NSE7 Practice Test 36 — 15 Questions

Question 1

An administrator is configuring BGP on a FortiGate to peer with an ISP router. The FortiGate is advertising a prefix (203.0.113.0/24) to the ISP. To ensure that traffic to the prefix is load balanced across two WAN links (port1 and port2) using SD-WAN, the administrator must configure which THREE of the following? (Select THREE.)

Accepted Answer

Define both port1 and port2 as SD-WAN members. Options A, B, and D are correct. SD-WAN members must be the WAN interfaces. The SD-WAN rule must use a load balancing algorithm (e.g., sessions) to distribute traffic. BGP must advertise the prefix via both interfaces; this is typically done via advertising the prefix through BGP on both members or by using SD-WAN to influence the routing. Actually, BGP advertisement is separate; SD-WAN does not advertise routes. But to load balance inbound traffic, the administrator may need to advertise via both links. However, the question focuses on SD-WAN configuration, so A, B, D are essential.

Answer

Configure a performance SLA to monitor each link

Answer

Configure BGP to use the same AS number on both members

Question 2

A FortiGate has OSPF configured in multiple areas. The administrator wants to redistribute routes from area 0 into area 1 with a metric of 10. Which command is correct?

Accepted Answer

config router ospf
  config redistribute "ospf"
    set status enable
    set metric 10
  end

Answer

config router ospf
  config redistribute "connected"
    set metric 10
  end

Answer

config router ospf
  config area
    edit 1
      set type nssa
    end

Answer

config router ospf
  set redistribute "ospf" metric 10

Question 3

Which BGP attribute is used by FortiGate SD-WAN to influence outbound traffic path selection?

Accepted Answer

Local Preference

Answer

Next Hop

Answer

MED

Answer

AS Path

Question 4

Which SD-WAN load balancing algorithm is best for ensuring that all traffic from a specific source-destination pair uses the same WAN link?

Accepted Answer

Source-dest IP

Answer

Spillover

Answer

Volume

Answer

Lowest-cost

Question 5

A FortiGate is configured with multiple virtual routers (VRFs). The administrator wants to allow communication between two VRFs using a firewall policy. Which type of interface is required for the policy?

Accepted Answer

VDOM link

Answer

VLAN subinterface

Answer

Loopback interface

Answer

Virtual-wire pair

Question 6

An administrator wants to use BFD with OSPF to detect link failures faster. What must be configured on the FortiGate?

Accepted Answer

Enable BFD globally and under the OSPF process with 'set bfd enable'.

Answer

Enable BFD only on the OSPF interfaces using 'set bfd enable' under the interface configuration.

Answer

BFD is automatically enabled when OSPF is configured; no additional steps are needed.

Answer

Create a BFD template and apply it to the OSPF process.

Question 7

An administrator configures a prefix list to filter routes received from a BGP neighbor. The prefix list permits 192.168.0.0/16 le 24. Which routes are permitted?

Accepted Answer

Any route with prefix length between 16 and 24 inclusive, starting with 192.168

Answer

Only routes with prefix length exactly 16 within 192.168.0.0/16

Answer

Only routes with prefix length exactly 24 within 192.168.0.0/16

Answer

Any route with prefix length greater than 24 within 192.168.0.0/16

Question 8

A FortiGate is configured with multiple VRFs to segregate traffic from different departments. The administrator needs to allow the Finance VRF to access a shared printer in the default VRF. Which TWO steps are required to enable inter-VRF communication?

Accepted Answer

Configure a leak route from the Finance VRF to the default VRF for the printer's subnet. To route between VRFs, you need a route leak. This can be done using leak routes under config router vrf, or by using policy-based routing between VRFs. Firewall policies between VRFs are also required to permit the traffic. Option B is correct: firewall policies must be configured between the two VRFs. Option D is correct: a route leak (or inter-VRF policy route) must be configured to enable routing between VRFs. Option A is not required if you leak routes. Option C is not the primary method; a leak route is more appropriate. Option E is not necessary if you use route leaking.

