NSE7 Advanced Networking and SD-WAN Practice Test 11 — 15 Questions

Question 1

An administrator has configured a FortiGate with two WAN interfaces in an SD-WAN zone. They want to ensure that if the primary WAN link fails, traffic automatically switches to the secondary link. Which SD-WAN member configuration setting should they verify?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The 'link-health' setting with a performance SLA to monitor the primary link.. Automatic failover in SD-WAN relies on link health monitoring. By configuring a performance SLA and associating it with the SD-WAN members, the FortiGate can detect when the primary link degrades or fails and then switch traffic to the secondary link according to the SD-WAN rule. The other settings do not provide this dynamic failover capability.

Answer

The 'status' setting to ensure both members are enabled.

Answer

The 'load-balance' algorithm set to 'lowest-cost' to prefer the primary link.

Answer

The 'priority' setting within the SD-WAN member configuration.

Question 2

A FortiGate is configured with an SD-WAN rule that uses the 'maximize-bandwidth' algorithm. The rule includes three members: port1 (10 Mbps), port2 (20 Mbps), and port3 (30 Mbps). All members are alive. A user initiates a single TCP session to a remote server. Which statement describes how the FortiGate will handle this session?

Accepted Answer

The session will be sent out the member with the highest available bandwidth, which is port3.. The maximize-bandwidth algorithm selects the SD-WAN member with the highest available bandwidth for each new session. In this case, port3 has the highest capacity and is alive, so it will be chosen. This algorithm does not split a single session across multiple links, as that would cause packet reordering. It is designed to utilize the link with the most available bandwidth, which is suitable for high-bandwidth applications.

Answer

The session will be dropped because a single session cannot exceed the bandwidth of one member.

Answer

The session will be sent out port1 because it has the lowest cost by default.

Answer

The session will be load balanced across all three members, distributing packets proportionally to their bandwidth.

Question 3

A FortiGate is configured with an SD-WAN zone containing three members: port1, port2, and port3. The administrator wants to ensure that if port1 fails, traffic is automatically redirected to port2, and if port2 also fails, to port3. The administrator has configured a performance SLA that monitors all three members. Which SD-WAN rule configuration will achieve this?

Accepted Answer

Set the SD-WAN rule to use the 'lowest-cost (SLA)' strategy and assign priorities to the members (port1 highest, port3 lowest).. To achieve ordered failover with automatic redirection, the 'lowest-cost (SLA)' strategy is appropriate. By assigning costs (priorities) to members, the FortiGate will prefer the member with the lowest cost that meets the SLA. If that member fails, it will select the next lowest-cost member that meets SLA. This provides the desired failover sequence: port1, then port2, then port3.

Answer

Set the SD-WAN rule to use the 'volume' strategy and assign weights to the members.

Answer

Set the SD-WAN rule to use the 'maximize-bandwidth (SLA)' strategy and assign priorities to the members.

Answer

Set the SD-WAN rule to use the 'source-ip' strategy and configure a separate rule for each member.

Question 4

A FortiGate is configured with an SD-WAN rule that uses the 'lowest-cost' algorithm based on a performance SLA that monitors latency and jitter. The administrator notices that traffic is being sent over a WAN member that has higher latency but lower jitter compared to another member. Which configuration parameter could explain this behavior?

Accepted Answer

The performance SLA has a higher weight assigned to jitter than to latency.. The performance SLA allows administrators to assign weights to latency, jitter, and packet loss. These weights determine the cost calculation. If jitter is given a higher weight, a member with lower jitter can have a lower overall cost even if its latency is higher. This explains why the FortiGate selected the member with higher latency but lower jitter. The weights are configured in the SLA settings.

Answer

The 'lowest-cost' algorithm always prioritizes latency over jitter, so the selection is unexpected.

Answer

The SD-WAN rule is configured with a 'priority' that favors the higher-latency member.

Answer

The SD-WAN rule is using the 'lowest-cost' algorithm, but the cost is calculated based on the interface's configured cost value.

