NSE7 Advanced Networking and SD-WAN Practice Test 17 — 15 Questions

Question 1

A FortiGate is configured with BGP and OSPF. The administrator wants to ensure that routes learned via BGP are redistributed into OSPF, but only specific prefixes. Which three components are needed? (Select THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A route map that references the prefix list and sets OSPF parameters. Option D is correct because a prefix list is the mechanism used to match the specific BGP-learned prefixes that should be redistributed into OSPF, allowing granular control over which networks are permitted. Option A is correct because a route map is required to reference that prefix list and apply the desired OSPF parameters (such as metric, metric-type, or tag) to the redistributed routes. Option B is correct because redistribution must be configured under the OSPF routing process with the route map applied, for example using 'config redistribute bgp' and 'set route-map <name>' under 'config router ospf', so that only the matched BGP routes are injected into OSPF. Option C is not needed because a VRF is only required to separate routing tables in multi-tenant or overlapping-address scenarios, not for basic route redistribution between BGP and OSPF. Option E is not needed because a distribute list filters OSPF routes being received or advertised within OSPF, not BGP routes being redistributed into OSPF.

Answer

A VRF to separate the routing tables

Answer

A distribute list in OSPF to filter incoming routes

Question 2

A network admin needs to configure a FortiGate to load balance traffic across two ISP links using SD-WAN. The requirement is to use both links simultaneously for different sessions based on source-destination IP hash. Which two settings are required? (Select TWO.)

Accepted Answer

Create an SD-WAN zone with both WAN members. Option A is correct because SD-WAN load balancing requires the WAN interfaces to be grouped into an SD-WAN zone, which serves as the logical interface containing both ISP members that traffic can be distributed across. Option B is correct because the requirement explicitly states sessions must be distributed based on a source-destination IP hash, and the SD-WAN rule's load-balance algorithm must be set to 'source-dest-ip-hash' to achieve per-session hashing across both links simultaneously. Option C is not required because a performance SLA is only needed for quality-based or SLA-driven steering, not for pure hash-based load balancing. Option D is incorrect because the 'best quality' strategy selects a single best link based on SLA metrics rather than distributing sessions across both links. Option E is incorrect because spillover is a strategy used to send traffic to a secondary link only when the primary exceeds a threshold, which does not satisfy the requirement of using both links simultaneously for different sessions.

Answer

Add a performance SLA for each member

Answer

Set the rule strategy to 'best quality'

Answer

Enable 'spillover' under the SD-WAN rule

Question 3

An administrator wants to use a FortiGate to manage FortiSwitch units via the LAN. Which interface configuration is required on the FortiGate to allow this management?

Accepted Answer

The interface must have 'set type switch' enabled. The interface must have 'set type switch' enabled to manage FortiSwitch units. This configuration sets the interface as a FortiLink port, enabling automatic discovery, provisioning, and management of FortiSwitch devices. Trunk mode is not required; in fact, setting the interface as a trunk (set mode trunk) is for aggregating multiple ports or carrying multiple VLANs but does not enable FortiLink control protocols. Therefore, option D is correct.

Answer

The interface must have 'set role lan' configured

Answer

The interface must be configured as a 'trunk' mode to connect to the FortiSwitch

Answer

The interface must be a member of a VDOM

Question 4

An administrator configures SD-WAN with two members (wan1, wan2) and a performance SLA for ICMP to 1.1.1.1. The SD-WAN rule is set to 'Best Quality' with 'latency' metric. The admin notices that traffic sometimes switches to the other link even when the current link has acceptable latency. Which action can reduce unnecessary flapping?

Accepted Answer

Configure a hysteresis value for the SLA. Configuring a hysteresis value for the SLA introduces a buffer or deadband around the latency threshold. This prevents the SD-WAN from switching links when latency fluctuates slightly above and below the threshold, which is the root cause of flapping. Without hysteresis, even a minor transient spike in latency can trigger a switch, even if the link's overall performance is acceptable.

Answer

Increase the SLA probe interval

Answer

Use 'manual' strategy instead

Answer

Increase the 'update-cascade-interface' setting

Question 5

A FortiGate is configured with multiple virtual routers (VRFs). The administrator wants to allow communication between two VRFs using a firewall policy. Which type of interface is required for the policy?

