NSE7 Advanced Networking and SD-WAN Practice Test 12 — 15 Questions

Question 1

A FortiGate administrator is integrating a FortiSwitch managed by the FortiGate. They want to configure a VLAN interface on the FortiSwitch for user traffic. Which configuration is required on the FortiGate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a VLAN on the FortiSwitch under the switch controller and assign it to a port. When integrating a FortiSwitch managed by a FortiGate, VLANs for user traffic must be created under the switch controller on the FortiGate. This allows the FortiGate to push the VLAN configuration to the FortiSwitch, including assigning the VLAN to a specific port or port group. Option B correctly describes this process, as the switch controller manages the FortiSwitch as an extension of the FortiGate, not as a standalone device.

Answer

Enable DHCP relay on the FortiSwitch VLAN

Answer

Use the config system interface to create a VLAN on the FortiGate and tag it on the trunk

Answer

Create a VLAN subinterface on the FortiGate's port that connects to the FortiSwitch

Question 2

An administrator is troubleshooting an SD-WAN rule that is not matching expected traffic. The SD-WAN rule uses a custom application category and has a performance SLA attached. Which two conditions must be true for the traffic to be matched by the SD-WAN rule? (Select TWO.)

Accepted Answer

The traffic must be identified by the application control sensor as the configured application category. SD-WAN rules in FortiOS rely on application control sensors to classify traffic into custom application categories. If the traffic is not identified by the application control sensor as belonging to the configured category, the SD-WAN rule cannot match it, regardless of other conditions.

Answer

The performance SLA must be marked as 'up' for at least one member in the SD-WAN zone

Answer

The destination port must be 80 or 443

Answer

The source IP must be in the same subnet as the SD-WAN member's IP

Question 3

A FortiGate is configured with BGP and OSPF. The administrator wants to ensure that routes learned via BGP are redistributed into OSPF, but only specific prefixes. Which three components are needed? (Select THREE.)

Accepted Answer

A route map that references the prefix list and sets OSPF parameters. A route map is required to match the specific prefixes (via the prefix list) and to set OSPF metric or metric-type parameters when redistributing BGP routes into OSPF. Without the route map, redistribution would apply to all BGP routes or use default OSPF parameters, which does not meet the requirement of controlling which prefixes are redistributed.

Answer

A VRF to separate the routing tables

Answer

A distribute list in OSPF to filter incoming routes

Question 4

A network admin needs to configure a FortiGate to load balance traffic across two ISP links using SD-WAN. The requirement is to use both links simultaneously for different sessions based on source-destination IP hash. Which two settings are required? (Select TWO.)

Accepted Answer

Create an SD-WAN zone with both WAN members. An SD-WAN zone is a logical grouping of WAN members (interfaces) that allows FortiGate to treat multiple ISP links as a single entity for load balancing and redundancy. Without creating a zone that includes both WAN members, the SD-WAN rules cannot reference them collectively for traffic distribution. Option B is correct because the 'source-dest-ip-hash' load balancing algorithm ensures that sessions with the same source and destination IP pair are consistently forwarded over the same link, enabling per-session load balancing across both ISPs simultaneously.

Answer

Add a performance SLA for each member

Answer

Set the rule strategy to 'best quality'

Answer

Enable 'spillover' under the SD-WAN rule

Question 5

An administrator configures SD-WAN with two members (port1 and port2). A performance SLA monitors latency to 8.8.8.8. The SD-WAN rule uses 'Best Quality' strategy based on latency. When the link on port1 becomes slow, the FortiGate continues using port1 even though port2 has lower latency. What is the most likely cause?

Accepted Answer

The performance SLA is not associated with the SD-WAN members. The performance SLA must be explicitly associated with the SD-WAN members (port1 and port2) for the 'Best Quality' strategy to use latency measurements. Without this association, the FortiGate cannot compare the SLA results per interface and defaults to using the current active member, even if its latency is higher. The SLA monitors 8.8.8.8, but the SD-WAN rule has no link to those measurements, so port1 continues to be used.

