NSE7 Advanced Networking and SD-WAN Practice Test 5 — 15 Questions

Question 1

An administrator configures an SD-WAN rule with the 'volume' load balancing algorithm. The two WAN members have bandwidth capacities: port1 = 100 Mbps, port2 = 50 Mbps. Traffic is HTTP and HTTPS from internal users to the internet. How will the traffic be distributed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Traffic is sent to the member with the least number of bytes transmitted, resulting in a balanced distribution proportional to bandwidth. The 'volume' load balancing algorithm distributes traffic based on the cumulative bytes transmitted on each WAN member, sending new traffic to the member with the least total bytes transmitted. This results in a distribution proportional to the bandwidth capacities (port1: 100 Mbps, port2: 50 Mbps), ensuring that port1 carries approximately twice the traffic volume of port2 over time.

Answer

All traffic uses port1 until it reaches 100 Mbps, then uses port2

Answer

Traffic is distributed evenly session-by-session (round-robin)

Answer

Source-destination IP pairs are hashed to a specific member

Question 2

You run the following command on a FortiGate:

diagnose sys session filter dport 443
diagnose sys session list

Output:
proto=6 proto_state=01 duration=3600 expire=3599

What does the 'proto_state=01' indicate?

Accepted Answer

The session is in the 'init' state, meaning the first SYN packet has been seen but the handshake is not complete. In FortiGate session diagnostics, 'proto_state=01' for TCP (proto=6) indicates the session is in the 'init' state, meaning only the initial SYN packet has been observed and the three-way handshake has not yet completed. This is a transient state before the session transitions to 'established' (proto_state=02) once the final ACK of the handshake is received.

Answer

The session is fully established and in the 'established' state

Answer

The session is a UDP or ICMP session with no state tracking

Answer

The session is being torn down (FIN or RST received)

Question 3

A FortiGate is configured with two VRF instances (VRF1 and VRF2). The admin needs to allow traffic from VRF1 to reach a server in VRF2. The server is directly connected to the FortiGate on an interface in VRF2. What configuration is required?

Accepted Answer

Use VRF route leaking with route maps to export necessary routes between VRFs. B is correct because VRF route leaking is the standard method to enable communication between separate VRF instances on a FortiGate. This involves using route maps to selectively export routes from VRF2 into VRF1, allowing traffic from VRF1 to reach the server in VRF2. Without route leaking, VRFs are isolated by default, and no other mechanism (like static routes or firewall policies alone) can bridge the routing table separation.

Answer

Add both VRFs to the same VDOM

Answer

Configure a static route in VRF1 pointing to the server's IP via the VRF2 interface

Answer

Configure a firewall policy with source VRF1 and destination VRF2

Question 4

An administrator notices that when a BGP session goes down, failover to the backup path takes about 30 seconds. The admin wants to reduce the failover time to less than 1 second. Which technology should the administrator implement?

Accepted Answer

Enable BFD on the BGP neighbor and the associated interface. BFD (Bidirectional Forwarding Detection) provides sub-second failure detection for BGP sessions by sending rapid hello packets independently of the BGP keepalive mechanism. By enabling BFD on both the BGP neighbor and the associated interface, the router can detect a link or neighbor failure in milliseconds (e.g., 50-300 ms), allowing BGP to converge and switch to the backup path in under 1 second, far faster than the default 30-second hold timer.

Answer

Configure BGP fast external failover

Answer

Increase the BGP keepalive timer to 1 second

Answer

Use policy-based routing with SLA monitoring

Question 5

An administrator is configuring a FortiGate as a LAN edge device with FortiSwitch and FortiAP. Which feature must be enabled on the FortiGate to centrally manage the FortiSwitch and FortiAP devices?

Accepted Answer

FortiLink. FortiLink is the proprietary protocol that enables a FortiGate to centrally manage FortiSwitch and FortiAP devices as logical extensions of the FortiGate itself. When FortiLink is enabled on a FortiGate interface, the FortiGate automatically discovers, provisions, and manages connected FortiSwitch and FortiAP units, handling VLAN assignment, PoE control, and firmware synchronization without requiring separate management platforms.

Answer

CAPWAP

Answer

LLDP

Answer

SNMP

Question 6

A FortiGate has an SD-WAN configuration with two members (wan1, wan2). The performance SLA monitors latency to 8.8.8.8. The admin notices that even when the SLA is satisfied on both members, all traffic uses wan1. The SD-WAN rule is configured with 'strategy = best quality'. What is the most likely cause?

