NSE7 Advanced Networking and SD-WAN — 30 Questions

Question 1

A network administrator is configuring SD-WAN on a FortiGate. The organization has two internet links: MPLS (primary) and broadband (backup). The administrator wants all traffic to use the MPLS link unless it fails, in which case traffic should fail over to the broadband link. Which SD-WAN configuration best achieves this requirement?

Accepted Answer

Set the MPLS link priority to 10 and the broadband link priority to 5, then configure an SD-WAN rule with the 'best quality' strategy.. Option A is correct because setting the MPLS link priority to 10 (higher) and broadband to 5 (lower) ensures the SD-WAN rule with 'best quality' strategy selects the MPLS link as the preferred path. The 'best quality' strategy evaluates link quality metrics and, when priorities differ, prefers the higher-priority link. If the MPLS link fails, the strategy automatically fails over to the broadband link, meeting the requirement.

Answer

Enable 'set role' on the MPLS link as 'primary' and on the broadband link as 'standby' with the 'redundant' strategy.

Answer

Configure both links in the SD-WAN zone with equal priority and use the 'lowest cost' strategy.

Answer

Create two static routes: one with higher distance for MPLS and one with lower distance for broadband.

Question 2

A FortiGate is configured with SD-WAN and has two WAN members: Member1 (ISP1) with priority 10, and Member2 (ISP2) with priority 5. The SD-WAN rule for traffic from the internal network uses the 'best quality' strategy. During normal operation, traffic flows through Member1. After a link failure on Member1, traffic correctly fails over to Member2. However, when Member1 is restored, traffic does not fail back. What is the most likely cause?

Accepted Answer

The health-check for Member1 is configured with 'set probe-mode passive' and 'set update-static-route disable'.. Option B is correct because when 'set probe-mode passive' is configured, the health-check server only monitors the link without actively generating probe traffic, and 'set update-static-route disable' prevents the static route associated with Member1 from being re-enabled after the link is restored. This means the route remains inactive, so SD-WAN cannot fail back to Member1 even though the physical link is up.

Answer

The static route for Member1 has a higher administrative distance than Member2.

Answer

The SD-WAN rule is configured with 'set fallback' disabled.

Answer

The priority of Member2 is higher than Member1.

Question 3

An enterprise uses FortiGate as an SD-WAN edge device with three WAN links: Link A (MPLS), Link B (broadband), and Link C (LTE). The SD-WAN rule for VoIP traffic uses the 'best quality' strategy with link-quality-measurement enabled. The VoIP traffic is routed via Link A. During peak hours, users report poor voice quality. The administrator checks the SD-WAN performance SLA logs and sees that Link A's jitter and latency are within acceptable thresholds, but packet loss is slightly elevated. Which action would most likely improve VoIP quality without manual intervention?

Accepted Answer

Configure a performance SLA for VoIP traffic with jitter < 10ms, latency < 100ms, and packet-loss < 0.5% and apply it to the SD-WAN rule.. Option B is correct because configuring a performance SLA with specific thresholds for jitter, latency, and packet loss allows FortiGate to dynamically failover VoIP traffic to another WAN link when Link A's packet loss exceeds the defined threshold (e.g., 0.5%). Since the 'best quality' strategy uses link-quality-measurement to select the link with the best SLA compliance, applying a performance SLA with a packet-loss threshold ensures that even if jitter and latency are acceptable, elevated packet loss triggers a switch to a healthier link, improving voice quality without manual intervention.

Answer

Increase the priority of Link A to ensure it remains the preferred link.

Answer

Disable link-quality-measurement to reduce overhead on Link A.

Answer

Add a new SD-WAN rule with 'lowest cost' strategy for VoIP traffic.

Question 4

Which THREE statements are true about FortiGate SD-WAN health-check configuration?

Accepted Answer

Health-check can be configured with multiple thresholds for jitter, latency, and packet loss.. Option C is correct because FortiGate SD-WAN health-check allows configuring multiple thresholds for jitter, latency, and packet loss. These thresholds are used to determine the quality of a link; if any threshold is exceeded, the link is considered failed. This enables granular control over link health assessment beyond simple reachability.

