NSE7 Advanced Networking and SD-WAN Practice Test 13 — 15 Questions

Question 1

A FortiGate is configured with an SD-WAN rule using 'spillover' algorithm. The primary member has a spillover threshold of 100 Mbps. Traffic of 80 Mbps is currently flowing through the primary member. A new session requiring 30 Mbps arrives. What will happen?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The new session is sent to the secondary member because the primary threshold would be exceeded.. The SD-WAN 'spillover' algorithm forwards traffic to the primary member until its load reaches the configured threshold (100 Mbps). With 80 Mbps already flowing, adding a new 30 Mbps session would push the total to 110 Mbps, exceeding the threshold. Therefore, the new session is sent to the secondary member to avoid oversubscription, as per the spillover logic.

Answer

The new session is sent to the primary member because the current load is below the threshold.

Answer

The new session is dropped because no member can handle it.

Answer

The primary member's threshold is dynamically increased.

Question 2

An administrator wants to ensure that traffic from a specific source IP uses a particular SD-WAN member regardless of performance SLA results. Which SD-WAN configuration element should be used?

Accepted Answer

SD-WAN rule with manual strategy. A is correct because an SD-WAN rule with a manual strategy allows the administrator to explicitly pin traffic from a specific source IP to a particular SD-WAN member interface, overriding any performance SLA-based path selection. This is achieved by configuring the rule's 'strategy' as 'manual' and specifying the preferred member, which forces all matching traffic to use that interface regardless of SLA health.

Answer

Route map

Answer

Policy-based routing on the firewall policy

Answer

Performance SLA

Question 3

A FortiGate has two WAN interfaces (port1, port2) as SD-WAN members. The performance SLA monitor is configured for both with a latency threshold of 50 ms. The measured latency on port1 is 45 ms and on port2 is 55 ms. An SD-WAN rule uses 'lowest-cost' algorithm. Which interface will be selected for new sessions?

Accepted Answer

port1 because its latency is within threshold and lower than port2. The SD-WAN rule uses the 'lowest-cost' algorithm, which selects the interface with the lowest cost among those that meet the performance SLA threshold. Here, port1 has a measured latency of 45 ms, which is below the 50 ms threshold, while port2's latency of 55 ms exceeds the threshold, making port2 ineligible. Therefore, port1 is the only qualifying interface and is selected for new sessions.

Answer

port2 because port1's latency is close to threshold

Answer

The session is dropped

Answer

Both interfaces are used equally

Question 4

A FortiGate is configured with ECMP load balancing. What is the default behavior when multiple routes have equal cost?

Accepted Answer

Traffic is load balanced across the routes using a hash algorithm. When ECMP load balancing is configured on a FortiGate, the default behavior is to distribute traffic across multiple equal-cost routes using a hash algorithm. This hash algorithm considers fields such as source/destination IP, protocol, and ports to ensure session consistency, meaning all packets belonging to the same session follow the same path. This is the standard ECMP behavior in FortiOS, as documented in the FortiGate Administration Guide.

Answer

The route with the lowest metric is always preferred

Answer

The administrator must enable per-packet load balancing

Answer

All traffic is sent over the first route until it fails

Question 5

An administrator needs to apply different routing policies for traffic based on source IP address, overriding the normal routing table. Which feature should be configured?

Accepted Answer

Policy-based routing. Policy-based routing (PBR) is the correct feature because it allows an administrator to override the normal routing table lookup based on criteria such as source IP address. Unlike static or dynamic routing, PBR uses route maps to match traffic (e.g., source IP) and apply a specific next-hop or interface, enabling granular traffic steering independent of the destination-based routing table.

Answer

Prefix list

Answer

SD-WAN rule

Answer

Route map

Question 6

An administrator wants to integrate a FortiExtender into an existing SD-WAN deployment. Which TWO steps are required for proper integration?

Accepted Answer

Authorize the FortiExtender on the FortiGate. The FortiExtender must first be authorized on the FortiGate to establish a secure management and data plane connection. Once authorized, it must be added as an SD-WAN member interface so that SD-WAN rules and load-balancing algorithms can be applied to traffic traversing the FortiExtender's cellular or LTE link.

Answer

Disable all other WAN interfaces

Answer

Enable NAT on the FortiExtender interface

Answer

Configure a separate VDOM for the FortiExtender

Question 7

An administrator needs to configure VRF to separate traffic for two departments. Which TWO components must be configured for each VRF?

Accepted Answer

A VRF instance. A VRF instance (option A) is the foundational component that must be created for each VRF, as it establishes the separate routing table that isolates the department's traffic. Interface binding to the VRF (option B) is also required because interfaces must be assigned to the VRF so that traffic entering and leaving those interfaces uses the correct VRF routing table. A dedicated VDOM (option C) is incorrect because VDOMs are a Fortinet-specific virtualization concept separate from VRF, and VRF can be configured without VDOMs. Route leaking configuration (option D) is not mandatory for each VRF; it is only needed when you want to selectively share routes between VRFs, which is optional. A separate firewall policy for each VRF (option E) is not a required VRF component, as firewall policies are managed independently of VRF configuration and depend on the platform's security policy model.

Answer

A dedicated VDOM

Answer

Route leaking configuration

Answer

A separate firewall policy for each VRF

Question 8

Which of the following is the primary purpose of BFD (Bidirectional Forwarding Detection) on a FortiGate?

Accepted Answer

To provide fast detection of link failures. BFD (Bidirectional Forwarding Detection) is a lightweight protocol designed to provide sub-second failure detection between two forwarding engines, such as FortiGate peers. Unlike routing protocol hellos (e.g., OSPF Hello at 10-second intervals), BFD can detect link or neighbor failures in as little as 50–100 ms, enabling faster convergence. This makes it the primary mechanism for rapid link failure detection in high-availability and SD-WAN deployments.

