NSE7 Advanced Networking and SD-WAN Practice Test 16 — 15 Questions

Question 1

A FortiGate administrator wants to enable load balancing for equal-cost paths to the same destination. The FortiGate has two equal-cost routes via two different next-hop routers. Which feature should the admin enable to load balance traffic across both paths?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ECMP (Equal Cost Multi-Path). ECMP (Equal Cost Multi-Path) is the correct feature because it enables a FortiGate to distribute traffic across multiple equal-cost routes to the same destination. When the routing table contains two or more routes with identical administrative distance and metric, ECMP automatically load-balances sessions across those paths using a hash-based algorithm (e.g., source-destination IP hash), without requiring additional configuration beyond enabling the feature globally or per-VDOM.

Answer

BFD (Bidirectional Forwarding Detection)

Answer

Policy-based routing

Answer

SD-WAN load balancing

Question 2

Which routing technique allows a FortiGate to forward packets based on source IP address, destination IP address, or other criteria, in addition to the destination IP alone?

Accepted Answer

Policy-Based Routing (PBR). Policy-Based Routing (PBR) allows a FortiGate to forward packets based on criteria beyond the destination IP address, such as source IP, destination port, protocol, or application. This is achieved by configuring policy routes that override the default routing table lookup, enabling granular traffic steering for advanced networking scenarios like SD-WAN.

Answer

RIP

Answer

OSPF route redistribution

Answer

ECMP

Question 3

What is the purpose of a route map when used with route redistribution on a FortiGate?

Accepted Answer

To filter or modify route attributes during redistribution. Route maps are used with route redistribution to filter which routes are redistributed and to modify route attributes (such as metric, tag, or next-hop) as they are injected from one routing protocol into another. Option D is correct because route maps provide granular control over the redistribution process, allowing administrators to match specific routes using prefix lists or ACLs and then set attributes like metric or tag before the routes are redistributed.

Answer

To create a prefix list for BGP

Answer

To define the administrative distance of redistributed routes

Answer

To enable the redistribution process

Question 4

Which load balancing algorithm in SD-WAN sends new sessions to the member interface with the least number of active sessions?

Accepted Answer

Sessions. The Sessions algorithm in Fortinet SD-WAN selects the member interface with the fewest active sessions when a new session is initiated. This is the default load-balancing method and ensures even distribution of session counts across WAN links, preventing any single interface from becoming overloaded with connections.

Answer

Volume

Answer

Spillover

Answer

Source-dest IP

Question 5

A FortiGate is configured with VRF. Which statement about VRF is true?

Accepted Answer

VRF allows multiple routing tables to coexist on the same FortiGate.. VRF (Virtual Routing and Forwarding) allows a single FortiGate to maintain multiple independent routing tables, each with its own set of interfaces, routes, and forwarding decisions. This enables network segmentation and traffic isolation without requiring separate physical devices, making option B correct.

Answer

Interfaces can belong to multiple VRFs simultaneously.

Answer

Routes from different VRFs can be automatically redistributed without configuration.

Answer

VRF can only be used when OSPF is enabled.

Question 6

What is the purpose of BFD on a FortiGate?

Accepted Answer

To provide fast detection of link failures.. BFD (Bidirectional Forwarding Detection) provides sub-second failure detection for routing protocols like OSPF and BGP, independent of the routing protocol's own hello timers. On a FortiGate, BFD is used to rapidly detect link or neighbor failures, enabling faster convergence in SD-WAN and dynamic routing scenarios.

Answer

To load balance traffic across multiple paths.

Answer

To authenticate OSPF neighbors.

Answer

To encrypt traffic between two FortiGates.

Question 7

A FortiGate with FortiExtender is using LTE as a backup WAN link. When the primary link fails, the LTE link does not take over. What could be the cause?

Accepted Answer

The LTE interface is not added as an SD-WAN member.. For an LTE interface to be used as a backup WAN link in an SD-WAN setup, it must be explicitly added as an SD-WAN member. Without this, the FortiGate will not consider the LTE interface for traffic steering or failover, even if the primary link fails. The SD-WAN rules and performance SLA are only evaluated against interfaces that are members of the SD-WAN zone.

Answer

The primary link's performance SLA is still passing.

Answer

The FortiExtender is not configured in pass-through mode.

Answer

The FortiExtender firmware is out of date.

Question 8

Which SD-WAN load balancing algorithm is best for ensuring that all traffic from a specific source-destination pair uses the same WAN link?

Accepted Answer

Source-dest IP. Source-dest IP (B) is the correct algorithm because it uses a hash of both the source and destination IP addresses to deterministically select a WAN link. This ensures that all packets belonging to the same flow (same source-destination pair) are consistently forwarded over the same link, preserving packet order and avoiding reordering issues.

Answer

Spillover

Answer

Volume

Answer

Lowest-cost

Question 9

A network administrator is configuring SD-WAN on a FortiGate. They have multiple WAN links and want to ensure that traffic for a critical application uses the link with the lowest latency. Which SD-WAN configuration component should be used to achieve this?