Accepted Answer

The best quality strategy selects the member with the best SLA metric, which is wan1 by default when both meet SLA. When the SD-WAN rule uses 'best quality' strategy and both members meet the performance SLA, FortiGate selects the member with the best (lowest) latency metric. By default, if both members have equal SLA satisfaction, the first member in the SD-WAN configuration (wan1) is chosen as the tie-breaker. This explains why all traffic uses wan1 even though both links are healthy.

Answer

A firewall policy is overriding the SD-WAN rule

Answer

The performance SLA is incorrectly configured, causing wan2 to be ignored

Answer

The SD-WAN rule has 'set match-vip disable' which forces all traffic to wan1

Question 7

An administrator wants to integrate a FortiExtender with a FortiGate to provide additional WAN connectivity. Which configuration is required on the FortiGate to enable the FortiExtender to operate as a secondary WAN interface?

Accepted Answer

Configure the FortiExtender under Network > FortiExtender and assign it to a WAN interface. When a FortiExtender is configured under Network > FortiExtender and assigned to a WAN interface, the FortiGate treats it as a secondary WAN link, allowing it to participate in SD-WAN or load-balancing policies. The FortiExtender operates in its default routed mode, where it receives a public IP from the cellular network and the FortiGate uses it as an additional gateway for outbound traffic.

Answer

Enable LLDP on the port connected to the FortiExtender

Answer

Set the FortiExtender to bridge mode

Answer

Create a VLAN interface for the FortiExtender

Question 8

A network engineer is troubleshooting an OSPF multi-area setup on a FortiGate. The FortiGate is an ABR (Area Border Router) connecting area 0 and area 1. The engineer notices that routes from area 1 are not being advertised into area 0. Which TWO of the following are possible causes? (Select TWO.)

Accepted Answer

OSPF is not enabled on the interface in area 1, or the network type is mismatched. Option A is correct because OSPF must be enabled on the interface belonging to area 1 and the interface's network type must match the neighbor's (e.g., broadcast vs point-to-point); if OSPF is not enabled on that interface or the network type is mismatched, no adjacency forms in area 1, so no area 1 routes are learned and thus none can be advertised into area 0. Option C is correct because an ABR must have at least one interface in area 0 (the backbone) to generate inter-area LSAs into area 0; if the FortiGate has no direct connection to area 0, it cannot function as a proper ABR and area 1 routes will not be injected into area 0. Option B is not needed because redistributing connected networks is unrelated to advertising OSPF-learned inter-area routes between areas. Option D is incorrect because a static route to area 1 would not override OSPF's inter-area route advertisement behavior in this manner. Option E is incorrect because administrative distance affects route selection in the routing table, not the OSPF LSA flooding and inter-area advertisement process.

Answer

The 'redistribute connected' command is missing

Answer

The FortiGate has a static route to area 1 that overrides OSPF

Answer

The administrative distance for OSPF is set too high

Question 9

An administrator is configuring BGP on a FortiGate to peer with an ISP router. The FortiGate is advertising a prefix (203.0.113.0/24) to the ISP. To ensure that traffic to the prefix is load balanced across two WAN links (port1 and port2) using SD-WAN, the administrator must configure which THREE of the following? (Select THREE.)

Accepted Answer

Define both port1 and port2 as SD-WAN members. Option A is correct because SD-WAN can only load balance traffic across interfaces that are explicitly configured as SD-WAN members, so both port1 and port2 must be added to the SD-WAN zone/member list. Option C is correct because the SD-WAN rule must specify a load-balancing mode such as 'sessions' (or another supported algorithm) so that traffic is distributed across the two WAN links rather than following a single best-path decision. Option E is correct because an SD-WAN rule is required to match the traffic destined to the advertised prefix and apply the load-balancing algorithm to it; without the rule, the members and algorithm have no effect. Option B is not required for load balancing itself—a performance SLA is used for link health monitoring and quality-based steering, not for distributing sessions across links. Option D is incorrect because BGP AS number configuration is unrelated to SD-WAN load balancing; both WAN links can use the same or different BGP peering arrangements, and the AS number does not control per-session load distribution.

Answer

Configure a performance SLA to monitor each link

Answer

Configure BGP to use the same AS number on both members

Question 10

A FortiGate is deployed as a LAN edge switch with multiple FortiSwitch units connected. The administrator wants to configure VLANs and manage the switches centrally. Which TWO features must be enabled on the FortiGate to achieve this? (Select TWO.)

Accepted Answer

Create VLAN interfaces on the FortiGate and assign them to the FortiLink interface. VLAN interfaces must be created on the FortiGate and assigned to the FortiLink interface to enable centralized VLAN management. The FortiGate acts as the controller, pushing VLAN configurations to connected FortiSwitch units via the FortiLink tunnel, allowing the administrator to manage all VLANs from a single point without logging into each switch individually.

