NSE7 Practice Test 38 — 15 Questions

Question 1

An administrator runs 'get router info routing-table bgp' and sees that a route for 10.20.0.0/16 is learned via BGP from a neighbor. However, the route does not appear in the routing table. The administrator checks the BGP configuration and sees that 'network 10.20.0.0 255.255.0.0' is not configured under BGP. What is the most likely reason?

Accepted Answer

A route map is filtering the received route

Answer

The route is a default route (0.0.0.0/0) and is being suppressed

Answer

The BGP neighbor is not in the Established state

Answer

The route is not in the routing table because BGP requires the network statement to originate the route

Question 2

An administrator wants to use a FortiGate to manage FortiSwitch units via the LAN. Which interface configuration is required on the FortiGate to allow this management?

Accepted Answer

The interface must be configured as a 'trunk' mode to connect to the FortiSwitch

Answer

The interface must have 'set role lan' configured

Answer

The interface must be a member of a VDOM

Answer

The interface must have 'set type switch' enabled

Question 3

A FortiGate is configured with two SD-WAN members (port1 and port2). The administrator sets an SD-WAN rule with 'set load-balance-mode source-dst-ip' for all internal traffic. The source IP is 10.0.0.1 and destination IP is 172.16.0.1. Which factor determines the outgoing interface for this traffic?

Accepted Answer

The combination of source IP and destination IP hashed to select an interface

Answer

The destination IP only

Answer

The source IP only

Answer

The interface with the lowest current utilization

Question 4

A network admin is troubleshooting an SD-WAN rule that should steer VoIP traffic to a low-latency link. The rule matches traffic from the VoIP subnet to any destination and uses the 'best-quality' strategy with SLA monitoring. However, traffic is still using the other link. Which TWO checks should the admin perform? (Choose two.)

Accepted Answer

Check that the SD-WAN rule has a higher priority than other rules that might match the traffic.

Answer

Ensure that the FortiGate has a default route via each SD-WAN member.

Answer

Disable the other SD-WAN members temporarily to force traffic to the desired link.

Answer

Confirm that the VoIP subnet is included in the SD-WAN zone.

Question 5

A FortiGate running FortiOS 7.2 has multiple WAN interfaces. The administrator is configuring SD-WAN load balancing with the 'volume' algorithm. The requirement is that each interface carries a percentage of total traffic based on its bandwidth capacity. The administrator sets the 'weight' of each interface accordingly. However, traffic distribution is not as expected. Which TWO factors could cause this discrepancy?

Accepted Answer

The interface bandwidth settings (speed) do not reflect actual link capacity. The volume algorithm uses weight and interface bandwidth to distribute traffic. If the interface bandwidth is misconfigured (option B), the distribution will be wrong. Also, per-packet load balancing is not used; the algorithm works on sessions. However, if the traffic consists of few large sessions, the volume distribution may not be even. Option D is correct because the algorithm works at session level, not per-packet, so volume imbalance can occur if sessions vary greatly in size. Option A is irrelevant. Option C is incorrect because the algorithm does not use per-packet. Option E is a possible issue with health checks if traffic is diverted.

Answer

The weight values are not in the range 1-100

Answer

The load balancing algorithm is set to 'per-packet' instead of 'volume'

Answer

The performance SLA is set to 'disable' on some interfaces, causing them to be excluded

Question 6

A network engineer is troubleshooting an OSPF multi-area setup on a FortiGate. The FortiGate is an ABR (Area Border Router) connecting area 0 and area 1. The engineer notices that routes from area 1 are not being advertised into area 0. Which TWO of the following are possible causes? (Select TWO.)

Accepted Answer

OSPF is not enabled on the interface in area 1, or the network type is mismatched. Options A and C are correct. OSPF ABR needs a link to area 0; if there is no direct connection, routes may not be advertised. Also, interfaces in area 1 must be passive if no neighbors, but passive still advertises routes? Actually, if an interface is passive, it does not form adjacency but still advertises connected routes. However, option C is plausible: if the interface is not running OSPF (network type mismatch), no adjacency forms. So A and C are correct.

Answer

The 'redistribute connected' command is missing

Answer

The FortiGate has a static route to area 1 that overrides OSPF

Answer

The administrative distance for OSPF is set too high

Question 7

An administrator configures a route-map to match prefix-list 'PREFIX' and set metric 20. Which OSPF route redistribution uses this route-map correctly?

