NSE7 Advanced Networking and SD-WAN Practice Test 5 — 15 Questions

Question 1

A FortiGate is configured with OSPF and multiple areas. The administrator wants to prevent type 3 LSAs from entering a specific area, while still allowing inter-area routing. Which TWO configurations can achieve this?

Accepted Answer

Configure the area as a stub area. Type 3 LSAs are summary LSAs. To block them, you can configure the area as a stub area (which blocks type 5 as well) or use an area filter list to filter specific prefixes.

Answer

Configure the area as an NSSA

Answer

Set the OSPF network type to point-to-multipoint

Question 2

An administrator needs to integrate a FortiSwitch with a FortiGate for LAN edge management. The FortiSwitch will be used to provide access ports for end users. Which THREE configuration steps are required on the FortiGate?

Accepted Answer

Create a port profile that defines VLAN and security settings for the access ports. The FortiGate acts as the controller for managed FortiSwitches. Key steps include enabling CAPWAP, creating a port profile, and authorizing the switch.

Answer

Configure a DHCP server on the FortiGate to assign IP addresses to FortiSwitch management

Answer

Enable STP on the FortiGate interface

Question 3

A network administrator needs to configure SD-WAN on a FortiGate to distribute traffic across two WAN links based on session count. Which load balancing algorithm should be selected in the SD-WAN rule?

Accepted Answer

Sessions. The 'sessions' algorithm distributes new sessions across members proportionally to the number of active sessions, achieving session-based load balancing.

Answer

Volume

Answer

Lowest-cost

Answer

Spillover

Question 4

An administrator configures a performance SLA for SD-WAN health checks. The SLA uses a ping probe to 8.8.8.8 every 2 seconds with a latency threshold of 150 ms and jitter threshold of 20 ms. After some time, the SD-WAN rule still shows the member as 'dead'. Which command should the administrator use to verify the probe results?

Accepted Answer

diagnose sys sdwan health-check. The 'diagnose npu np6 sdf-wan health-check' command shows detailed probe statistics per member, including latency, jitter, and packet loss, helping to identify why the SLA is failing.

Answer

show system sdwan health-check

Answer

diagnose sys session list

Answer

execute ping-options source 8.8.8.8

Question 5

A FortiGate is configured with OSPF in multiple areas and redistributes connected routes into OSPF. The administrator notices that routes from area 1 are not appearing in area 0. The area 0 routers show the routes as 'O E2' but with an invalid metric. What is the most likely cause?

Accepted Answer

Redistribution is configured without a route map. Redistributed routes are external (O E2). For an ABR to propagate a Type 5 LSA into another area, route summarization or a route map is needed; otherwise, external routes are not injected into other areas by default. However, if the ABR is not performing redistribution properly, the metric may be incorrect. The most common cause is missing a route map to set the metric.

Answer

OSPF network type is broadcast on one side and point-to-point on the other

Answer

The interface costs are misconfigured

Answer

The ABR has 'area 0 stub' configured

Question 6

A FortiGate administrator sees the following output:

"diagnose sys session filter dport 443
diagnose sys session list
session info: proto=6 proto_state=01 duration=3600 expire=3599"

What does this session duration and expire time indicate?

Accepted Answer

The session has a timeout of 7200 seconds (2 hours). Duration 3600 seconds (1 hour) and expire 3599 seconds means the session has been active for 1 hour and will expire in about 1 hour, total timeout 2 hours, which matches the default TCP session timeout.

Answer

The session is about to be torn down

Answer

The session is newly established

Answer

The session is using UDP protocol

Question 7

An administrator wants to ensure that all traffic from a specific LAN subnet (192.168.10.0/24) to the internet uses a particular WAN interface (wan1) in an SD-WAN setup, while other traffic uses wan2. What is the correct configuration to achieve this?

Accepted Answer

Configure an SD-WAN rule with source address matching 192.168.10.0/24 and set the preferred member to wan1. SD-WAN rules are used to match traffic based on criteria and direct it to specific members. The rule would match source 192.168.10.0/24 and set the destination interface to wan1.

Answer

Create a policy-based routing rule with source 192.168.10.0/24 and set outgoing interface to wan1

Answer

Set the default route for wan1 with a higher distance

Answer

Use a route map with prefix list to match the subnet and set next-hop to wan1

Question 8

What is the purpose of BFD (Bidirectional Forwarding Detection) in a FortiGate routing configuration?