Answer

To synchronize routing tables between peers

Answer

To load balance traffic across multiple paths

Answer

To encrypt routing updates between peers

Question 9

An administrator is troubleshooting SD-WAN and runs the following CLI command:
 'execute sdwan-health-check status'
The output shows that one SD-WAN member has a status of 'dead'. What does this indicate?

Accepted Answer

The member has failed the health check probe to the target server. The 'execute sdwan-health-check status' command displays the results of active health-check probes sent to configured target servers. A status of 'dead' means that the SD-WAN member has failed to receive a successful response from the target server within the configured probe interval and retry count, indicating a loss of connectivity or reachability to that target. This is distinct from interface administrative status or SLA compliance, as the health check specifically tests end-to-end reachability to the probe target.

Answer

The member interface is administratively down

Answer

The member is not meeting the performance SLA thresholds

Answer

The SD-WAN member is not included in any SD-WAN rule

Question 10

A FortiGate has two WAN interfaces configured as SD-WAN members. The administrator wants traffic to specific destination IP addresses to use a particular member. Which SD-WAN configuration object should be used to achieve this?

Accepted Answer

SD-WAN rule. SD-WAN rules are the correct configuration object because they allow you to define policy-based forwarding (PBF) criteria, such as source/destination IP addresses, to steer traffic to a specific SD-WAN member interface. Unlike static routes, SD-WAN rules evaluate traffic against match conditions and then apply an explicit action to use a designated member or strategy, making them the precise tool for this requirement.

Answer

Route map

Answer

Prefix list

Answer

Performance SLA

Question 11

An administrator configures OSPF on a FortiGate with multiple areas. After configuration, the FortiGate does not become an ABR. What is the most likely reason?

Accepted Answer

There is no interface assigned to area 0. For a FortiGate to function as an OSPF Area Border Router (ABR), it must have at least one interface assigned to the backbone area (area 0) and at least one interface assigned to a non-backbone area. Without an interface in area 0, the FortiGate cannot generate Type 3 summary LSAs or perform inter-area routing, so it remains an internal router. Option D is correct because the absence of an interface in area 0 is the most direct and common reason for a FortiGate not becoming an ABR.

Answer

The router-id is not configured

Answer

The OSPF process is not enabled

Answer

The network type is set to point-to-point

Question 12

What is the function of a VRF (Virtual Routing and Forwarding) on a FortiGate?

Accepted Answer

To create multiple independent routing tables. VRF (Virtual Routing and Forwarding) on a FortiGate allows the creation of multiple independent routing tables within a single physical device. This enables network segmentation and traffic isolation at Layer 3, where each VRF maintains its own routing table, forwarding decisions, and interface associations, preventing routes from leaking between VRFs unless explicitly configured with route leaking.

Answer

To provide redundancy for routing protocols

Answer

To aggregate multiple physical interfaces into one logical interface

Answer

To encrypt traffic between different virtual domains

Question 13

An administrator wants to integrate a FortiExtender with a FortiGate to provide cellular WAN connectivity. Which configuration step is required on the FortiGate to use the FortiExtender as an SD-WAN member?

Accepted Answer

Add the FortiExtender's interface to the SD-WAN zone. To use a FortiExtender as an SD-WAN member, the FortiExtender's physical or logical interface must be added to the SD-WAN zone on the FortiGate. This allows the FortiGate to apply SD-WAN rules, load balancing, and SLA-based path selection to traffic traversing the cellular WAN link. Without this step, the interface remains a standard WAN interface and cannot participate in SD-WAN policies.

Answer

Enable BGP on the FortiExtender interface

Answer

Create a firewall policy allowing traffic from the FortiExtender

Answer

Configure a static route pointing to the FortiExtender

Question 14

An administrator configures a route map on a FortiGate to redistribute connected routes into OSPF. The route map sets a metric of 100. After applying, the redistributed routes appear with metric 20. What is the most likely reason?

Accepted Answer

The route map is not applied to the redistribution configuration. The most likely reason the redistributed routes appear with metric 20 instead of the configured 100 is that the route map was not applied to the redistribution configuration. In FortiGate OSPF redistribution, a route map must be explicitly referenced under the 'redistribute connected' command; otherwise, the route map is ignored, and OSPF uses its default metric of 20 for redistributed connected routes.

Answer

The route map is applied to the wrong direction

Answer

OSPF does not allow metric setting via route maps

Answer

The metric type is set to type 1

Question 15

A network administrator is configuring SD-WAN on a FortiGate and wants to ensure that VoIP traffic uses the link with the lowest latency while bulk download traffic uses the link with the highest bandwidth. Which TWO configuration steps are required?

Accepted Answer

Create an SD-WAN rule for VoIP traffic with 'best quality' strategy. Option B is correct because an SD-WAN rule with the 'best quality' strategy selects the member link that best satisfies the configured performance SLA (lowest latency, jitter, and packet loss), which is exactly what VoIP traffic requires. Option E is correct because the 'best quality' strategy depends on a performance SLA that defines the latency threshold and probes (e.g., ping, HTTP, or twamp) used to measure each member's link quality; without a latency SLA, the SD-WAN rule cannot evaluate link quality. Option A is incorrect because a static route for the VoIP subnet does not perform dynamic link selection based on latency and would bypass SD-WAN path selection. Option C is incorrect because BFD is a failure-detection mechanism for fast link-down detection, not a latency-based path selection method. Option D is incorrect because route maps are used for route filtering and attribute manipulation in routing protocols, not for SD-WAN quality-based steering.

Answer

Assign a static route for the VoIP subnet

Answer

Enable BFD on all WAN interfaces

Answer

Configure a route map for VoIP traffic