NSE7 Advanced Networking and SD-WAN Practice Test 2 — 15 Questions

Question 1

An administrator wants to segment traffic between two departments (Engineering and Finance) using the same FortiGate. Each department must have its own routing table with overlapping IP addresses. Which feature should be enabled to achieve this without creating separate VDOMs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VRF. VRF (Virtual Routing and Forwarding) allows a single FortiGate to maintain multiple independent routing tables, enabling overlapping IP address spaces for different departments without requiring separate VDOMs. Each VRF instance isolates routing decisions, forwarding tables, and interfaces, meeting the segmentation requirement while preserving a unified management plane.

Answer

Policy-based routing

Answer

Virtual IP (VIP)

Answer

Multiple VDOMs

Question 2

A network administrator is configuring SD-WAN on a FortiGate with three WAN links: MPLS (10 Mbps), Broadband (50 Mbps), and LTE (20 Mbps). They want to load balance traffic based on link bandwidth, with the option to manually steer critical traffic to the MPLS link. Which TWO steps must be taken to achieve this?

Accepted Answer

Set the SD-WAN rule strategy to 'Maximize Bandwidth' with volume algorithm for general traffic.. Setting the SD-WAN rule strategy to 'Maximize Bandwidth' with the volume algorithm distributes traffic proportionally based on link bandwidth (10:50:20 ratio), achieving load balancing. Option B is correct because creating a separate SD-WAN rule with strategy 'Manual' and selecting MPLS as the preferred member allows manual steering of critical traffic to the MPLS link, overriding the load-balancing behavior for that traffic.

Answer

Set the load balancing algorithm to 'Spillover' on all rules.

Answer

Enable ECMP on the FortiGate.

Answer

Configure a performance SLA for each link.

Question 3

An administrator is troubleshooting an SD-WAN deployment where traffic from the branch to the datacenter is being sent over the backup LTE link even though the primary MPLS link has low latency and jitter. The SD-WAN rule uses 'Best Quality' strategy with latency and jitter metrics. The performance SLA for MPLS shows 'alive'. Which TWO configurations could cause this behavior?

Accepted Answer

The SD-WAN rule has 'set member' configured to only include LTE.. If the SD-WAN rule uses 'set member' to include only the LTE interface, traffic will be forced over LTE regardless of the performance SLA status or the 'Best Quality' strategy. This overrides the dynamic path selection logic, causing the backup link to be used even when the primary MPLS link is healthy.

Answer

BFD is enabled on MPLS but not on LTE.

Answer

The route to the datacenter is learned via OSPF with a lower cost over LTE.

Answer

The latency threshold is set too low for MPLS.

Question 4

A FortiGate is integrated with FortiSwitch and FortiAP. The administrator wants to manage both devices from the FortiGate GUI using the LAN edge management features. Which THREE conditions must be met for this integration to work?

Accepted Answer

FortiAP must be in CAPWAP mode to connect to the FortiGate.. FortiAP must operate in CAPWAP (Control and Provisioning of Wireless Access Points) mode to establish a control tunnel to the FortiGate. This allows the FortiGate to act as the wireless controller, managing AP configuration, firmware, and client traffic via CAPWAP encapsulation. Without CAPWAP mode, the FortiAP cannot be discovered or managed through the FortiGate's LAN edge management features.

Answer

The FortiGate must operate in transparent mode.

Answer

The FortiGate must have a separate VDOM for each managed device.

Question 5

Which command is used on a FortiGate to view the current state of BFD sessions?

Accepted Answer

diagnose sys bfd session list. 'diagnose sys bfd session list' is the FortiGate CLI command used to display the current state of Bidirectional Forwarding Detection (BFD) sessions, including session state, local/remote discriminators, and timers. This command is part of the 'diagnose' utility, which provides detailed operational and diagnostic information for troubleshooting BFD in SD-WAN or routing contexts.

Answer

get router info bfd

Answer

show bfd sessions

Answer

execute bfd show

Question 6

A FortiGate is configured with OSPF multi-area. The administrator needs to ensure that routes from area 2 are advertised into area 0. Which TWO configurations are necessary?

