NSE7 Advanced Networking and SD-WAN Practice Test 11 — 15 Questions

Question 1

What is the purpose of BFD on a FortiGate?

Accepted Answer

To provide fast detection of link failures.. BFD (Bidirectional Forwarding Detection) provides sub-second failure detection for routing protocols like OSPF and BGP, independent of the routing protocol's own hello timers. On a FortiGate, BFD is used to rapidly detect link or neighbor failures, enabling faster convergence in SD-WAN and dynamic routing scenarios.

Answer

To load balance traffic across multiple paths.

Answer

To authenticate OSPF neighbors.

Answer

To encrypt traffic between two FortiGates.

Question 2

A FortiGate with FortiExtender is using LTE as a backup WAN link. When the primary link fails, the LTE link does not take over. What could be the cause?

Accepted Answer

The LTE interface is not added as an SD-WAN member.. For an LTE interface to be used as a backup WAN link in an SD-WAN setup, it must be explicitly added as an SD-WAN member. Without this, the FortiGate will not consider the LTE interface for traffic steering or failover, even if the primary link fails. The SD-WAN rules and performance SLA are only evaluated against interfaces that are members of the SD-WAN zone.

Answer

The primary link's performance SLA is still passing.

Answer

The FortiExtender is not configured in pass-through mode.

Answer

The FortiExtender firmware is out of date.

Question 3

An administrator configures a route-map to match prefix-list 'PREFIX' and set metric 20. Which OSPF route redistribution uses this route-map correctly?

Accepted Answer

config router ospf
  config redistribute "connected"
    set route-map "RM"
  end. In FortiOS, the route-map is applied to a specific redistribution rule under 'config router ospf' using the 'set route-map' command within the 'config redistribute' block. This correctly associates the route-map 'RM' with the redistribution of connected routes into OSPF, matching the prefix-list 'PREFIX' and setting the metric to 20.

Answer

config router policy
  config route-map
    edit "RM"
      config rule
        set match-ip-address "PREFIX"
        set set-metric 20
      end
    end

Answer

config router ospf
  set route-map "RM"

Answer

config router prefix-list
  edit "PREFIX"
    set rule permit 10.0.0.0/8
  end

Question 4

Which SD-WAN load balancing algorithm is best for ensuring that all traffic from a specific source-destination pair uses the same WAN link?

Accepted Answer

Source-dest IP. Source-dest IP (B) is the correct algorithm because it uses a hash of both the source and destination IP addresses to deterministically select a WAN link. This ensures that all packets belonging to the same flow (same source-destination pair) are consistently forwarded over the same link, preserving packet order and avoiding reordering issues.

Answer

Spillover

Answer

Volume

Answer

Lowest-cost

Question 5

An administrator needs to configure a FortiGate to use two WAN links for internet traffic with failover and load balancing. Which TWO steps are required?

Accepted Answer

Define SD-WAN rules to match internet-bound traffic.. For internet traffic failover and load balancing over two WAN links, the FortiGate must first add both WAN interfaces as SD-WAN members (option E) to form the SD-WAN zone. Then, SD-WAN rules (option D) are required to match internet-bound traffic and define how it is distributed among the members (e.g., by volume, session, or spillover) and which failover strategy to apply. Without these rules, the SD-WAN zone cannot enforce load balancing or failover policies for the traffic.

Answer

Configure a performance SLA for each SD-WAN member.

Answer

Set the SD-WAN zone to 'spillover' mode.

Answer

Enable NAT on the SD-WAN zone.

Question 6

An administrator wants to use policy-based routing to forward traffic from subnet 192.168.1.0/24 to a specific next-hop via port2. Which TWO configuration elements are needed?

Accepted Answer

A route-map that matches the source subnet and sets the next-hop.. Policy-based routing (PBR) on FortiGate uses a route-map to override the normal routing table lookup. Option B is correct because the route-map must match the source subnet (e.g., via a prefix-list or access-list) and set the next-hop to the desired gateway. Option D is also correct because a prefix-list is the standard method to define the subnet match condition within the route-map.

Answer

An SD-WAN rule overriding the routing decision.

Answer

A static route with a higher administrative distance.

Answer

A firewall policy matching the traffic with action 'accept'.

Question 7

A network administrator is configuring SD-WAN on a FortiGate. They have multiple WAN links and want to ensure that traffic for a critical application uses the link with the lowest latency. Which SD-WAN configuration component should be used to achieve this?

Accepted Answer

Performance SLA with latency threshold and SD-WAN rule using best-quality strategy. The Performance SLA monitors latency (and other metrics) against a configured threshold, and the SD-WAN rule with the 'best-quality' strategy dynamically selects the WAN link that currently has the lowest latency. This ensures the critical application traffic is steered to the optimal link based on real-time performance measurements.

Answer

SD-WAN rule with spillover load balancing

Answer

SD-WAN members with static priority

Answer

Load balancing algorithm set to lowest-cost (SLA)

Question 8

A FortiGate is running OSPF with multiple areas. The administrator needs to redistribute a static route into OSPF. Which command will correctly configure redistribution of static routes into OSPF process 10?

Accepted Answer

config router ospf
 set redistribute static enable
end. In FortiOS, the command to redistribute static routes into OSPF is configured directly under the OSPF process using `set redistribute static enable` within `config router ospf`. This enables the redistribution of static routes into OSPF process 10, as specified in the question.

