-WAN members (interfaces), a performance SLA to monitor the links, and an SD-WAN rule that uses the SLA to determine which member to use. The 'best quality' strategy automatically switches when thresholds are not met.

Answer

SD-WAN members, one performance SLA, one SD-WAN member with a static route

Answer

SD-WAN members, two performance SLAs (one per interface), one SD-WAN rule

Answer

SD-WAN members, one performance SLA, two SD-WAN rules (one for each interface)

Question 11

What is the function of a route map in FortiGate routing?

Accepted Answer

To filter and modify routing information during redistribution.. Route maps provide granular control over route redistribution by matching prefix lists or other attributes and then applying actions like set metric, set next hop, or permit/deny.

Answer

To configure load balancing between multiple WAN links.

Answer

To enable BFD on a specific interface.

Answer

To create a static route for a specific destination.

Question 12

A network administrator is configuring SD-WAN rules with load balancing. They want to distribute HTTP traffic evenly across two WAN links based on the number of sessions. Which TWO settings should they use? (Choose two.)

Accepted Answer

Ensure the SD-WAN rule matches HTTP traffic (e.g., using protocol or port criteria).. To distribute HTTP sessions evenly, the load balancing algorithm should be 'session', and the SD-WAN rule must match HTTP traffic using appropriate criteria (e.g., destination port 80).

Answer

Set the load balancing algorithm to 'volume'.

Answer

Create a performance SLA to monitor the links.

Answer

Enable 'set update-static-route' on the SD-WAN rule.

Question 13

You run the following command on a FortiGate:

diagnose sys session filter dport 443
diagnose sys session list

Output:
proto=6 proto_state=01 duration=3600 expire=3599

What does the 'proto_state=01' indicate?

Accepted Answer

The session is in the 'init' state, meaning the first SYN packet has been seen but the handshake is not complete. Option B is correct. In FortiGate session table, proto_state values: 01 means the session is in the 'init' state (SYN sent, SYN-ACK not yet received). For TCP, this indicates the connection is being established.

Answer

The session is fully established and in the 'established' state

Answer

The session is a UDP or ICMP session with no state tracking

Answer

The session is being torn down (FIN or RST received)

Question 14

Which routing protocol is commonly used in SD-WAN deployments to exchange routes between FortiGate and the provider edge router in an MPLS network?

Accepted Answer

BGP

Answer

RIP

Answer

IS-IS

Answer

OSPF

Question 15

An administrator connects a FortiExtender to the FortiGate's USB port. The FortiGate detects the FortiExtender and creates a virtual interface 'wwan1'. However, the link status shows 'down'. The SIM card is inserted and the cellular plan is active. What should the administrator check?

Accepted Answer

The APN settings are not configured under the FortiExtender interface. FortiExtender requires provisioning from the FortiGate; the APN must be configured correctly, and the extender may need to be activated.

Answer

The FortiGate needs a security policy allowing traffic from wwan1

Answer

The FortiExtender firmware is not compatible with the FortiGate

Answer

The FortiExtender is not powered on