Question 5

An administrator is deploying a FortiGate in an SD-WAN environment with two WAN links: port1 (ISP1) and port2 (ISP2). The administrator wants to configure an SD-WAN rule that routes traffic from the internal subnet 192.168.1.0/24 to the internet using both links, but with a preference for port1 as long as it meets the SLA. If port1 fails the SLA, traffic should use port2. The administrator also wants to ensure that return traffic from the internet uses the same link that the outbound traffic used. Which TWO configuration steps are required to achieve this? (Choose two.)

Accepted Answer

Configure an SD-WAN rule with the 'lowest-cost' algorithm and set the cost of port1 lower than port2.. To prefer port1 while it meets the SLA and fall back to port2, use the lowest-cost algorithm with port1 having a lower cost. This ensures port1 is selected as long as it is alive. To ensure return traffic uses the same link, enable 'preserve-session-route' in the SD-WAN global settings, which maintains session symmetry across the SD-WAN members.

Answer

Configure the SD-WAN rule with the 'lowest-latency' algorithm and set the SLA target to monitor latency.

Answer

Enable 'preserve-session-route' in the SD-WAN rule to ensure return traffic uses the same link.

Answer

Configure a static route for each WAN link and enable 'ecmp' to load balance traffic.

Question 6

An administrator is deploying SD-WAN on a FortiGate with two WAN links: port1 (primary) and port2 (backup). They want to ensure that VoIP traffic uses port1 as long as it meets the performance SLA, and fails over to port2 if port1 does not meet the SLA. Which two configuration steps are required to achieve this? (Choose two.)

Accepted Answer

Create a performance SLA that monitors both port1 and port2, and set the SLA criteria for latency, jitter, and packet loss.. To achieve SLA-based failover for VoIP traffic, you need a performance SLA that monitors both WAN links and an SD-WAN rule that matches VoIP traffic and uses the SLA to select a link. The 'lowest-cost (SLA)' strategy with port1 assigned a lower cost ensures port1 is preferred when it meets the SLA, and port2 is used when port1 fails. This combination provides the desired behavior.

Answer

Enable 'sla' in the SD-WAN rule and set the action to 'drop' when the SLA is not met.

Answer

Configure the SD-WAN rule to use the 'maximize bandwidth (SLA)' strategy with port1 and port2 as members.

Answer

Configure a static route for VoIP traffic pointing to port1 with a lower distance than the route to port2.

Question 7

An administrator is configuring an SD-WAN rule to route VoIP traffic over the most reliable link. They want the FortiGate to select the member with the lowest latency and jitter. Which SD-WAN load balancing algorithm should they use?

Accepted Answer

Lowest-latency. For VoIP traffic, the lowest-latency algorithm is the best choice because it uses performance SLA measurements to select the member with the lowest latency. This ensures that real-time traffic takes the most responsive path. The other algorithms do not consider latency or jitter, making them less suitable for VoIP. While jitter is also important, lowest-latency is the closest match among the given options.

Answer

Maximize-bandwidth

Answer

Lowest-cost

Answer

Source-ip-based

Question 8

An administrator is configuring an SD-WAN rule to route traffic based on application detection. The rule uses the 'application' strategy and includes a custom application signature for a proprietary application. After applying the rule, the administrator notices that the traffic is not being matched by the rule. What is the most likely cause?

Accepted Answer

The custom application signature is not included in the SD-WAN rule's application list.. SD-WAN rules that use the application strategy rely on the application list configured within the rule. To match a custom application, the custom signature must be explicitly added to that list. Without it, the rule cannot identify the traffic as the specified application, and thus will not match. The other options relate to firewall policies or profiles, which do not affect SD-WAN application matching.

Answer

The application control profile is not applied to the firewall policy, so the signature is not detected.

Answer

The custom application signature must be enabled in the firewall policy that allows the traffic.

Answer

The SD-WAN rule must be placed above any firewall policy that allows the traffic.

