NSE7 Advanced Networking and SD-WAN Practice Test 10 — 15 Questions

Question 1

An administrator has configured an SD-WAN zone named 'virtual-wan-link' with two members: port1 and port2. A performance SLA named 'sla1' is applied to the zone with a latency threshold of 100 ms. The administrator notices that when port1 exceeds 100 ms latency, traffic still uses port1. Which SD-WAN rule configuration is required to ensure traffic fails over to port2 when port1 violates the SLA?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the SD-WAN rule with 'SLA Target' set to 'sla1' and set the strategy to 'Best Quality'.. For an SD-WAN rule to fail over based on a performance SLA, the rule must reference the SLA target and use a strategy that dynamically selects the best member according to SLA status. The 'Best Quality' strategy continuously evaluates members and picks the one with the best measured quality, so when port1 exceeds the latency threshold, traffic moves to port2.

Answer

Configure the SD-WAN rule with 'SLA Target' set to 'sla1' and set the strategy to 'Manual' with port1 as the primary member.

Answer

Configure the SD-WAN rule with 'SLA Target' set to 'sla1' and enable 'Passive WAN Health Measurement'.

Answer

Configure the SD-WAN rule with 'SLA Target' set to 'sla1' and set the strategy to 'Lowest Cost (SLA)'.

Question 2

An administrator is configuring an SD-WAN rule to steer traffic for a critical application. The rule uses the 'lowest-cost' strategy and includes two members: port1 and port2. The administrator wants to ensure that if both members fail the performance SLA, traffic is still forwarded using the best available member. Which two configurations are required to achieve this? (Choose two.)

Accepted Answer

In the SD-WAN rule, enable 'Fallback' and select a member to be used when all SLA-monitored members are dead.. To ensure traffic is forwarded when all SLA-monitored members are dead, the administrator must configure a performance SLA that monitors the members with appropriate thresholds, and enable fallback in the SD-WAN rule to select a member to use when all are dead. This combination provides resilience and maintains traffic flow even when performance degrades.

Answer

Set the SD-WAN rule's strategy to 'lowest-cost' and enable 'SLA' as the primary criterion.

Answer

Set the SD-WAN rule's strategy to 'manual' and assign a priority order to the members.

Answer

Configure the SD-WAN rule to use 'maximize-bandwidth' strategy with SLA targets.

Question 3

An administrator is configuring an SD-WAN rule to route traffic based on application detection. They want to ensure that traffic for Microsoft 365 is routed over the best available link, but they also want to avoid using the LTE link due to high cost, unless both other links fail. Which two configuration steps are required to achieve this? (Choose two.)

Accepted Answer

Create an SD-WAN rule with the application 'Microsoft 365' as the match criteria, and set the strategy to 'Best Quality'.. To route Microsoft 365 traffic over the best available link while avoiding LTE unless necessary, the administrator must create an SD-WAN rule matching the application and set the strategy to 'Best Quality' to select the best-performing link. Additionally, assigning a higher cost to the LTE member and using the 'Lowest Cost' strategy ensures that LTE is only used when the other members fail the SLA. These two steps together achieve the desired behavior: application-based routing with cost-aware fallback.

Answer

Configure a performance SLA that only monitors the LTE link, and apply it to the SD-WAN rule.

Answer

In the SD-WAN rule, exclude the LTE member from the rule by not adding it to the rule's member list, or by using a negative match.

Answer

Enable 'SLA target' in the SD-WAN rule and select the performance SLA that includes all members.

Question 4

An administrator is deploying an SD-WAN solution with two hubs and multiple branches. They want to enable ADVPN to allow branches to communicate directly. Which FortiGate feature must be configured on the hubs to allow branches to establish shortcuts?

Accepted Answer

IPsec VPN with 'auto-discovery' enabled on the hub. To enable ADVPN, the hub must have IPsec VPN configured with auto-discovery. This allows the hub to send shortcut messages to branches, enabling them to establish direct tunnels. The hub acts as a broker, and branches use the information to create shortcuts. Without auto-discovery, ADVPN shortcuts cannot be established.

