NSE7 Advanced Networking and SD-WAN Practice Test 15 — 15 Questions

Question 1

A multi-area OSPF network includes a FortiGate as an ABR. The administrator needs to redistribute a static route into OSPF. Which command is required on the FortiGate to achieve this?

Accepted Answer

config router ospf
config redistribute
edit 'static'
set status enable
end. To redistribute a static route into OSPF on a FortiGate, you must enter the OSPF configuration context, navigate to the 'redistribute' subcommand, select the 'static' route type, and set its status to 'enable'. This is the standard method for enabling route redistribution from one routing protocol (or static routes) into OSPF, as defined in the FortiGate CLI reference.

Answer

config router prefix-list
edit 'static'
set action permit
end

Answer

config router policy
set src 0.0.0.0/0
set dst 0.0.0.0/0
end

Answer

config router static
set redistribute ospf enable
end

Question 2

Which load balancing algorithm in SD-WAN distributes new sessions based on the source and destination IP addresses, ensuring that all sessions from a given source-destination pair go to the same member?

Accepted Answer

Source-dest IP. The Source-dest IP algorithm in Fortinet SD-WAN uses a hash of the source and destination IP addresses to determine the outbound member for each new session. This ensures that all sessions between the same source-destination pair are consistently forwarded to the same WAN member, preserving flow affinity without requiring session-based state tracking.

Answer

Lowest cost

Answer

Volume

Answer

Sessions

Question 3

An administrator configures BFD on a BGP session between two FortiGates. After enabling BFD, the BGP session flaps intermittently. What is the most likely cause?

Accepted Answer

The BFD failure detection intervals are too low, causing false positives. When BFD is enabled on a BGP session, the BFD failure detection intervals (typically the minimum transmit and receive intervals) determine how quickly a link failure is detected. If these intervals are set too low, BFD may generate false positives due to transient network jitter or minor packet loss, causing the BGP session to flap as BFD triggers a session reset even though the underlying link is stable. This is the most likely cause because the symptom appeared immediately after enabling BFD, and the default or misconfigured intervals can be too aggressive for the network conditions.

Answer

BFD is incompatible with BGP and should not be used together

Answer

BGP hold timer is shorter than BFD detection time

Answer

The BFD minimum transmit and receive intervals are set too high

Question 4

An administrator wants to use FortiExtender to provide LTE WAN connectivity. After connecting the FortiExtender to the FortiGate, the LTE interface is not showing up. What is the first troubleshooting step?

Accepted Answer

Verify the FortiExtender is connected to the correct port and powered on. The first troubleshooting step is to verify the physical connection and power status of the FortiExtender. If the FortiExtender is not connected to the correct port (typically a USB or PoE port) or is not powered on, the FortiGate will not detect the LTE interface at all, making any software-level checks premature.

Answer

Run 'execute lte test' command

Answer

Configure an SD-WAN rule for LTE traffic

Answer

Check the signal strength of the LTE connection

Question 5

A FortiGate has two equal-cost paths to a destination network. ECMP is enabled. The administrator notices that all traffic uses the first path. What is the most likely cause?

Accepted Answer

ECMP is configured to use 'source-dest-ip' hash and all sessions are from same source to same destination. When ECMP is configured with the 'source-dest-ip' hash algorithm, traffic is load-balanced based on a hash of both source and destination IP addresses. If all sessions originate from the same source IP and go to the same destination IP, the hash value is identical for every session, causing all traffic to be forwarded over the same path. This is the most likely cause because the administrator sees all traffic using the first path despite ECMP being enabled.

Answer

ECMP is configured with 'spillover' mode

Answer

The second path is administratively down

Answer

The route metric is not equal

Question 6

A FortiGate is configured with SD-WAN using load balancing algorithm 'source-dest-ip'. What is the primary characteristic of this algorithm?

Accepted Answer

All traffic from the same source IP to the same destination IP uses the same SD-WAN member.. The 'source-dest-ip' load balancing algorithm in SD-WAN uses a hash of both the source IP and destination IP to deterministically select an SD-WAN member. This ensures that all packets belonging to the same flow (same source-destination pair) are consistently forwarded over the same member, preserving per-flow stickiness and avoiding out-of-order delivery.

Answer

Traffic is sent to the member with the highest bandwidth.

Answer

Traffic is sent to the member with the lowest cost metric.

Answer

Traffic is distributed evenly across all SD-WAN members regardless of source or destination.

Question 7

An administrator is troubleshooting BGP with SD-WAN. They have configured BGP on the FortiGate and the SD-WAN rule uses 'best quality' strategy. However, failover does not happen when a WAN link goes down. The BGP session is still up. What is the most likely reason?

Accepted Answer

The performance SLA is not configured to track the BGP next hop.. The 'best quality' SD-WAN strategy selects the best path based on performance SLA metrics. Without a performance SLA monitoring the BGP next hop, the FortiGate cannot detect that the link has failed from a BGP perspective, so it will not trigger a failover even if the physical interface goes down. The BGP session remains up because it is still receiving keepalives, but the SD-WAN rule does not consider the link unusable without SLA tracking.

Answer

The SD-WAN rule is configured with 'set update-static-route disable'.

Answer

The BGP session is using eBGP multihop.

Answer

The load balancing algorithm is set to 'volume'.

Question 8

What is the purpose of configuring BFD (Bidirectional Forwarding Detection) on a FortiGate?