Accepted Answer

Configure a virtual-link between area 2 and area 0. Option A is correct because in OSPF multi-area, a virtual link is used to connect a non-backbone area (area 2) to the backbone area 0 when the ABR does not have a direct physical interface in area 0; the virtual link is configured between the ABR in area 2 and an ABR that has an interface in area 0, allowing area 2 routes to be advertised into area 0. Option C is correct because an Area Border Router (ABR) is required to connect area 2 to area 0; the ABR has interfaces in both areas and generates Type 3 summary LSAs to advertise routes from area 2 into area 0 (and vice versa). Option B is incorrect because the OSPF network type (point-to-point) affects adjacency formation and DR/BDR election, not inter-area route advertisement. Option D is incorrect because disabling OSPF on area 0 would break the backbone and prevent any inter-area routing. Option E is incorrect because OSPF does not redistribute routes from OSPF into OSPF; inter-area routes are learned via Type 3 LSAs generated by ABRs, not redistribution.

Answer

Set the OSPF network type to point-to-point

Answer

Disable OSPF on area 0

Answer

Enable route redistribution from OSPF into OSPF

Question 7

A network administrator wants to configure SD-WAN on a FortiGate with two internet connections (port1 and port2). The requirement is to use the link with the lowest cost as the primary path for all traffic, unless it exceeds a threshold. Which SD-WAN load balancing algorithm should the administrator choose?

Accepted Answer

Lowest-cost. The 'Lowest-cost' algorithm (option C) is correct because it allows the administrator to assign a cost metric to each SD-WAN link and designate the link with the lowest cost as the primary path. Traffic will use this primary link until its cost exceeds a defined threshold, at which point the FortiGate will spill over traffic to the next lowest-cost link. This directly matches the requirement of using the lowest-cost link as primary unless a threshold is exceeded.

Answer

Spillover

Answer

Sessions

Answer

Volume

Question 8

A FortiGate is configured with SD-WAN using BGP. The administrator wants to influence outbound traffic to prefer one SD-WAN member over another based on BGP attributes. Which BGP attribute, when modified on the FortiGate, can achieve this for outbound traffic?

Accepted Answer

Local-preference. Local-preference is a well-known mandatory BGP attribute that is propagated within an AS to influence outbound traffic by indicating the preferred exit point. When modified on the FortiGate, a higher local-preference value makes the route more preferred for outbound traffic, allowing the administrator to steer traffic toward a specific SD-WAN member without affecting inbound routing.

Answer

Weight

Answer

AS-Path prepending

Answer

MED

Question 9

A FortiGate is running OSPF in a multi-area network. The administrator notices that routes from area 1 are not being redistributed into area 0. The configuration includes 'redistribute connected' under OSPF. What is the most likely cause?

Accepted Answer

Area 1 is a stub area. The question states that the configuration includes 'redistribute connected' under OSPF. If Area 1 is a stub area, external routes (such as those redistributed from connected interfaces) are not allowed into the area. Therefore, the redistributed connected routes will not be present in Area 1 and cannot be propagated to Area 0 by the ABR. This is the most likely cause given the scenario.

Answer

The OSPF network type is not broadcast

Answer

The ABR is not configured with 'area 0'

Answer

The 'redistribute connected' command is missing under the OSPF process

Question 10

A FortiGate is configured with SD-WAN and uses performance SLA to monitor link quality. The administrator sets the SLA threshold to jitter < 30ms. If a link has average jitter of 35ms, what is the status of that link in the SD-WAN health check?

Accepted Answer

Degraded. In FortiGate SD-WAN, when a link's measured jitter exceeds the configured Performance SLA threshold (30ms) but does not fail the SLA entirely, the link is marked as 'Degraded'. The SLA threshold defines the acceptable quality; exceeding it means the link is still alive but not meeting the desired performance, hence degraded.

Answer

Dead

Answer

Unavailable

Answer

Alive

Question 11

A FortiGate has ECMP configured with two equal-cost routes to a destination. The administrator wants to ensure that all packets from a given source IP use the same next-hop. Which ECMP load balancing method should be configured?