Answer

SD-WAN rule with 'lowest cost' strategy on the hub

Answer

BGP with route reflectors on the hub

Answer

OSPF with point-to-multipoint network type on the hub

Question 5

An administrator is configuring a FortiGate with two WAN interfaces in an SD-WAN zone. They want to monitor the quality of each link using a performance SLA. The SLA should check the latency to a remote server and consider the link dead if latency exceeds 150 ms for three consecutive checks. Which configuration is required to achieve this?

Accepted Answer

Create a performance SLA with 'protocol' set to ping, 'latency-threshold' set to 150, and 'failures' set to 3, and ensure that the SLA is applied to the SD-WAN members.. To monitor latency and mark a link dead after three consecutive violations, the performance SLA must have the latency threshold set and the failure count set to 3. In FortiOS, the 'failures' parameter controls how many consecutive violations (including latency) are needed to declare the SLA dead. The SLA must be associated with the SD-WAN members. This configuration ensures that the link is considered dead only after persistent high latency.

Answer

Create a performance SLA with 'protocol' set to ping, 'latency-threshold' set to 150, and 'threshold' set to 3.

Answer

Create a performance SLA with 'protocol' set to ping, 'latency-threshold' set to 150, and 'latency-failures' set to 3.

Answer

Create a performance SLA with 'protocol' set to ping, 'latency-threshold' set to 150, and 'failures' set to 3.

Question 6

An administrator is configuring an SD-WAN rule to route traffic based on application detection. The rule should prioritize Microsoft Teams traffic over the WAN and ensure it uses the best link based on latency. Which two configuration steps are required to achieve this? (Choose two.)

Accepted Answer

Configure a performance SLA that monitors latency to a Microsoft Teams server and assign it to the SD-WAN rule.. The two required steps are to create an SD-WAN rule that matches Microsoft Teams application traffic and to configure a performance SLA that monitors latency and assign it to the rule. The rule should then use a dynamic strategy such as 'lowest-cost' to select the best link. These steps ensure that Teams traffic is identified and routed over the WAN link with the lowest latency.

Answer

Enable application control on the firewall policy that references the SD-WAN rule.

Answer

Set the SD-WAN rule's strategy to 'Manual' and select the preferred member.

Answer

Enable 'application-optimization' in the SD-WAN rule to prioritize Teams traffic.

Question 7

An administrator is configuring an SD-WAN rule to route VoIP traffic (identified by a specific application signature) over the best-quality link. The SD-WAN zone has two members: port1 (MPLS) and port2 (Internet). A performance SLA named 'voip-sla' monitors latency and jitter. The administrator wants the rule to use port1 as long as it meets the SLA, and only use port2 if port1 fails the SLA. Which SD-WAN rule strategy should be selected?

Accepted Answer

SLA Target with 'Priority' strategy. The 'Priority' strategy in an SD-WAN rule lets you define a preference order for members. The FortiGate uses the highest-priority member that satisfies the SLA target. This ensures that port1 is used as long as it meets the SLA, and failover to port2 occurs only when port1 violates the SLA. Other strategies like 'Best Quality' or 'Lowest Cost (SLA)' do not enforce a strict primary/backup preference based on priority.

Answer

Best Quality

Answer

Lowest Cost (SLA)

Answer

Manual

Question 8

An administrator is configuring an SD-WAN rule to load balance traffic across two WAN interfaces using the 'source-ip-based' algorithm. They notice that some sessions from the same source IP are using different WAN interfaces. What is the most likely explanation?

Accepted Answer

The 'source-ip-based' algorithm distributes sessions based on a hash of the source IP and destination IP, so sessions to different destinations may use different interfaces.. The 'source-ip-based' algorithm in FortiGate SD-WAN uses a hash of both source and destination IP addresses to select an outgoing interface. This means that sessions from the same source IP but to different destinations can be load balanced across multiple WAN interfaces. If the administrator expects all sessions from a single source IP to use the same interface, they should use a different algorithm or a more specific rule that matches only the source IP.

