NSE7 Advanced Networking and SD-WAN Practice Test 3 — 15 Questions

Question 1

Match each IPsec VPN term to its definition.

Accepted Answer

IKE: Protocol used to establish security associations and authenticate peers.. Correct matches: IKE establishes SAs and authenticates peers; SPI is an index to identify SAs; ESP provides confidentiality, authentication, and integrity. Common confusions include swapping IKE and SA definitions.

Answer

IKE: A set of parameters defining how IPsec processes traffic between peers.

Answer

IPsec SA: Protocol used to establish security associations and authenticate peers.

Question 2

Match each FortiGate interface type to its usage.

Accepted Answer

Physical interface: A hardware port that provides direct network connectivity. The correct matches: Physical Interface → hardware port; VLAN Interface → logical interface for 802.1Q tagging; Loopback Interface → always-up virtual interface; Aggregate Interface → combines multiple physical interfaces. Common confusions include mixing the definitions of loopback and VLAN, or confusing physical interfaces with aggregate interfaces.

Answer

Physical interface: A logical interface that combines multiple physical interfaces

Answer

VLAN interface: A virtual interface that is always up

Question 3

A network engineer is configuring SD-WAN on a FortiGate. They have three WAN interfaces (wan1, wan2, lte) and want traffic to the primary datacenter (10.10.10.0/24) to use wan1 unless its latency exceeds 50 ms, in which case failover to wan2. The engineer created an SD-WAN rule with a strategy of 'Manual' and selected 'wan1' as the preferred member. What additional configuration is required to achieve automatic failover based on latency?

Accepted Answer

Configure a performance SLA for wan1 with a latency threshold of 50 ms and associate it with the SD-WAN rule.. SD-WAN automatic failover based on latency requires a Performance SLA (performance-sla) configured with a latency threshold of 50 ms, and that SLA must be associated with the SD-WAN rule. The rule's strategy should be set to 'Manual' with wan1 as preferred member, but the SLA triggers the failover when the latency exceeds the threshold, causing the rule to select the next available member (wan2). Without the SLA, the Manual strategy simply pins traffic to wan1 and never fails over.

Answer

Create a route map to prefer wan1 and apply it to the SD-WAN rule.

Answer

Set the SD-WAN rule strategy to 'Best Quality' and select latency as the metric.

Answer

Enable BFD on wan1 and wan2 with a minimum interval of 50 ms.

Question 4

A FortiGate is running OSPF with multiple areas. The admin wants to redistribute a static route for 192.168.100.0/24 into OSPF. After configuring 'config router ospf' with 'redistribute static' enabled, the route appears in the OSPF database but is not being advertised to other areas. What is the most likely cause?

Accepted Answer

The router is an ABR and the static route is being redistributed as a type 5 LSA, which is not flooded into stub areas.. An ABR does not flood Type 5 LSAs (which are generated by redistribution) into stub areas or NSSAs. Since the route appears in the OSPF database on the ABR but is not advertised to other areas, the most likely cause is that the receiving area is a stub area, which by design blocks Type 5 LSAs. The redistribution of a static route into OSPF creates a Type 5 LSA, which is only flooded throughout the AS except into stub areas and NSSAs.

Answer

The 'redistribute static' command needs a route map to filter the route correctly.

Answer

The static route's administrative distance is too high for OSPF.

Answer

OSPF must be configured with 'default-information originate' to allow redistribution.

Question 5

An administrator wants to load balance traffic across two ISP links using SD-WAN. The requirement is that sessions from the same source IP address must always use the same ISP link. Which SD-WAN load balancing algorithm should be used?

Accepted Answer

Source-destination IP. The Source-destination IP algorithm creates a hash based on both the source and destination IP addresses, ensuring that all packets belonging to sessions from the same source IP to the same destination IP are consistently forwarded over the same ISP link. This meets the requirement of session persistence for traffic from a given source IP without relying on stateful inspection or session tracking.

