NSE7 Advanced Networking and SD-WAN Practice Test 2 — 15 Questions

Question 1

Match each IPsec VPN term to its definition.

Question 2

Match each FortiGate interface type to its usage.

Question 3

A network engineer is configuring SD-WAN on a FortiGate. They have three WAN interfaces (wan1, wan2, lte) and want traffic to the primary datacenter (10.10.10.0/24) to use wan1 unless its latency exceeds 50 ms, in which case failover to wan2. The engineer created an SD-WAN rule with a strategy of 'Manual' and selected 'wan1' as the preferred member. What additional configuration is required to achieve automatic failover based on latency?

Accepted Answer

Configure a performance SLA for wan1 with a latency threshold of 50 ms and associate it with the SD-WAN rule.. For automatic failover based on latency, a performance SLA must be configured to measure latency on wan1. The SD-WAN rule uses the SLA to determine if the preferred member meets the threshold; if not, traffic switches to the next available member. Option A correctly identifies this requirement.

Answer

Create a route map to prefer wan1 and apply it to the SD-WAN rule.

Answer

Set the SD-WAN rule strategy to 'Best Quality' and select latency as the metric.

Answer

Enable BFD on wan1 and wan2 with a minimum interval of 50 ms.

Question 4

A FortiGate is running OSPF with multiple areas. The admin wants to redistribute a static route for 192.168.100.0/24 into OSPF. After configuring 'config router ospf' with 'redistribute static' enabled, the route appears in the OSPF database but is not being advertised to other areas. What is the most likely cause?

Accepted Answer

The router is an ABR and the static route is being redistributed as a type 5 LSA, which is not flooded into stub areas.. By default, OSPF does not redistribute external routes into other areas unless the redistributing router is an ASBR and the route is a type 5 LSA. However, type 5 LSAs are not flooded into stub areas or NSSAs. If the router is in a NSSA or stub area, redistribution must be handled differently. The most common reason is that the router is an ABR and the external route is not being advertised into other areas because the router is not acting as an ASBR for those areas.

Answer

The 'redistribute static' command needs a route map to filter the route correctly.

Answer

The static route's administrative distance is too high for OSPF.

Answer

OSPF must be configured with 'default-information originate' to allow redistribution.

Question 5

An administrator wants to load balance traffic across two ISP links using SD-WAN. The requirement is that sessions from the same source IP address must always use the same ISP link. Which SD-WAN load balancing algorithm should be used?

Accepted Answer

Source-destination IP. The source-destination IP algorithm uses a hash of source and destination IP addresses to consistently map traffic to the same member. This ensures that all sessions with the same source and destination IP pair go to the same link, meeting the requirement.

Answer

Sessions

Answer

Volume

Answer

Spillover

Question 6

You are troubleshooting BFD on a FortiGate SD-WAN deployment. BFD is configured on two WAN interfaces (wan1, wan2) with a minimum transmit interval of 100 ms and a multiplier of 3. The network experiences occasional jitter causing packet loss. After a brief outage, the BFD session does not recover. Which setting should be adjusted to improve BFD resilience without significantly increasing failover time?

Accepted Answer

Increase the BFD multiplier to 4 or higher.. Increasing the multiplier allows more consecutive missed BFD packets before declaring the session down, making it more tolerant to jitter. Decreasing the interval would make it more sensitive. The multiplier of 3 means 3 * 100 ms = 300 ms before declaring down; increasing to 4 would give 400 ms tolerance, improving resilience.

Answer

Disable BFD and rely on route timers.

Answer

Enable BFD on the management interface.

Answer

Increase the BFD minimum transmit interval on both interfaces.

Question 7

A FortiGate with SD-WAN enabled uses two members: MPLS (10 ms latency) and Internet (40 ms latency). The SD-WAN rule uses 'Best Quality' strategy with latency as the metric. Traffic to a critical application (10.1.1.0/24) is currently using the MPLS link. The MPLS link's latency increases to 60 ms due to a routing issue. How will FortiGate handle new sessions to 10.1.1.0/24?

Accepted Answer

New sessions will use the Internet link; existing sessions continue on MPLS.. With 'Best Quality' strategy, FortiGate continuously monitors performance SLAs. When the MPLS link's latency exceeds the threshold or becomes worse than the Internet link, new sessions will be steered to the best available member (Internet) based on the metric. Existing sessions remain on the original link until they expire.

Answer

FortiGate will wait for the MPLS link to recover before sending new traffic.

Answer

All sessions immediately switch to the Internet link.

Answer

Existing sessions continue on MPLS; new sessions will use MPLS until the next SLA probe.

Question 8

Which feature allows a FortiGate to participate in multiple routing tables simultaneously, enabling network segmentation and overlapping IP address spaces?

Accepted Answer

VRF. Virtual Routing and Forwarding (VRF) partitions the routing table into multiple independent tables, allowing overlapping IP addresses and separate routing policies per VRF. This is the standard method for network segmentation on FortiGate.

Answer

VDOM

Answer

Policy-based routing

Answer

Route redistribution

Question 9

An administrator needs to ensure that traffic from the internal network (10.0.0.0/8) destined to the Internet is routed through a specific next-hop (192.168.1.1) only if a more specific route for the destination does not exist. Which routing feature should be used?