Answer

The 'source-ip-based' algorithm uses a round-robin method if multiple members have the same cost.

Answer

The 'source-ip-based' algorithm is only applied to new sessions; existing sessions are not re-evaluated, so they may use different interfaces.

Answer

The 'source-ip-based' algorithm requires a performance SLA to be attached; without it, the algorithm falls back to round-robin.

Question 9

An administrator is deploying a hub-and-spoke SD-WAN topology using FortiGate devices. The hub has two WAN links, and the spokes have one WAN link each. The administrator wants to enable direct spoke-to-spoke communication for certain applications while still using the hub for other traffic. Which two features must be configured to achieve this? (Choose two.)

Accepted Answer

Enable ADVPN on the hub and spokes to allow dynamic shortcut tunnels.. ADVPN enables dynamic spoke-to-spoke tunnels, and setting 'net-device disable' on the IPsec phase1-interface is required for ADVPN to function. Together, these allow spokes to establish direct tunnels when needed, while still using the hub for other traffic. BGP is also necessary but not the specific feature that enables the shortcut; the two correct options are the core requirements.

Answer

Enable 'auto-discovery' in the SD-WAN settings to allow dynamic tunnel creation.

Answer

Configure BGP with route reflectors on the hub to propagate routes between spokes.

Answer

Set the SD-WAN load balancing algorithm to 'source-ip-based' to ensure spoke-to-spoke traffic uses the direct path.

Question 10

A FortiGate is configured with two WAN interfaces in an SD-WAN zone. The administrator wants to ensure that all traffic to a critical SaaS application (10.0.0.0/24) always uses the best-performing link based on a performance SLA. They also want to ensure that if both links fail the SLA, traffic is dropped rather than using a degraded link. Which SD-WAN configuration should be used?

Accepted Answer

Create an SD-WAN rule with the performance SLA as the link quality metric, set the strategy to 'lowest-cost (SLA)', and configure the SLA target with 'drop' as the action for out-of-SLA traffic.. The correct configuration uses a performance SLA to monitor link quality and an SD-WAN rule that selects the best link meeting the SLA. The strategy 'lowest-cost (SLA)' ensures only SLA-compliant links are considered, and setting the SLA target action to 'drop' enforces dropping traffic when no link meets the SLA. This meets both requirements: using the best-performing link and avoiding degraded links.

Answer

Create an SD-WAN rule with the performance SLA as the link quality metric, and set the 'SLA target' to the desired SLA. Enable 'quality' and set the strategy to 'lowest-cost (SLA)'.

Answer

Create an SD-WAN rule with the performance SLA as the link quality metric, set the strategy to 'maximize bandwidth (SLA)', and enable 'SLA target' with 'drop' action for out-of-SLA traffic.

Answer

Create an SD-WAN rule with the performance SLA as the link quality metric, set the strategy to 'lowest-cost (SLA)', and enable 'SLA target' with 'drop' action for out-of-SLA traffic.

Question 11

A FortiGate is configured with an SD-WAN rule that uses the 'maximize-bandwidth (SLA)' strategy. The rule includes two WAN members: wan1 and wan2. The administrator notices that even though both members meet the SLA, all traffic is being sent out wan1. What is the most likely cause?

Accepted Answer

One of the WAN members is not meeting the performance SLA, so the FortiGate uses only the healthy member.. The maximize-bandwidth (SLA) strategy load balances traffic across all SD-WAN members that meet the performance SLA. If one member fails the SLA, it is removed from the group, and traffic is sent only to the healthy member. In this scenario, wan2 likely does not meet the SLA, so all traffic egresses wan1. Verifying the SLA status for each member will confirm this.

Answer

The SD-WAN rule is missing a 'set gateway' configuration, causing all traffic to use the default gateway.

