NSE7 Advanced Networking and SD-WAN Practice Test 13 — 15 Questions

Question 1

An administrator is configuring SD-WAN rules to direct specific traffic types. Which TWO of the following criteria can be used in an SD-WAN rule to match traffic?

Accepted Answer

Destination IP address. Destination IP address (C) is a valid SD-WAN rule match criterion because SD-WAN rules can use destination IP address ranges or prefixes to steer traffic over specific transport interfaces or SD-WAN members. This allows administrators to route traffic to particular destinations (e.g., a branch office subnet or a cloud service) through preferred WAN links based on IP-based policy. Application (D) is also a valid criterion because SD-WAN rules can match traffic based on application signatures (e.g., Office365, YouTube) to apply appropriate steering policies, ensuring critical applications use optimal paths while non-critical traffic can be directed over lower-cost links.

Answer

Source interface

Answer

Time of day

Answer

URL category

Question 2

An administrator is troubleshooting SD-WAN and wants to verify that performance SLA probes are being sent correctly. Which THREE CLI commands can provide information about the SLA probes and their results?

Accepted Answer

diagnose sys sdwan health-check. The 'diagnose sys sdwan health-check' command displays the current status and results of performance SLA probes for each SD-WAN health-check server, including metrics like latency, jitter, and packet loss. This allows the administrator to verify that probes are being sent and whether they meet the configured SLA thresholds.

Answer

diagnose sys sdwan route

Answer

diagnose sys sdwan config

Question 3

A FortiGate is configured with OSPF and BGP. The administrator wants to redistribute OSPF routes into BGP. Which TWO steps are required?

Accepted Answer

Use the 'redistribute ospf' command under the BGP configuration. The 'redistribute ospf' command under BGP configuration is the explicit method to inject OSPF-learned routes into the BGP table. This command triggers the redistribution process, allowing OSPF routes to be advertised to BGP peers.

Answer

Configure a route map to filter the routes being redistributed

Answer

Set the BGP table version to 2

Answer

Disable OSPF on the interface

Question 4

An administrator is configuring SD-WAN on a FortiGate. They want traffic from the internal network to a specific SaaS application to use the MPLS link unless the latency exceeds 50 ms, in which case traffic should failover to the broadband link. Which configuration elements are required?

Accepted Answer

Create an SD-WAN member for each link, configure a performance SLA with latency threshold 50 ms, and add an SD-WAN rule matching the SaaS traffic with the MPLS member as preferred and enable 'set failover enable'.. It uses SD-WAN members for each link, a performance SLA with a latency threshold of 50 ms to monitor link quality, and an SD-WAN rule that matches SaaS traffic with the MPLS member as preferred and failover enabled. This configuration ensures that traffic uses the MPLS link as long as latency stays below 50 ms, and automatically fails over to the broadband link when the SLA is violated.

Answer

Configure policy-based routing to direct SaaS traffic to the MPLS link and rely on default routing for failover.

Answer

Add a static route for the SaaS IP with the MPLS interface as the gateway and a higher distance than the default route via broadband.

Answer

Create an SD-WAN member for each link, configure a performance SLA with jitter threshold 50 ms, and add an SD-WAN rule matching the SaaS traffic using the 'best-quality' strategy with the MPLS member.

Question 5

A FortiGate is configured with two SD-WAN members (port1 and port2). The administrator sets an SD-WAN rule with 'set load-balance-mode source-dst-ip' for all internal traffic. The source IP is 10.0.0.1 and destination IP is 172.16.0.1. Which factor determines the outgoing interface for this traffic?

Accepted Answer

The combination of source IP and destination IP hashed to select an interface. With 'set load-balance-mode source-dst-ip', the FortiGate performs a hash of both the source IP and destination IP to deterministically select an outgoing SD-WAN member. This ensures that all packets belonging to the same source-destination pair are consistently forwarded over the same interface, preserving flow symmetry without relying on per-packet metrics.

