NSE7 Advanced Networking and SD-WAN Practice Test 4 — 15 Questions

Question 1

An administrator wants to integrate a FortiSwitch with a FortiGate for LAN edge management. Which TWO steps are required for initial setup? (Choose two.)

Accepted Answer

Connect the FortiSwitch to the FortiGate's managed switch port. Option B is correct because the FortiSwitch must be physically connected to a FortiGate port that is part of the managed switch (hardware switch) or configured as a managed FortiSwitch port, which is the prerequisite for the FortiGate to discover and control the switch. Option D is correct because after the FortiSwitch is discovered, the administrator must authorize it in the FortiGate's switch controller (WiFi & Switch Controller > Managed FortiSwitches) so the FortiGate can push configuration and manage the switch. Option A is incorrect because OSPF is a dynamic routing protocol and is not required for initial FortiSwitch integration; FortiLink uses its own discovery and control mechanisms. Option C is incorrect because 'transparent' mode is not a valid FortiSwitch management mode for FortiLink integration; the switch operates in standalone or managed (FortiLink) mode. Option E is incorrect because no firewall policy is needed between the FortiGate and FortiSwitch for initial setup, since FortiLink traffic is internal to the FortiGate and handled by the switch controller.

Answer

Configure OSPF on the FortiSwitch

Answer

Set the FortiSwitch to 'transparent' mode

Answer

Create a firewall policy allowing traffic between FortiSwitch and FortiGate

Question 2

An administrator runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session has been active for 1 hour and will expire in about 1 hour. The 'duration=3600' indicates the session has been active for 3600 seconds (1 hour), and 'expire=3599' shows the idle timeout remaining is approximately 1 hour. The proto_state=01 value indicates the session is in the INIT state (SYN sent, full handshake not yet complete); however, the duration shows it has been active for an hour, meaning this is a long-lived session that has not yet progressed to an established state—possibly due to no response. The key point is the duration and expire values, not the proto_state interpretation.

Answer

The session is about to expire and will be removed soon

Answer

The session is using UDP protocol

Answer

The session is in a half-open state

Question 3

A FortiGate is configured with multiple VRF instances. The administrator needs to ensure that traffic from VRF 10 can reach a server in VRF 20. Which configuration is required?

Accepted Answer

Use static routes with the appropriate VRF tags to leak routes between VRFs. Inter-VRF route leaking in FortiGate is achieved by configuring static routes with the 'vrf' tag to specify the source VRF and using the 'dst-vrf' or 'vrf-leak' settings to export routes into the destination VRF. This allows traffic from VRF 10 to reach a server in VRF 20 by ensuring the necessary routes are present in both VRFs without merging the VRFs.

Answer

Enable inter-VRF routing by setting 'vrf-leak enable' on the VRF instances

Answer

Configure a firewall policy that allows traffic between the VRFs

Answer

Place both interfaces in the same VRF

Question 4

Which BFD mode is used to detect forwarding path failures between two FortiGates that are directly connected?

Accepted Answer

Asynchronous mode. Asynchronous mode is the default BFD mode used between two directly connected FortiGates to detect forwarding path failures. In this mode, both peers periodically send control packets at negotiated intervals, and if a peer stops receiving these packets within the detection multiplier, the session is declared down. This allows rapid detection of link or forwarding failures without relying on echo packets or on-demand triggers.

Answer

Synchronous mode

Answer

Echo mode

Answer

Demand mode

Question 5

An administrator configures a route map to control redistribution of connected routes into OSPF. The route map uses a prefix list to match routes. After applying the redistribution, no routes are redistributed. What is the most likely oversight?

Accepted Answer

The route map is missing a 'permit' action, so it denies all routes. The route map used for redistribution into OSPF must have at least one 'permit' statement to allow routes. If only a prefix list is referenced in the route map without an explicit 'permit' action, the implicit deny at the end of the route map blocks all routes. The common mistake is to assume that simply matching with a prefix list is sufficient; however, an explicit 'permit' action is required.

Answer

The prefix list is configured with the wrong sequence number

Answer

OSPF process ID is incorrect

Answer

The connected routes are not in the routing table

Question 6

An administrator is configuring SD-WAN with two members: MPLS and Broadband. The requirement is that voice traffic (UDP ports 16384-32768) should use MPLS primarily, and if MPLS fails SLA, then use Broadband. Which two configurations are needed? (Choose TWO.)

Accepted Answer

Configure a performance SLA for the MPLS member. Option B is correct because a performance SLA must be configured on the MPLS member to monitor its health (e.g., latency, jitter, packet loss) so the SD-WAN can detect when MPLS fails the SLA and trigger a failover. Option C is correct because an SD-WAN rule matching voice traffic (UDP ports 16384-32768) with the 'best quality' strategy will select the MPLS member as primary and automatically switch to Broadband when MPLS violates the SLA, satisfying the requirement. Option A is incorrect because disabling Broadband from the SD-WAN zone would remove it as a failover path, defeating the purpose. Option D is incorrect because policy-based routing is a static routing mechanism that does not provide dynamic SLA-based failover. Option E is incorrect because a 'sessions' load balancing algorithm distributes traffic across members without regard to SLA compliance or prioritizing MPLS for voice.

