NSE7 Advanced Networking and SD-WAN Practice Test 10 — 15 Questions

Question 1

An administrator is configuring BGP on a FortiGate to peer with an ISP router. The FortiGate is advertising a prefix (203.0.113.0/24) to the ISP. To ensure that traffic to the prefix is load balanced across two WAN links (port1 and port2) using SD-WAN, the administrator must configure which THREE of the following? (Select THREE.)

Accepted Answer

Define both port1 and port2 as SD-WAN members. Options A, B, and D are correct. SD-WAN members must be the WAN interfaces. The SD-WAN rule must use a load balancing algorithm (e.g., sessions) to distribute traffic. BGP must advertise the prefix via both interfaces; this is typically done via advertising the prefix through BGP on both members or by using SD-WAN to influence the routing. Actually, BGP advertisement is separate; SD-WAN does not advertise routes. But to load balance inbound traffic, the administrator may need to advertise via both links. However, the question focuses on SD-WAN configuration, so A, B, D are essential.

Answer

Configure a performance SLA to monitor each link

Answer

Configure BGP to use the same AS number on both members

Question 2

A FortiGate is deployed as a LAN edge switch with multiple FortiSwitch units connected. The administrator wants to configure VLANs and manage the switches centrally. Which TWO features must be enabled on the FortiGate to achieve this? (Select TWO.)

Accepted Answer

Create VLAN interfaces on the FortiGate and assign them to the FortiLink interface. Options A and D are correct. FortiLink is required for central management of FortiSwitch. The FortiGate must have a dedicated FortiLink interface (e.g., internal) configured under Network > Interfaces. VLANs are created on the FortiGate and propagated to switches via FortiLink.

Answer

LLDP-MED

Answer

Configure a separate management VRF

Answer

STP (Spanning Tree Protocol) on the FortiGate

Question 3

An administrator configured an SD-WAN rule to steer traffic to a specific member interface using the 'lowest-cost' strategy. After applying, the traffic is not being load-balanced as expected. Which configuration element is MOST likely missing?

Accepted Answer

A performance SLA has not been assigned to the SD-WAN member interfaces.

Answer

The 'best-quality' strategy was inadvertently selected instead.

Answer

The SD-WAN member interfaces are not in the same zone.

Answer

The 'update-static-route' option is disabled on the SD-WAN member.

Question 4

A FortiGate has OSPF configured in multiple areas. The administrator wants to redistribute routes from area 0 into area 1 with a metric of 10. Which command is correct?

Accepted Answer

config router ospf
  config redistribute "ospf"
    set status enable
    set metric 10
  end

Answer

config router ospf
  config redistribute "connected"
    set metric 10
  end

Answer

config router ospf
  config area
    edit 1
      set type nssa
    end

Answer

config router ospf
  set redistribute "ospf" metric 10

Question 5

Which load balancing algorithm in SD-WAN sends new sessions to the member interface with the least number of active sessions?

Accepted Answer

Sessions

Answer

Volume

Answer

Spillover

Answer

Source-dest IP

Question 6

An administrator configures two SD-WAN members (port1, port2) with performance SLAs. The SD-WAN rule uses 'best-quality' strategy. During a failover test, the primary member port1 becomes unavailable but traffic does not switch to port2. What should the administrator check first?

Accepted Answer

The performance SLA's failover threshold is not met.

Answer

The SD-WAN rule is not configured to use the performance SLA.

Answer

The 'set status' on the performance SLA is 'passive'.

Answer

The 'update-static-route' is enabled on port1.

Question 7

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is using TCP and has been up for 3600 seconds, with 3599 seconds remaining before expiry.

Answer

The session is in a half-open state (proto_state=01) and will expire in 3600 seconds.

Answer

The session has been idle for 3600 seconds and will be removed in 3599 seconds.

Answer

The session is UDP and has 3600 seconds to live.

Question 8

A FortiGate is configured with VRF. Which statement about VRF is true?

Accepted Answer

VRF allows multiple routing tables to coexist on the same FortiGate.

Answer

Interfaces can belong to multiple VRFs simultaneously.

Answer

Routes from different VRFs can be automatically redistributed without configuration.

Answer

VRF can only be used when OSPF is enabled.

Question 9

An administrator wants to load-balance traffic across two WAN links using ECMP. The routes have equal distances and metrics. However, traffic is only using one of the links. What could be the cause?

Accepted Answer

The routes are learned via different routing protocols with different administrative distances.

Answer

ECMP is not enabled globally under config system settings.

Answer

The firewall policy is configured to use a specific egress interface.

Answer

The traffic is session-based and ECMP uses per-packet load balancing.

Question 10

Which BGP attribute is used by FortiGate SD-WAN to influence outbound traffic path selection?

Accepted Answer

Local Preference

Answer

Next Hop

Answer

MED

Answer

AS Path

Question 11

What is the purpose of BFD on a FortiGate?

Accepted Answer

To provide fast detection of link failures.

Answer

To load balance traffic across multiple paths.

Answer

To authenticate OSPF neighbors.

Answer

To encrypt traffic between two FortiGates.

Question 12

A FortiGate with FortiExtender is using LTE as a backup WAN link. When the primary link fails, the LTE link does not take over. What could be the cause?

Accepted Answer

The LTE interface is not added as an SD-WAN member.. Option D is correct because for an LTE interface to be used as a backup WAN link in an SD-WAN setup, it must be explicitly added as an SD-WAN member. Without this, the FortiGate will not consider the LTE interface for traffic steering or failover, even if the primary link fails. The SD-WAN rules and performance SLA are only evaluated against interfaces that are members of the SD-WAN zone.

Answer

The primary link's performance SLA is still passing.

Answer

The FortiExtender is not configured in pass-through mode.

Answer

The FortiExtender firmware is out of date.

Question 13

An administrator configures a route-map to match prefix-list 'PREFIX' and set metric 20. Which OSPF route redistribution uses this route-map correctly?

Accepted Answer

config router ospf
  config redistribute "connected"
    set route-map "RM"
  end

Answer

config router policy
  config route-map
    edit "RM"
      config rule
        set match-ip-address "PREFIX"
        set set-metric 20
      end
    end

Answer

config router ospf
  set route-map "RM"

Answer

config router prefix-list
  edit "PREFIX"
    set rule permit 10.0.0.0/8
  end

Question 14

Which SD-WAN load balancing algorithm is best for ensuring that all traffic from a specific source-destination pair uses the same WAN link?

Accepted Answer

Source-dest IP

Answer

Spillover

Answer

Volume

Answer

Lowest-cost

Question 15

An administrator needs to configure a FortiGate to use two WAN links for internet traffic with failover and load balancing. Which TWO steps are required?

Accepted Answer

Define SD-WAN rules to match internet-bound traffic.

Answer

Configure a performance SLA for each SD-WAN member.

Answer

Set the SD-WAN zone to 'spillover' mode.

Answer

Enable NAT on the SD-WAN zone.