NSE7 Advanced Networking and SD-WAN Practice Test 3 — 15 Questions

Question 1

An administrator is troubleshooting an SD-WAN deployment where traffic from the branch to the datacenter is being sent over the backup LTE link even though the primary MPLS link has low latency and jitter. The SD-WAN rule uses 'Best Quality' strategy with latency and jitter metrics. The performance SLA for MPLS shows 'alive'. Which TWO configurations could cause this behavior?

Accepted Answer

The SD-WAN rule has 'set member' configured to only include LTE.. If the SD-WAN rule has an 'input-device' match that excludes MPLS, or if the rule's 'set member' does not include MPLS, traffic will not use it even if the SLA is good. Another possibility is that the performance SLA is not associated with the rule, so the rule treats MPLS as unavailable. Options A and B are the most likely.

Answer

BFD is enabled on MPLS but not on LTE.

Answer

The route to the datacenter is learned via OSPF with a lower cost over LTE.

Answer

The latency threshold is set too low for MPLS.

Question 2

A FortiGate is integrated with FortiSwitch and FortiAP. The administrator wants to manage both devices from the FortiGate GUI using the LAN edge management features. Which THREE conditions must be met for this integration to work?

Accepted Answer

FortiAP must be in CAPWAP mode to connect to the FortiGate.. FortiSwitch and FortiAP management via FortiGate (LAN edge) requires: the FortiGate must be in NAT mode (transparent mode does not support this), a CAPWAP connection is used for FortiAP, and the devices must be in the same broadcast domain or reachable via the management VLAN. Option A is incorrect because FortiGate can manage them without VDOM. Option D is required for Layer 2 adjacency.

Answer

The FortiGate must operate in transparent mode.

Answer

The FortiGate must have a separate VDOM for each managed device.

Question 3

An administrator configures an SD-WAN rule to steer traffic from a specific subnet to an SD-WAN member with the lowest cost. Which load balancing algorithm should be selected in the SD-WAN rule to achieve this behavior?

Accepted Answer

Lowest-cost. Lowest-cost algorithm selects the member with the lowest cost (from performance SLA) for each session. Other algorithms do not consider cost.

Answer

Volume

Answer

Sessions

Answer

Source-dest-IP

Question 4

You run 'diagnose sys session filter dport 179' on a FortiGate and see many sessions with proto=6 and proto_state=01. What does this indicate about the BGP sessions?

Accepted Answer

BGP sessions are in the process of being established, but not yet fully up.. proto_state=01 indicates TCP session establishment (SYN_SENT). Persistent sessions in this state suggest BGP peers are not reaching Established state, possibly due to misconfiguration or firewall blocking.

Answer

BGP sessions are fully established and exchanging routes.

Answer

BGP sessions are being actively torn down.

Answer

BGP sessions are using TCP port 179 but are idle.

Question 5

A network admin configures OSPF on a FortiGate with multiple areas. To ensure that routes from one area are advertised into another area, which OSPF feature must be properly configured?

Accepted Answer

OSPF route redistribution. Route redistribution is used to inject routes from one OSPF area into another or from other protocols. Without redistribution, routes stay within their own area.

Answer

OSPF passive interface

Answer

OSPF virtual-link

Answer

OSPF network type

Question 6

Which FortiGate feature allows multiple independent routing tables on a single device, enabling traffic separation for different departments or customers?

Accepted Answer

VRF. VRF (Virtual Routing and Forwarding) partitions the routing table into multiple instances, each with its own routing table and forwarding decisions.

Answer

ECMP

Answer

VDOM

Answer

Policy-based routing

Question 7

An administrator configures BFD on a FortiGate to improve convergence time for OSPF. What is the primary purpose of BFD in this context?

Accepted Answer

To detect link failures faster than OSPF hello timers. BFD provides fast failure detection (sub-second) for routing protocols like OSPF, triggering quicker route convergence.