Answer

Disable the Broadband member from the SD-WAN zone

Answer

Configure policy-based routing for voice traffic

Answer

Set the load balancing algorithm to 'sessions'

Question 7

A FortiGate is acting as an ABR between OSPF area 0 and area 1. The administrator needs to redistribute a static route into OSPF so that it appears as an inter-area route (Type 3 LSA). Which three steps are required? (Choose THREE.)

Accepted Answer

Verify the OSPF process has network statements covering all interfaces. Option C is correct because the OSPF process must have network statements (or interface-level OSPF configuration) that enable OSPF on the ABR's interfaces in both area 0 and area 1; without active OSPF adjacencies in both areas, the ABR cannot generate and flood Type 3 LSAs between areas. Option D is correct because redistribution of the static route into OSPF requires the 'redistribute static' command under 'config router ospf' on the ABR, which causes the static route to be injected into the OSPF domain and, when advertised across an area boundary by the ABR, to appear as an inter-area (Type 3) LSA. Option E is correct because a static route must be installed in the routing table (active) before OSPF can redistribute it; if the next-hop is unreachable or the route is inactive, 'redistribute static' will not advertise it. Option A is not required because disabling summarization is unrelated to generating Type 3 LSAs for a redistributed static route; summarization affects aggregation of routes, not basic redistribution. Option B is not required because setting the metric type to Type 1 via a route map controls the external metric type (E1 vs E2) for Type 5 LSAs originated in the same area, not the creation of an inter-area Type 3 LSA by the ABR.

Answer

Disable route summarization on the ABR

Answer

Configure a route map to set the metric type to Type 1

Question 8

An administrator deploys a FortiGate in a remote office with a FortiSwitch and FortiAP. The LAN edge management features are used to manage these devices. The FortiGate is configured as a controller. Which three steps are required to manage the FortiAP via the FortiGate? (Choose THREE.)

Accepted Answer

Configure DHCP option 138 or DNS to point FortiAP to FortiGate. Option A is correct because a FortiAP must first discover and reach its controller; DHCP option 138 (or DNS resolution of the FortiGate's hostname) delivers the FortiGate's IP address so the AP can initiate CAPWAP to it. Option B is correct because after the AP appears as an unauthorized device, the administrator must authorize it by serial number on the FortiGate so it becomes a managed, trusted AP. Option C is correct because the FortiGate must have CAPWAP enabled (the control/data channel used by FortiAP management) for the AP to establish its management tunnel and be controlled. Option D is not required for FortiAP management, since LLDP is a discovery/link-layer protocol used for topology and VLAN information, not for AP controller onboarding. Option E is not a management step; configuring an SSID under the FortiAP profile is a wireless service configuration performed after the AP is already authorized and managed.

Answer

Enable LLDP on the FortiSwitch

Answer

Configure an SSID under the FortiAP profile

Question 9

A network administrator is configuring SD-WAN on a FortiGate with two WAN links (port1 and port2). They want traffic to destination 10.0.0.0/8 to use port1 as long as its latency is below 50ms and jitter below 10ms; otherwise, fail over to port2. Which SD-WAN configuration components are required?

Accepted Answer

SD-WAN members, one performance SLA, one SD-WAN rule with the performance SLA as a strategy. SD-WAN failover based on latency and jitter thresholds requires a single performance SLA to measure both metrics on the active link (port1), and one SD-WAN rule that uses that SLA as the strategy to determine best path. The rule defines the destination (10.0.0.0/8) and the SLA's thresholds trigger failover to port2 when exceeded. Only one SLA is needed since the condition is applied to the primary link, not both.

Answer

SD-WAN members, one performance SLA, one SD-WAN member with a static route

Answer

SD-WAN members, two performance SLAs (one per interface), one SD-WAN rule

Answer

SD-WAN members, one performance SLA, two SD-WAN rules (one for each interface)

Question 10

A FortiGate is running OSPF with multiple areas. The administrator notices that routes from area 1 are not being redistributed into area 0. The ABR has the following configuration: 'config router ospf
 config area
  edit 0.0.0.0
  set type nssa
 end
 config area
  edit 0.0.0.1
  set type standard
 end
 end'. What is the issue?

Accepted Answer

Area 0 is configured as NSSA, which does not accept type 3 LSAs from other areas.. Area 0 is configured as an NSSA (Not-So-Stubby Area), which by default does not accept Type 3 summary LSAs from other areas. Since routes from area 1 (a standard area) are injected into the ABR as Type 3 LSAs, they are blocked by the NSSA area 0 boundary. This prevents inter-area route redistribution into area 0.

Answer

The ABR must have 'set type standard' for area 0.

Answer

The ABR is missing a 'redistribute connected' command.