Accepted Answer

config router ospf
  config redistribute "connected"
    set route-map "RM"
  end

Answer

config router policy
  config route-map
    edit "RM"
      config rule
        set match-ip-address "PREFIX"
        set set-metric 20
      end
    end

Answer

config router ospf
  set route-map "RM"

Answer

config router prefix-list
  edit "PREFIX"
    set rule permit 10.0.0.0/8
  end

Question 8

A FortiGate is running OSPF with multiple areas. The administrator needs to redistribute a static route into OSPF. Which command will correctly configure redistribution of static routes into OSPF process 10?

Accepted Answer

config router ospf
 set redistribute static enable
end

Answer

config router ospf
 config redistribute
  edit static
   set status enable
  next
 end
end

Answer

config router policy
 set redistribute static
end

Answer

config router static
 set redistribute ospf
end

Question 9

Which SD-WAN load balancing algorithm distributes new sessions based on the number of active sessions on each link?

Accepted Answer

Sessions

Answer

Source-dest IP

Answer

Spillover

Answer

Volume

Question 10

A FortiGate is deployed as a LAN edge switch with multiple FortiSwitch units connected. The administrator wants to configure VLANs and manage the switches centrally. Which TWO features must be enabled on the FortiGate to achieve this? (Select TWO.)

Accepted Answer

Create VLAN interfaces on the FortiGate and assign them to the FortiLink interface. Options A and D are correct. FortiLink is required for central management of FortiSwitch. The FortiGate must have a dedicated FortiLink interface (e.g., internal) configured under Network > Interfaces. VLANs are created on the FortiGate and propagated to switches via FortiLink.

Answer

LLDP-MED

Answer

Configure a separate management VRF

Answer

STP (Spanning Tree Protocol) on the FortiGate

Question 11

A FortiGate is configured with policy-based routing to force traffic from subnet 10.0.1.0/24 to go through a WAN interface. The administrator notices that traffic from 10.0.1.0/24 is still using the default route. Which debug command can confirm if the policy-based routing is being applied?

Accepted Answer

diagnose debug flow policy-based-route

Answer

diagnose debug routing ip-probe 10.0.1.1 8.8.8.8

Answer

diagnose debug enable && diagnose debug router policy

Answer

get router info policy-based-route

Question 12

An administrator wants to load balance traffic across two WAN links by session count. Which SD-WAN load balancing algorithm should they use?

Accepted Answer

Sessions

Answer

Spillover

Answer

Lowest-cost

Answer

Volume

Question 13

An administrator needs to integrate a FortiSwitch with a FortiGate for LAN edge management. The FortiGate will manage the switch via the LAN interface. Which TWO steps are required? (Choose two.)

Accepted Answer

Enable switch controller on the FortiGate.

Answer

Assign an IP address to the FortiSwitch's management VLAN on the FortiGate.

Answer

Configure the FortiSwitch in standalone mode.

Answer

Disable STP on the FortiSwitch ports connected to the FortiGate.

Question 14

A network administrator is configuring SD-WAN on a FortiGate to control outbound internet traffic. The requirement is to load balance traffic across two WAN interfaces (port1 and port2) based on the number of new sessions, but only when both links are healthy. The administrator has added both interfaces to the SD-WAN zone and configured performance SLAs. Which TWO additional configuration steps are necessary to implement this requirement?

Accepted Answer

Configure the SD-WAN rule to use a performance SLA for health checking. SD-WAN load balancing is configured in the SD-WAN rules. Setting the load balancing algorithm to 'sessions' achieves session-based distribution. The rule must also be configured to use the performance SLA to check link health, typically by setting the 'health check' field under SD-WAN rule strategy. Option A is correct because the algorithm must be set to 'sessions'. Option D is correct because the rule must reference a performance SLA to consider link health.

Answer

Enable 'ECMP load balancing' in the routing settings

Answer

Configure a policy-based routing rule to direct traffic to the SD-WAN zone

Answer

Set the 'sla-check' under config system sdwan to 'enable'

Question 15

An administrator sees the following output from 'get router info routing-table':
S       0.0.0.0/0 [10/0] via 192.168.1.1, port1
S       0.0.0.0/0 [10/0] via 192.168.2.1, port2
They have configured ECMP load balancing. However, traffic to a specific destination IP is always using port1. What is the likely reason?

Accepted Answer

The destination IP hash results in the same link for all sessions due to the load balancing algorithm

Answer

The firewall policy only allows traffic on port1

Answer

ECMP uses per-packet load balancing by default and the traffic is a single flow

Answer

One of the static routes has a lower administrative distance