Answer

The SD-WAN rule is configured with a manual priority order, overriding the load balancing algorithm.

Answer

The load balancing algorithm is set to 'source-ip-based' instead of 'maximize-bandwidth (SLA)'.

Question 12

An administrator has an SD-WAN rule with the load balancing algorithm 'lowest-cost' and two members: port1 (cost 10) and port2 (cost 20). The performance SLA is 'alive' on both members. The administrator notices that all new sessions are being sent to port1. Which configuration change will cause the FortiGate to distribute sessions across both members?

Accepted Answer

Set the same cost value on both members.. The lowest-cost algorithm selects the member with the lowest cost value. To achieve load balancing across both members, the costs must be equalized. Changing the algorithm to source-ip-based or volume might distribute sessions, but they do not address the specific behavior of lowest-cost. Setting the same cost on both members ensures that the FortiGate views them as equally preferred and distributes sessions accordingly.

Answer

Change the load balancing algorithm to 'source-ip-based'.

Answer

Enable 'spillover' on the SD-WAN rule.

Answer

Change the load balancing algorithm to 'volume'.

Question 13

An administrator wants to configure SD-WAN to distribute traffic across two WAN links based on the volume of traffic sent. The links have different bandwidth capacities: port1 has 100 Mbps and port2 has 50 Mbps. The administrator wants to use the 'volume' load balancing algorithm. How does the FortiGate determine the ratio of traffic sent over each link?

Accepted Answer

It uses the configured interface bandwidth values to calculate a weighted distribution.. The 'volume' load balancing algorithm uses the configured bandwidth of each SD-WAN member to calculate the proportion of traffic to send over each link. With port1 at 100 Mbps and port2 at 50 Mbps, the ratio is 2:1, so port1 receives twice the traffic volume. This ensures efficient utilization of the available bandwidth.

Answer

It uses the current session count on each link to adjust the volume dynamically.

Answer

It uses the measured latency of each link to calculate the distribution ratio.

Answer

It distributes traffic equally regardless of the interface bandwidth.

Question 14

An administrator wants to verify which SD-WAN member is currently being used for a specific traffic flow that matches an SD-WAN rule. The rule uses the 'Best Quality' strategy, and the administrator needs to see real-time member selection. Which command should the administrator use on the FortiGate CLI?

Accepted Answer

diagnose sys sdwan health-check. The command 'diagnose sys sdwan health-check' displays the health-check results for SD-WAN members, including latency, jitter, packet loss, and the status of each member relative to the SLA. It also shows which member is currently selected for each SLA, allowing the administrator to verify real-time member selection for a specific traffic flow.

Answer

diagnose sys session list

Answer

diagnose sys sdwan service

Answer

diagnose sys sdwan member

Question 15

A FortiGate is configured with two VRF instances: VRF10 (for a customer) and VRF20 (for another customer). The administrator needs to allow traffic from a server in VRF10 to reach a server in VRF20. The servers are on different subnets. Which configuration is required to enable communication between the VRFs?

Accepted Answer

Configure a shared VRF or use a inter-VRF link by assigning a common interface to both VRFs and configuring routing to allow traffic to pass between them.. VRFs on FortiGate are separate routing tables that isolate traffic. To allow communication between them, you need a shared interface or inter-VRF link that both VRFs can use. This can be achieved by assigning an interface to a common VRF or by configuring a dedicated link. Routing and firewall policies must then permit the traffic. Simply adding static routes or firewall policies without a shared segment will not work because the VRFs remain isolated.

Answer

Configure a firewall policy that allows traffic from VRF10 to VRF20 and enable 'set vrf' in the policy to specify the source and destination VRFs.

Answer

Configure route leaking by creating a static route in VRF10 with the destination subnet of VRF20 and specifying the outgoing interface as a VRF20 interface, and vice versa.

Answer

Configure inter-VRF routing by creating a static route in VRF10 pointing to VRF20 and another in VRF20 pointing to VRF10, using the respective VRF interfaces as gateways.