NSE7 Advanced Networking and SD-WAN — 40 Questions

Question 1

Which TWO statements are true regarding BGP path selection in a FortiGate SD-WAN environment?

Accepted Answer

BGP best path selection is independent of SD-WAN rules unless explicitly overridden.. BGP best path selection operates independently of SD-WAN rules because BGP selects the best route based on its own path attributes (e.g., weight, local preference, AS path length, MED) as defined in RFC 4271. SD-WAN rules can only override this selection if explicitly configured to do so, typically by using route maps or policy-based routing to influence the decision. Additionally, SD-WAN rules can use BGP community values as match criteria in SD-WAN rules, allowing for more granular traffic control based on BGP attributes. Therefore, both statements A and E are correct.

Answer

SD-WAN cannot be applied to routes learned via BGP.

Answer

SD-WAN can modify BGP MED values to influence path selection.

Answer

SD-WAN rules always follow the BGP best path selection.

Question 2

An administrator configures an SD-WAN rule to steer traffic from a specific subnet to an SD-WAN member with the lowest cost. Which load balancing algorithm should be selected in the SD-WAN rule to achieve this behavior?

Accepted Answer

Lowest-cost. The 'Lowest-cost' algorithm is correct because it directs traffic to the SD-WAN member with the lowest configured cost metric, which directly matches the administrator's requirement to steer traffic from a specific subnet to the member with the lowest cost. In Fortinet SD-WAN, the cost is a static metric assigned per SD-WAN member interface, and the Lowest-cost algorithm selects the member with the smallest cost value for each new session, ensuring traffic follows the least-cost path.

Answer

Volume

Answer

Sessions

Answer

Source-dest-IP

Question 3

An administrator needs to configure VRF to separate traffic for two departments. Which TWO components must be configured for each VRF?

Accepted Answer

A VRF instance. For basic VRF operation, only a VRF instance (A) and interface binding (B) are strictly required. The VRF instance creates the separate routing table, and interface binding associates the interface with that table. The other options are not mandatory: a dedicated VDOM (C) is not needed because VRF operates within a VDOM; route leaking (D) is only for inter-VRF communication; and separate firewall policies (E) are optional and not a routing component. Although the question asks for three components, only two are essential for VRF separation.

Answer

A dedicated VDOM

Answer

Route leaking configuration

Answer

A separate firewall policy for each VRF

Question 4

A FortiGate is running OSPF in a multi-area network. The administrator notices that routes from area 1 are not being redistributed into area 0. The configuration includes 'redistribute connected' under OSPF. What is the most likely cause?

Accepted Answer

Area 1 is a stub area. The question states that the configuration includes 'redistribute connected' under OSPF. If Area 1 is a stub area, external routes (such as those redistributed from connected interfaces) are not allowed into the area. Therefore, the redistributed connected routes will not be present in Area 1 and cannot be propagated to Area 0 by the ABR. This is the most likely cause given the scenario.

Answer

The OSPF network type is not broadcast

Answer

The ABR is not configured with 'area 0'

Answer

The 'redistribute connected' command is missing under the OSPF process

Question 5

A network administrator is configuring SD-WAN on a FortiGate and wants to ensure that VoIP traffic uses the link with the lowest latency while bulk download traffic uses the link with the highest bandwidth. Which TWO configuration steps are required?

Accepted Answer

Create an SD-WAN rule for VoIP traffic with 'best quality' strategy. Create an SD-WAN rule for VoIP with 'best quality' strategy (B) and a performance SLA to measure latency (E). This ensures VoIP uses the lowest-latency link. Bulk download traffic, not matching this rule, will use the highest-bandwidth link by default due to the SD-WAN default strategy (e.g., 'lowest cost' based on bandwidth), satisfying both requirements.

Answer

Assign a static route for the VoIP subnet

Answer

Enable BFD on all WAN interfaces

Answer

Configure a route map for VoIP traffic

Question 6

A FortiGate is configured with OSPF and multiple areas. The administrator wants to prevent type 3 LSAs from entering a specific area, while still allowing inter-area routing. Which TWO configurations can achieve this?

Accepted Answer

Use an area filter list with 'prefix-list' to deny specific prefixes. To prevent Type 3 LSAs from entering a specific area while still allowing inter-area routing, the two correct configurations are using an area filter list with a prefix-list (Option C) and configuring the area as a totally stubby area (Option E). A totally stubby area blocks both Type 3 and Type 5 LSAs, but the default route is injected to enable inter-area routing. An area filter list with a prefix-list allows selective filtering of Type 3 LSAs based on prefixes. Option A (stub area) only blocks Type 5 LSAs, not Type 3 LSAs, so it does not meet the requirement. Option B (NSSA) also allows Type 3 LSAs and only blocks Type 5 LSAs. Option D (point-to-multipoint network type) does not affect LSA type filtering.

