NSE7 Advanced Networking and SD-WAN Practice Test 18 — 15 Questions

Question 1

An administrator has deployed a FortiGate at a branch with two WAN links: port1 (primary) and port2 (backup). They create an SD-WAN zone and a performance SLA named 'ISP-Health' that monitors 8.8.8.8 using ping. The SLA is configured with link-cost-factor latency and a threshold of 50 ms. After a week, they notice that the primary link is still being used for all traffic even though its latency frequently exceeds 150 ms. The backup link has 20 ms latency. What is the most likely reason the SD-WAN rule is not failing over?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The performance SLA is not referenced in the SD-WAN rule, so the rule cannot use the SLA status to make decisions.. The SD-WAN rule must explicitly reference the performance SLA for the FortiGate to use SLA results in path selection. Without that association, the rule falls back to static criteria such as interface priority or link cost, so the primary link continues to be used even when its latency exceeds the threshold. The administrator needs to edit the rule and select the SLA as a target.

Answer

The SD-WAN rule is using the 'lowest-cost' algorithm, which ignores SLA status and only uses link cost.

Answer

The SLA monitor uses ping, which is not supported for latency measurement; only HTTP and TCP echo are valid.

Answer

The link-cost-factor is set to latency, but the backup link must also have an SLA configured to be eligible for failover.

Question 2

An administrator has deployed a FortiGate at a branch with two WAN links: port1 (primary) and port2 (backup). They create an SD-WAN zone and a performance SLA named 'ISP-Health' that monitors 8.8.8.8 using ping. The SLA is configured with link-cost-factor latency and a threshold of 50 ms. After a week, they notice that the primary link is still being used for all traffic even though its latency frequently exceeds 150 ms. The backup link has 20 ms latency. What is the most likely reason the SD-WAN rule is not failing over?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure ADVPN on the hub and spokes, and enable 'set auto-discovery' on the IPsec phase1-interface.. ADVPN enables dynamic spoke-to-spoke tunnels through a hub, allowing traffic to initially flow via the hub and then directly between spokes. Enabling auto-discovery on the IPsec phase1-interface is the key step to activate this behavior. Other options either preserve sessions, add static routes without dynamic tunneling, or configure routing protocols that do not create the necessary overlay shortcuts.

Answer

Enable 'set preserve-session-route' on the hub's SD-WAN zone.

Answer

Enable 'set exchange-interface-ip' on the hub's IPsec tunnels and configure BGP with route reflection.

Answer

Create a static route on each spoke pointing to the hub for all remote spoke subnets.

Question 3

An administrator is troubleshooting an SD-WAN rule that is not matching traffic as expected. The rule is configured with a source address of 'all', destination '10.0.0.0/24', and service 'HTTP'. The rule is placed after a rule that matches all traffic to '10.0.0.0/24' with service 'ALL'. The administrator notices that HTTP traffic to 10.0.0.0/24 is being handled by the first rule. What is the most likely cause?

Accepted Answer

SD-WAN rules are evaluated in order, and the first matching rule is applied. The rule with service 'ALL' matches HTTP traffic, so it takes precedence.. SD-WAN rules are processed in the order they are listed, and the first rule that matches the traffic is used. In this case, the rule with service 'ALL' matches HTTP traffic before the HTTP-specific rule is evaluated. The solution is to move the HTTP rule above the generic rule.

Answer

The SD-WAN rule with service 'ALL' has a higher priority value, which overrides the order of rules.

Answer

The HTTP rule is not matching because the service 'HTTP' is not defined in the SD-WAN rule; the administrator must use 'ALL' for web traffic.

Answer

SD-WAN rules are evaluated based on the most specific match, so the HTTP rule should take precedence regardless of order.

Question 4

A FortiGate is configured with two VRF instances: VRF10 (for a customer) and VRF20 (for another customer). Each VRF has its own interfaces and routing table. The administrator wants to allow a specific server in VRF10 (10.10.10.5) to be reachable from a host in VRF20 (20.20.20.5) without leaking all routes between VRFs. Which FortiGate feature should be used to achieve this?

Accepted Answer

An inter-VRF link using a pair of interfaces, one in each VRF, with a firewall policy allowing the specific traffic.. Inter-VRF routing on FortiGate is achieved by creating a link between VRFs using a pair of interfaces, each assigned to a different VRF. A firewall policy then controls what traffic can traverse that link. This allows selective reachability, such as permitting only one server, without leaking all routes between the VRFs. The other options either do not provide the necessary routing or lack the granular control required.

Answer

A firewall policy with source VRF10 and destination VRF20, using NAT to translate the server IP.

Answer

A static route in VRF20 pointing to 10.10.10.5/32 with the next-hop being the VRF10 interface gateway.

Answer

Inter-VRF routing using a route leaking policy with a route-map.