Accepted Answer

Performance SLA with latency threshold and SD-WAN rule using best-quality strategy. The Performance SLA monitors latency (and other metrics) against a configured threshold, and the SD-WAN rule with the 'best-quality' strategy dynamically selects the WAN link that currently has the lowest latency. This ensures the critical application traffic is steered to the optimal link based on real-time performance measurements.

Answer

SD-WAN rule with spillover load balancing

Answer

SD-WAN members with static priority

Answer

Load balancing algorithm set to lowest-cost (SLA)

Question 10

An administrator has configured BGP on a FortiGate with two upstream ISPs. They notice that traffic to a specific prefix is not load-balanced as expected; all traffic goes through ISP1 even though both paths are available. 'get router info bgp network' shows the prefix with two next hops. What is the MOST likely cause?

Accepted Answer

The BGP multi-path is disabled. BGP multi-path must be explicitly enabled to allow load balancing across multiple equal-cost paths. Even if both next hops are present in the BGP table, without the 'set multipath' or 'set multipath number' configuration under the BGP process, the FortiGate will select only the best path (lowest weight, local preference, AS-path length, etc.) and install that single route in the routing table. This is why all traffic uses ISP1 despite both paths being available.

Answer

The prefix is being learned via an IGP with a lower administrative distance

Answer

The administrative distance of BGP is higher than OSPF

Answer

The eBGP multihop is not configured

Question 11

An administrator sees the following output from 'get router info routing-table':
S       0.0.0.0/0 [10/0] via 192.168.1.1, port1
S       0.0.0.0/0 [10/0] via 192.168.2.1, port2
They have configured ECMP load balancing. However, traffic to a specific destination IP is always using port1. What is the likely reason?

Accepted Answer

The destination IP hash results in the same link for all sessions due to the load balancing algorithm. D is correct because FortiGate ECMP load balancing uses a hash-based algorithm (source-destination IP, port, or protocol) by default, not per-packet. When the hash of the destination IP consistently maps to the same link (port1), all sessions to that specific IP will use that interface, even though multiple routes exist with equal administrative distance and cost.

Answer

The firewall policy only allows traffic on port1

Answer

ECMP uses per-packet load balancing by default and the traffic is a single flow

Answer

One of the static routes has a lower administrative distance

Question 12

Which SD-WAN load balancing algorithm distributes new sessions based on the number of active sessions on each link?

Accepted Answer

Sessions. The Sessions algorithm distributes new sessions based on the current number of active sessions on each SD-WAN link. When a new session is initiated, the SD-WAN controller selects the link with the fewest active sessions, ensuring a balanced load across all available transport interfaces. This is distinct from algorithms that consider source/destination IP pairs, traffic volume, or bandwidth thresholds.

Answer

Source-dest IP

Answer

Spillover

Answer

Volume

Question 13

A FortiGate with SD-WAN configured has a Performance SLA monitoring Google DNS (8.8.8.8). The SLA is configured with latency threshold 100 ms and jitter threshold 20 ms. The link is currently meeting both thresholds. The administrator wants to ensure that if the SLA fails, traffic moves to another link. Which SD-WAN rule strategy should be used?

Accepted Answer

Failover (SLA). The Failover (SLA) strategy is correct because it ensures that traffic is moved to another link only when the Performance SLA fails, while the primary link is used as long as it meets the configured latency (100 ms) and jitter (20 ms) thresholds. This strategy provides deterministic failover behavior, matching the administrator's requirement to switch traffic only upon SLA failure.

Answer

Best quality

Answer

Manual selection

Answer

Maximize bandwidth (SLA)

Question 14

Which FortiGate feature allows the creation of multiple virtual routing tables within a single VDOM?

Accepted Answer

VRF. VRF (Virtual Routing and Forwarding) allows a single FortiGate VDOM to maintain multiple independent routing tables, each with its own forwarding decisions. This is achieved by creating separate VRF instances (identified by VRF IDs 1-255) within the same VDOM, enabling traffic isolation and overlapping IP address spaces without requiring separate VDOMs.

Answer

Policy-based routing

Answer

VDOM

Answer

ECMP

Question 15

A FortiGate administrator is integrating a FortiSwitch managed by the FortiGate. They want to configure a VLAN interface on the FortiSwitch for user traffic. Which configuration is required on the FortiGate?

Accepted Answer

Configure a VLAN on the FortiSwitch under the switch controller and assign it to a port. When integrating a FortiSwitch managed by a FortiGate, VLANs for user traffic must be created under the switch controller on the FortiGate. This allows the FortiGate to push the VLAN configuration to the FortiSwitch, including assigning the VLAN to a specific port or port group. Option B correctly describes this process, as the switch controller manages the FortiSwitch as an extension of the FortiGate, not as a standalone device.

Answer

Enable DHCP relay on the FortiSwitch VLAN

Answer

Use the config system interface to create a VLAN on the FortiGate and tag it on the trunk

Answer

Create a VLAN subinterface on the FortiGate's port that connects to the FortiSwitch