Answer

Configure the area as a stub area

Answer

Configure the area as an NSSA

Answer

Set the OSPF network type to point-to-multipoint

Question 7

A network administrator is troubleshooting an SD-WAN setup where traffic from a specific application is not being load-balanced as expected. The SD-WAN rule uses the 'volume' load balancing algorithm. Which TWO factors could cause traffic to not be distributed equally? (Choose two.)

Accepted Answer

One of the SD-WAN members is a PPPoE interface. A PPPoE interface introduces MTU overhead (typically 8 bytes) and possible fragmentation, which can disrupt session-based load balancing. The 'volume' algorithm distributes sessions based on traffic volume, but if encapsulation issues cause session drops or asymmetric handling, distribution becomes unequal. Option D is correct because asymmetric routing (forward and return traffic taking different paths) can cause sessions to be created on different SD-WAN members than intended. This breaks the consistent session-to-member mapping required for the 'volume' algorithm to distribute traffic equally, as sessions may be split or misdirected.

Answer

The SD-WAN rule is configured with 'mode = load-balance' but the algorithm is set to 'source-dest-ip'

Answer

The performance SLA has a high packet loss threshold causing the member to be dead

Answer

The traffic is encrypted and cannot be inspected

Question 8

An administrator runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session has been active for 1 hour and will expire in about 1 hour. The 'duration=3600' indicates the session has been active for 3600 seconds (1 hour), and 'expire=3599' shows the idle timeout remaining is approximately 1 hour. The proto_state=01 value indicates the session is in the INIT state (SYN sent, full handshake not yet complete); however, the duration shows it has been active for an hour, meaning this is a long-lived session that has not yet progressed to an established state—possibly due to no response. The key point is the duration and expire values, not the proto_state interpretation.

Answer

The session is about to expire and will be removed soon

Answer

The session is using UDP protocol

Answer

The session is in a half-open state

Question 9

An administrator wants to integrate a FortiExtender with a FortiGate for LTE backup. The FortiGate is using SD-WAN. What is the correct way to add the FortiExtender as an SD-WAN member?

Accepted Answer

Connect the FortiExtender to a physical port on the FortiGate and configure that port as an SD-WAN member.. When integrating a FortiExtender with a FortiGate for LTE backup in an SD-WAN setup, the correct method is to physically connect the FortiExtender to a physical port on the FortiGate. The physical port itself is then configured as an SD-WAN member, which allows the FortiGate to treat the LTE link as a standard SD-WAN interface, enabling SD-WAN rules, SLA monitoring, and automatic failover. The FortiExtender does not create a separate virtual interface; the physical port acts as the LTE interface.

Answer

Configure the FortiExtender as a standalone firewall and use IPsec between them.

Answer

Configure the FortiExtender as a separate VDOM and route between VDOMs.

Answer

Use a virtual-wire pair to connect the FortiExtender.

Question 10

An administrator configures two SD-WAN members (port1, port2) with performance SLAs. The SD-WAN rule uses 'best-quality' strategy. During a failover test, the primary member port1 becomes unavailable but traffic does not switch to port2. What should the administrator check first?

Accepted Answer

The SD-WAN rule is not configured to use the performance SLA.. When a physical interface goes down, FortiGate immediately marks the SD-WAN member as dead, regardless of SLA thresholds. Traffic should fail over to port2. The most likely reason is that the SD-WAN rule is not actually configured to use the performance SLA (option A) or the member is not part of the SLA. Option C is incorrect because SLA failover thresholds only matter when the interface is up but performance degrades; an interface-down event should trigger immediate failover.

Answer

The 'set status' on the performance SLA is 'passive'.

Answer

The performance SLA's failover threshold is not met.

Answer

The 'update-static-route' is enabled on port1.

Question 11

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is using TCP and has been up for 3600 seconds, with 3599 seconds remaining before expiry.. The output shows a TCP session (proto=6) with a duration of 3600 seconds and an expire value of 3599 seconds. In FortiGate, 'duration' is the time since session creation, and 'expire' is the remaining time before removal. The 'proto_state=01' indicates the initial SYN-SENT state (not established), but this does not affect the interpretation of duration and expire values. Option A is incorrect because proto_state=01 actually represents a half-open (SYN-SENT) state, but the expire value is 3599 seconds, not 3600. Option B is incorrect because duration is not idle time. Option D is incorrect because UDP uses proto=17.