Answer

Configure OSPF to redistribute routes between VRFs

Answer

Place both the Finance and default VRF interfaces into the same zone

Answer

Assign the printer's IP address to an interface in the Finance VRF

Question 9

A FortiGate is experiencing asymmetric routing due to route leaking between VRFs. The administrator wants to ensure that traffic using a specific VRF returns via the same path. Which THREE actions should be taken? (Choose three.)

Accepted Answer

Enable 'set pbr-enforce-symmetric' on the VRF interfaces. To handle asymmetric routing, the administrator can enable 'set pbr-enforce-symmetric', configure policy-based routing to enforce symmetric paths, or use route maps to influence route selection.

Answer

Disable route leaking between VRFs

Answer

Increase the administrative distance of the leaked routes

Question 10

An administrator is configuring SD-WAN with two members: MPLS and Broadband. The requirement is that voice traffic (UDP ports 16384-32768) should use MPLS primarily, and if MPLS fails SLA, then use Broadband. Which two configurations are needed? (Choose TWO.)

Accepted Answer

Configure a performance SLA for the MPLS member. A performance SLA monitors the MPLS link quality, and an SD-WAN rule is configured to match voice traffic with a strategy that prefers MPLS but falls back to Broadband if SLA fails. Without the SLA, the rule cannot detect failure.

Answer

Disable the Broadband member from the SD-WAN zone

Answer

Configure policy-based routing for voice traffic

Answer

Set the load balancing algorithm to 'sessions'

Question 11

Which routing technique allows a FortiGate to forward packets based on source IP address, destination IP address, or other criteria, in addition to the destination IP alone?

Accepted Answer

Policy-Based Routing (PBR). Option C is correct. Policy-Based Routing (PBR) allows forwarding decisions based on source IP, destination IP, protocol, port, etc., overriding the destination-based routing table.

Answer

RIP

Answer

OSPF route redistribution

Answer

ECMP

Question 12

An administrator configured an SD-WAN rule to steer traffic to a specific member interface using the 'lowest-cost' strategy. After applying, the traffic is not being load-balanced as expected. Which configuration element is MOST likely missing?

Accepted Answer

A performance SLA has not been assigned to the SD-WAN member interfaces.

Answer

The 'best-quality' strategy was inadvertently selected instead.

Answer

The SD-WAN member interfaces are not in the same zone.

Answer

The 'update-static-route' option is disabled on the SD-WAN member.

Question 13

An administrator is troubleshooting an SD-WAN rule that is not matching expected traffic. The SD-WAN rule uses a custom application category and has a performance SLA attached. Which two conditions must be true for the traffic to be matched by the SD-WAN rule? (Select TWO.)

Accepted Answer

The traffic must be identified by the application control sensor as the configured application category

Answer

The performance SLA must be marked as 'up' for at least one member in the SD-WAN zone

Answer

The destination port must be 80 or 443

Answer

The source IP must be in the same subnet as the SD-WAN member's IP

Question 14

A FortiGate is using BFD for BGP fast failure detection. The administrator wants to ensure that if the BFD session goes down, the BGP neighbor is removed and routes are withdrawn immediately. Which configuration is necessary?

Accepted Answer

Enable BFD on the BGP neighbor and ensure BFD timers are set lower than BGP hold time

Answer

Configure BGP graceful restart

Answer

Set BGP hold time to 0

Answer

Use 'set bfd-desired-min-tx 100' on the interface

Question 15

A FortiGate is connected to a FortiExtender via USB. The administrator wants to use LTE as a backup WAN link in an SD-WAN setup. After configuring the FortiExtender, the LTE interface is not showing up as an SD-WAN member. What is the most likely reason?

Accepted Answer

The FortiGate does not have a valid FortiExtender license

Answer

The FortiExtender is not in managed mode

Answer

The LTE SIM card is not activated

Answer

The LTE interface must be configured as a WAN link in the FortiExtender first