Accepted Answer

VDOM link. A VDOM link is a virtual interface that connects two VDOMs (Virtual Domains) and inherently supports routing between different VRFs (Virtual Routing and Forwarding instances) within a FortiGate. When a firewall policy is applied to a VDOM link, it can control traffic flowing between the two VRFs, as the link itself is a Layer 3 interface that belongs to both VDOMs and can be assigned to different VRFs on each side. This is the only interface type that natively allows inter-VRF communication with firewall policy enforcement.

Answer

VLAN subinterface

Answer

Loopback interface

Answer

Virtual-wire pair

Question 6

A FortiGate is configured with OSPF and BGP. The administrator wants to redistribute OSPF routes into BGP. Which TWO steps are required?

Accepted Answer

Use the 'redistribute ospf' command under the BGP configuration. The 'redistribute ospf' command under BGP configuration is the explicit method to inject OSPF-learned routes into the BGP table. This command triggers the redistribution process, allowing OSPF routes to be advertised to BGP peers.

Answer

Configure a route map to filter the routes being redistributed

Answer

Set the BGP table version to 2

Answer

Disable OSPF on the interface

Question 7

A FortiGate is configured with two SD-WAN members (port1 and port2). The administrator sets an SD-WAN rule with 'set load-balance-mode source-dst-ip' for all internal traffic. The source IP is 10.0.0.1 and destination IP is 172.16.0.1. Which factor determines the outgoing interface for this traffic?

Accepted Answer

The combination of source IP and destination IP hashed to select an interface. With 'set load-balance-mode source-dst-ip', the FortiGate performs a hash of both the source IP and destination IP to deterministically select an outgoing SD-WAN member. This ensures that all packets belonging to the same source-destination pair are consistently forwarded over the same interface, preserving flow symmetry without relying on per-packet metrics.

Answer

The destination IP only

Answer

The source IP only

Answer

The interface with the lowest current utilization

Question 8

An administrator wants to load balance traffic across two WAN links by session count. Which SD-WAN load balancing algorithm should they use?

Accepted Answer

Sessions. The Sessions algorithm distributes new sessions across WAN links based on the current session count, ensuring each link handles a roughly equal number of active sessions. This directly matches the administrator's requirement to load balance by session count, as it uses the session counter as the metric for link selection.

Answer

Spillover

Answer

Lowest-cost

Answer

Volume

Question 9

A FortiGate with SD-WAN has two members: MPLS (port1) and Broadband (port2). The performance SLA is configured to monitor latency and packet loss. The administrator notices that after a brief outage on the MPLS link, traffic fails over to Broadband but does not fail back when MPLS recovers. What is the likely cause?

Accepted Answer

The SD-WAN rule for the traffic has 'set failback disable'.. The 'set failback disable' command in the SD-WAN rule prevents traffic from automatically returning to the preferred MPLS link after it recovers. By default, failback is enabled, meaning traffic will revert to the higher-priority member once the performance SLA is satisfied again. When disabled, the FortiGate keeps traffic on the backup link indefinitely, which matches the described behavior.

Answer

The SLA threshold is set too aggressively, causing the link to be considered down long after recovery.

Answer

The Broadband link has a higher cost, so the FortiGate prefers to keep traffic there.

Answer

The SLA probe interval is longer than the outage duration, so the SLA never detected the outage.

Question 10

A FortiGate is configured with ECMP load balancing for equal-cost routes. The administrator wants to ensure that all traffic from a specific source IP uses the same next hop. Which ECMP load balancing method should be selected?

Accepted Answer

Source-IP-based. Source-IP-based ECMP load balancing ensures that all packets from a specific source IP address are forwarded to the same next hop by hashing only the source IP field. This maintains session consistency for traffic originating from a single host, which is critical for stateful inspection and applications that require symmetric routing.

Answer

Destination-IP-based

Answer

Weighted random

Answer

Round-robin

Question 11

An administrator is integrating a FortiExtender with a FortiGate. The FortiExtender is connected to port5 and configured with a cellular WAN connection. What must be configured on the FortiGate to allow the FortiExtender to provide WAN connectivity as an SD-WAN member?

Accepted Answer

Enable the 'fortiextender' option on port5 and configure the FortiExtender as an SD-WAN member using the virtual wan interface.. To integrate a FortiExtender as an SD-WAN member, the FortiGate must enable the 'fortiextender' option on the physical port (port5) to which the FortiExtender is connected. This creates a virtual wan interface that represents the FortiExtender's cellular WAN connection, allowing it to be added as an SD-WAN member for load balancing and failover policies. No static route or SIM card configuration is needed on the FortiGate, as the FortiExtender handles cellular authentication and routing internally.

