NSE7 Advanced Networking and SD-WAN Practice Test 10 — 15 Questions

Question 1

An administrator notices that when a BGP session goes down, failover to the backup path takes about 30 seconds. The admin wants to reduce the failover time to less than 1 second. Which technology should the administrator implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable BFD on the BGP neighbor and the associated interface. BFD (Bidirectional Forwarding Detection) provides sub-second failure detection for BGP sessions by sending rapid hello packets independently of the BGP keepalive mechanism. By enabling BFD on both the BGP neighbor and the associated interface, the router can detect a link or neighbor failure in milliseconds (e.g., 50-300 ms), allowing BGP to converge and switch to the backup path in under 1 second, far faster than the default 30-second hold timer.

Answer

Configure BGP fast external failover

Answer

Increase the BGP keepalive timer to 1 second

Answer

Use policy-based routing with SLA monitoring

Question 2

Which routing technique allows a FortiGate to forward packets based on source IP address, destination IP address, or other criteria, in addition to the destination IP alone?

Accepted Answer

Policy-Based Routing (PBR). Policy-Based Routing (PBR) allows a FortiGate to forward packets based on criteria beyond the destination IP address, such as source IP, destination port, protocol, or application. This is achieved by configuring policy routes that override the default routing table lookup, enabling granular traffic steering for advanced networking scenarios like SD-WAN.

Answer

RIP

Answer

OSPF route redistribution

Answer

ECMP

Question 3

An administrator is configuring a FortiGate as a LAN edge device with FortiSwitch and FortiAP. Which feature must be enabled on the FortiGate to centrally manage the FortiSwitch and FortiAP devices?

Accepted Answer

FortiLink. FortiLink is the proprietary protocol that enables a FortiGate to centrally manage FortiSwitch and FortiAP devices as logical extensions of the FortiGate itself. When FortiLink is enabled on a FortiGate interface, the FortiGate automatically discovers, provisions, and manages connected FortiSwitch and FortiAP units, handling VLAN assignment, PoE control, and firmware synchronization without requiring separate management platforms.

Answer

CAPWAP

Answer

LLDP

Answer

SNMP

Question 4

A FortiGate has an SD-WAN configuration with two members (wan1, wan2). The performance SLA monitors latency to 8.8.8.8. The admin notices that even when the SLA is satisfied on both members, all traffic uses wan1. The SD-WAN rule is configured with 'strategy = best quality'. What is the most likely cause?

Accepted Answer

The best quality strategy selects the member with the best SLA metric, which is wan1 by default when both meet SLA. When the SD-WAN rule uses 'best quality' strategy and both members meet the performance SLA, FortiGate selects the member with the best (lowest) latency metric. By default, if both members have equal SLA satisfaction, the first member in the SD-WAN configuration (wan1) is chosen as the tie-breaker. This explains why all traffic uses wan1 even though both links are healthy.

Answer

A firewall policy is overriding the SD-WAN rule

Answer

The performance SLA is incorrectly configured, causing wan2 to be ignored

Answer

The SD-WAN rule has 'set match-vip disable' which forces all traffic to wan1

Question 5

What is the purpose of a route map when used with route redistribution on a FortiGate?

Accepted Answer

To filter or modify route attributes during redistribution. Route maps are used with route redistribution to filter which routes are redistributed and to modify route attributes (such as metric, tag, or next-hop) as they are injected from one routing protocol into another. Option D is correct because route maps provide granular control over the redistribution process, allowing administrators to match specific routes using prefix lists or ACLs and then set attributes like metric or tag before the routes are redistributed.

Answer

To create a prefix list for BGP

Answer

To define the administrative distance of redistributed routes

Answer

To enable the redistribution process

Question 6

An administrator wants to integrate a FortiExtender with a FortiGate to provide additional WAN connectivity. Which configuration is required on the FortiGate to enable the FortiExtender to operate as a secondary WAN interface?

Accepted Answer

Configure the FortiExtender under Network > FortiExtender and assign it to a WAN interface. When a FortiExtender is configured under Network > FortiExtender and assigned to a WAN interface, the FortiGate treats it as a secondary WAN link, allowing it to participate in SD-WAN or load-balancing policies. The FortiExtender operates in its default routed mode, where it receives a public IP from the cellular network and the FortiGate uses it as an additional gateway for outbound traffic.

Answer

Enable LLDP on the port connected to the FortiExtender

Answer

Set the FortiExtender to bridge mode

Answer

Create a VLAN interface for the FortiExtender

Question 7

A network engineer is troubleshooting an OSPF multi-area setup on a FortiGate. The FortiGate is an ABR (Area Border Router) connecting area 0 and area 1. The engineer notices that routes from area 1 are not being advertised into area 0. Which TWO of the following are possible causes? (Select TWO.)

Accepted Answer

OSPF is not enabled on the interface in area 1, or the network type is mismatched. If OSPF is not enabled on the interface in area 1, the FortiGate cannot form adjacencies or exchange routes within that area. A network type mismatch (e.g., broadcast vs. point-to-point) can prevent neighbor relationships from forming, which would block Type 3 LSA generation by the ABR. Without OSPF running correctly on the area 1 interface, the ABR cannot inject area 1 routes into area 0.