Answer

The destination IP only

Answer

The source IP only

Answer

The interface with the lowest current utilization

Question 6

A FortiGate is running OSPF in a multi-area topology. The administrator needs to redistribute connected routes from area 0 into area 1 but does not want to leak any other routes. Which configuration is correct?

Accepted Answer

Configure route redistribution under OSPF with 'redistribute connected' and apply a route map that permits only the desired connected networks.. OSPF does not automatically redistribute connected routes between areas; it only advertises routes learned via OSPF. To inject connected routes from area 0 into area 1 without leaking other routes, you must use 'redistribute connected' under OSPF and apply a route map that explicitly permits only the desired connected networks. This ensures that only those specific prefixes are advertised as Type 5 or Type 7 LSAs into area 1, while all other routes remain unaffected.

Answer

Use policy-based routing to forward traffic to the connected networks.

Answer

Add the connected networks as networks in area 1 using 'network x.x.x.x 255.255.255.0 area 1'.

Answer

Use 'set redistribute connected' under the OSPF interface configuration for the connected interface in area 0.

Question 7

An administrator wants to load balance traffic across two WAN links by session count. Which SD-WAN load balancing algorithm should they use?

Accepted Answer

Sessions. The Sessions algorithm distributes new sessions across WAN links based on the current session count, ensuring each link handles a roughly equal number of active sessions. This directly matches the administrator's requirement to load balance by session count, as it uses the session counter as the metric for link selection.

Answer

Spillover

Answer

Lowest-cost

Answer

Volume

Question 8

A FortiGate with SD-WAN has two members: MPLS (port1) and Broadband (port2). The performance SLA is configured to monitor latency and packet loss. The administrator notices that after a brief outage on the MPLS link, traffic fails over to Broadband but does not fail back when MPLS recovers. What is the likely cause?

Accepted Answer

The SD-WAN rule for the traffic has 'set failback disable'.. The 'set failback disable' command in the SD-WAN rule prevents traffic from automatically returning to the preferred MPLS link after it recovers. By default, failback is enabled, meaning traffic will revert to the higher-priority member once the performance SLA is satisfied again. When disabled, the FortiGate keeps traffic on the backup link indefinitely, which matches the described behavior.

Answer

The SLA threshold is set too aggressively, causing the link to be considered down long after recovery.

Answer

The Broadband link has a higher cost, so the FortiGate prefers to keep traffic there.

Answer

The SLA probe interval is longer than the outage duration, so the SLA never detected the outage.

Question 9

You run the following command on a FortiGate:
`diagnose sys session filter dport 443`
Output:
`proto=6 proto_state=01 duration=3600 expire=3599`
What does this output indicate?

Accepted Answer

The session is for TCP port 443, is in state SYN_SENT, and has been active for 3600 seconds.. The output shows `proto=6`, which is the protocol number for TCP, and `dport 443` filters for destination port 443. The `proto_state=01` indicates the TCP state is SYN_SENT (state 1 in the FortiGate session table). The `duration=3600` means the session has been active for 3600 seconds, and `expire=3599` shows the remaining time in seconds before the session times out. Thus, Option B correctly interprets these fields.

Answer

The session is for UDP port 443, is in state ESTABLISHED, and has 3599 bytes remaining.

Answer

The session is for TCP port 443, is in state TIME_WAIT, and will expire in 3600 seconds.

Answer

The session is for TCP port 443, is in state FIN_WAIT, and will expire in 3599 seconds.

Question 10

Which feature allows a FortiGate to maintain separate routing tables for different customers or departments on the same device?

Accepted Answer

VRF (Virtual Routing and Forwarding). VRF (Virtual Routing and Forwarding) allows a FortiGate to maintain separate, isolated routing tables and forwarding instances for different customers or departments on the same physical device. Each VRF has its own routing table, forwarding table, and interfaces, ensuring traffic from one VRF never crosses into another without explicit route leaking. This is the correct feature for multi-tenant or multi-department routing isolation.