Answer

To reduce the number of OSPF neighbors

Answer

To encrypt OSPF packets

Answer

To load balance OSPF traffic across multiple links

Question 8

Which SD-WAN load balancing algorithm distributes traffic based on the number of active sessions per SD-WAN member?

Accepted Answer

Sessions. The sessions algorithm bases distribution on the current session count on each member.

Answer

Source-dest-IP

Answer

Spillover

Answer

Volume

Question 9

A FortiGate is configured with an SD-WAN rule using 'spillover' algorithm. The primary member has a spillover threshold of 100 Mbps. Traffic of 80 Mbps is currently flowing through the primary member. A new session requiring 30 Mbps arrives. What will happen?

Accepted Answer

The new session is sent to the secondary member because the primary threshold would be exceeded.. Spillover algorithm will direct the new session to the secondary member because the primary's current load (80 Mbps) plus the new session (30 Mbps) would exceed the threshold (100 Mbps).

Answer

The new session is sent to the primary member because the current load is below the threshold.

Answer

The new session is dropped because no member can handle it.

Answer

The primary member's threshold is dynamically increased.

Question 10

An administrator wants to ensure that traffic from a specific source IP uses a particular SD-WAN member regardless of performance SLA results. Which SD-WAN configuration element should be used?

Accepted Answer

SD-WAN rule with manual strategy. SD-WAN rules allow matching traffic based on source/destination, and can set the 'strategy' to 'manual' or explicitly select a member, overriding SLA-based choices.

Answer

Route map

Answer

Policy-based routing on the firewall policy

Answer

Performance SLA

Question 11

A FortiGate has two WAN interfaces (port1, port2) as SD-WAN members. The performance SLA monitor is configured for both with a latency threshold of 50 ms. The measured latency on port1 is 45 ms and on port2 is 55 ms. An SD-WAN rule uses 'lowest-cost' algorithm. Which interface will be selected for new sessions?

Accepted Answer

port1 because its latency is within threshold and lower than port2. Lowest-cost algorithm selects the member with the lowest cost, where cost is based on the performance SLA metric. Port1 has lower latency (45 ms < 55 ms) and is within threshold, so it has lower cost.

Answer

port2 because port1's latency is close to threshold

Answer

The session is dropped

Answer

Both interfaces are used equally

Question 12

Which command is used on a FortiGate to view the current state of BFD sessions?

Accepted Answer

diagnose sys bfd session list. Option D is correct because 'diagnose sys bfd session list' is the FortiGate CLI command used to display the current state of Bidirectional Forwarding Detection (BFD) sessions, including session state, local/remote discriminators, and timers. This command is part of the 'diagnose' utility, which provides detailed operational and diagnostic information for troubleshooting BFD in SD-WAN or routing contexts.

Answer

get router info bfd

Answer

show bfd sessions

Answer

execute bfd show

Question 13

A FortiGate is configured with ECMP load balancing. What is the default behavior when multiple routes have equal cost?

Accepted Answer

Traffic is load balanced across the routes using a hash algorithm. ECMP (Equal-Cost Multi-Path) by default uses a hash-based method to distribute traffic across the equal-cost paths.

Answer

The route with the lowest metric is always preferred

Answer

The administrator must enable per-packet load balancing

Answer

All traffic is sent over the first route until it fails

Question 14

An administrator needs to apply different routing policies for traffic based on source IP address, overriding the normal routing table. Which feature should be configured?

Accepted Answer

Policy-based routing. Policy-based routing (PBR) allows routing decisions based on criteria like source IP, protocol, etc., overriding the routing table.

Answer

Prefix list

Answer

SD-WAN rule

Answer

Route map

Question 15

An administrator wants to integrate a FortiExtender into an existing SD-WAN deployment. Which TWO steps are required for proper integration?

Accepted Answer

Authorize the FortiExtender on the FortiGate. The FortiExtender must be authorized and added as an SD-WAN member to participate in SD-WAN.

Answer

Disable all other WAN interfaces

Answer

Enable NAT on the FortiExtender interface

Answer

Configure a separate VDOM for the FortiExtender