Answer

The FortiGate is not receiving ICMP replies from 8.8.8.8

Answer

The SD-WAN rule is configured with 'Manual' strategy

Answer

The load balancing algorithm is set to 'volume' instead of 'lowest-latency'

Question 6

A FortiGate is configured with two ISPs in an SD-WAN. The administrator wants to use the link with the highest bandwidth for bulk downloads, but if that link fails, all traffic should automatically use the backup link. Which load balancing algorithm should be used?

Accepted Answer

Spillover. The Spillover algorithm is designed to use a preferred link until its bandwidth capacity is reached, then 'spill over' traffic to a backup link. In this scenario, the administrator wants to use the highest-bandwidth link for bulk downloads and fail over to the backup link only when the primary link fails. Spillover matches this requirement because it can be configured with a bandwidth threshold; once the primary link's bandwidth is exhausted or the link fails, traffic automatically shifts to the backup link.

Answer

Sessions

Answer

Volume

Answer

Source-destination IP

Question 7

An administrator runs 'get router info routing-table bgp' and sees that a route for 10.20.0.0/16 is learned via BGP from a neighbor. However, the route does not appear in the routing table. The administrator checks the BGP configuration and sees that 'network 10.20.0.0 255.255.0.0' is not configured under BGP. What is the most likely reason?

Accepted Answer

A route map is filtering the received route. The route for 10.20.0.0/16 is learned via BGP from a neighbor and appears in the BGP table, but it is not installed in the routing table. The most likely reason is that a route map is filtering the received route, preventing it from being installed. Since the network statement is not configured under BGP, the route is not originated locally, but it can still be received from a neighbor; however, an inbound or outbound route map can deny the route from entering the routing table.

Answer

The route is a default route (0.0.0.0/0) and is being suppressed

Answer

The BGP neighbor is not in the Established state

Answer

The route is not in the routing table because BGP requires the network statement to originate the route

Question 8

An administrator has configured OSPF on a FortiGate with multiple areas. They want to ensure that routes from area 0 are redistributed into area 1, but they notice that routes from area 1 are not appearing in area 0. What is the most likely configuration issue?

Accepted Answer

The ABR is not configured with 'area 0' and 'area 1' on the same router. The most likely configuration issue is that the ABR is not properly configured as an ABR – it must have interfaces in both area 0 and area 1. Without an interface in area 0, the router cannot generate Type 3 LSAs (inter-area advertisements) between the areas, so routes from area 1 never appear in area 0. Option B is incorrect because a stub area blocks Type 5 LSAs from entering the stub area, but it does not block Type 3 LSAs from being advertised out of the stub area into the backbone; therefore, stub configuration would not prevent inter-area routes from reaching area 0.

Answer

There is a firewall policy blocking OSPF packets

Answer

The ABR has 'area 1 stub' configured, preventing LSA type 5 redistribution

Answer

The redistribution is done with a route map that is not permitting the routes

Question 9

A FortiGate is using BFD for BGP fast failure detection. The administrator wants to ensure that if the BFD session goes down, the BGP neighbor is removed and routes are withdrawn immediately. Which configuration is necessary?

Accepted Answer

Enable BFD on the BGP neighbor and ensure BFD timers are set lower than BGP hold time. BFD provides sub-second failure detection independent of BGP's hold timer. When BFD is enabled on a BGP neighbor and the BFD session goes down, the BGP neighbor is immediately declared dead and all routes from that neighbor are withdrawn, without waiting for the BGP hold timer to expire. This ensures rapid convergence as requested by the administrator.

Answer

Configure BGP graceful restart

Answer

Set BGP hold time to 0

Answer

Use 'set bfd-desired-min-tx 100' on the interface

Question 10

A FortiGate is configured with policy-based routing to force traffic from subnet 10.0.1.0/24 to go through a WAN interface. The administrator notices that traffic from 10.0.1.0/24 is still using the default route. Which debug command can confirm if the policy-based routing is being applied?

Accepted Answer

diagnose debug flow policy-based-route. The `diagnose debug flow policy-based-route` command enables flow-based debugging specifically for policy-based routing (PBR) decisions. This command shows real-time details on how the FortiGate processes packets against PBR rules, including which policy matches and which egress interface is selected, allowing the administrator to confirm whether PBR is being applied to traffic from 10.0.1.0/24.

