NSE7 Advanced Networking and SD-WAN Practice Test 12 — 15 Questions

Question 1

A FortiGate is configured with BGP and OSPF. The administrator wants to ensure that routes learned via BGP are redistributed into OSPF, but only specific prefixes. Which three components are needed? (Select THREE.)

Accepted Answer

A route map that references the prefix list and sets OSPF parameters

Answer

A VRF to separate the routing tables

Answer

A distribute list in OSPF to filter incoming routes

Question 2

A network admin needs to configure a FortiGate to load balance traffic across two ISP links using SD-WAN. The requirement is to use both links simultaneously for different sessions based on source-destination IP hash. Which two settings are required? (Select TWO.)

Accepted Answer

Create an SD-WAN zone with both WAN members

Answer

Add a performance SLA for each member

Answer

Set the rule strategy to 'best quality'

Answer

Enable 'spillover' under the SD-WAN rule

Question 3

An administrator configures SD-WAN with two members (port1 and port2). A performance SLA monitors latency to 8.8.8.8. The SD-WAN rule uses 'Best Quality' strategy based on latency. When the link on port1 becomes slow, the FortiGate continues using port1 even though port2 has lower latency. What is the most likely cause?

Accepted Answer

The performance SLA is not associated with the SD-WAN members

Answer

The FortiGate is not receiving ICMP replies from 8.8.8.8

Answer

The SD-WAN rule is configured with 'Manual' strategy

Answer

The load balancing algorithm is set to 'volume' instead of 'lowest-latency'

Question 4

A FortiGate is configured with two ISPs in an SD-WAN. The administrator wants to use the link with the highest bandwidth for bulk downloads, but if that link fails, all traffic should automatically use the backup link. Which load balancing algorithm should be used?

Accepted Answer

Spillover

Answer

Sessions

Answer

Volume

Answer

Source-destination IP

Question 5

An administrator runs 'get router info routing-table bgp' and sees that a route for 10.20.0.0/16 is learned via BGP from a neighbor. However, the route does not appear in the routing table. The administrator checks the BGP configuration and sees that 'network 10.20.0.0 255.255.0.0' is not configured under BGP. What is the most likely reason?

Accepted Answer

A route map is filtering the received route

Answer

The route is a default route (0.0.0.0/0) and is being suppressed

Answer

The BGP neighbor is not in the Established state

Answer

The route is not in the routing table because BGP requires the network statement to originate the route

Question 6

An administrator has configured OSPF on a FortiGate with multiple areas. They want to ensure that routes from area 0 are redistributed into area 1, but they notice that routes from area 1 are not appearing in area 0. What is the most likely configuration issue?

Accepted Answer

The ABR has 'area 1 stub' configured, preventing LSA type 5 redistribution

Answer

There is a firewall policy blocking OSPF packets

Answer

The redistribution is done with a route map that is not permitting the routes

Answer

The ABR is not configured with 'area 0' and 'area 1' on the same router

Question 7

A FortiGate is using BFD for BGP fast failure detection. The administrator wants to ensure that if the BFD session goes down, the BGP neighbor is removed and routes are withdrawn immediately. Which configuration is necessary?

Accepted Answer

Enable BFD on the BGP neighbor and ensure BFD timers are set lower than BGP hold time

Answer

Configure BGP graceful restart

Answer

Set BGP hold time to 0

Answer

Use 'set bfd-desired-min-tx 100' on the interface

Question 8

An administrator wants to use a FortiGate to manage FortiSwitch units via the LAN. Which interface configuration is required on the FortiGate to allow this management?

Accepted Answer

The interface must be configured as a 'trunk' mode to connect to the FortiSwitch

Answer

The interface must have 'set role lan' configured

Answer

The interface must be a member of a VDOM

Answer

The interface must have 'set type switch' enabled

Question 9

A FortiGate is configured with policy-based routing to force traffic from subnet 10.0.1.0/24 to go through a WAN interface. The administrator notices that traffic from 10.0.1.0/24 is still using the default route. Which debug command can confirm if the policy-based routing is being applied?

Accepted Answer

diagnose debug flow policy-based-route

Answer

diagnose debug routing ip-probe 10.0.1.1 8.8.8.8

Answer

diagnose debug enable && diagnose debug router policy

Answer

get router info policy-based-route

Question 10

A FortiGate has two WAN links and uses ECMP load balancing for default routes. The administrator wants to ensure that all packets belonging to the same TCP session go out the same interface. Which setting should be enabled?

Accepted Answer

ECMP with 'session-based' algorithm

Answer

Persistent NAT

Answer

ECMP source-destination-ip hash

Answer

ECMP with source-ip hash

Question 11

An administrator configures SD-WAN with two members (wan1, wan2) and a performance SLA for ICMP to 1.1.1.1. The SD-WAN rule is set to 'Best Quality' with 'latency' metric. The admin notices that traffic sometimes switches to the other link even when the current link has acceptable latency. Which action can reduce unnecessary flapping?

Accepted Answer

Configure a hysteresis value for the SLA

Answer

Increase the SLA probe interval

Answer

Use 'manual' strategy instead

Answer

Increase the 'update-cascade-interface' setting

Question 12

A FortiGate is configured with multiple virtual routers (VRFs). The administrator wants to allow communication between two VRFs using a firewall policy. Which type of interface is required for the policy?

Accepted Answer

VDOM link

Answer

VLAN subinterface

Answer

Loopback interface

Answer

Virtual-wire pair

Question 13

A FortiGate is connected to a FortiExtender via USB. The administrator wants to use LTE as a backup WAN link in an SD-WAN setup. After configuring the FortiExtender, the LTE interface is not showing up as an SD-WAN member. What is the most likely reason?

Accepted Answer

The FortiGate does not have a valid FortiExtender license

Answer

The FortiExtender is not in managed mode

Answer

The LTE SIM card is not activated

Answer

The LTE interface must be configured as a WAN link in the FortiExtender first

Question 14

An administrator sees the following output from 'diagnose sys session list' for a particular session: proto=6 proto_state=01 duration=3600 expire=3599. What does this indicate about the session?

Accepted Answer

The session is a TCP session that is still open and will expire in 3599 seconds

Answer

The session is an ICMP session

Answer

The session is a TCP session in TIME_WAIT state

Answer

The session is for UDP traffic and has been up for 3600 seconds

Question 15

An administrator is configuring SD-WAN rules to direct specific traffic types. Which TWO of the following criteria can be used in an SD-WAN rule to match traffic?

Accepted Answer

Destination IP address

Answer

Source interface

Answer

Time of day

Answer

URL category