Question 5

An administrator has configured an SD-WAN zone named 'virtual-wan' containing two members: port1 and port2. They want to apply different SD-WAN rules based on the destination IP address. Which FortiGate configuration object should they use to define the destination IP address for matching traffic in an SD-WAN rule?

Accepted Answer

Address object referenced in the SD-WAN rule's destination field. SD-WAN rules on FortiGate use firewall address objects to define destination criteria. These objects can represent IP subnets, FQDNs, or geographic locations. When configuring an SD-WAN rule, the destination field expects an address object, which is then used to match traffic. This allows flexible and granular control over which traffic is routed through which SD-WAN member.

Answer

Policy route with destination address and outgoing interface

Answer

Internet Service Database (ISDB) entry selected in the SD-WAN rule

Answer

Application control signature referenced in the SD-WAN rule

Question 6

An administrator wants to verify which SD-WAN member is currently being used for a specific traffic flow. Which command should they use on the FortiGate?

Accepted Answer

diagnose sys sdwan session. The command 'diagnose sys sdwan session' shows active sessions that are being processed by SD-WAN rules, including the chosen member. It is the most direct way to verify which SD-WAN member is used for a specific flow.

Answer

diagnose sys sdwan health-check

Answer

diagnose sys session list

Answer

diagnose sys sdwan member

Question 7

An administrator is configuring an SD-WAN rule to route traffic to a specific destination through a preferred member, but wants to ensure that if that member fails, traffic automatically switches to another member. Which SD-WAN rule configuration setting should they use to define the order of member preference?

Accepted Answer

Member sequence in the SD-WAN rule. To define a preferred order of members for failover in an SD-WAN rule, the administrator should list the members in the desired sequence within the rule configuration. The FortiGate will use the first available member according to that order when the strategy is 'manual' or when failover is triggered. This ensures deterministic behavior.

Answer

SLA target

Answer

Load balancing algorithm

Answer

Priority

Question 8

An administrator is configuring an SD-WAN rule to route VoIP traffic over the most reliable link. The performance SLA monitors latency, jitter, and packet loss. The administrator wants the rule to select the member with the lowest jitter that also meets the SLA thresholds. Which SD-WAN strategy should be used?

Accepted Answer

lowest-jitter (SLA). For VoIP, jitter is a critical metric. The lowest-jitter (SLA) strategy chooses the member with the lowest jitter among those passing the SLA. Other strategies focus on cost, bandwidth, or latency, which do not directly address the need for minimal jitter.

Answer

maximize-bandwidth (SLA)

Answer

lowest-latency (SLA)

Answer

lowest-cost (SLA)

Question 9

An administrator has an SD-WAN deployment with two members, port1 (primary, low latency) and port2 (secondary, high latency). A performance SLA is configured using a ping probe to 8.8.8.8 with a 100 ms latency threshold. The SLA status for port1 is 'alive' and for port2 is 'dead'. The administrator creates an SD-WAN rule with the 'SLA' strategy that includes both members. They expect traffic to use port1 and, if it fails, port2. However, after applying the rule, all traffic is still going out port1 and never uses port2. What is the cause of this behavior?

Accepted Answer

The SD-WAN rule's 'SLA' strategy only uses members that meet the SLA; since port2 is 'dead', it is excluded, and port1 is used exclusively as long as it meets SLA.. The 'SLA' strategy in an SD-WAN rule prioritizes members that meet the performance SLA. When at least one member meets the SLA, only those members are used. A member with a 'dead' SLA status is excluded from selection unless all members are dead, in which case the rule falls back to the best available member. In this scenario, port1 meets the SLA, so it is used exclusively, and port2 is not used. The administrator's expectation of immediate fallback is a misunderstanding of the strategy's behavior.

Answer

The performance SLA probe target 8.8.8.8 is unreachable from port2, causing the SLA to be 'dead' and thus port2 is excluded from the rule.

Answer

The SD-WAN rule is missing the 'load-balance' setting; by default, it uses only the first member in the list.

Answer

The SD-WAN rule must include a manual order of members; the 'SLA' strategy does not automatically fall back to a member with 'dead' SLA status.

Question 10

An administrator has configured a FortiGate with two VRF instances: VRF10 and VRF20. They need to allow a server in VRF10 (10.10.10.0/24) to communicate with a server in VRF20 (10.20.20.0/24). The administrator creates a firewall policy with source interface VRF10 and destination interface VRF20, but traffic is not passing. What is the most likely cause?

Accepted Answer

VRF instances are isolated by default; inter-VRF traffic requires a static route or policy route to leak routes between VRFs.. FortiGate VRF instances have separate routing tables. To allow traffic between them, the administrator must configure route leaking, typically by adding a static route in each VRF that points to the other VRF's interface or using policy routes. Without these routes, the FortiGate will drop packets even if a firewall policy permits them, because it cannot determine the next hop for the destination network.

Answer

The firewall policy must have 'match-vip' enabled to allow traffic between different VRFs.

