NSE7 Advanced Networking and SD-WAN Practice Test 19 — 15 Questions

Question 1

A FortiGate is configured with two VRF instances: VRF10 (for the finance department) and VRF20 (for the engineering department). Each VRF has its own routing table and interfaces. The administrator needs to allow a server in VRF10 (10.10.10.10) to communicate with a server in VRF20 (10.20.20.20). The administrator has already configured the necessary firewall policies to allow the traffic. However, pings from 10.10.10.10 to 10.20.20.20 fail. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VRFs are isolated by default; inter-VRF routing requires configuring route leaking or a VRF-to-VRF link.. VRF instances provide isolated routing tables. By default, traffic cannot flow between them. To enable communication, the administrator must configure route leaking, which allows routes from one VRF to be imported into another. This is typically done using BGP with route targets or static route leaking commands. Firewall policies alone are insufficient because the FortiGate lacks a route to the destination network in the other VRF. Therefore, the missing configuration is route leaking or a VRF-to-VRF link.

Answer

The FortiGate requires a static route in the global routing table to route traffic between VRFs.

Answer

The FortiGate does not support inter-VRF routing; a separate physical interface is required to connect the VRFs.

Answer

The firewall policies must be configured with the 'set vrf' option to specify the source and destination VRFs.

Question 2

An administrator needs to configure an SD-WAN rule that routes traffic from the guest VLAN to the Internet using the most cost-effective link. The SD-WAN zone contains three members: port1 (MPLS, cost 10), port2 (Broadband, cost 5), and port3 (LTE, cost 20). All members meet the performance SLA. Which load balancing algorithm should be used to ensure traffic uses the lowest-cost link?

Accepted Answer

Lowest Cost. The 'Lowest Cost' strategy is designed to select the member with the lowest cost that meets the SLA. In this scenario, port2 has the lowest cost, so it will be chosen as long as it meets the SLA. This ensures that guest traffic uses the most cost-effective link while still maintaining acceptable performance. The other strategies do not prioritize cost and would not meet the requirement.

Answer

Best Quality

Answer

Source IP

Answer

Volume

Question 3

An administrator has configured an SD-WAN zone named 'virtual-wan-link' with two members: port1 (WAN1) and port2 (WAN2). A performance SLA named 'SLA1' is created and assigned to the zone. The administrator wants to ensure that SD-WAN rules use the SLA results to select the best member. Which statement correctly describes how the FortiGate uses the performance SLA results in SD-WAN rule selection?

Accepted Answer

The FortiGate uses the SLA status to mark members as 'alive' or 'dead' and only selects members that are 'alive' when the rule's strategy is 'SLA' or when the rule is configured to use SLA information.. When a performance SLA is assigned to an SD-WAN zone, the FortiGate actively probes the members. If a member fails to meet the SLA thresholds, it is marked as dead. SD-WAN rules that are configured to use SLA information will then avoid that member, ensuring traffic is sent over a link that meets the required performance criteria. This is a core feature of Fortinet SD-WAN.

Answer

The performance SLA results are used only for monitoring and logging; SD-WAN rules do not consider them.

Answer

The FortiGate uses the SLA results to automatically adjust the link cost of each member, which then influences routing decisions.

Answer

The performance SLA results are used only for load balancing algorithms like 'source-ip-based' and 'session-based'.

Question 4

An administrator is troubleshooting an SD-WAN deployment where traffic is not being forwarded according to the configured SD-WAN rules. The FortiGate has two WAN interfaces, port1 and port2, both members of an SD-WAN zone. A performance SLA is configured and both members are within SLA. The administrator suspects that the SD-WAN rules are not being evaluated correctly. Which two statements about SD-WAN rule evaluation are correct? (Choose two.)

Accepted Answer

SD-WAN rules are evaluated in the order they appear in the configuration, and the first matching rule is applied.. SD-WAN rules are evaluated in a top-down order, and the first matching rule determines the path selection. They can match on various criteria, including applications identified by application control. If no rule matches, the FortiGate uses the regular routing table. SD-WAN rules are part of the routing decision and are evaluated before firewall policies. They are not limited to outbound traffic; they can apply to any traffic that matches the criteria.

Answer

If no SD-WAN rule matches, traffic is dropped by default.

Answer

SD-WAN rules are evaluated only after a firewall policy has allowed the traffic.

Answer

SD-WAN rules are applied only to outbound traffic initiated from the internal network.

Question 5

An administrator is configuring an SD-WAN rule to prefer a specific overlay tunnel for VoIP traffic. The rule uses the 'SLA' strategy with a performance SLA that measures jitter and latency. After applying the rule, the administrator notices that VoIP traffic is still being routed over a different member that does not meet the SLA. What is the most likely cause?