Accepted Answer

To provide rapid failure detection between two forwarding engines.. BFD (Bidirectional Forwarding Detection) provides sub-second failure detection between two forwarding engines, such as FortiGate peers running OSPF or BGP. It operates independently of the routing protocol, using a lightweight hello mechanism to detect link or neighbor failures faster than protocol-native timers (e.g., OSPF dead interval of 40 seconds). This enables rapid convergence in SD-WAN and advanced networking scenarios.

Answer

To load balance traffic across multiple links.

Answer

To encrypt BGP updates between peers.

Answer

To authenticate OSPF neighbors.

Question 9

A FortiGate has multiple VRFs configured. An administrator wants to allow traffic from VRF 1 to reach a server in VRF 2. What configuration is required?

Accepted Answer

Configure a VRF leak policy using route maps or policy routes.. VRF leaking is the standard method to allow traffic between different VRFs on a FortiGate. This is achieved by configuring route maps or policy routes to selectively import/export routes between VRFs, enabling inter-VRF communication without merging the VRFs or using VDOMs.

Answer

Use a single VDOM and enable inter-VDOM links.

Answer

Place both interfaces in the same VRF.

Answer

Create a static route from one VRF to another.

Question 10

An administrator runs 'diagnose sys session filter dport 443' and sees:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is a TCP session in established state that has been up for 3600 seconds and will expire in 3599 seconds.. The output shows proto=6, which is TCP, and proto_state=01, which indicates the TCP session is in an established state (TCP_ESTABLISHED). The duration=3600 means the session has been active for 3600 seconds, and expire=3599 means it will expire in 3599 seconds (i.e., the idle timeout is counting down). This is a standard TCP session in the established state, not a multicast or UDP session.

Answer

The session is a multicast session with a duration of 3600 seconds.

Answer

The session is in SYN_SENT state and has timed out after 3600 seconds.

Answer

The session is a UDP session that has been active for 3600 seconds.

Question 11

What is the function of a route map in FortiGate routing?

Accepted Answer

To filter and modify routing information during redistribution.. A route map in FortiGate routing is primarily used to filter and modify routing information during route redistribution between different routing protocols (e.g., OSPF, BGP, RIP). It allows granular control over which routes are accepted, advertised, or tagged with attributes like metric or community values, ensuring policy-based routing decisions.

Answer

To configure load balancing between multiple WAN links.

Answer

To enable BFD on a specific interface.

Answer

To create a static route for a specific destination.

Question 12

A FortiGate is configured with ECMP load balancing for multiple equal-cost routes. The administrator wants to ensure that all packets belonging to the same session go out the same interface. Which ECMP load balancing method should be used?

Accepted Answer

Source-dest-IP-based. Source-dest-IP-based ECMP (often called per-flow load balancing) uses a hash of both source and destination IP addresses to consistently map all packets of a session to the same next-hop interface. This ensures session integrity because the hash remains constant for the entire flow, preventing out-of-order delivery or packet drops that would occur if packets from the same session took different paths.

Answer

Weighted

Answer

Source-IP-based

Answer

Spillover

Question 13

What is the purpose of a prefix list in FortiGate routing?

Accepted Answer

To match routes based on their network prefix and subnet mask.. A prefix list in FortiGate is used to match routes based on their network prefix and subnet mask (prefix length). It is commonly applied in route maps or BGP configurations to filter or manipulate routing information, such as in redistribution or neighbor policy statements. Unlike access lists, prefix lists match the exact prefix and length, providing more granular control over route advertisement and acceptance.

Answer

To configure NAT rules.

Answer

To define SD-WAN members.

Answer

To assign IP addresses to interfaces.

Question 14

A network administrator is configuring SD-WAN rules with load balancing. They want to distribute HTTP traffic evenly across two WAN links based on the number of sessions. Which TWO settings should they use? (Choose two.)

Accepted Answer

Ensure the SD-WAN rule matches HTTP traffic (e.g., using protocol or port criteria).. Option A is correct because the SD-WAN rule must first identify the traffic to be balanced, so it needs to match HTTP traffic using protocol or port criteria (e.g., TCP port 80/443) before any load-balancing algorithm can be applied to it. Option E is correct because the scenario explicitly requires distributing traffic based on the number of sessions, and the 'session' load-balancing algorithm in FortiGate SD-WAN distributes sessions across the member links to achieve a per-session balance. Option B is incorrect because the 'volume' algorithm balances based on traffic volume (bytes) rather than session count, which does not meet the stated requirement. Option C is incorrect because a performance SLA monitors link health and quality (latency, jitter, packet loss) and is not the mechanism that distributes HTTP sessions evenly. Option D is incorrect because 'set update-static-route' controls whether the SD-WAN rule updates the static route for the selected interface and does not affect load-balancing behavior.

Answer

Set the load balancing algorithm to 'volume'.

Answer

Create a performance SLA to monitor the links.

Answer

Enable 'set update-static-route' on the SD-WAN rule.

Question 15

A FortiGate is running OSPF with multiple areas. The admin wants to redistribute a static route (192.168.100.0/24) into OSPF area 0. The route is configured as a static route on the FortiGate. Which configuration step is essential to ensure the static route is redistributed into OSPF?

Accepted Answer

Enable 'redistribute static' under the OSPF router configuration. The 'redistribute static' command under OSPF router configuration is the essential step to inject static routes into the OSPF domain. Without this explicit redistribution command, OSPF will not advertise any static routes, regardless of other filtering or metric settings. This is a fundamental requirement for route redistribution in OSPF.

Answer

Create a prefix list to allow the static route and apply it to the OSPF area

Answer

Set the administrative distance of the static route to 110

Answer

Configure a route map to match the static route and set OSPF type