Answer

Inter-VRF traffic is only supported when using VXLAN tunnels between the VRFs.

Answer

VRF instances require the use of 'set vrf' in the firewall policy to specify the source and destination VRFs.

Question 11

A FortiGate is configured with two SD-WAN members: port1 and port2. The administrator wants to ensure that voice traffic uses port1, but if port1's latency exceeds 150 ms, voice traffic should fail over to port2. Which configuration is required to achieve this?

Accepted Answer

Create an SD-WAN rule with the 'Application' criteria for voice, set the outgoing interface to port1 and port2, and configure a performance SLA with latency threshold 150 ms on both members.. To achieve automatic failover based on latency, the SD-WAN rule must include both members as possible outgoing interfaces, and a performance SLA must be configured to monitor latency on both. If the preferred member exceeds the threshold, it is marked out of SLA, and the rule selects the next best member.

Answer

Create an SD-WAN rule with the 'Application' criteria for voice, set the outgoing interface to port1, and enable 'SLA target' with a latency threshold of 150 ms on port1.

Answer

Create two SD-WAN rules: one for port1 with a latency threshold of 150 ms, and one for port2 with a higher priority. Voice traffic will automatically use port1 and fail over to port2.

Answer

Create an SD-WAN rule with the 'Application' criteria for voice, set the outgoing interface to port1, and configure a performance SLA with latency threshold 150 ms on port1 only.

Question 12

An administrator is configuring an SD-WAN rule to distribute traffic across two WAN links based on the number of active sessions. They want to ensure that new sessions are assigned to the link with the fewest current sessions. Which load balancing algorithm should they use?

Accepted Answer

Session count. The 'session count' load balancing algorithm selects the WAN member with the fewest active sessions for each new session. This directly achieves the administrator's goal of distributing traffic based on the number of active sessions, ensuring balanced utilization of the links. Other algorithms like source IP, volume, or round robin do not specifically target session count.

Answer

Source IP

Answer

Round robin

Answer

Volume

Question 13

An administrator is configuring an SD-WAN rule to route VoIP traffic over the most reliable link. They have two WAN members: port1 (MPLS) and port2 (Internet). They create a performance SLA that monitors latency and jitter, and set the SLA target to 150 ms latency and 30 ms jitter. They apply the SLA to both members. The SD-WAN rule is set to 'Best Quality' strategy. After applying the configuration, they notice that VoIP traffic is sometimes routed over port2 even though port1 has lower latency and jitter. What is the most likely reason?

Accepted Answer

Port1 is intermittently failing the SLA due to jitter spikes, causing the FortiGate to temporarily select port2 until port1 meets the SLA again.. With the 'Best Quality' strategy, the FortiGate continuously evaluates member health against the SLA. If port1 experiences jitter spikes that exceed the configured threshold, it is considered to have failed the SLA, and the rule will select the next best member, which is port2. This can cause VoIP traffic to temporarily switch to port2. Once port1's jitter returns below the threshold, it will be preferred again. This behavior ensures that traffic only uses links that meet the required quality.

Answer

The performance SLA is not enabled on the SD-WAN rule, so the FortiGate falls back to a default load balancing method.

Answer

The 'Best Quality' strategy selects the member with the lowest cost, not the best quality, so port2 is chosen because it has a lower cost.

Answer

The SD-WAN rule is configured with a source IP-based load balancing method, which overrides the 'Best Quality' strategy.

Question 14

An administrator is configuring a FortiGate for SD-WAN and wants to ensure that outgoing traffic from the internal network is distributed across two WAN links based on the number of active sessions. Which SD-WAN load balancing algorithm should be used?

Accepted Answer

Session count. The 'session count' SD-WAN algorithm selects the member with the fewest active sessions, which directly load balances based on session count. Other algorithms like source IP, volume, or weighted round robin use different criteria such as source address, data volume, or static weights, and do not dynamically balance based on the number of active sessions. Therefore, 'session count' is the correct choice.

Answer

Weighted round robin

Answer

Source IP based

Answer

Volume

Question 15

A FortiGate is configured with two SD-WAN members: port1 and port2, both with the same cost. An SD-WAN rule is set to use the 'lowest-cost (SLA)' strategy. The administrator observes that all traffic is going out port1, even though port2 is also within SLA. What is the most likely reason?

Accepted Answer

Port2 is administratively down or has no active route, so it is excluded from the SD-WAN rule.. In lowest-cost (SLA), traffic is distributed among members with the lowest cost that meet SLA. If port2 is down or has no route, it is removed from consideration, leaving port1 as the only viable member. Equal costs alone do not guarantee load sharing; operational status and routing must be valid.

Answer

Port2 is configured with a higher link priority value, causing it to be preferred over port1.

Answer

The 'lowest-cost (SLA)' strategy always selects the first member in the list when costs are equal.

Answer

The SD-WAN rule is configured with 'set gateway enable', which forces traffic through the first member.