Accepted Answer

The performance SLA is not assigned to the SD-WAN rule, so the rule cannot use SLA status for member selection.. An SD-WAN rule with the SLA strategy must explicitly reference a performance SLA to use its measurements for member selection. If the SLA is not linked, the rule cannot determine which members meet the SLA and may fall back to other criteria, causing traffic to use a non-compliant member. Ensuring the correct SLA is attached to the rule resolves the issue.

Answer

The SD-WAN rule is placed below a static route in the routing table, so it is not evaluated.

Answer

The performance SLA is configured with the wrong protocol; it must use HTTP to measure jitter and latency.

Answer

The SD-WAN rule is configured with the 'load-balance' strategy instead of 'SLA', so it does not consider SLA status.

Question 6

An administrator is configuring an SD-WAN rule to load balance traffic across two WAN links based on the source IP address of the traffic. Which load balancing algorithm should be used to achieve this?

Accepted Answer

Source IP-based. The source IP-based algorithm is designed to distribute traffic across SD-WAN members based on the source IP address. This ensures that all sessions from a particular source IP are consistently routed through the same member, which can be important for applications that require session persistence. It is one of the available load balancing algorithms in FortiOS SD-WAN.

Answer

Volume-based

Answer

Session-based

Answer

Spoiled-weighted round robin

Question 7

An administrator has configured a FortiGate with an SD-WAN zone named 'virtual-wan-link' containing two members: port1 (WAN1) and port2 (WAN2). A performance SLA named 'CriticalSLA' monitors a server at 8.8.8.8 using ICMP probes every 5 seconds, with failure thresholds: latency 200 ms, jitter 50 ms, packet loss 5%. The SLA status for port1 is 'alive' and for port2 is 'dead'. An SD-WAN rule is configured to use the 'lowest-cost' algorithm with the SLA target 'CriticalSLA'. The administrator notices that all traffic is being routed through port1, even though port2 has a lower cost metric. What is the most likely reason for this behavior?

Accepted Answer

The SD-WAN rule is configured with the 'lowest-cost' algorithm, which only selects members that meet the SLA target; port2 is excluded because it is dead.. The lowest-cost algorithm selects the member with the lowest cost among those that meet the SLA target. Since port2 is dead, it is excluded from selection, leaving port1 as the only eligible member. This ensures traffic only uses links that meet the performance requirements. The cost metric is only considered after filtering by SLA status.

Answer

The performance SLA is using ICMP probes, which are not supported for SLA monitoring; the FortiGate falls back to using only port1.

Answer

The SD-WAN rule is missing a priority configuration; without priority, the FortiGate defaults to using the first member in the zone.

Answer

The 'lowest-cost' algorithm only considers the configured cost of each member, and port2 has a higher cost than port1.

Question 8

An administrator is configuring an SD-WAN rule to route VoIP traffic (identified by application 'VoIP') over the best available link. The SD-WAN zone 'virtual-wan-link' contains three members: port1 (cost 10), port2 (cost 20), and port3 (cost 30). A performance SLA named 'VoIP-SLA' is applied to the rule, monitoring latency, jitter, and packet loss. The administrator wants the rule to select the member with the lowest latency that meets the SLA. Which SD-WAN algorithm should be used?

Accepted Answer

Lowest Latency (SLA). The Lowest Latency (SLA) algorithm is designed to select the member with the lowest measured latency among those that meet the SLA. This is ideal for latency-sensitive applications like VoIP. Other algorithms focus on cost, bandwidth, or static assignment, none of which prioritize latency as the selection metric.

Answer

Maximize Bandwidth (SLA)

Answer

Source IP

Answer

Lowest Cost (SLA)

Question 9

A FortiGate is configured with two SD-WAN members: port1 (WAN1) and port2 (WAN2). An SD-WAN rule routes traffic from the internal subnet 10.0.1.0/24 to the internet using the 'volume' load-balancing algorithm. The rule is configured with a volume ratio of 70:30 for port1:port2. After some time, the administrator notices that port1 is handling approximately 90% of the traffic volume, while port2 handles only 10%. What is the most likely cause of this imbalance?

Accepted Answer

The volume algorithm may not achieve the exact ratio if there are long-lived sessions that are not re-evaluated; existing sessions remain on their original member, causing an imbalance over time.. The volume algorithm aims to distribute traffic volume according to the configured ratio, but it does not rebalance existing sessions. Long-lived sessions can cause a persistent imbalance because they remain on their original member. The algorithm only affects new session assignments, so if a few large flows are pinned to one member, the overall volume can deviate from the target ratio.

Answer

The volume algorithm uses the configured volume ratio only when both members are alive and meet the SLA; if port2 is dead, all traffic goes to port1.

Answer

The volume algorithm distributes traffic based on the configured ratio, but the ratio is applied to the number of sessions, not the volume of data.

Answer

The volume algorithm uses the configured ratio only as a target, but it also considers the current bandwidth usage; if port1 has higher bandwidth, it may receive more traffic.