Answer

The session is in a half-open state (proto_state=01) and will expire in 3600 seconds.

Answer

The session has been idle for 3600 seconds and will be removed in 3599 seconds.

Answer

The session is UDP and has 3600 seconds to live.

Question 12

A FortiGate in a multi-area OSPF network is not learning routes from area 1. Which THREE items could be causing this?

Accepted Answer

There is a firewall policy blocking OSPF traffic between areas.. Options C and E are correct causes. A firewall policy blocking OSPF protocol 89 prevents neighbor formation, stopping route exchange. An administratively down interface in area 1 also prevents adjacency. Option D is incorrect because a stub area only blocks external routes (Type 5), not inter-area routes (Type 3), so it would not prevent learning routes from area 1.

Answer

The ABR is not configured with 'set type' for area 1.

Answer

The 'set redistribute' option is missing on the ABR.

Answer

Area 1 is configured as a stub area and does not accept external routes.

Question 13

An administrator configures policy-based routing (PBR) on a FortiGate to route traffic from a specific subnet through an MPLS link. The PBR is configured under config router policy. However, traffic from that subnet is still using the default route. What is the most likely issue?

Accepted Answer

The firewall policy is not allowing traffic to use the PBR. On FortiGate, PBR is evaluated before the firewall policy lookup. However, if the firewall policy denies the traffic (e.g., no matching policy or action is deny), the traffic is dropped before it reaches the routing table, so PBR never applies. Additionally, if the matching firewall policy has a 'set routing' override or uses a different route, it can bypass the PBR rule. The most common issue is that the firewall policy is not properly configured to allow traffic from the specified subnet, or it has a policy-based route override that supersedes the PBR rule. There is no requirement to enable PBR on the firewall policy for classic PBR.

Answer

The PBR policy does not have a set tos or set dscp value

Answer

The PBR policy has a higher priority number than the default route

Answer

The MPLS link is down

Question 14

A FortiGate is configured with a route map named RM_OSPF that sets a metric of 100 for redistributed routes. The route map is applied to redistribution into OSPF. After applying, the redistributed routes have a metric of 20. What could be the cause?

Accepted Answer

The OSPF process has a default-metric of 20 that overrides the route map. In FortiOS, when redistributing routes into OSPF with a route map that sets a metric, the route map's set command should override the default-metric configured under the OSPF process. However, if the OSPF process has a default-metric of 20, and the route map is applied correctly, the metric set by the route map will be used. The fact that the redistributed routes have a metric of 20 indicates that the route map was not applied as expected. The most common reason is that the OSPF default-metric value overrides the route map's set metric when the route map is not properly configured or referenced, but in this case the route map is applied but the default-metric takes precedence due to a known behavior in certain FortiOS versions where the default-metric command overrides the route map's set metric. Therefore, option C correctly identifies the cause.

Answer

The route map does not have a match statement and therefore is not applied

Answer

The route map is applied in the wrong direction

Answer

The redistributed route is already in OSPF with a metric of 20

Question 15

An administrator wants to use a FortiGate to manage FortiSwitch units via the LAN. Which interface configuration is required on the FortiGate to allow this management?

Accepted Answer

The interface must have 'set type switch' enabled. The interface must have 'set type switch' enabled to manage FortiSwitch units. This configuration sets the interface as a FortiLink port, enabling automatic discovery, provisioning, and management of FortiSwitch devices. Trunk mode is not required; in fact, setting the interface as a trunk (set mode trunk) is for aggregating multiple ports or carrying multiple VLANs but does not enable FortiLink control protocols. Therefore, option D is correct.

Answer

The interface must have 'set role lan' configured

Answer

The interface must be configured as a 'trunk' mode to connect to the FortiSwitch

Answer

The interface must be a member of a VDOM

Question 16

An administrator wants to use BFD with OSPF to detect link failures faster. What must be configured on the FortiGate?

Accepted Answer

Enable BFD globally and under the OSPF process with 'set bfd enable'.. BFD (Bidirectional Forwarding Detection) on FortiGate requires both global activation under 'config system settings' and per-process activation under 'config router ospf' with the 'set bfd enable' command. This two-level configuration ensures BFD sessions are established for OSPF neighbors, enabling sub-second link failure detection independent of OSPF's hello/dead timers.

