NSE7 Advanced Networking and SD-WAN Practice Test 3 — 15 Questions

Question 1

Which command is used on a FortiGate to view the current routing table including VRF instances?

Accepted Answer

get router info routing-table all. 'get router info routing-table all' is the FortiGate CLI command that displays the complete routing table, including all VRF instances. This command retrieves the kernel routing table entries for every VRF, showing routes from all routing protocols (static, OSPF, BGP, etc.) and is the standard way to view the full routing context on FortiGate.

Answer

show ip route

Answer

diagnose ip route list

Answer

execute router list

Question 2

An administrator wants to integrate a FortiExtender with a FortiGate to provide WAN connectivity. Which interface type is used on the FortiGate to connect to the FortiExtender?

Accepted Answer

wan. The FortiGate uses a dedicated 'wan' interface type to connect to a FortiExtender, as this interface is specifically designed to manage the cellular or broadband WAN link provided by the extender. The FortiExtender appears as a WAN-facing device, and the 'wan' interface type allows the FortiGate to apply SD-WAN rules, load balancing, and failover policies directly to that connection.

Answer

lan

Answer

dmz

Answer

loopback

Question 3

An administrator configures a route map named RMAP_EXPORT that sets a community for routes redistributed into BGP. The route map is applied to the 'redistribute connected' statement under BGP. However, the connected routes are not being advertised to BGP peers. What is the most likely cause?

Accepted Answer

The route map does not have a 'match ip address' statement. A route map used for redistribution into BGP must contain at least one 'match' statement to filter which routes are redistributed. Without a 'match ip address' statement, the route map does not explicitly permit any routes, causing all connected routes to be denied by default. BGP redistribution requires an explicit permit action via a match condition; otherwise, the implicit deny at the end of the route map blocks all routes.

Answer

The BGP neighbor is not configured with 'route-map in'

Answer

Connected routes are not in the routing table

Answer

The route map is missing a 'set community' action

Question 4

Which feature allows a FortiGate to use multiple VRFs to separate routing tables for different customers or departments on the same physical device?

Accepted Answer

VRF. C is correct because VRF (Virtual Routing and Forwarding) is the native feature that allows a FortiGate to maintain multiple independent routing tables within a single physical device. Each VRF instance has its own routing table, forwarding table, and interface associations, enabling traffic separation for different customers or departments without requiring separate hardware. This is distinct from VDOMs, which provide full virtualized security and management contexts, and from SD-WAN or policy-based routing, which do not create separate routing tables.

Answer

SD-WAN

Answer

VDOM

Answer

Policy-based routing

Question 5

A network administrator is troubleshooting an SD-WAN setup where traffic from a specific application is not being load-balanced as expected. The SD-WAN rule uses the 'volume' load balancing algorithm. Which TWO factors could cause traffic to not be distributed equally? (Choose two.)

Accepted Answer

One of the SD-WAN members is a PPPoE interface. Option B is correct because the volume load-balancing algorithm distributes sessions based on the measured volume of traffic on each member, and a PPPoE interface's dynamic/overhead characteristics and potentially lower effective throughput can skew the volume calculation so that traffic is not spread equally. Option D is correct because volume load balancing assigns each new session to a member based on current volume, so asymmetric traffic (where return traffic follows a different path or sessions are created unevenly) can cause sessions to land on different members than expected and defeat equal distribution. Option A is not correct because setting the algorithm to source-dest-ip is a different algorithm, not the volume algorithm described in the scenario, so it does not explain unequal distribution under volume load balancing. Option C is not correct because a dead member due to a performance SLA packet-loss threshold would remove that member from selection rather than cause the volume algorithm to distribute unequally among the remaining members. Option E is not correct because encryption does not prevent the SD-WAN volume algorithm from counting bytes per member, so it is not a cause of unequal load balancing.

Answer

The SD-WAN rule is configured with 'mode = load-balance' but the algorithm is set to 'source-dest-ip'

Answer

The performance SLA has a high packet loss threshold causing the member to be dead

Answer

The traffic is encrypted and cannot be inspected

Question 6

A FortiGate is configured with OSPF multi-area. The administrator wants to redistribute a static route into OSPF area 0 and ensure it is propagated to all areas. Which THREE steps are required? (Choose three.)

