NSE7 Advanced Networking and SD-WAN Practice Test 12 — 15 Questions

Question 1

A company has two internet connections: a primary fiber link (port1, 100 Mbps) and a backup DSL link (port2, 20 Mbps). They are using SD-WAN to load balance traffic based on volume, with a rule that sends 70% of traffic to port1 and 30% to port2. Recently, users report that video conferencing applications are experiencing high latency and jitter. The network team finds that the SD-WAN performance SLA for the fiber link shows 80% packet loss and high latency. The SD-WAN rule action is set to 'best quality' with a latency threshold of 150 ms. The current latency on port1 is 200 ms, and on port2 is 40 ms. What should the administrator do to ensure that video conferencing traffic uses the DSL link while the fiber link is degraded?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

No changes are needed; the SD-WAN rule with 'best quality' will automatically use port2 for new sessions because port1 does not meet the SLA.. The SD-WAN rule action is set to 'best quality', which means the FortiGate will automatically steer new sessions away from any interface that fails the performance SLA. Since port1 has 80% packet loss and 200 ms latency (exceeding the 150 ms threshold), it is considered degraded, and new video conferencing traffic will be directed to port2 (40 ms latency) without manual intervention.

Answer

Increase the SLA latency threshold to 250 ms so that the fiber link is considered acceptable.

Answer

Change the SD-WAN rule action to 'lowest cost' to favor the DSL link.

Answer

Adjust the volume ratio to send 100% of traffic to port2 until the fiber link recovers.

Question 2

Drag and drop the steps to configure a FortiGate to use an external authentication server (e.g., RADIUS) for admin login into the correct order.

Accepted Answer

Add RADIUS server, configure server details, create user group, assign group to admin, test. The correct sequence ensures that the RADIUS server is defined with full details before it is referenced by a user group, which is then assigned to an admin profile. Testing validates the entire chain, confirming that authentication works as expected.

Answer

Create user group, add RADIUS server, configure server details, assign group to admin, test

Answer

Add RADIUS server, create user group, assign group to admin, configure server details, test

Answer

Test, add RADIUS server, configure server details, create user group, assign group to admin

Question 3

A FortiGate is running OSPF with multiple areas. The admin wants to redistribute a static route for 192.168.100.0/24 into OSPF. After configuring 'config router ospf' with 'redistribute static' enabled, the route appears in the OSPF database but is not being advertised to other areas. What is the most likely cause?

Accepted Answer

The router is an ABR and the static route is being redistributed as a type 5 LSA, which is not flooded into stub areas.. An ABR does not flood Type 5 LSAs (which are generated by redistribution) into stub areas or NSSAs. Since the route appears in the OSPF database on the ABR but is not advertised to other areas, the most likely cause is that the receiving area is a stub area, which by design blocks Type 5 LSAs. The redistribution of a static route into OSPF creates a Type 5 LSA, which is only flooded throughout the AS except into stub areas and NSSAs.

Answer

The 'redistribute static' command needs a route map to filter the route correctly.

Answer

The static route's administrative distance is too high for OSPF.

Answer

OSPF must be configured with 'default-information originate' to allow redistribution.

Question 4

You are troubleshooting BFD on a FortiGate SD-WAN deployment. BFD is configured on two WAN interfaces (wan1, wan2) with a minimum transmit interval of 100 ms and a multiplier of 3. The network experiences occasional jitter causing packet loss. After a brief outage, the BFD session does not recover. Which setting should be adjusted to improve BFD resilience without significantly increasing failover time?

Accepted Answer

Increase the BFD multiplier to 4 or higher.. Increasing the BFD multiplier (from 3 to 4 or higher) allows the session to tolerate more lost BFD control packets before declaring a failure. This directly addresses the jitter-induced packet loss without changing the detection timing for sustained outages, as the multiplier only affects the number of missed packets required to trigger a failure. The minimum transmit interval remains at 100 ms, so the base detection time (multiplier × interval) increases only slightly, preserving fast failover for true link failures.

