NSE7 Advanced Networking and SD-WAN Practice Test 13 — 15 Questions

Question 1

An administrator is troubleshooting SD-WAN and wants to verify that performance SLA probes are being sent correctly. Which THREE CLI commands can provide information about the SLA probes and their results?

Accepted Answer

diagnose sys sdwan health-check

Answer

diagnose sys sdwan route

Answer

diagnose sys sdwan config

Question 2

A FortiGate is configured with OSPF and BGP. The administrator wants to redistribute OSPF routes into BGP. Which TWO steps are required?

Accepted Answer

Use the 'redistribute ospf' command under the BGP configuration

Answer

Configure a route map to filter the routes being redistributed

Answer

Set the BGP table version to 2

Answer

Disable OSPF on the interface

Question 3

An administrator is configuring SD-WAN on a FortiGate. They want traffic from the internal network to a specific SaaS application to use the MPLS link unless the latency exceeds 50 ms, in which case traffic should failover to the broadband link. Which configuration elements are required?

Accepted Answer

Create an SD-WAN member for each link, configure a performance SLA with latency threshold 50 ms, and add an SD-WAN rule matching the SaaS traffic with the MPLS member as preferred and enable 'set failover enable'.

Answer

Configure policy-based routing to direct SaaS traffic to the MPLS link and rely on default routing for failover.

Answer

Add a static route for the SaaS IP with the MPLS interface as the gateway and a higher distance than the default route via broadband.

Answer

Create an SD-WAN member for each link, configure a performance SLA with jitter threshold 50 ms, and add an SD-WAN rule matching the SaaS traffic using the 'best-quality' strategy with the MPLS member.

Question 4

A FortiGate is configured with two SD-WAN members (port1 and port2). The administrator sets an SD-WAN rule with 'set load-balance-mode source-dst-ip' for all internal traffic. The source IP is 10.0.0.1 and destination IP is 172.16.0.1. Which factor determines the outgoing interface for this traffic?

Accepted Answer

The combination of source IP and destination IP hashed to select an interface

Answer

The destination IP only

Answer

The source IP only

Answer

The interface with the lowest current utilization

Question 5

A FortiGate is running OSPF in a multi-area topology. The administrator needs to redistribute connected routes from area 0 into area 1 but does not want to leak any other routes. Which configuration is correct?

Accepted Answer

Configure route redistribution under OSPF with 'redistribute connected' and apply a route map that permits only the desired connected networks.

Answer

Use policy-based routing to forward traffic to the connected networks.

Answer

Add the connected networks as networks in area 1 using 'network x.x.x.x 255.255.255.0 area 1'.

Answer

Use 'set redistribute connected' under the OSPF interface configuration for the connected interface in area 0.

Question 6

An administrator wants to load balance traffic across two WAN links by session count. Which SD-WAN load balancing algorithm should they use?

Accepted Answer

Sessions

Answer

Spillover

Answer

Lowest-cost

Answer

Volume

Question 7

A FortiGate with SD-WAN has two members: MPLS (port1) and Broadband (port2). The performance SLA is configured to monitor latency and packet loss. The administrator notices that after a brief outage on the MPLS link, traffic fails over to Broadband but does not fail back when MPLS recovers. What is the likely cause?

Accepted Answer

The SD-WAN rule for the traffic has 'set failback disable'.

Answer

The SLA threshold is set too aggressively, causing the link to be considered down long after recovery.

Answer

The Broadband link has a higher cost, so the FortiGate prefers to keep traffic there.

Answer

The SLA probe interval is longer than the outage duration, so the SLA never detected the outage.

Question 8

You run the following command on a FortiGate:
`diagnose sys session filter dport 443`
Output:
`proto=6 proto_state=01 duration=3600 expire=3599`
What does this output indicate?

Accepted Answer

The session is for TCP port 443, is in state SYN_SENT, and has been active for 3600 seconds.

Answer

The session is for UDP port 443, is in state ESTABLISHED, and has 3599 bytes remaining.

Answer

The session is for TCP port 443, is in state TIME_WAIT, and will expire in 3600 seconds.

Answer

The session is for TCP port 443, is in state FIN_WAIT, and will expire in 3599 seconds.

Question 9

An administrator wants to use BFD with OSPF to detect link failures faster. What must be configured on the FortiGate?

Accepted Answer

Enable BFD globally and under the OSPF process with 'set bfd enable'.

Answer

Enable BFD only on the OSPF interfaces using 'set bfd enable' under the interface configuration.

Answer

BFD is automatically enabled when OSPF is configured; no additional steps are needed.

Answer

Create a BFD template and apply it to the OSPF process.

Question 10

Which feature allows a FortiGate to maintain separate routing tables for different customers or departments on the same device?

Accepted Answer

VRF (Virtual Routing and Forwarding)

Answer

Route maps

Answer

VDOM

Answer

Policy-based routing

Question 11

A FortiGate is configured with ECMP load balancing for equal-cost routes. The administrator wants to ensure that all traffic from a specific source IP uses the same next hop. Which ECMP load balancing method should be selected?

Accepted Answer

Source-IP-based

Answer

Destination-IP-based

Answer

Weighted random

Answer

Round-robin

Question 12

An administrator is integrating a FortiExtender with a FortiGate. The FortiExtender is connected to port5 and configured with a cellular WAN connection. What must be configured on the FortiGate to allow the FortiExtender to provide WAN connectivity as an SD-WAN member?

Accepted Answer

Enable the 'fortiextender' option on port5 and configure the FortiExtender as an SD-WAN member using the virtual wan interface.

Answer

Create a static route to the FortiExtender's management IP to use it as a gateway.

Answer

Configure port5 as a physical member and assign the FortiExtender's SIM card details.

Answer

Use the FortiExtender as a standalone router and configure policy-based routing on the FortiGate.

Question 13

Which routing protocol is commonly used in SD-WAN deployments to exchange routes between FortiGate and the provider edge router in an MPLS network?

Accepted Answer

BGP

Answer

RIP

Answer

IS-IS

Answer

OSPF

Question 14

An administrator configures a prefix list to filter routes received from a BGP neighbor. The prefix list permits 192.168.0.0/16 le 24. Which routes are permitted?

Accepted Answer

Any route with prefix length between 16 and 24 inclusive, starting with 192.168

Answer

Only routes with prefix length exactly 16 within 192.168.0.0/16

Answer

Only routes with prefix length exactly 24 within 192.168.0.0/16

Answer

Any route with prefix length greater than 24 within 192.168.0.0/16

Question 15

An administrator needs to integrate a FortiSwitch with a FortiGate for LAN edge management. The FortiGate will manage the switch via the LAN interface. Which TWO steps are required? (Choose two.)

Accepted Answer

Enable switch controller on the FortiGate.

Answer

Assign an IP address to the FortiSwitch's management VLAN on the FortiGate.

Answer

Configure the FortiSwitch in standalone mode.

Answer

Disable STP on the FortiSwitch ports connected to the FortiGate.