NSE7 Practice Test 39 — 15 Questions

Question 1

A FortiGate is configured with a route map named RM_OSPF that sets a metric of 100 for redistributed routes. The route map is applied to redistribution into OSPF. After applying, the redistributed routes have a metric of 20. What could be the cause?

Accepted Answer

The route map does not have a match statement and therefore is not applied

Answer

The route map is applied in the wrong direction

Answer

The OSPF process has a default-metric of 20 that overrides the route map

Answer

The redistributed route is already in OSPF with a metric of 20

Question 2

A FortiGate is configured with BGP and OSPF. The administrator wants to ensure that routes learned via BGP are redistributed into OSPF, but only specific prefixes. Which three components are needed? (Select THREE.)

Accepted Answer

A route map that references the prefix list and sets OSPF parameters

Answer

A VRF to separate the routing tables

Answer

A distribute list in OSPF to filter incoming routes

Question 3

A FortiGate is configured with two ISPs in an SD-WAN. The administrator wants to use the link with the highest bandwidth for bulk downloads, but if that link fails, all traffic should automatically use the backup link. Which load balancing algorithm should be used?

Accepted Answer

Spillover

Answer

Sessions

Answer

Volume

Answer

Source-destination IP

Question 4

An administrator is configuring SD-WAN rules to direct specific traffic types. Which TWO of the following criteria can be used in an SD-WAN rule to match traffic?

Accepted Answer

Destination IP address

Answer

Source interface

Answer

Time of day

Answer

URL category

Question 5

An administrator is configuring SD-WAN on a FortiGate. They want traffic from the internal network to a specific SaaS application to use the MPLS link unless the latency exceeds 50 ms, in which case traffic should failover to the broadband link. Which configuration elements are required?

Accepted Answer

Create an SD-WAN member for each link, configure a performance SLA with latency threshold 50 ms, and add an SD-WAN rule matching the SaaS traffic with the MPLS member as preferred and enable 'set failover enable'.

Answer

Configure policy-based routing to direct SaaS traffic to the MPLS link and rely on default routing for failover.

Answer

Add a static route for the SaaS IP with the MPLS interface as the gateway and a higher distance than the default route via broadband.

Answer

Create an SD-WAN member for each link, configure a performance SLA with jitter threshold 50 ms, and add an SD-WAN rule matching the SaaS traffic using the 'best-quality' strategy with the MPLS member.

Question 6

A FortiGate is connected to a FortiSwitch via a trunk port. The administrator wants to manage the FortiSwitch using FortiLink. Which of the following is a prerequisite for FortiLink to function?

Accepted Answer

A dedicated FortiLink interface (physical or VLAN) must be configured on the FortiGate. FortiLink requires a dedicated interface or VLAN for management. The FortiGate must have a FortiLink interface configured, typically using a physical interface or a VLAN interface for management traffic. Option A is correct because a dedicated FortiLink interface must be created. Option B is unnecessary; DHCP is not required. Option C is optional. Option D is not required; FortiSwitch can use the same management IP.

Answer

The FortiSwitch must be running a firmware version that supports CAPWAP

Answer

The FortiSwitch must be configured with a DHCP server to assign IP addresses

Answer

The FortiSwitch must have a management IP in the same subnet as the FortiGate's management IP

Question 7

A FortiGate is configured with an SD-WAN zone containing two WAN interfaces. The administrator wants to use the 'spillover' load balancing algorithm to ensure that the primary link carries traffic until its bandwidth reaches 80% utilization, after which new sessions are sent to the secondary link. Which THREE configuration steps are necessary?

Accepted Answer

Add both interfaces as members of the SD-WAN rule. Spillover requires setting the algorithm to 'spillover' in the SD-WAN rule (option A). Then, you need to define the spillover threshold on the primary interface (option C), and also set the secondary interface as a member (option E) so traffic can fail over. Option B is not needed if you use spillover; you don't need to set weight. Option D is incorrect because the threshold is set on the interface, not in a performance SLA.

Answer

Create a performance SLA to measure bandwidth utilization

Answer

Assign a weight of 80 to the primary interface and 20 to the secondary

Question 8

A FortiGate with SD-WAN has two members: MPLS (port1) and Broadband (port2). The performance SLA is configured to monitor latency and packet loss. The administrator notices that after a brief outage on the MPLS link, traffic fails over to Broadband but does not fail back when MPLS recovers. What is the likely cause?

Accepted Answer

The SD-WAN rule for the traffic has 'set failback disable'.

Answer

The SLA threshold is set too aggressively, causing the link to be considered down long after recovery.

Answer

The Broadband link has a higher cost, so the FortiGate prefers to keep traffic there.

Answer

The SLA probe interval is longer than the outage duration, so the SLA never detected the outage.

Question 9

A FortiGate is configured with BGP to an SD-WAN member link. The administrator wants to prefer one link over another for specific routes based on AS path length. Which THREE configurations can influence BGP path selection? (Choose three.)