Answer

Area 1 is not configured as NSSA, so routes cannot be redistributed.

Question 11

A FortiGate is configured with policy-based routing (PBR) to route certain traffic through a specific next hop. However, some traffic that should match the PBR rule is not being affected. What is a likely reason?

Accepted Answer

The PBR rule is applied on the wrong interface or direction.. Policy-based routing (PBR) in FortiOS is applied per interface and per direction (incoming or outgoing). If the PBR rule is applied on the wrong interface or in the wrong direction, traffic will never be evaluated against the route map, causing the rule to have no effect. This is the most common misconfiguration when PBR does not work as expected.

Answer

The PBR rule uses a route map that references an incorrect prefix list.

Answer

The PBR rule has a higher priority than the SD-WAN rule, but the traffic is hitting the SD-WAN rule first because of firewall policy order.

Answer

The traffic is generated locally from the FortiGate and PBR does not affect locally generated traffic.

Question 12

An administrator wants to integrate a FortiExtender with a FortiGate for LTE backup. The FortiGate is using SD-WAN. What is the correct way to add the FortiExtender as an SD-WAN member?

Accepted Answer

Connect the FortiExtender to a physical port on the FortiGate and configure that port as an SD-WAN member.. When integrating a FortiExtender with a FortiGate for LTE backup in an SD-WAN setup, the correct method is to physically connect the FortiExtender to a physical port on the FortiGate. The physical port itself is then configured as an SD-WAN member, which allows the FortiGate to treat the LTE link as a standard SD-WAN interface, enabling SD-WAN rules, SLA monitoring, and automatic failover. The FortiExtender does not create a separate virtual interface; the physical port acts as the LTE interface.

Answer

Configure the FortiExtender as a standalone firewall and use IPsec between them.

Answer

Configure the FortiExtender as a separate VDOM and route between VDOMs.

Answer

Use a virtual-wire pair to connect the FortiExtender.

Question 13

A FortiGate is in a multi-area OSPF environment. The administrator needs to redistribute connected routes from area 1 into OSPF. Which THREE steps are required? (Choose three.)

Accepted Answer

Configure 'redistribute connected' under the OSPF configuration.. Option B is correct because redistribution of non-OSPF routes (such as directly connected networks) into OSPF requires the 'redistribute connected' command under 'config router ospf', which injects connected routes as external LSAs into the OSPF domain. Option C is correct because FortiGate requires a route map to be referenced with the redistribute statement to control which connected routes are actually redistributed; without a route map, the redistribution is not applied as intended. Option D is correct because redistributed routes enter OSPF as external type 2 (E2) by default, and the administrator must set the metric and metric-type values under the redistribute entry to define the external cost and LSA type (E1 or E2). Option A is not required because passive interfaces only suppress OSPF hellos on an interface; they do not perform redistribution of connected routes. Option E is not required because 'default-information originate' only injects a default route into OSPF and is unrelated to redistributing connected subnets from area 1.

Answer

Configure the connected interfaces as OSPF passive interfaces.

Answer

Enable 'default-information originate' to advertise a default route.

Question 14

An administrator wants to deploy FortiSwitch and FortiAP using LAN edge management from a FortiGate. Which TWO conditions must be met? (Choose two.)

Accepted Answer

The FortiGate must be configured with the FortiLink interface for FortiSwitch and a CAPWAP interface for FortiAP.. FortiGate uses a dedicated FortiLink interface (typically a hardware switch or aggregate interface) to manage FortiSwitch devices via L2 protocols, and a CAPWAP interface (a loopback or IP interface) to terminate CAPWAP tunnels from FortiAPs. These are the required interface types for LAN edge management, as specified in the FortiOS LAN edge deployment guide.

Answer

The FortiSwitch and FortiAP must be factory reset before connecting.

Answer

The FortiGate must have a valid FortiCare contract for unified management.

Answer

The FortiGate must have the 'set allowaccess' command enabled for HTTPS or SSH on the managing interface.

Question 15

A network admin is configuring SD-WAN on a FortiGate with two WAN members (port1, port2). The requirement is that traffic for Office 365 (source IP 10.1.1.0/24, destination IP 132.245.0.0/16) should use port1 primarily unless it fails the performance SLA, in which case it should use port2. Which SD-WAN rule configuration should the admin use?

Accepted Answer

Configure the rule with 'strategy = best quality', and enable 'set match-vip enable'. Use performance SLA to monitor port1. 'best quality' strategy allows SD-WAN to use performance SLA to monitor port1 and automatically fail over to port2 when port1 fails the SLA. This matches the requirement of using port1 primarily unless it fails the performance SLA. The 'set match-vip enable' is not directly relevant here but does not invalidate the rule; the core mechanism is the performance SLA-driven failover.

Answer

Configure the rule with 'strategy = spillover' and set spillover thresholds

Answer

Configure the rule with 'strategy = source-dest-ip' and include port1 and port2

Answer

Configure the rule with 'strategy = manual' and set the preferred member to port1