NSE7 Advanced Networking and SD-WAN Practice Test 5 — 15 Questions

Question 1

A network administrator wants to configure SD-WAN on a FortiGate with two internet connections (port1 and port2). The requirement is to use the link with the lowest cost as the primary path for all traffic, unless it exceeds a threshold. Which SD-WAN load balancing algorithm should the administrator choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Lowest-cost. The 'Lowest-cost' algorithm (option C) is correct because it allows the administrator to assign a cost metric to each SD-WAN link and designate the link with the lowest cost as the primary path. Traffic will use this primary link until its cost exceeds a defined threshold, at which point the FortiGate will spill over traffic to the next lowest-cost link. This directly matches the requirement of using the lowest-cost link as primary unless a threshold is exceeded.

Answer

Spillover

Answer

Sessions

Answer

Volume

Question 2

A FortiGate is configured with SD-WAN using BGP. The administrator wants to influence outbound traffic to prefer one SD-WAN member over another based on BGP attributes. Which BGP attribute, when modified on the FortiGate, can achieve this for outbound traffic?

Accepted Answer

Local-preference. Local-preference is a well-known mandatory BGP attribute that is propagated within an AS to influence outbound traffic by indicating the preferred exit point. When modified on the FortiGate, a higher local-preference value makes the route more preferred for outbound traffic, allowing the administrator to steer traffic toward a specific SD-WAN member without affecting inbound routing.

Answer

Weight

Answer

AS-Path prepending

Answer

MED

Question 3

Which of the following is the primary purpose of BFD (Bidirectional Forwarding Detection) on a FortiGate?

Accepted Answer

To provide fast detection of link failures. BFD (Bidirectional Forwarding Detection) is a lightweight protocol designed to provide sub-second failure detection between two forwarding engines, such as FortiGate peers. Unlike routing protocol hellos (e.g., OSPF Hello at 10-second intervals), BFD can detect link or neighbor failures in as little as 50–100 ms, enabling faster convergence. This makes it the primary mechanism for rapid link failure detection in high-availability and SD-WAN deployments.

Answer

To synchronize routing tables between peers

Answer

To load balance traffic across multiple paths

Answer

To encrypt routing updates between peers

Question 4

An administrator is troubleshooting SD-WAN and runs the following CLI command:
 'execute sdwan-health-check status'
The output shows that one SD-WAN member has a status of 'dead'. What does this indicate?

Accepted Answer

The member has failed the health check probe to the target server. The 'execute sdwan-health-check status' command displays the results of active health-check probes sent to configured target servers. A status of 'dead' means that the SD-WAN member has failed to receive a successful response from the target server within the configured probe interval and retry count, indicating a loss of connectivity or reachability to that target. This is distinct from interface administrative status or SLA compliance, as the health check specifically tests end-to-end reachability to the probe target.

Answer

The member interface is administratively down

Answer

The member is not meeting the performance SLA thresholds

Answer

The SD-WAN member is not included in any SD-WAN rule

Question 5

A FortiGate has two WAN interfaces configured as SD-WAN members. The administrator wants traffic to specific destination IP addresses to use a particular member. Which SD-WAN configuration object should be used to achieve this?

Accepted Answer

SD-WAN rule. SD-WAN rules are the correct configuration object because they allow you to define policy-based forwarding (PBF) criteria, such as source/destination IP addresses, to steer traffic to a specific SD-WAN member interface. Unlike static routes, SD-WAN rules evaluate traffic against match conditions and then apply an explicit action to use a designated member or strategy, making them the precise tool for this requirement.

Answer

Route map

Answer

Prefix list

Answer

Performance SLA

Question 6

An administrator configures OSPF on a FortiGate with multiple areas. After configuration, the FortiGate does not become an ABR. What is the most likely reason?

Accepted Answer

There is no interface assigned to area 0. For a FortiGate to function as an OSPF Area Border Router (ABR), it must have at least one interface assigned to the backbone area (area 0) and at least one interface assigned to a non-backbone area. Without an interface in area 0, the FortiGate cannot generate Type 3 summary LSAs or perform inter-area routing, so it remains an internal router. Option D is correct because the absence of an interface in area 0 is the most direct and common reason for a FortiGate not becoming an ABR.

Answer

The router-id is not configured

Answer

The OSPF process is not enabled

Answer

The network type is set to point-to-point

Question 7

What is the function of a VRF (Virtual Routing and Forwarding) on a FortiGate?

Accepted Answer

To create multiple independent routing tables. VRF (Virtual Routing and Forwarding) on a FortiGate allows the creation of multiple independent routing tables within a single physical device. This enables network segmentation and traffic isolation at Layer 3, where each VRF maintains its own routing table, forwarding decisions, and interface associations, preventing routes from leaking between VRFs unless explicitly configured with route leaking.

Answer

To provide redundancy for routing protocols

Answer

To aggregate multiple physical interfaces into one logical interface

Answer

To encrypt traffic between different virtual domains

Question 8

A FortiGate is configured with SD-WAN and uses performance SLA to monitor link quality. The administrator sets the SLA threshold to jitter < 30ms. If a link has average jitter of 35ms, what is the status of that link in the SD-WAN health check?