Accepted Answer

Use a route map to prepend AS numbers to the AS path for the less preferred link.

Answer

Set the metric (MED) to a lower value on the desired link.

Answer

Configure the 'set aspath' command in a route map to change the AS path.

Question 10

A FortiGate administrator wants to use BFD to quickly detect link failures in an SD-WAN deployment. Which statement about BFD configuration on FortiGate is correct?

Accepted Answer

BFD can be configured under the interface or routing protocol to detect forwarding path failures. BFD (Bidirectional Forwarding Detection) is configured under the interface or routing protocol to provide fast failure detection. It is not enabled by default. Option A is incorrect because BFD must be configured. Option B is incorrect because BFD uses dedicated sessions, not sharing OSPF hello intervals. Option D is incorrect because BFD does not use performance SLA; SLAs are separate health checks.

Answer

BFD is enabled by default on all FortiGate interfaces

Answer

BFD sessions are established automatically when OSPF neighbors form

Answer

BFD uses performance SLA probes to determine link health

Question 11

An administrator is configuring SD-WAN rules to steer traffic based on application performance. The requirement is to use VoIP traffic over the WAN link that has the lowest latency, but if latency exceeds 100ms, fail over to a backup link. The administrator has already created performance SLAs for both links. Which THREE configuration steps are required?

Accepted Answer

Configure the SLA metric to 'latency' in the performance SLA. To achieve the requirement: first, create an SD-WAN rule that matches VoIP traffic (option A). Then, set the strategy to 'best quality' and select the latency SLA metric (option C). Finally, configure the failover threshold by setting the SLA trigger (option E). Option B is not needed because the rule matches the application, not the interface. Option D is incorrect because the threshold is set in the SLA, not the interface.

Answer

Set the 'failover-threshold' on each SD-WAN member to 100

Answer

Add both WAN interfaces to the rule as members and set weight based on latency

Question 12

A FortiGate is configured with multiple VRFs. An administrator notices that routes from VRF A are not being advertised to VRF B via BGP, even though the BGP configuration is correct. Which TWO actions could resolve this issue?

Accepted Answer

Configure a route leak from VRF A to VRF B under config router vrf. BGP by default does not advertise routes between VRFs. You must enable route leaking, either by using 'config router vrf' and 'leak-route' (option B) or by configuring 'next-hop-self' and using BGP multipath (option D) in certain topologies. Option A is not directly related. Option C is unnecessary. Option E is incorrect because you don't need to import routes.

Answer

Enable 'route-flap damping' on the BGP session between VRFs

Answer

Disable 'bgp enforce-first-as' to allow cross-VRF advertisements

Answer

Configure 'set import-route' under the BGP VRF configuration

Question 13

A FortiGate administrator wants to ensure that only devices with an up-to-date antivirus and OS patch level can access a sensitive application published via ZTNA. Which ZTNA component should the administrator configure to enforce this requirement?

Accepted Answer

ZTNA tags with posture checks. ZTNA tags are used to define conditions based on device posture (e.g., antivirus status, OS patch level). Tags are assigned via FortiClient EMS and referenced in ZTNA policies to grant or deny access.

Answer

ZTNA proxy configuration

Answer

SSL VPN portal settings

Answer

Firewall policy with application control

Question 14

An administrator is configuring a hub-and-spoke ADVPN with FortiGates. The spoke sites use dynamic public IP addresses. The administrator has enabled auto-discovery on the spoke and hub. However, shortcut tunnels are not being established between spokes that communicate frequently. What is the most likely missing configuration?

Accepted Answer

Auto-discovery is not enabled on the spoke's phase1 configuration. For shortcut tunnels to be established in ADVPN, each spoke must have a tunnel interface with an IP address in the same subnet as other spokes, and the 'auto-discovery' setting must be enabled on the spoke's phase1 configuration. Additionally, a firewall policy must allow the shortcut traffic. Option D is correct because without enabling auto-discovery on the spoke's phase1, the spoke will not initiate shortcut negotiation.

Answer

The spoke's phase2 proposal includes a different encryption algorithm than the hub

Answer

The hub does not have a route to the spoke's local subnets

Answer

The spoke's VPN interface is not in the same VDOM as the hub

Question 15

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the traffic?

Accepted Answer

The session is an established TCP connection. The output shows a TCP session (proto=6), with proto_state=01 indicating the session is in the 'listen' or 'established' state? Actually, in FortiGate session diagnostics, proto_state=01 means the session is in the 'established' state (TCP state ESTABLISHED). The session has been up for 3600 seconds and will expire in 3599 seconds. Option A is correct because it's an established TCP session.

Answer

The session is being blocked by the firewall

Answer

The session is in a half-open state, waiting for SYN-ACK

Answer

The session is a UDP connection with a long timeout