Answer

Disable BFD and rely on route timers.

Answer

Enable BFD on the management interface.

Answer

Increase the BFD minimum transmit interval on both interfaces.

Question 5

A FortiGate with SD-WAN enabled uses two members: MPLS (10 ms latency) and Internet (40 ms latency). The SD-WAN rule uses 'Best Quality' strategy with latency as the metric. Traffic to a critical application (10.1.1.0/24) is currently using the MPLS link. The MPLS link's latency increases to 60 ms due to a routing issue. How will FortiGate handle new sessions to 10.1.1.0/24?

Accepted Answer

New sessions will use the Internet link; existing sessions continue on MPLS.. The 'Best Quality' strategy with latency metric selects the link with the lowest latency for new sessions. When MPLS latency rises to 60 ms, it exceeds the Internet link's 40 ms, so new sessions will be steered to the Internet. However, SD-WAN does not preemptively rehash existing sessions; they remain on the original link (MPLS) until they expire or are torn down.

Answer

FortiGate will wait for the MPLS link to recover before sending new traffic.

Answer

All sessions immediately switch to the Internet link.

Answer

Existing sessions continue on MPLS; new sessions will use MPLS until the next SLA probe.

Question 6

Which feature allows a FortiGate to participate in multiple routing tables simultaneously, enabling network segmentation and overlapping IP address spaces?

Accepted Answer

VRF. C is correct because VRF (Virtual Routing and Forwarding) allows a FortiGate to maintain multiple separate routing tables (RIB) on the same physical device. Each VRF instance operates as an independent routing domain, enabling network segmentation and the use of overlapping IP address spaces without conflict, which is essential for MPLS L3VPN and multi-tenant environments.

Answer

VDOM

Answer

Policy-based routing

Answer

Route redistribution

Question 7

A FortiGate is configured with two SD-WAN members (wan1, wan2) and a performance SLA for each. The SD-WAN rule uses 'Maximize Bandwidth' strategy with volume-based load balancing. The administrator notices that traffic is only using wan1, even though both links have capacity. The SLA status for wan2 shows 'alive'. What could be the problem?

Accepted Answer

The SD-WAN rule has a 'set member' statement that lists only wan1.. The 'Maximize Bandwidth' strategy with volume-based load balancing distributes traffic based on bandwidth weights, but the SD-WAN rule's 'set member' statement explicitly defines which interfaces are eligible for load balancing. If the rule lists only wan1, traffic will never be sent to wan2, regardless of SLA status or bandwidth weights. This is the most direct cause of the observed behavior.

Answer

The link cost for wan2 is too high.

Answer

The performance SLA for wan2 is not associated with the SD-WAN rule.

Answer

The bandwidth weight for wan2 is set to 0.

Question 8

Which FortiGate feature is used to detect link failures within milliseconds, allowing rapid convergence for routing protocols like OSPF and BGP?

Accepted Answer

BFD. Bidirectional Forwarding Detection (BFD) is the correct answer because it provides sub-second (millisecond) link failure detection independent of routing protocols. Unlike OSPF or BGP's own keepalive mechanisms, BFD can detect failures in as little as 50-100 ms, enabling rapid convergence for protocols like OSPF and BGP by immediately notifying them of a neighbor loss.

Answer

ECMP

Answer

OSPF Fast Hello

Answer

Route tagging

Question 9

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is a TCP session in established state that has been active for 1 hour and will expire in about 1 hour.. The output shows 'proto=6', which is the protocol number for TCP, and 'proto_state=01', which indicates the TCP session is in an established state (TCP_ESTABLISHED). The 'duration=3600' means the session has been active for 3600 seconds (1 hour), and 'expire=3599' means the session will expire in 3599 seconds (approximately 1 hour), consistent with the default TCP session timeout of 3600 seconds in FortiGate.

Answer

The session is a UDP session with a short timeout.

Answer

The session is a UDP session that has been active for 1 hour.

Answer

The session is a TCP session that has timed out and is being removed.