Answer

Sessions

Answer

Volume

Answer

Spillover

Question 6

You are troubleshooting BFD on a FortiGate SD-WAN deployment. BFD is configured on two WAN interfaces (wan1, wan2) with a minimum transmit interval of 100 ms and a multiplier of 3. The network experiences occasional jitter causing packet loss. After a brief outage, the BFD session does not recover. Which setting should be adjusted to improve BFD resilience without significantly increasing failover time?

Accepted Answer

Increase the BFD multiplier to 4 or higher.. Increasing the BFD multiplier (from 3 to 4 or higher) allows the session to tolerate more lost BFD control packets before declaring a failure. This directly addresses the jitter-induced packet loss without changing the detection timing for sustained outages, as the multiplier only affects the number of missed packets required to trigger a failure. The minimum transmit interval remains at 100 ms, so the base detection time (multiplier × interval) increases only slightly, preserving fast failover for true link failures.

Answer

Disable BFD and rely on route timers.

Answer

Enable BFD on the management interface.

Answer

Increase the BFD minimum transmit interval on both interfaces.

Question 7

A FortiGate with SD-WAN enabled uses two members: MPLS (10 ms latency) and Internet (40 ms latency). The SD-WAN rule uses 'Best Quality' strategy with latency as the metric. Traffic to a critical application (10.1.1.0/24) is currently using the MPLS link. The MPLS link's latency increases to 60 ms due to a routing issue. How will FortiGate handle new sessions to 10.1.1.0/24?

Accepted Answer

New sessions will use the Internet link; existing sessions continue on MPLS.. The 'Best Quality' strategy with latency metric selects the link with the lowest latency for new sessions. When MPLS latency rises to 60 ms, it exceeds the Internet link's 40 ms, so new sessions will be steered to the Internet. However, SD-WAN does not preemptively rehash existing sessions; they remain on the original link (MPLS) until they expire or are torn down.

Answer

FortiGate will wait for the MPLS link to recover before sending new traffic.

Answer

All sessions immediately switch to the Internet link.

Answer

Existing sessions continue on MPLS; new sessions will use MPLS until the next SLA probe.

Question 8

Which feature allows a FortiGate to participate in multiple routing tables simultaneously, enabling network segmentation and overlapping IP address spaces?

Accepted Answer

VRF. C is correct because VRF (Virtual Routing and Forwarding) allows a FortiGate to maintain multiple separate routing tables (RIB) on the same physical device. Each VRF instance operates as an independent routing domain, enabling network segmentation and the use of overlapping IP address spaces without conflict, which is essential for MPLS L3VPN and multi-tenant environments.

Answer

VDOM

Answer

Policy-based routing

Answer

Route redistribution

Question 9

An administrator needs to ensure that traffic from the internal network (10.0.0.0/8) destined to the Internet is routed through a specific next-hop (192.168.1.1) only if a more specific route for the destination does not exist. Which routing feature should be used?

Accepted Answer

Use policy-based routing with a deny rule for the specific prefixes that have more specific routes.. Policy-based routing (PBR) allows you to define a policy that matches traffic destined to specific prefixes and applies a deny action, effectively bypassing the PBR for those destinations. This ensures that traffic with a more specific route in the routing table uses that route, while all other traffic (without a more specific route) is forced through the next-hop 192.168.1.1 via a set ip next-hop command in the PBR policy.

Answer

Configure route redistribution from BGP to OSPF.

Answer

Enable ECMP load balancing.

Answer

Create a static default route with a higher administrative distance.

Question 10

During an SD-WAN health check, an administrator observes that a performance SLA for wan1 shows 'Status: dead' even though the interface is up and can ping the SLA server. The SLA configuration uses a TCP echo probe to 8.8.8.8 port 443. What is the most likely cause?

Accepted Answer

The probe protocol is TCP echo, but the server at 8.8.8.8 does not support TCP echo on port 443.. The TCP echo probe sends a TCP SYN to the specified port and expects a SYN-ACK to confirm connectivity. 8.8.8.8 (Google DNS) does not run a TCP echo service on port 443; it serves HTTPS. The server will respond with a TCP RST or simply ignore the probe, causing the SLA to fail and show 'dead' even though the interface is up and ICMP ping works.