Question 10

An administrator is configuring an SD-WAN rule to load balance traffic across two WAN links. The administrator wants to distribute traffic based on the source IP address to ensure that each source uses a consistent path. Which load balancing algorithm should be used?

Accepted Answer

Source IP. The 'source-ip' load balancing algorithm uses a hash of the source IP address to select an SD-WAN member. This ensures that all traffic from a specific source IP consistently uses the same WAN link, providing session persistence. This meets the administrator's requirement to distribute traffic based on source IP and maintain consistent paths.

Answer

Weighted round robin

Answer

Lowest cost (SLA)

Answer

Volume

Question 11

A network administrator is troubleshooting an SD-WAN setup where a specific application is not using the intended overlay tunnel. The SD-WAN rule is configured with a destination of 'all' and a source of 'all', and the strategy is set to 'manual' with the overlay tunnel as the preferred member. However, traffic is still going out via the underlay. What is the most likely reason?

Accepted Answer

The overlay tunnel member is down or not meeting the SLA, so the rule falls back to the underlay.. When an SD-WAN rule uses a manual strategy with a preferred member, the FortiGate will use that member if it is available and healthy. If the member is down or fails its SLA, the rule will fall back to other members, such as the underlay. Thus, the most likely reason for traffic using the underlay is that the overlay member is not available or not meeting the SLA.

Answer

The 'manual' strategy requires a gateway to be specified for the preferred member.

Answer

The SD-WAN rule is placed below a static route that directs traffic to the underlay.

Answer

The SD-WAN rule is missing a matching service or application, so it does not match the traffic.

Question 12

An administrator is configuring an SD-WAN rule on a FortiGate. They want to load balance traffic across three WAN links based on the volume of traffic sent. Which load balancing algorithm should they use?

Accepted Answer

Volume. The volume load balancing algorithm in SD-WAN distributes traffic based on the measured volume of data sent through each link. It dynamically selects the link with the least volume, ensuring that the total traffic is balanced across available links. This is the only algorithm among the options that directly uses traffic volume as the metric, making it the correct choice for the scenario.

Answer

Source IP

Answer

Session count

Answer

Weighted round robin

Question 13

An administrator is configuring an SD-WAN rule that uses the 'volume' load balancing algorithm. The rule includes two members: port1 with a volume ratio of 3, and port2 with a volume ratio of 1. Which two statements correctly describe how the FortiGate will distribute sessions? (Choose two.)

Accepted Answer

The FortiGate will send approximately 75% of sessions to port1 and 25% to port2.. The volume load balancing algorithm distributes sessions based on configured volume ratios. With ratios of 3 and 1, port1 receives three times the traffic volume of port2, resulting in approximately 75% and 25% distribution. The algorithm continuously uses both members according to these ratios as long as they are alive. It does not fill one member before using the other, nor does it require percentages that sum to 100.

Answer

The FortiGate will send sessions to port1 until its volume limit is reached, then switch to port2.

Answer

The volume ratio must be configured as a percentage that totals 100%.

Answer

The volume algorithm will only use port2 if port1 is down or fails its SLA.

Question 14

A FortiGate has an SD-WAN rule with two members: port1 and port2. The rule uses the 'lowest-cost' algorithm. The administrator configures a performance SLA that monitors latency to a remote server. The SLA is applied to both members. After some time, port1's latency exceeds the SLA threshold and its status becomes 'dead'. What happens to new sessions that match the SD-WAN rule?

Accepted Answer

New sessions will be sent to port2, because port1 is excluded due to SLA failure.. When a performance SLA fails, the member is marked as dead and excluded from SD-WAN rule selection. The FortiGate will use the remaining alive member, port2, for new sessions. This behavior ensures that traffic is only sent over links that meet the configured performance criteria. The lowest-cost algorithm only considers alive members, so port1 is not used while it is dead.

Answer

New sessions will be dropped until port1's SLA status becomes alive again.

Answer

New sessions will be load balanced across both members, but existing sessions on port1 will be re-evaluated.

Answer

New sessions will still be sent to port1 because lowest-cost ignores SLA status.

Question 15

An administrator has configured an SD-WAN rule with the 'lowest-cost' strategy. The rule includes two members: port1 and port2. The administrator notices that all traffic is being sent over port1, even though port2 has a lower latency. Which factor is most likely causing this behavior?

Accepted Answer

The cost of port1 is configured lower than the cost of port2.. The 'lowest-cost' strategy selects the member with the lowest configured cost. Even if another member has better performance metrics like latency, the cost takes precedence. Therefore, if port1 has a lower cost than port2, it will be selected for all traffic. Administrators must ensure costs are set appropriately to reflect the desired priority.

Answer

The SD-WAN rule is configured with 'maximize-bandwidth' instead of 'lowest-cost'.

Answer

Port2 is administratively down.

Answer

The performance SLA is not configured for port2.