Question 9

A FortiGate is configured with two SD-WAN members: port1 and port2. The administrator wants to ensure that traffic to a specific destination (203.0.113.0/24) is always sent out port1, regardless of the SD-WAN rule's load balancing algorithm. Which configuration should be used?

Accepted Answer

Create an SD-WAN rule that matches traffic to 203.0.113.0/24 and set the strategy to 'manual' with port1 as the only member, and set the action to 'drop' when port1 is unavailable.. To ensure traffic to a specific destination always uses a particular SD-WAN member and never fails over, you need an SD-WAN rule that includes only that member and is configured to drop traffic when the member is unavailable. The manual strategy with a single member and a drop action achieves this. Other options either allow failover or bypass SD-WAN, which does not meet the strict requirement.

Answer

Create an SD-WAN rule that matches traffic to 203.0.113.0/24 and set the strategy to 'lowest-cost (SLA)' with port1 assigned a lower cost than port2, and disable SLA checks for this rule.

Answer

Configure an SD-WAN rule that matches traffic to 203.0.113.0/24 and set the strategy to 'manual' with port1 as the preferred member.

Answer

Create a policy route that matches traffic to 203.0.113.0/24 and sets the outgoing interface to port1, with a higher priority than the SD-WAN rule.

Question 10

An administrator is configuring BGP on a FortiGate to peer with two ISPs. The FortiGate is advertising a default route to both ISPs. The administrator wants to ensure that the FortiGate prefers ISP1 for all outbound traffic unless ISP1 fails. Which BGP attribute should be manipulated to achieve this?

Accepted Answer

Configure a static route to ISP1 with a lower distance than the route to ISP2.. The FortiGate's outbound traffic is determined by its routing table. To prefer ISP1, a static default route pointing to ISP1 with a lower distance than the route to ISP2 is the correct approach. This ensures that as long as the ISP1 route is present, it is used. If ISP1 fails, the route is removed and the ISP2 route becomes active. BGP attributes like local preference or MED affect inbound or outbound traffic in different contexts, but for the FortiGate's own outbound selection, administrative distance on static routes is key.

Answer

Set a higher local preference for routes learned from ISP1.

Answer

Set a lower MED for routes advertised to ISP1.

Answer

Set a higher weight for routes learned from ISP1.

Question 11

A FortiGate is configured with an SD-WAN rule that uses the 'maximize-bandwidth' algorithm. The administrator notices that some sessions are being routed over a WAN link that has a higher latency, causing poor application performance. The performance SLA shows that both links are within the configured latency threshold. Which action should the administrator take to ensure that traffic is directed to the lower-latency link while still utilizing both links?

Accepted Answer

Change the SD-WAN rule to use the 'lowest-cost' algorithm.. The 'maximize-bandwidth' algorithm distributes traffic across all links to utilize total bandwidth, without considering latency as long as the SLA is met. To prefer the lower-latency link while still using both links, the administrator should switch to the 'lowest-cost' algorithm. This algorithm dynamically selects the link with the best performance metrics, including latency, and only uses other links if the cost becomes higher. This ensures optimal performance for latency-sensitive applications.

Answer

Enable 'link-cost-factor' with 'latency' and set the SD-WAN rule to use 'lowest-cost'.

Answer

Change the SD-WAN rule to use the 'maximize-bandwidth' algorithm with a higher weight on the lower-latency link.

Answer

Adjust the performance SLA latency threshold to a lower value so that the higher-latency link is marked as dead.

Question 12

A network administrator is configuring SD-WAN on a FortiGate. The organization has two internet links: MPLS (primary) and broadband (backup). The administrator wants all traffic to use the MPLS link unless it fails, in which case traffic should fail over to the broadband link. Which SD-WAN configuration best achieves this requirement?