Answer

Route maps

Answer

VDOM

Answer

Policy-based routing

Question 11

A FortiGate is configured with ECMP load balancing for equal-cost routes. The administrator wants to ensure that all traffic from a specific source IP uses the same next hop. Which ECMP load balancing method should be selected?

Accepted Answer

Source-IP-based. Source-IP-based ECMP load balancing ensures that all packets from a specific source IP address are forwarded to the same next hop by hashing only the source IP field. This maintains session consistency for traffic originating from a single host, which is critical for stateful inspection and applications that require symmetric routing.

Answer

Destination-IP-based

Answer

Weighted random

Answer

Round-robin

Question 12

An administrator is integrating a FortiExtender with a FortiGate. The FortiExtender is connected to port5 and configured with a cellular WAN connection. What must be configured on the FortiGate to allow the FortiExtender to provide WAN connectivity as an SD-WAN member?

Accepted Answer

Enable the 'fortiextender' option on port5 and configure the FortiExtender as an SD-WAN member using the virtual wan interface.. To integrate a FortiExtender as an SD-WAN member, the FortiGate must enable the 'fortiextender' option on the physical port (port5) to which the FortiExtender is connected. This creates a virtual wan interface that represents the FortiExtender's cellular WAN connection, allowing it to be added as an SD-WAN member for load balancing and failover policies. No static route or SIM card configuration is needed on the FortiGate, as the FortiExtender handles cellular authentication and routing internally.

Answer

Create a static route to the FortiExtender's management IP to use it as a gateway.

Answer

Configure port5 as a physical member and assign the FortiExtender's SIM card details.

Answer

Use the FortiExtender as a standalone router and configure policy-based routing on the FortiGate.

Question 13

Which routing protocol is commonly used in SD-WAN deployments to exchange routes between FortiGate and the provider edge router in an MPLS network?

Accepted Answer

BGP. BGP is the correct answer because it is the standard exterior gateway protocol used in MPLS Layer 3 VPNs to exchange customer routes between a FortiGate (CE router) and the provider edge (PE) router. BGP supports advanced features like route filtering, load balancing, and traffic engineering, which are essential for SD-WAN overlay integration with MPLS underlay networks.

Answer

RIP

Answer

IS-IS

Answer

OSPF

Question 14

An administrator configures a prefix list to filter routes received from a BGP neighbor. The prefix list permits 192.168.0.0/16 le 24. Which routes are permitted?

Accepted Answer

Any route with prefix length between 16 and 24 inclusive, starting with 192.168. The prefix list `192.168.0.0/16 le 24` permits any route that matches the prefix `192.168.0.0/16` and has a prefix length between 16 and 24 inclusive. The `le` (less-than-or-equal-to) operator sets the maximum prefix length, so routes with lengths 16, 17, 18, 19, 20, 21, 22, 23, and 24 are all allowed, as long as they fall within the 192.168.0.0/16 network.

Answer

Only routes with prefix length exactly 16 within 192.168.0.0/16

Answer

Only routes with prefix length exactly 24 within 192.168.0.0/16

Answer

Any route with prefix length greater than 24 within 192.168.0.0/16

Question 15

An administrator needs to integrate a FortiSwitch with a FortiGate for LAN edge management. The FortiGate will manage the switch via the LAN interface. Which TWO steps are required? (Choose two.)

Accepted Answer

Enable switch controller on the FortiGate.. Enabling the switch controller on the FortiGate activates the FortiLink management protocol, which is required for the FortiGate to discover, configure, and manage the FortiSwitch as a managed switch. Option E is correct because the physical port connecting the FortiSwitch must be configured as a 'switch' interface type (FortiLink interface) to establish the proprietary control and data plane communication between the devices.

Answer

Assign an IP address to the FortiSwitch's management VLAN on the FortiGate.

Answer

Configure the FortiSwitch in standalone mode.

Answer

Disable STP on the FortiSwitch ports connected to the FortiGate.