Answer

config router ospf
 config redistribute
  edit static
   set status enable
  next
 end
end

Answer

config router policy
 set redistribute static
end

Answer

config router static
 set redistribute ospf
end

Question 9

An administrator has configured BGP on a FortiGate with two upstream ISPs. They notice that traffic to a specific prefix is not load-balanced as expected; all traffic goes through ISP1 even though both paths are available. 'get router info bgp network' shows the prefix with two next hops. What is the MOST likely cause?

Accepted Answer

The BGP multi-path is disabled. BGP multi-path must be explicitly enabled to allow load balancing across multiple equal-cost paths. Even if both next hops are present in the BGP table, without the 'set multipath' or 'set multipath number' configuration under the BGP process, the FortiGate will select only the best path (lowest weight, local preference, AS-path length, etc.) and install that single route in the routing table. This is why all traffic uses ISP1 despite both paths being available.

Answer

The prefix is being learned via an IGP with a lower administrative distance

Answer

The administrative distance of BGP is higher than OSPF

Answer

The eBGP multihop is not configured

Question 10

A FortiGate administrator needs to configure BFD (Bidirectional Forwarding Detection) on a BGP peer to quickly detect link failures. Which CLI command enables BFD on the BGP neighbor 10.1.1.1?

Accepted Answer

config router bgp
 config neighbor
  edit 10.1.1.1
   set bfd enable
  next
 end
end. BFD must be enabled specifically under the BGP neighbor configuration to associate BFD with the BGP session. The `config router bgp` → `config neighbor` → `set bfd enable` command activates BFD for that neighbor, allowing rapid link failure detection independent of BGP hold timers.

Answer

config router policy
 set bfd enable
end

Answer

config system interface
 edit port1
  set bfd enable
 next
end

Answer

config router static
 set bfd enable
end

Question 11

A FortiGate has multiple VRFs. The administrator wants to leak a route from VRF1 to VRF2. Which configuration is required?

Accepted Answer

Configure route leaking using route maps and set vrf command under VRF1's routing process. Route leaking between VRFs on a FortiGate is achieved by configuring route maps with the `set vrf` command under the source VRF's routing process. This allows specific routes from VRF1 to be imported into VRF2, enabling controlled inter-VRF communication without requiring a VDOM or static route workaround.

Answer

Use the config router vrf-leak command to define leaking rules

Answer

Enable inter-VRF routing on the VDOM

Answer

Configure a static route in VRF2 pointing to the next-hop in VRF1 with a different administrative distance

Question 12

An administrator sees the following output from 'get router info routing-table':
S       0.0.0.0/0 [10/0] via 192.168.1.1, port1
S       0.0.0.0/0 [10/0] via 192.168.2.1, port2
They have configured ECMP load balancing. However, traffic to a specific destination IP is always using port1. What is the likely reason?

Accepted Answer

The destination IP hash results in the same link for all sessions due to the load balancing algorithm. D is correct because FortiGate ECMP load balancing uses a hash-based algorithm (source-destination IP, port, or protocol) by default, not per-packet. When the hash of the destination IP consistently maps to the same link (port1), all sessions to that specific IP will use that interface, even though multiple routes exist with equal administrative distance and cost.

Answer

The firewall policy only allows traffic on port1

Answer

ECMP uses per-packet load balancing by default and the traffic is a single flow

Answer

One of the static routes has a lower administrative distance

Question 13

Which SD-WAN load balancing algorithm distributes new sessions based on the number of active sessions on each link?

Accepted Answer

Sessions. The Sessions algorithm distributes new sessions based on the current number of active sessions on each SD-WAN link. When a new session is initiated, the SD-WAN controller selects the link with the fewest active sessions, ensuring a balanced load across all available transport interfaces. This is distinct from algorithms that consider source/destination IP pairs, traffic volume, or bandwidth thresholds.

Answer

Source-dest IP

Answer

Spillover

Answer

Volume

Question 14

A FortiGate with SD-WAN configured has a Performance SLA monitoring Google DNS (8.8.8.8). The SLA is configured with latency threshold 100 ms and jitter threshold 20 ms. The link is currently meeting both thresholds. The administrator wants to ensure that if the SLA fails, traffic moves to another link. Which SD-WAN rule strategy should be used?

Accepted Answer

Failover (SLA). The Failover (SLA) strategy is correct because it ensures that traffic is moved to another link only when the Performance SLA fails, while the primary link is used as long as it meets the configured latency (100 ms) and jitter (20 ms) thresholds. This strategy provides deterministic failover behavior, matching the administrator's requirement to switch traffic only upon SLA failure.

Answer

Best quality

Answer

Manual selection

Answer

Maximize bandwidth (SLA)

Question 15

Which FortiGate feature allows the creation of multiple virtual routing tables within a single VDOM?

Accepted Answer

VRF. VRF (Virtual Routing and Forwarding) allows a single FortiGate VDOM to maintain multiple independent routing tables, each with its own forwarding decisions. This is achieved by creating separate VRF instances (identified by VRF IDs 1-255) within the same VDOM, enabling traffic isolation and overlapping IP address spaces without requiring separate VDOMs.

Answer

Policy-based routing

Answer

VDOM

Answer

ECMP