Answer

Health-check probes can be sent from any interface, including loopback.

Answer

Health-check can only be configured on physical interfaces, not VLANs or subinterfaces.

Question 5

Which TWO statements correctly describe the behavior of SD-WAN rules when using the 'maximize-bandwidth' strategy?

Accepted Answer

The administrator can assign different weights to members to influence the proportion of traffic each handles.. Option B is correct because the 'maximize-bandwidth' strategy in SD-WAN rules uses weighted load balancing, where the administrator assigns weights to each member link. The proportion of traffic each member handles is directly proportional to its assigned weight, allowing fine-grained control over bandwidth utilization across multiple WAN links.

Answer

The strategy ensures that all traffic uses the member with the highest bandwidth.

Answer

Traffic from a single session can be split across multiple members for better performance.

Answer

Traffic is distributed based on session count to keep each link equally utilized.

Question 6

A FortiGate is deployed with two ISPs and SD-WAN. The organization uses OSPF to exchange routes with a remote branch. The administrator notices that the FortiGate is not installing OSPF-learned routes into the routing table. The OSPF configuration is verified to be correct, and neighbors are established. Which configuration could be causing the issue?

Accepted Answer

A distribute-list configured under OSPF is filtering the routes from being installed.. Option C is correct because a distribute-list applied under OSPF can filter routes from being installed into the routing table even when OSPF neighbors are fully established and the OSPF database contains the routes. This is a common cause of routes being learned but not installed, as the filter operates after the SPF calculation and before route insertion.

Answer

The SD-WAN health-check is configured with 'update-static-route' and is overriding OSPF routes.

Answer

The administrative distance of OSPF is set to 200, which is higher than the default 110.

Answer

The OSPF interface is configured as 'passive', which prevents route exchange.

Question 7

An organization is deploying SD-WAN across multiple sites with two internet links (MPLS and broadband) at the main branch. They want voice traffic to use the MPLS link unless it fails, in which case failover to broadband should occur. Which SD-WAN rule configuration achieves this?

Accepted Answer

Configure an SD-WAN rule for voice with strategy 'best quality', set MPLS as preferred member, and define SLA targets for MPLS.. Option C is correct because the 'best quality' strategy with a preferred member and SLA targets allows voice traffic to use the MPLS link as long as it meets the defined SLA (e.g., latency, jitter, packet loss). If the MPLS link fails or degrades below the SLA threshold, the SD-WAN rule automatically fails over to the broadband link, ensuring voice traffic continuity.

Answer

Configure an SD-WAN rule for voice with strategy 'maximize bandwidth' and members MPLS and broadband.

Answer

Configure an SD-WAN rule for voice with strategy 'lowest cost' and members MPLS and broadband.

Answer

Configure an SD-WAN rule for voice with strategy 'manual' and members MPLS and broadband.

Question 8

A network engineer is troubleshooting an SD-WAN setup where traffic from a specific subnet is not being load-balanced as expected. The SD-WAN rule uses 'source IP' hashing. The engineer notices that the traffic originates from multiple hosts in the same /24 subnet. What is the most likely cause of poor load distribution?

Accepted Answer

The source IP hashing algorithm causes multiple hosts in the same subnet to map to the same member.. Source IP hashing in SD-WAN uses a hash of the source IP address to select a member for each flow. When multiple hosts reside in the same /24 subnet, their source IPs share the same first 24 bits, which can cause the hash algorithm to map them to the same SD-WAN member if the hash function is not sufficiently granular or if the number of members is small. This results in poor load distribution despite multiple sources.

Answer

The SD-WAN rule is not matching the traffic.

Answer

The SD-WAN members have different bandwidths.

Answer

Traffic is using a single destination IP and port.

Question 9

A FortiGate is configured with two static routes to the same destination 0.0.0.0/0 with equal distance but different priorities. The priority values are 10 and 20. Which route will be used for traffic matching the default route?