Accepted Answer

Degraded. In FortiGate SD-WAN, when a link's measured jitter exceeds the configured Performance SLA threshold (30ms) but does not fail the SLA entirely, the link is marked as 'Degraded'. The SLA threshold defines the acceptable quality; exceeding it means the link is still alive but not meeting the desired performance, hence degraded.

Answer

Dead

Answer

Unavailable

Answer

Alive

Question 9

An administrator wants to integrate a FortiExtender with a FortiGate to provide cellular WAN connectivity. Which configuration step is required on the FortiGate to use the FortiExtender as an SD-WAN member?

Accepted Answer

Add the FortiExtender's interface to the SD-WAN zone. To use a FortiExtender as an SD-WAN member, the FortiExtender's physical or logical interface must be added to the SD-WAN zone on the FortiGate. This allows the FortiGate to apply SD-WAN rules, load balancing, and SLA-based path selection to traffic traversing the cellular WAN link. Without this step, the interface remains a standard WAN interface and cannot participate in SD-WAN policies.

Answer

Enable BGP on the FortiExtender interface

Answer

Create a firewall policy allowing traffic from the FortiExtender

Answer

Configure a static route pointing to the FortiExtender

Question 10

A FortiGate has ECMP configured with two equal-cost routes to a destination. The administrator wants to ensure that all packets from a given source IP use the same next-hop. Which ECMP load balancing method should be configured?

Accepted Answer

Source IP. Source IP-based ECMP load balancing uses the source IP address to select the next-hop for all packets in a flow. This ensures that packets from a given source IP always take the same path, maintaining session consistency without requiring stateful inspection.

Answer

Destination IP

Answer

Source-destination IP

Answer

Round robin

Question 11

An administrator configures a route map on a FortiGate to redistribute connected routes into OSPF. The route map sets a metric of 100. After applying, the redistributed routes appear with metric 20. What is the most likely reason?

Accepted Answer

The route map is not applied to the redistribution configuration. The most likely reason the redistributed routes appear with metric 20 instead of the configured 100 is that the route map was not applied to the redistribution configuration. In FortiGate OSPF redistribution, a route map must be explicitly referenced under the 'redistribute connected' command; otherwise, the route map is ignored, and OSPF uses its default metric of 20 for redistributed connected routes.

Answer

The route map is applied to the wrong direction

Answer

OSPF does not allow metric setting via route maps

Answer

The metric type is set to type 1

Question 12

An administrator needs to integrate a FortiSwitch with a FortiGate for LAN edge management. The FortiSwitch will be used to provide access ports for end users. Which THREE configuration steps are required on the FortiGate?

Accepted Answer

Create a port profile that defines VLAN and security settings for the access ports. A port profile on the FortiGate defines the VLAN membership, allowed VLANs, and security policies (e.g., 802.1X, MAC authentication bypass) that are pushed to the FortiSwitch for its access ports. This is the primary mechanism for centrally managing access port configuration in a FortiSwitch deployment.

Answer

Configure a DHCP server on the FortiGate to assign IP addresses to FortiSwitch management

Answer

Enable STP on the FortiGate interface

Question 13

A network administrator needs to configure SD-WAN on a FortiGate to distribute traffic across two WAN links based on session count. Which load balancing algorithm should be selected in the SD-WAN rule?

Accepted Answer

Sessions. The 'Sessions' load balancing algorithm distributes new sessions across SD-WAN members based on the current session count, ensuring an even distribution of sessions. This directly matches the requirement to distribute traffic based on session count, as it selects the member with the fewest active sessions for each new session.

Answer

Volume

Answer

Lowest-cost

Answer

Spillover

Question 14

An administrator configures a performance SLA for SD-WAN health checks. The SLA uses a ping probe to 8.8.8.8 every 2 seconds with a latency threshold of 150 ms and jitter threshold of 20 ms. After some time, the SD-WAN rule still shows the member as 'dead'. Which command should the administrator use to verify the probe results?

Accepted Answer

diagnose sys sdwan health-check. The 'diagnose sys sdwan health-check' command is the correct tool because it provides real-time, detailed probe results for each SD-WAN health-check member, including latency, jitter, packet loss, and SLA status. This allows the administrator to see exactly why the member is marked as 'dead', such as exceeding the 150 ms latency or 20 ms jitter thresholds. The 'show system sdwan health-check' command only displays configured parameters, not live probe data.

Answer

show system sdwan health-check

Answer

diagnose sys session list

Answer

execute ping-options source 8.8.8.8

Question 15

A FortiGate is configured with OSPF in multiple areas and redistributes connected routes into OSPF. The administrator notices that routes from area 1 are not appearing in area 0. The area 0 routers show the routes as 'O E2' but with an invalid metric. What is the most likely cause?

Accepted Answer

Redistribution is configured without a route map. When a route is redistributed into OSPF without a route map, it is advertised as a Type 5 LSA (external) with a default metric of 20. However, if the redistribution is not properly filtered or the metric is not explicitly set, the route may appear with an invalid metric (e.g., 0 or unexpected value) on the ABR. The ABR will flood this LSA into area 0, but the metric inconsistency causes the routes to be seen as 'O E2' with an invalid metric, preventing proper route installation.

Answer

OSPF network type is broadcast on one side and point-to-point on the other

Answer

The interface costs are misconfigured

Answer

The ABR has 'area 0 stub' configured