Answer

Enable BFD only on the OSPF interfaces using 'set bfd enable' under the interface configuration.

Answer

BFD is automatically enabled when OSPF is configured; no additional steps are needed.

Answer

Create a BFD template and apply it to the OSPF process.

Question 17

A network administrator is configuring SD-WAN on a FortiGate. The organization has two internet links: MPLS (primary) and broadband (backup). The administrator wants all traffic to use the MPLS link unless it fails, in which case traffic should fail over to the broadband link. Which SD-WAN configuration best achieves this requirement?

Accepted Answer

Set the MPLS link priority to 10 and the broadband link priority to 5, then configure an SD-WAN rule with the 'best quality' strategy.. Setting the MPLS link priority to 10 (higher) and broadband to 5 (lower) ensures the SD-WAN rule with 'best quality' strategy selects the MPLS link as the preferred path. The 'best quality' strategy evaluates link quality metrics and, when priorities differ, prefers the higher-priority link. If the MPLS link fails, the strategy automatically fails over to the broadband link, meeting the requirement.

Answer

Enable 'set role' on the MPLS link as 'primary' and on the broadband link as 'standby' with the 'redundant' strategy.

Answer

Configure both links in the SD-WAN zone with equal priority and use the 'lowest cost' strategy.

Answer

Create two static routes: one with higher distance for MPLS and one with lower distance for broadband.

Question 18

A FortiGate is configured with SD-WAN and has two WAN members: Member1 (ISP1) with priority 10, and Member2 (ISP2) with priority 5. The SD-WAN rule for traffic from the internal network uses the 'best quality' strategy. During normal operation, traffic flows through Member1. After a link failure on Member1, traffic correctly fails over to Member2. However, when Member1 is restored, traffic does not fail back. What is the most likely cause?

Accepted Answer

The health-check for Member1 is configured with 'set probe-mode passive' and 'set update-static-route disable'.. When 'set probe-mode passive' is configured, the health-check server only monitors the link without actively generating probe traffic, and 'set update-static-route disable' prevents the static route associated with Member1 from being re-enabled after the link is restored. This means the route remains inactive, so SD-WAN cannot fail back to Member1 even though the physical link is up.

Answer

The static route for Member1 has a higher administrative distance than Member2.

Answer

The SD-WAN rule is configured with 'set fallback' disabled.

Answer

The priority of Member2 is higher than Member1.

Question 19

An enterprise uses FortiGate as an SD-WAN edge device with three WAN links: Link A (MPLS), Link B (broadband), and Link C (LTE). The SD-WAN rule for VoIP traffic uses the 'best quality' strategy with link-quality-measurement enabled. The VoIP traffic is routed via Link A. During peak hours, users report poor voice quality. The administrator checks the SD-WAN performance SLA logs and sees that Link A's jitter and latency are within acceptable thresholds, but packet loss is slightly elevated. Which action would most likely improve VoIP quality without manual intervention?

Accepted Answer

Configure a performance SLA for VoIP traffic with jitter < 10ms, latency < 100ms, and packet-loss < 0.5% and apply it to the SD-WAN rule.. Configuring a performance SLA with specific thresholds for jitter, latency, and packet loss allows FortiGate to dynamically failover VoIP traffic to another WAN link when Link A's packet loss exceeds the defined threshold (e.g., 0.5%). Since the 'best quality' strategy uses link-quality-measurement to select the link with the best SLA compliance, applying a performance SLA with a packet-loss threshold ensures that even if jitter and latency are acceptable, elevated packet loss triggers a switch to a healthier link, improving voice quality without manual intervention.

Answer

Increase the priority of Link A to ensure it remains the preferred link.

Answer

Disable link-quality-measurement to reduce overhead on Link A.

Answer

Add a new SD-WAN rule with 'lowest cost' strategy for VoIP traffic.

Question 20

Which THREE statements are true about FortiGate SD-WAN health-check configuration?

Accepted Answer

Health-check can be configured with multiple thresholds for jitter, latency, and packet loss.. FortiGate SD-WAN health-check allows configuring multiple thresholds for jitter, latency, and packet loss. These thresholds are used to determine the quality of a link; if any threshold is exceeded, the link is considered failed. This enables granular control over link health assessment beyond simple reachability.

Answer

Health-check probes can be sent from any interface, including loopback.

Answer

Health-check can only be configured on physical interfaces, not VLANs or subinterfaces.