Accepted Answer

Ensure the static route has a valid next-hop and is in the routing table. Option B is correct because OSPF redistribution only advertises routes that are active in the FortiGate routing table, so the static route must have a valid next-hop and be installed before it can be redistributed. Option C is correct because redistribution must be explicitly enabled with 'config redistribute static' (set status enable) under 'config router ospf', otherwise the static route is never injected into OSPF. Option E is correct because a route map applied to the redistribute statement lets you set the metric-type to E1 (and a metric), ensuring the external route is propagated with the desired type into area 0 and then into all other areas. Option A is incorrect because the point-to-multipoint network type is a per-interface OSPF setting unrelated to redistributing a static route. Option D is incorrect because disabling OSPF on interfaces would prevent adjacencies and stop the route from being propagated at all.

Answer

Set the OSPF network type to point-to-multipoint

Answer

Disable OSPF on all interfaces to prevent loops

Question 7

An administrator is configuring BGP with SD-WAN on a FortiGate. Which TWO statements are true about BGP and SD-WAN integration? (Choose two.)

Accepted Answer

SD-WAN performance SLA can override BGP best path selection. SD-WAN performance SLA rules can override BGP best path selection by steering traffic over a different SD-WAN member interface, even if BGP would have chosen a different path. This is achieved through SD-WAN rules that match traffic and apply an action like 'best quality' or 'lowest cost', which takes precedence over the BGP routing table decision.

Answer

BGP must be disabled on interfaces used for SD-WAN

Answer

BGP learned routes cannot be used as SD-WAN members

Answer

BGP route redistribution is not supported with SD-WAN

Question 8

A network administrator configures SD-WAN on a FortiGate with two WAN members (port1, port2). They set up a performance SLA to measure latency to 8.8.8.8. The SLA shows both members are 'alive'. However, traffic matching an SD-WAN rule with 'best quality' strategy is not using the lowest-latency link. What is the MOST likely cause?

Accepted Answer

The performance SLA does not have 'latency' as the first metric in the priority order. The 'best quality' strategy selects the link with the highest priority based on the performance SLA's metric order. If latency is not the first metric in the priority list (e.g., jitter or packet loss is first), the algorithm will prefer the link that best satisfies the first metric, not necessarily the lowest latency. Thus, even though both links are alive, the link with lower latency may be deprioritized if it performs worse on the first metric.

Answer

Both WAN members have the same cost in the SD-WAN configuration

Answer

The SD-WAN rule is configured with 'manual' strategy

Answer

The SD-WAN rule has 'set-match' enabled for source IP

Question 9

An administrator wants to use BFD to detect failures in an OSPF neighbor relationship faster than OSPF hello timers. They configure 'config router ospf' and 'set bfd enable'. However, BFD sessions are not coming up. What is a possible reason?

Accepted Answer

The interface has 'set bfd enable' missing under config system interface. On FortiGate, enabling BFD under the OSPF process alone does not activate BFD on the interface. The interface itself must also have 'set bfd enable' under 'config system interface' to allow BFD session establishment. Option C is incorrect because while BFD generally requires both ends to enable it, the question specifically asks for a reason on the local FortiGate's configuration; the neighbor's configuration is outside the administrator's control for this scenario, and the most common oversight is the interface-level setting.

Answer

OSPF is configured with 'network point-to-multipoint'

Answer

The neighbor does not have BFD enabled on its OSPF configuration

Answer

The FortiGate's BFD transmit interval is set too high

Question 10

You have configured a route map named 'RM-BGP' to filter routes redistributed from OSPF into BGP. The route map uses 'set community 65000:100' and 'set metric 50'. After applying the route map under 'config router bgp' with 'redistribute ospf route-map RM-BGP', you see that routes are being redistributed but without the community and metric. What is wrong?

Accepted Answer

The route map does not have any 'match' criteria, so it never applies. A route map without any 'match' statements is considered a 'permit all' by default, but it does not apply 'set' actions unless a 'match' condition is explicitly met. In FortiOS, a route map with only 'set' commands and no 'match' criteria will not execute those 'set' actions during redistribution. Therefore, the routes are redistributed with default BGP attributes, not the configured community or metric.

Answer

The route map is missing a 'set community' statement with 'additive' option

Answer

The BGP neighbor requires 'soft-reconfiguration inbound' to see the changes

Answer

The 'set metric' command is not supported for BGP redistribution

Question 11

An administrator connects a FortiExtender to the FortiGate's USB port. The FortiGate detects the FortiExtender and creates a virtual interface 'wwan1'. However, the link status shows 'down'. The SIM card is inserted and the cellular plan is active. What should the administrator check?