Answer

diagnose debug routing ip-probe 10.0.1.1 8.8.8.8

Answer

diagnose debug enable && diagnose debug router policy

Answer

get router info policy-based-route

Question 11

A FortiGate has two WAN links and uses ECMP load balancing for default routes. The administrator wants to ensure that all packets belonging to the same TCP session go out the same interface. Which setting should be enabled?

Accepted Answer

ECMP with 'session-based' algorithm. The 'session-based' algorithm (also known as 'source-ip-based' or 'ECMP with session-based' in FortiOS) ensures that all packets belonging to the same TCP session are forwarded out the same interface by hashing the 5-tuple (source IP, destination IP, source port, destination port, protocol). This guarantees session stickiness across ECMP paths, preventing out-of-order delivery and TCP retransmissions. Option D is correct because it directly addresses the requirement for per-session interface consistency.

Answer

Persistent NAT

Answer

ECMP source-destination-ip hash

Answer

ECMP with source-ip hash

Question 12

An administrator configures SD-WAN with two members (wan1, wan2) and a performance SLA for ICMP to 1.1.1.1. The SD-WAN rule is set to 'Best Quality' with 'latency' metric. The admin notices that traffic sometimes switches to the other link even when the current link has acceptable latency. Which action can reduce unnecessary flapping?

Accepted Answer

Configure a hysteresis value for the SLA. Configuring a hysteresis value for the SLA introduces a buffer or deadband around the latency threshold. This prevents the SD-WAN from switching links when latency fluctuates slightly above and below the threshold, which is the root cause of flapping. Without hysteresis, even a minor transient spike in latency can trigger a switch, even if the link's overall performance is acceptable.

Answer

Increase the SLA probe interval

Answer

Use 'manual' strategy instead

Answer

Increase the 'update-cascade-interface' setting

Question 13

A FortiGate is configured with multiple virtual routers (VRFs). The administrator wants to allow communication between two VRFs using a firewall policy. Which type of interface is required for the policy?

Accepted Answer

VDOM link. A VDOM link is a virtual interface that connects two VDOMs (Virtual Domains) and inherently supports routing between different VRFs (Virtual Routing and Forwarding instances) within a FortiGate. When a firewall policy is applied to a VDOM link, it can control traffic flowing between the two VRFs, as the link itself is a Layer 3 interface that belongs to both VDOMs and can be assigned to different VRFs on each side. This is the only interface type that natively allows inter-VRF communication with firewall policy enforcement.

Answer

VLAN subinterface

Answer

Loopback interface

Answer

Virtual-wire pair

Question 14

A FortiGate is connected to a FortiExtender via USB. The administrator wants to use LTE as a backup WAN link in an SD-WAN setup. After configuring the FortiExtender, the LTE interface is not showing up as an SD-WAN member. What is the most likely reason?

Accepted Answer

The FortiGate does not have a valid FortiExtender license. When a FortiGate connects to a FortiExtender via USB, the LTE interface will not appear as an SD-WAN member unless the FortiExtender is in managed mode and the FortiGate has a valid FortiExtender license. Without the license, the FortiGate cannot manage the FortiExtender or expose its LTE interface for SD-WAN membership, even if the physical connection and SIM are functional.

Answer

The FortiExtender is not in managed mode

Answer

The LTE SIM card is not activated

Answer

The LTE interface must be configured as a WAN link in the FortiExtender first

Question 15

An administrator sees the following output from 'diagnose sys session list' for a particular session: proto=6 proto_state=01 duration=3600 expire=3599. What does this indicate about the session?

Accepted Answer

The session is a TCP session that is still open and will expire in 3599 seconds. The output shows proto=6, which is the protocol number for TCP. proto_state=01 indicates the TCP session is in the SYN_SENT state, meaning the session has been created but the TCP three-way handshake is not yet complete. The duration=3600 means the session has existed for 3600 seconds, and expire=3599 means it will expire in 3599 seconds if no further traffic is seen. Therefore, the session is a TCP session that is still open and will expire in 3599 seconds, making option B correct.

Answer

The session is an ICMP session

Answer

The session is a TCP session in TIME_WAIT state

Answer

The session is for UDP traffic and has been up for 3600 seconds