Accepted Answer

Set the MPLS link priority to 10 and the broadband link priority to 5, then configure an SD-WAN rule with the 'best quality' strategy.. Setting the MPLS link priority to 10 (higher) and broadband to 5 (lower) ensures the SD-WAN rule with 'best quality' strategy selects the MPLS link as the preferred path. The 'best quality' strategy evaluates link quality metrics and, when priorities differ, prefers the higher-priority link. If the MPLS link fails, the strategy automatically fails over to the broadband link, meeting the requirement.

Answer

Enable 'set role' on the MPLS link as 'primary' and on the broadband link as 'standby' with the 'redundant' strategy.

Answer

Configure both links in the SD-WAN zone with equal priority and use the 'lowest cost' strategy.

Answer

Create two static routes: one with higher distance for MPLS and one with lower distance for broadband.

Question 13

Which THREE statements are true about FortiGate SD-WAN health-check configuration?

Accepted Answer

Health-check can be configured with multiple thresholds for jitter, latency, and packet loss.. Option C is correct because FortiGate SD-WAN health checks support SLA targets with separate thresholds for latency, jitter, and packet loss, allowing each performance metric to be evaluated independently. Option D is correct because the 'update-static-route' setting (enabled by default) lets the health check dynamically remove or restore a static route when the link's SLA is violated or recovered, providing automatic fallback. Option E is correct because SD-WAN health checks can use several probe protocols, including ping, TCP echo, HTTP, and DNS, to verify end-to-end link health beyond simple ICMP. Option A is incorrect because health-check probes must be sourced from the interface being monitored, not from arbitrary interfaces such as a loopback. Option B is incorrect because health checks can be applied to VLANs and subinterfaces, not only physical interfaces.

Answer

Health-check probes can be sent from any interface, including loopback.

Answer

Health-check can only be configured on physical interfaces, not VLANs or subinterfaces.

Question 14

A FortiGate is deployed with two ISPs and SD-WAN. The organization uses OSPF to exchange routes with a remote branch. The administrator notices that the FortiGate is not installing OSPF-learned routes into the routing table. The OSPF configuration is verified to be correct, and neighbors are established. Which configuration could be causing the issue?

Accepted Answer

A distribute-list configured under OSPF is filtering the routes from being installed.. A distribute-list applied under OSPF can filter routes from being installed into the routing table even when OSPF neighbors are fully established and the OSPF database contains the routes. This is a common cause of routes being learned but not installed, as the filter operates after the SPF calculation and before route insertion.

Answer

The SD-WAN health-check is configured with 'update-static-route' and is overriding OSPF routes.

Answer

The administrative distance of OSPF is set to 200, which is higher than the default 110.

Answer

The OSPF interface is configured as 'passive', which prevents route exchange.

Question 15

A company with a hub-and-spoke SD-WAN topology uses FortiGates at each site. The hub has two WAN links: MPLS (10 Mbps) and broadband (100 Mbps). The spokes connect only via MPLS. The company deploys a new real-time application that requires low latency and low jitter. The network administrator creates an SD-WAN rule for this application with 'best quality' strategy and both MPLS and broadband as members. The SLA for MPLS is configured with latency < 10 ms and jitter < 5 ms. The SLA for broadband is configured with latency < 50 ms and jitter < 20 ms. The actual measured latency on MPLS is 12 ms, and jitter is 4 ms. The broadband latency is 25 ms, jitter 10 ms. Which path will the application traffic take?

Accepted Answer

The traffic will use the broadband link because MPLS SLA fails and broadband SLA is met.. The SD-WAN rule uses the 'best quality' strategy, which selects the member with the best SLA performance. The MPLS link fails its SLA because its measured latency of 12 ms exceeds the configured threshold of 10 ms, even though jitter is within limits. The broadband link meets both its latency (25 ms < 50 ms) and jitter (10 ms < 20 ms) thresholds, so it becomes the active path for the application traffic.

Answer

The traffic will be load-balanced between MPLS and broadband.

Answer

The traffic will use the MPLS link because it is the preferred member.

Answer

The traffic will be dropped because no link meets the SLA.