Answer

Create a static route to the FortiExtender's management IP to use it as a gateway.

Answer

Configure port5 as a physical member and assign the FortiExtender's SIM card details.

Answer

Use the FortiExtender as a standalone router and configure policy-based routing on the FortiGate.

Question 12

Which routing protocol is commonly used in SD-WAN deployments to exchange routes between FortiGate and the provider edge router in an MPLS network?

Accepted Answer

BGP. BGP is the correct answer because it is the standard exterior gateway protocol used in MPLS Layer 3 VPNs to exchange customer routes between a FortiGate (CE router) and the provider edge (PE) router. BGP supports advanced features like route filtering, load balancing, and traffic engineering, which are essential for SD-WAN overlay integration with MPLS underlay networks.

Answer

RIP

Answer

IS-IS

Answer

OSPF

Question 13

An administrator configures a prefix list to filter routes received from a BGP neighbor. The prefix list permits 192.168.0.0/16 le 24. Which routes are permitted?

Accepted Answer

Any route with prefix length between 16 and 24 inclusive, starting with 192.168. The prefix list `192.168.0.0/16 le 24` permits any route that matches the prefix `192.168.0.0/16` and has a prefix length between 16 and 24 inclusive. The `le` (less-than-or-equal-to) operator sets the maximum prefix length, so routes with lengths 16, 17, 18, 19, 20, 21, 22, 23, and 24 are all allowed, as long as they fall within the 192.168.0.0/16 network.

Answer

Only routes with prefix length exactly 16 within 192.168.0.0/16

Answer

Only routes with prefix length exactly 24 within 192.168.0.0/16

Answer

Any route with prefix length greater than 24 within 192.168.0.0/16

Question 14

A FortiGate administrator wants to use BFD to quickly detect link failures in an SD-WAN deployment. Which statement about BFD configuration on FortiGate is correct?

Accepted Answer

BFD can be configured under the interface or routing protocol to detect forwarding path failures. BFD (Bidirectional Forwarding Detection) on FortiGate can be configured either directly on an interface or under a dynamic routing protocol (such as OSPF or BGP). When configured under the interface, BFD monitors the forwarding path to that specific neighbor; when configured under the routing protocol, it provides sub-second failure detection for routes learned via that protocol. This flexibility allows the administrator to tailor BFD to the SD-WAN deployment's needs, ensuring rapid link failure detection without relying on routing protocol timers.

Answer

BFD is enabled by default on all FortiGate interfaces

Answer

BFD sessions are established automatically when OSPF neighbors form

Answer

BFD uses performance SLA probes to determine link health

Question 15

A FortiGate is configured with two WAN interfaces in an SD-WAN zone. The administrator wants to ensure that Voice over IP (VoIP) traffic uses the link with the lowest latency, while all other traffic uses the link with the highest available bandwidth. The performance SLA 'VoIP_SLA' monitors latency to a VoIP provider. Which SD-WAN configuration should the administrator implement to meet these requirements?

Accepted Answer

Create an SD-WAN rule with the 'lowest-latency' algorithm, referencing the VoIP_SLA, and apply it to VoIP traffic; create a second rule with the 'maximize-bandwidth' algorithm for all other traffic.. The correct configuration uses an SD-WAN rule with the 'lowest-latency' algorithm for VoIP traffic, which selects the WAN member with the lowest latency as measured by the performance SLA. For all other traffic, a rule with the 'maximize-bandwidth' algorithm selects the member with the highest available bandwidth. This combination satisfies both requirements.

Answer

Create an SD-WAN rule with the 'lowest-latency' algorithm, referencing the VoIP_SLA, and apply it to VoIP traffic; create a second rule with the 'lowest-cost' algorithm for all other traffic.

Answer

Create an SD-WAN rule with the 'lowest-cost' algorithm, referencing the VoIP_SLA, and apply it to VoIP traffic; create a second rule with the 'maximize-bandwidth' algorithm for all other traffic.

Answer

Create an SD-WAN rule with the 'lowest-jitter' algorithm, referencing the VoIP_SLA, and apply it to VoIP traffic; create a second rule with the 'maximize-bandwidth' algorithm for all other traffic.