Accepted Answer

The route with priority 10 will be used.. In FortiGate, when multiple static routes have the same distance (administrative distance) to the same destination, the route with the lowest priority value is selected. Priority is a FortiGate-specific metric that breaks ties among routes with equal distance. Since priority 10 is lower than 20, the route with priority 10 will be installed in the routing table and used for traffic matching 0.0.0.0/0.

Answer

The route with priority 20 will be used.

Answer

The route with lower distance will be used.

Answer

Both routes will be used for load balancing.

Question 10

Which TWO statements are true regarding BGP path selection in a FortiGate SD-WAN environment?

Accepted Answer

BGP best path selection is independent of SD-WAN rules unless explicitly overridden.. BGP best path selection operates independently of SD-WAN rules because BGP selects the best route based on its own path attributes (e.g., weight, local preference, AS path length, MED) as defined in RFC 4271. SD-WAN rules can only override this selection if explicitly configured to do so, typically by using route maps or policy-based routing to influence the decision. Without such an override, the BGP best path is installed in the routing table and SD-WAN rules then apply to traffic forwarding, not to the BGP path selection process itself.

Answer

SD-WAN cannot be applied to routes learned via BGP.

Answer

SD-WAN can modify BGP MED values to influence path selection.

Answer

SD-WAN rules always follow the BGP best path selection.

Question 11

A company with a hub-and-spoke SD-WAN topology uses FortiGates at each site. The hub has two WAN links: MPLS (10 Mbps) and broadband (100 Mbps). The spokes connect only via MPLS. The company deploys a new real-time application that requires low latency and low jitter. The network administrator creates an SD-WAN rule for this application with 'best quality' strategy and both MPLS and broadband as members. The SLA for MPLS is configured with latency < 10 ms and jitter < 5 ms. The SLA for broadband is configured with latency < 50 ms and jitter < 20 ms. The actual measured latency on MPLS is 12 ms, and jitter is 4 ms. The broadband latency is 25 ms, jitter 10 ms. Which path will the application traffic take?

Accepted Answer

The traffic will use the broadband link because MPLS SLA fails and broadband SLA is met.. The SD-WAN rule uses the 'best quality' strategy, which selects the member with the best SLA performance. The MPLS link fails its SLA because its measured latency of 12 ms exceeds the configured threshold of 10 ms, even though jitter is within limits. The broadband link meets both its latency (25 ms < 50 ms) and jitter (10 ms < 20 ms) thresholds, so it becomes the active path for the application traffic.

Answer

The traffic will be load-balanced between MPLS and broadband.

Answer

The traffic will use the MPLS link because it is the preferred member.

Answer

The traffic will be dropped because no link meets the SLA.

Question 12

An administrator is configuring SD-WAN on a FortiGate to route traffic between two internet connections (ISP1 and ISP2). The SD-WAN rules use performance SLA to measure latency. Which TWO statements are true about SD-WAN rule matching and failover?

Accepted Answer

When the SD-WAN rule action is set to 'best quality' and no member meets the SLA, the FortiGate will still forward traffic using the member with the best SLA status.. Option A is correct because when an SD-WAN rule is configured with 'best quality' strategy, the FortiGate selects the member with the best SLA status even if no member fully meets the SLA threshold. This ensures traffic is still forwarded using the least-bad option rather than being dropped, maintaining connectivity under degraded conditions.

Answer

SD-WAN automatically fails over all sessions to the backup member if the primary member exceeds the SLA threshold.

Answer

If multiple SD-WAN rules match, the rule with the highest bandwidth member is used.

Answer

When the SD-WAN rule action is set to 'lowest cost' and no member meets the SLA, the FortiGate drops the traffic.