Accepted Answer

To detect forwarding path failures quickly. BFD provides fast failure detection for routing protocols like OSPF and BGP, enabling sub-second convergence by detecting link failures faster than protocol hello timers.

Answer

To encrypt routing protocol traffic

Answer

To authenticate routing peers

Answer

To provide load balancing across multiple paths

Question 9

A FortiGate with two WAN interfaces configured in an SD-WAN setup uses the 'lowest-cost' load balancing algorithm. The performance SLA monitors latency and jitter. If wan1 has a cost of 10 and wan2 has a cost of 20, but wan1 is experiencing 50% packet loss, what will happen to traffic?

Accepted Answer

Traffic is sent to wan2 because wan1 is considered dead. The 'lowest-cost' algorithm selects the member with the lowest cost. However, if a member fails the performance SLA (e.g., high packet loss), it is considered 'dead' and will not be used, even if its cost is lower. Traffic will then be sent to the next lowest-cost member that is alive.

Answer

Traffic is distributed equally between both links

Answer

Traffic is dropped until wan1 recovers

Answer

Traffic continues using wan1 because cost is lower

Question 10

Which command is used on a FortiGate to view the current routing table including VRF instances?

Accepted Answer

get router info routing-table all. Option B is correct because 'get router info routing-table all' is the FortiGate CLI command that displays the complete routing table, including all VRF instances. This command retrieves the kernel routing table entries for every VRF, showing routes from all routing protocols (static, OSPF, BGP, etc.) and is the standard way to view the full routing context on FortiGate.

Answer

show ip route

Answer

diagnose ip route list

Answer

execute router list

Question 11

An administrator wants to integrate a FortiExtender with a FortiGate to provide WAN connectivity. Which interface type is used on the FortiGate to connect to the FortiExtender?

Accepted Answer

wan. FortiExtender connects via a WAN interface, typically configured as a 'wan' or 'vlan' interface. The FortiGate automatically detects the FortiExtender and creates a 'wwan' interface for the cellular link.

Answer

lan

Answer

dmz

Answer

loopback

Question 12

A FortiGate has multiple equal-cost routes to the same destination via two different interfaces. ECMP load balancing is enabled. What determines how traffic is distributed among the routes?

Accepted Answer

A hash of source and destination IP addresses. ECMP uses a hash algorithm based on source/destination IP and optionally ports to distribute sessions. The 'load-balance' setting in the routing configuration determines the method (e.g., source-dest-ip, source-dest-port).

Answer

The interface speed

Answer

Round-robin per packet

Answer

The route metric

Question 13

An administrator configures a route map named RMAP_EXPORT that sets a community for routes redistributed into BGP. The route map is applied to the 'redistribute connected' statement under BGP. However, the connected routes are not being advertised to BGP peers. What is the most likely cause?

Accepted Answer

The route map does not have a 'match ip address' statement. Route maps used for redistribution require a 'match' statement to select routes. If the route map has only a 'set' action without a 'match', it may not match any routes, resulting in no redistribution. A common mistake is omitting the 'match' clause.

Answer

The BGP neighbor is not configured with 'route-map in'

Answer

Connected routes are not in the routing table

Answer

The route map is missing a 'set community' action

Question 14

Which feature allows a FortiGate to use multiple VRFs to separate routing tables for different customers or departments on the same physical device?

Accepted Answer

VRF. VRF (Virtual Routing and Forwarding) enables multiple independent routing table instances on a single FortiGate, allowing traffic separation without additional hardware.

Answer

SD-WAN

Answer

VDOM

Answer

Policy-based routing

Question 15

A network administrator is troubleshooting an SD-WAN setup where traffic from a specific application is not being load-balanced as expected. The SD-WAN rule uses the 'volume' load balancing algorithm. Which TWO factors could cause traffic to not be distributed equally? (Choose two.)

Accepted Answer

One of the SD-WAN members is a PPPoE interface. Volume algorithm uses a weighted distribution. If one member is a PPPoE interface, it cannot be used for load balancing due to NAT issues. Also, if traffic is asymmetric, the session may not be balanced properly.

Answer

The SD-WAN rule is configured with 'mode = load-balance' but the algorithm is set to 'source-dest-ip'

Answer

The performance SLA has a high packet loss threshold causing the member to be dead

Answer

The traffic is encrypted and cannot be inspected