Accepted Answer

The APN settings are not configured under the FortiExtender interface. The link status of the wwan1 interface remains 'down' because the FortiExtender requires the Access Point Name (APN) to be configured to establish a cellular data connection. Without the correct APN, the modem cannot attach to the mobile network, even with an active SIM card and power. The APN is configured under the FortiExtender interface settings on the FortiGate, not on the FortiExtender itself.

Answer

The FortiGate needs a security policy allowing traffic from wwan1

Answer

The FortiExtender firmware is not compatible with the FortiGate

Answer

The FortiExtender is not powered on

Question 12

You have configured VRF on a FortiGate with two VRFs: VRF 1 for guest traffic and VRF 2 for corporate traffic. You want to allow limited communication from guests to a corporate DNS server. What is the correct configuration step?

Accepted Answer

Configure route leaking between VRF 1 and VRF 2 for the DNS server's IP. VRF isolation by default prevents traffic from crossing between VRFs. To allow a guest in VRF 1 to reach a corporate DNS server in VRF 2, you must leak the DNS server's route from VRF 2 into VRF 1. This is achieved by configuring route leaking (e.g., using route maps or VRF route leaking on FortiGate), which installs the DNS server's IP prefix into the guest VRF's routing table, enabling reachability without breaking VRF separation for other traffic.

Answer

Create a firewall policy from VRF 1 to VRF 2 allowing DNS traffic

Answer

Enable 'set allow-vrf' on the DNS server's interface

Answer

Place the DNS server in a management VDOM and use inter-VDOM links

Question 13

An administrator configures a performance SLA to monitor a remote server. The SLA status shows 'dead' for one WAN member. The administrator checks the interface and sees that it is up and passing other traffic. What is the most likely cause?

Accepted Answer

The SLA probe is using TCP port 80 but the server is only responding to ICMP. The performance SLA status shows 'dead' because the probe is failing to reach the remote server. The administrator configured the SLA to use TCP port 80, but the server only responds to ICMP. Since the probe packets (TCP SYN) are not being acknowledged, the SLA marks the member as dead, even though the interface is up and other traffic (e.g., ICMP) passes successfully.

Answer

The FortiGate's routing table does not have a route to the probe target

Answer

The interface is not added as an SD-WAN member

Answer

The SLA probe interval is set too high

Question 14

A network administrator is configuring SD-WAN rules and wants to ensure that voice traffic is sent over the link with the lowest jitter. Which TWO configurations should the administrator apply? (Choose two.)

Accepted Answer

Set the SD-WAN rule strategy to 'best quality'. Setting the SD-WAN rule strategy to 'best quality' instructs FortiGate to select the link with the best performance metrics, such as lowest jitter, based on the configured performance SLA. This strategy dynamically routes traffic to the interface that meets the SLA targets, ensuring voice traffic uses the link with the lowest jitter.

Answer

Set the SD-WAN rule strategy to 'lowest cost'

Answer

Configure the SD-WAN rule to use 'volume' load balancing

Answer

Enable 'set jitter-threshold' on the SD-WAN rule

Question 15

A FortiGate is experiencing asymmetric routing due to route leaking between VRFs. The administrator wants to ensure that traffic using a specific VRF returns via the same path. Which THREE actions should be taken? (Choose three.)

Accepted Answer

Enable 'set pbr-enforce-symmetric' on the VRF interfaces. Option A is correct because enabling 'set pbr-enforce-symmetric' on the VRF interfaces forces policy-based routing to enforce symmetric return-path behavior, ensuring return traffic uses the same path as the original flow. Option B is correct because configuring policy-based routing with 'set-next-hop' explicitly directs return traffic out the same interface it arrived on, which resolves the asymmetric routing caused by route leaking. Option C is correct because using a route map to set the next-hop on routes leaked into the VRF controls the forwarding path of leaked routes, ensuring return traffic follows the intended symmetric path. Option D is not correct because disabling route leaking entirely is a drastic measure that defeats the purpose of VRF route leaking rather than fixing the asymmetry. Option E is not correct because increasing the administrative distance of leaked routes only affects route preference and does not guarantee that return traffic takes the same path.

Answer

Disable route leaking between VRFs

Answer

Increase the administrative distance of the leaked routes