Accepted Answer

Source IP. Source IP-based ECMP load balancing uses the source IP address to select the next-hop for all packets in a flow. This ensures that packets from a given source IP always take the same path, maintaining session consistency without requiring stateful inspection.

Answer

Destination IP

Answer

Source-destination IP

Answer

Round robin

Question 12

A FortiGate is configured with OSPF and multiple areas. The administrator wants to prevent type 3 LSAs from entering a specific area, while still allowing inter-area routing. Which TWO configurations can achieve this?

Accepted Answer

Use an area filter list with 'prefix-list' to deny specific prefixes. Option C is correct because an OSPF area filter list applied with a prefix-list allows the administrator to selectively deny specific type 3 summary LSAs from being injected into an area, while still permitting other inter-area routes to pass, which matches the requirement of blocking type 3 LSAs without eliminating inter-area routing entirely. Option E is correct because configuring an area as totally stubby (totally stubby area) blocks all type 3, type 4, and type 5 LSAs from entering that area, relying on a default route for external and inter-area destinations; this prevents type 3 LSAs from entering the area, and inter-area reachability is maintained via the ABR-generated default route. Option A is incorrect because a standard stub area still allows type 3 LSAs (inter-area routes) to be advertised into the area, so it does not prevent type 3 LSAs from entering. Option B is incorrect because an NSSA allows type 3 LSAs and instead handles type 5 LSAs by converting them to type 7 within the area, so it does not block type 3 LSAs. Option D is incorrect because changing the OSPF network type to point-to-multipoint affects neighbor adjacency and DR/BDR election behavior on the interface, not the flooding of type 3 LSAs into an area.

Answer

Configure the area as a stub area

Answer

Configure the area as an NSSA

Answer

Set the OSPF network type to point-to-multipoint

Question 13

An administrator needs to integrate a FortiSwitch with a FortiGate for LAN edge management. The FortiSwitch will be used to provide access ports for end users. Which THREE configuration steps are required on the FortiGate?

Accepted Answer

Create a port profile that defines VLAN and security settings for the access ports. A port profile on the FortiGate defines the VLAN membership, allowed VLANs, and security policies (e.g., 802.1X, MAC authentication bypass) that are pushed to the FortiSwitch for its access ports. This is the primary mechanism for centrally managing access port configuration in a FortiSwitch deployment.

Answer

Configure a DHCP server on the FortiGate to assign IP addresses to FortiSwitch management

Answer

Enable STP on the FortiGate interface

Question 14

A FortiGate is configured with OSPF in multiple areas and redistributes connected routes into OSPF. The administrator notices that routes from area 1 are not appearing in area 0. The area 0 routers show the routes as 'O E2' but with an invalid metric. What is the most likely cause?

Accepted Answer

Redistribution is configured without a route map. When a route is redistributed into OSPF without a route map, it is advertised as a Type 5 LSA (external) with a default metric of 20. However, if the redistribution is not properly filtered or the metric is not explicitly set, the route may appear with an invalid metric (e.g., 0 or unexpected value) on the ABR. The ABR will flood this LSA into area 0, but the metric inconsistency causes the routes to be seen as 'O E2' with an invalid metric, preventing proper route installation.

Answer

OSPF network type is broadcast on one side and point-to-point on the other

Answer

The interface costs are misconfigured

Answer

The ABR has 'area 0 stub' configured

Question 15

A FortiGate administrator sees the following output:

"diagnose sys session filter dport 443
diagnose sys session list
session info: proto=6 proto_state=01 duration=3600 expire=3599"

What does this session duration and expire time indicate?

Accepted Answer

The session has a timeout of 7200 seconds (2 hours). The session duration of 3600 seconds and expire time of 3599 seconds indicate that the session has been active for 3600 seconds and has 3599 seconds remaining before timeout. Since the total timeout is the sum of duration and expire time (3600 + 3599 = 7199, approximately 7200 seconds), this matches the default TCP session timeout of 7200 seconds (2 hours) on FortiGate. The 'proto_state=01' confirms a TCP session in established state, and the output shows the session is still valid with a long remaining lifetime.

Answer

The session is about to be torn down

Answer

The session is newly established

Answer

The session is using UDP protocol