Question 10

An administrator configures an SD-WAN rule to steer traffic from a specific subnet to an SD-WAN member with the lowest cost. Which load balancing algorithm should be selected in the SD-WAN rule to achieve this behavior?

Accepted Answer

Lowest-cost. The 'Lowest-cost' algorithm is correct because it directs traffic to the SD-WAN member with the lowest configured cost metric, which directly matches the administrator's requirement to steer traffic from a specific subnet to the member with the lowest cost. In Fortinet SD-WAN, the cost is a static metric assigned per SD-WAN member interface, and the Lowest-cost algorithm selects the member with the smallest cost value for each new session, ensuring traffic follows the least-cost path.

Answer

Volume

Answer

Sessions

Answer

Source-dest-IP

Question 11

You run 'diagnose sys session filter dport 179' on a FortiGate and see many sessions with proto=6 and proto_state=01. What does this indicate about the BGP sessions?

Accepted Answer

BGP sessions are in the process of being established, but not yet fully up.. Proto=6 indicates TCP, and proto_state=01 corresponds to TCP SYN_SENT (state 1 in the Linux TCP state model used by FortiGate). This means the BGP session has sent a SYN but has not yet received a SYN-ACK, so the three-way handshake is incomplete and the session is not established. BGP uses TCP port 179, so seeing many sessions in this state indicates ongoing connection attempts that have not yet completed.

Answer

BGP sessions are fully established and exchanging routes.

Answer

BGP sessions are being actively torn down.

Answer

BGP sessions are using TCP port 179 but are idle.

Question 12

A network admin configures OSPF on a FortiGate with multiple areas, including one area that is not directly connected to the backbone (Area 0). To ensure that routes from that area are advertised into other areas, which OSPF feature must be properly configured?

Accepted Answer

OSPF virtual-link. OSPF virtual-links are used to connect a non-backbone area to the backbone area through a transit area. This ensures that the area has a logical path to the backbone, allowing ABRs to generate Type 3 summary LSAs and advertise routes between areas. Without proper virtual-link configuration, routes from an area not directly connected to the backbone cannot be advertised to other areas.

Answer

OSPF route redistribution

Answer

OSPF passive interface

Answer

OSPF network type

Question 13

Which FortiGate feature allows multiple independent routing tables on a single device, enabling traffic separation for different departments or customers?

Accepted Answer

VRF. VRF (Virtual Routing and Forwarding) allows a single FortiGate to maintain multiple independent routing tables, each with its own set of interfaces, routes, and forwarding decisions. This enables traffic separation for different departments or customers without requiring separate physical devices, as each VRF instance operates as a logically isolated router within the same hardware.

Answer

ECMP

Answer

VDOM

Answer

Policy-based routing

Question 14

An administrator configures BFD on a FortiGate to improve convergence time for OSPF. What is the primary purpose of BFD in this context?

Accepted Answer

To detect link failures faster than OSPF hello timers. BFD (Bidirectional Forwarding Detection) provides sub-second link failure detection, typically in the range of 50-300 milliseconds, which is significantly faster than OSPF's default hello/dead intervals (e.g., 10/40 seconds for broadcast networks). By integrating BFD with OSPF, the FortiGate can trigger OSPF neighbor state changes and route convergence almost immediately upon a link failure, without waiting for OSPF's own hello timer expiration.

Answer

To reduce the number of OSPF neighbors

Answer

To encrypt OSPF packets

Answer

To load balance OSPF traffic across multiple links

Question 15

Which SD-WAN load balancing algorithm distributes traffic based on the number of active sessions per SD-WAN member?

Accepted Answer

Sessions. The Sessions algorithm in Fortinet SD-WAN distributes traffic by counting the number of active sessions currently traversing each SD-WAN member interface. The member with the fewest active sessions receives the next new session, ensuring a balanced session load across the SD-WAN links. This is distinct from volume-based or hash-based algorithms, as it directly uses session count as the metric.

Answer

Source-dest-IP

Answer

Spillover

Answer

Volume