Answer

The 'redistribute connected' command is missing

Answer

The FortiGate has a static route to area 1 that overrides OSPF

Answer

The administrative distance for OSPF is set too high

Question 8

An administrator is configuring BGP on a FortiGate to peer with an ISP router. The FortiGate is advertising a prefix (203.0.113.0/24) to the ISP. To ensure that traffic to the prefix is load balanced across two WAN links (port1 and port2) using SD-WAN, the administrator must configure which THREE of the following? (Select THREE.)

Accepted Answer

Define both port1 and port2 as SD-WAN members. SD-WAN load balancing requires that both WAN interfaces (port1 and port2) are defined as SD-WAN members. Without adding them to the SD-WAN zone, the FortiGate cannot distribute traffic across them using SD-WAN rules or load-balancing algorithms.

Answer

Configure a performance SLA to monitor each link

Answer

Configure BGP to use the same AS number on both members

Question 9

A FortiGate is deployed as a LAN edge switch with multiple FortiSwitch units connected. The administrator wants to configure VLANs and manage the switches centrally. Which TWO features must be enabled on the FortiGate to achieve this? (Select TWO.)

Accepted Answer

Create VLAN interfaces on the FortiGate and assign them to the FortiLink interface. VLAN interfaces must be created on the FortiGate and assigned to the FortiLink interface to enable centralized VLAN management. The FortiGate acts as the controller, pushing VLAN configurations to connected FortiSwitch units via the FortiLink tunnel, allowing the administrator to manage all VLANs from a single point without logging into each switch individually.

Answer

LLDP-MED

Answer

Configure a separate management VRF

Answer

STP (Spanning Tree Protocol) on the FortiGate

Question 10

An administrator configured an SD-WAN rule to steer traffic to a specific member interface using the 'lowest-cost' strategy. After applying, the traffic is not being load-balanced as expected. Which configuration element is MOST likely missing?

Accepted Answer

A performance SLA has not been assigned to the SD-WAN member interfaces.. The 'lowest-cost' strategy in Fortinet SD-WAN selects the member interface with the lowest cost value. However, without a performance SLA assigned to the SD-WAN member interfaces, the SD-WAN rule cannot dynamically measure link quality or update interface costs based on real-time conditions. As a result, the rule defaults to static cost values or may not load-balance traffic at all, because the SLA is required to trigger cost-based path selection and failover. Assigning an SLA enables the FortiGate to monitor link performance and adjust the effective cost, allowing proper load balancing across multiple members.

Answer

The 'best-quality' strategy was inadvertently selected instead.

Answer

The SD-WAN member interfaces are not in the same zone.

Answer

The 'update-static-route' option is disabled on the SD-WAN member.

Question 11

A FortiGate has OSPF configured in multiple areas. The administrator wants to redistribute routes from area 0 into area 1 with a metric of 10. Which command is correct?

Accepted Answer

config router ospf
  set redistribute "ospf" metric 10. None of the provided commands correctly set the metric for inter-area OSPF routes. OSPF automatically floods Type 3 LSAs between areas; the metric is determined by interface costs and cannot be directly set via redistribution. Redistributing OSPF into the same process is not a supported method for inter-area metric control.

Answer

config router ospf
  config redistribute "ospf"
    set status enable
    set metric 10
  end

Answer

config router ospf
  config redistribute "connected"
    set metric 10
  end

Answer

config router ospf
  config area
    edit 1
      set type nssa
    end

Question 12

Which load balancing algorithm in SD-WAN sends new sessions to the member interface with the least number of active sessions?

Accepted Answer

Sessions. The Sessions algorithm in Fortinet SD-WAN selects the member interface with the fewest active sessions when a new session is initiated. This is the default load-balancing method and ensures even distribution of session counts across WAN links, preventing any single interface from becoming overloaded with connections.

Answer

Volume

Answer

Spillover

Answer

Source-dest IP

Question 13

A FortiGate is configured with VRF. Which statement about VRF is true?

Accepted Answer

VRF allows multiple routing tables to coexist on the same FortiGate.. VRF (Virtual Routing and Forwarding) allows a single FortiGate to maintain multiple independent routing tables, each with its own set of interfaces, routes, and forwarding decisions. This enables network segmentation and traffic isolation without requiring separate physical devices, making option B correct.

Answer

Interfaces can belong to multiple VRFs simultaneously.

Answer

Routes from different VRFs can be automatically redistributed without configuration.

Answer

VRF can only be used when OSPF is enabled.

Question 14

An administrator wants to load-balance traffic across two WAN links using ECMP. The routes have equal distances and metrics. However, traffic is only using one of the links. What could be the cause?

Accepted Answer

The routes are learned via different routing protocols with different administrative distances.. ECMP (Equal-Cost Multi-Path) requires routes to have identical administrative distances (AD) to be considered equal-cost. If routes are learned via different routing protocols (e.g., OSPF with AD 110 and static with AD 1), the FortiGate will prefer the route with the lower AD, even if metrics are equal. This causes traffic to use only the preferred link, as the other route is not installed in the routing table for ECMP selection.

Answer

ECMP is not enabled globally under config system settings.

Answer

The firewall policy is configured to use a specific egress interface.

Answer

The traffic is session-based and ECMP uses per-packet load balancing.

Question 15

Which BGP attribute is used by FortiGate SD-WAN to influence outbound traffic path selection?

Accepted Answer

Local Preference

Answer

Next Hop

Answer

MED

Answer

AS Path