Question 13

A company has two internet connections: a primary fiber link (port1, 100 Mbps) and a backup DSL link (port2, 20 Mbps). They are using SD-WAN to load balance traffic based on volume, with a rule that sends 70% of traffic to port1 and 30% to port2. Recently, users report that video conferencing applications are experiencing high latency and jitter. The network team finds that the SD-WAN performance SLA for the fiber link shows 80% packet loss and high latency. The SD-WAN rule action is set to 'best quality' with a latency threshold of 150 ms. The current latency on port1 is 200 ms, and on port2 is 40 ms. What should the administrator do to ensure that video conferencing traffic uses the DSL link while the fiber link is degraded?

Accepted Answer

No changes are needed; the SD-WAN rule with 'best quality' will automatically use port2 for new sessions because port1 does not meet the SLA.. Option D is correct because the SD-WAN rule action is set to 'best quality', which means the FortiGate will automatically steer new sessions away from any interface that fails the performance SLA. Since port1 has 80% packet loss and 200 ms latency (exceeding the 150 ms threshold), it is considered degraded, and new video conferencing traffic will be directed to port2 (40 ms latency) without manual intervention.

Answer

Increase the SLA latency threshold to 250 ms so that the fiber link is considered acceptable.

Answer

Change the SD-WAN rule action to 'lowest cost' to favor the DSL link.

Answer

Adjust the volume ratio to send 100% of traffic to port2 until the fiber link recovers.

Question 14

Drag and drop the steps to troubleshoot a FortiGate SSL VPN connection failure into the correct order.

Question 15

Drag and drop the steps to configure a FortiGate to use an external authentication server (e.g., RADIUS) for admin login into the correct order.

Question 16

Match each IPsec VPN term to its definition.

Question 17

Match each FortiGate interface type to its usage.

Question 18

A network engineer is configuring SD-WAN on a FortiGate. They have three WAN interfaces (wan1, wan2, lte) and want traffic to the primary datacenter (10.10.10.0/24) to use wan1 unless its latency exceeds 50 ms, in which case failover to wan2. The engineer created an SD-WAN rule with a strategy of 'Manual' and selected 'wan1' as the preferred member. What additional configuration is required to achieve automatic failover based on latency?

Accepted Answer

Configure a performance SLA for wan1 with a latency threshold of 50 ms and associate it with the SD-WAN rule.. For automatic failover based on latency, a performance SLA must be configured to measure latency on wan1. The SD-WAN rule uses the SLA to determine if the preferred member meets the threshold; if not, traffic switches to the next available member. Option A correctly identifies this requirement.

Answer

Create a route map to prefer wan1 and apply it to the SD-WAN rule.

Answer

Set the SD-WAN rule strategy to 'Best Quality' and select latency as the metric.

Answer

Enable BFD on wan1 and wan2 with a minimum interval of 50 ms.

Question 19

A FortiGate is running OSPF with multiple areas. The admin wants to redistribute a static route for 192.168.100.0/24 into OSPF. After configuring 'config router ospf' with 'redistribute static' enabled, the route appears in the OSPF database but is not being advertised to other areas. What is the most likely cause?

Accepted Answer

The router is an ABR and the static route is being redistributed as a type 5 LSA, which is not flooded into stub areas.. By default, OSPF does not redistribute external routes into other areas unless the redistributing router is an ASBR and the route is a type 5 LSA. However, type 5 LSAs are not flooded into stub areas or NSSAs. If the router is in a NSSA or stub area, redistribution must be handled differently. The most common reason is that the router is an ABR and the external route is not being advertised into other areas because the router is not acting as an ASBR for those areas.

Answer

The 'redistribute static' command needs a route map to filter the route correctly.

Answer

The static route's administrative distance is too high for OSPF.

Answer

OSPF must be configured with 'default-information originate' to allow redistribution.

Question 20

An administrator wants to load balance traffic across two ISP links using SD-WAN. The requirement is that sessions from the same source IP address must always use the same ISP link. Which SD-WAN load balancing algorithm should be used?

Accepted Answer

Source-destination IP. The source-destination IP algorithm uses a hash of source and destination IP addresses to consistently map traffic to the same member. This ensures that all sessions with the same source and destination IP pair go to the same link, meeting the requirement.

Answer

Sessions

Answer

Volume

Answer

Spillover