Answer

LLDP-MED

Answer

Configure a separate management VRF

Answer

STP (Spanning Tree Protocol) on the FortiGate

Question 11

An administrator configured an SD-WAN rule to steer traffic to a specific member interface using the 'lowest-cost' strategy. After applying, the traffic is not being load-balanced as expected. Which configuration element is MOST likely missing?

Accepted Answer

A performance SLA has not been assigned to the SD-WAN member interfaces.. The 'lowest-cost' strategy in Fortinet SD-WAN selects the member interface with the lowest cost value. However, without a performance SLA assigned to the SD-WAN member interfaces, the SD-WAN rule cannot dynamically measure link quality or update interface costs based on real-time conditions. As a result, the rule defaults to static cost values or may not load-balance traffic at all, because the SLA is required to trigger cost-based path selection and failover. Assigning an SLA enables the FortiGate to monitor link performance and adjust the effective cost, allowing proper load balancing across multiple members.

Answer

The 'best-quality' strategy was inadvertently selected instead.

Answer

The SD-WAN member interfaces are not in the same zone.

Answer

The 'update-static-route' option is disabled on the SD-WAN member.

Question 12

A FortiGate has OSPF configured in multiple areas. The administrator wants to redistribute routes from area 0 into area 1 with a metric of 10. Which command is correct?

Accepted Answer

config router ospf
  set redistribute "ospf" metric 10. None of the provided commands correctly set the metric for inter-area OSPF routes. OSPF automatically floods Type 3 LSAs between areas; the metric is determined by interface costs and cannot be directly set via redistribution. Redistributing OSPF into the same process is not a supported method for inter-area metric control.

Answer

config router ospf
  config redistribute "ospf"
    set status enable
    set metric 10
  end

Answer

config router ospf
  config redistribute "connected"
    set metric 10
  end

Answer

config router ospf
  config area
    edit 1
      set type nssa
    end

Question 13

An administrator configures two SD-WAN members (port1, port2) with performance SLAs. The SD-WAN rule uses 'best-quality' strategy. During a failover test, the primary member port1 becomes unavailable but traffic does not switch to port2. What should the administrator check first?

Accepted Answer

The SD-WAN rule is not configured to use the performance SLA.. When a physical interface goes down, FortiGate immediately marks the SD-WAN member as dead, regardless of SLA thresholds. Traffic should fail over to port2. The most likely reason is that the SD-WAN rule is not actually configured to use the performance SLA (option A) or the member is not part of the SLA. Option C is incorrect because SLA failover thresholds only matter when the interface is up but performance degrades; an interface-down event should trigger immediate failover.

Answer

The 'set status' on the performance SLA is 'passive'.

Answer

The performance SLA's failover threshold is not met.

Answer

The 'update-static-route' is enabled on port1.

Question 14

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is using TCP and has been up for 3600 seconds, with 3599 seconds remaining before expiry.. The output shows a TCP session (proto=6) with a duration of 3600 seconds and an expire value of 3599 seconds. In FortiGate, 'duration' is the time since session creation, and 'expire' is the remaining time before removal. The 'proto_state=01' indicates the initial SYN-SENT state (not established), but this does not affect the interpretation of duration and expire values. Option A is incorrect because proto_state=01 actually represents a half-open (SYN-SENT) state, but the expire value is 3599 seconds, not 3600. Option B is incorrect because duration is not idle time. Option D is incorrect because UDP uses proto=17.

Answer

The session is in a half-open state (proto_state=01) and will expire in 3600 seconds.

Answer

The session has been idle for 3600 seconds and will be removed in 3599 seconds.

Answer

The session is UDP and has 3600 seconds to live.

Question 15

An administrator wants to load-balance traffic across two WAN links using ECMP. The routes have equal distances and metrics. However, traffic is only using one of the links. What could be the cause?

Accepted Answer

The routes are learned via different routing protocols with different administrative distances.. ECMP (Equal-Cost Multi-Path) requires routes to have identical administrative distances (AD) to be considered equal-cost. If routes are learned via different routing protocols (e.g., OSPF with AD 110 and static with AD 1), the FortiGate will prefer the route with the lower AD, even if metrics are equal. This causes traffic to use only the preferred link, as the other route is not installed in the routing table for ECMP selection.

Answer

ECMP is not enabled globally under config system settings.

Answer

The firewall policy is configured to use a specific egress interface.

Answer

The traffic is session-based and ECMP uses per-packet load balancing.