Answer

The SLA server is blocking ICMP echo requests.

Answer

The performance SLA is configured with the wrong threshold.

Answer

The firewall policy allowing the probe traffic is missing.

Question 11

A FortiGate is configured with two SD-WAN members (wan1, wan2) and a performance SLA for each. The SD-WAN rule uses 'Maximize Bandwidth' strategy with volume-based load balancing. The administrator notices that traffic is only using wan1, even though both links have capacity. The SLA status for wan2 shows 'alive'. What could be the problem?

Accepted Answer

The SD-WAN rule has a 'set member' statement that lists only wan1.. The 'Maximize Bandwidth' strategy with volume-based load balancing distributes traffic based on bandwidth weights, but the SD-WAN rule's 'set member' statement explicitly defines which interfaces are eligible for load balancing. If the rule lists only wan1, traffic will never be sent to wan2, regardless of SLA status or bandwidth weights. This is the most direct cause of the observed behavior.

Answer

The link cost for wan2 is too high.

Answer

The performance SLA for wan2 is not associated with the SD-WAN rule.

Answer

The bandwidth weight for wan2 is set to 0.

Question 12

An administrator wants to segment traffic between two departments (Engineering and Finance) using the same FortiGate. Each department must have its own routing table with overlapping IP addresses. Which feature should be enabled to achieve this without creating separate VDOMs?

Accepted Answer

VRF. VRF (Virtual Routing and Forwarding) allows a single FortiGate to maintain multiple independent routing tables, enabling overlapping IP address spaces for different departments without requiring separate VDOMs. Each VRF instance isolates routing decisions, forwarding tables, and interfaces, meeting the segmentation requirement while preserving a unified management plane.

Answer

Policy-based routing

Answer

Virtual IP (VIP)

Answer

Multiple VDOMs

Question 13

Which FortiGate feature is used to detect link failures within milliseconds, allowing rapid convergence for routing protocols like OSPF and BGP?

Accepted Answer

BFD. Bidirectional Forwarding Detection (BFD) is the correct answer because it provides sub-second (millisecond) link failure detection independent of routing protocols. Unlike OSPF or BGP's own keepalive mechanisms, BFD can detect failures in as little as 50-100 ms, enabling rapid convergence for protocols like OSPF and BGP by immediately notifying them of a neighbor loss.

Answer

ECMP

Answer

OSPF Fast Hello

Answer

Route tagging

Question 14

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is a TCP session in established state that has been active for 1 hour and will expire in about 1 hour.. The output shows 'proto=6', which is the protocol number for TCP, and 'proto_state=01', which indicates the TCP session is in an established state (TCP_ESTABLISHED). The 'duration=3600' means the session has been active for 3600 seconds (1 hour), and 'expire=3599' means the session will expire in 3599 seconds (approximately 1 hour), consistent with the default TCP session timeout of 3600 seconds in FortiGate.

Answer

The session is a UDP session with a short timeout.

Answer

The session is a UDP session that has been active for 1 hour.

Answer

The session is a TCP session that has timed out and is being removed.

Question 15

A network administrator is configuring SD-WAN on a FortiGate with three WAN links: MPLS (10 Mbps), Broadband (50 Mbps), and LTE (20 Mbps). They want to load balance traffic based on link bandwidth, with the option to manually steer critical traffic to the MPLS link. Which TWO steps must be taken to achieve this?

Accepted Answer

Set the SD-WAN rule strategy to 'Maximize Bandwidth' with volume algorithm for general traffic.. Setting the SD-WAN rule strategy to 'Maximize Bandwidth' with the volume algorithm distributes traffic proportionally based on link bandwidth (10:50:20 ratio), achieving load balancing. Option B is correct because creating a separate SD-WAN rule with strategy 'Manual' and selecting MPLS as the preferred member allows manual steering of critical traffic to the MPLS link, overriding the load-balancing behavior for that traffic.

Answer

Set the load balancing algorithm to 'Spillover' on all rules.

Answer

Enable ECMP on the FortiGate.

Answer

Configure a performance SLA for each link.