Accepted Answer

Use policy-based routing with a deny rule for the specific prefixes that have more specific routes.. Policy-based routing (PBR) allows traffic to be routed based on source/destination IP, port, etc., independent of the routing table. It can be configured to match traffic and set the next-hop, with a 'match' condition that can include the absence of a specific route. However, in FortiGate, policy-based routing rules are processed before the routing table, so if a more specific route exists, the PBR rule would still apply unless configured with the 'set match-vip' or other logic. Actually, the best way is to use a route map or prefix list with a deny statement for specific prefixes and then apply PBR. A simpler approach is to use default route with a higher distance, but that doesn't filter by destination. The correct answer is policy-based routing with a deny rule for specific prefixes.

Answer

Configure route redistribution from BGP to OSPF.

Answer

Enable ECMP load balancing.

Answer

Create a static default route with a higher administrative distance.

Question 10

During an SD-WAN health check, an administrator observes that a performance SLA for wan1 shows 'Status: dead' even though the interface is up and can ping the SLA server. The SLA configuration uses a TCP echo probe to 8.8.8.8 port 443. What is the most likely cause?

Accepted Answer

The probe protocol is TCP echo, but the server at 8.8.8.8 does not support TCP echo on port 443.. A TCP echo probe expects a TCP connection to the specified port, but the server must be configured to respond to TCP echo requests (RFC 862), which typically uses port 7. Using port 443 (HTTPS) would not result in a TCP echo response; the server would not send back the same data. The probe would fail, causing the SLA to show as dead.

Answer

The SLA server is blocking ICMP echo requests.

Answer

The performance SLA is configured with the wrong threshold.

Answer

The firewall policy allowing the probe traffic is missing.

Question 11

A FortiGate is configured with two SD-WAN members (wan1, wan2) and a performance SLA for each. The SD-WAN rule uses 'Maximize Bandwidth' strategy with volume-based load balancing. The administrator notices that traffic is only using wan1, even though both links have capacity. The SLA status for wan2 shows 'alive'. What could be the problem?

Accepted Answer

The SD-WAN rule has a 'set member' statement that lists only wan1.. The 'Maximize Bandwidth' strategy distributes traffic based on volume, but if the algorithm is set to 'Volume' and the bandwidth ratio settings (set bandwidth-weight) are imbalanced, one link might be preferred. However, the most common cause is that the SD-WAN rule's 'dst' or 'src' match criteria are restricting traffic to only wan1, or the rule's 'set member' includes only wan1. Another possibility: the rule might have 'set priority' or 'set input-device' that forces traffic to wan1.

Answer

The link cost for wan2 is too high.

Answer

The performance SLA for wan2 is not associated with the SD-WAN rule.

Answer

The bandwidth weight for wan2 is set to 0.

Question 12

An administrator wants to segment traffic between two departments (Engineering and Finance) using the same FortiGate. Each department must have its own routing table with overlapping IP addresses. Which feature should be enabled to achieve this without creating separate VDOMs?

Accepted Answer

VRF. VRF (Virtual Routing and Forwarding) allows multiple routing table instances within a single VDOM or global. It is ideal for network segmentation with overlapping IP spaces without the overhead of full VDOMs.

Answer

Policy-based routing

Answer

Virtual IP (VIP)

Answer

Multiple VDOMs

Question 13

Which FortiGate feature is used to detect link failures within milliseconds, allowing rapid convergence for routing protocols like OSPF and BGP?

Accepted Answer

BFD. Bidirectional Forwarding Detection (BFD) provides sub-second link failure detection independent of the routing protocol. It is commonly used with OSPF, BGP, and SD-WAN to speed up convergence.

Answer

ECMP

Answer

OSPF Fast Hello

Answer

Route tagging

Question 14

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is a TCP session in established state that has been active for 1 hour and will expire in about 1 hour.. proto=6 indicates TCP. proto_state=01 means the session is in 'established' state (TCP state established). duration=3600 seconds means the session has been active for 1 hour. expire=3599 means it will expire in 3599 seconds (almost 1 hour more). This indicates a healthy long-lived TCP session that is still active.

Answer

The session is a UDP session with a short timeout.

Answer

The session is a UDP session that has been active for 1 hour.

Answer

The session is a TCP session that has timed out and is being removed.

Question 15

A network administrator is configuring SD-WAN on a FortiGate with three WAN links: MPLS (10 Mbps), Broadband (50 Mbps), and LTE (20 Mbps). They want to load balance traffic based on link bandwidth, with the option to manually steer critical traffic to the MPLS link. Which TWO steps must be taken to achieve this?

Accepted Answer

Set the SD-WAN rule strategy to 'Maximize Bandwidth' with volume algorithm for general traffic.. To load balance based on bandwidth, the 'Maximize Bandwidth' strategy with volume algorithm should be used. To allow manual steering, the SD-WAN rule for critical traffic should be set to 'Manual' strategy with MPLS selected as the preferred member. Options B and D together satisfy both requirements.

Answer

Set the load balancing algorithm to 'Spillover' on all rules.

Answer

Enable ECMP on the FortiGate.

Answer

Configure a performance SLA for each link.