NSE7 Advanced Networking and SD-WAN Practice Test 6 — 15 Questions

Question 1

A FortiGate is configured with OSPF multi-area. The administrator wants to redistribute a static route into OSPF area 0 and ensure it is propagated to all areas. Which THREE steps are required? (Choose three.)

Accepted Answer

Ensure the static route has a valid next-hop and is in the routing table. To redistribute into OSPF, you need to configure redistribution under OSPF, optionally with a route map to set metrics. The route must be in the routing table. Also, OSPF must be enabled on appropriate interfaces to form adjacencies.

Answer

Set the OSPF network type to point-to-multipoint

Answer

Disable OSPF on all interfaces to prevent loops

Question 2

An administrator is configuring BGP with SD-WAN on a FortiGate. Which TWO statements are true about BGP and SD-WAN integration? (Choose two.)

Accepted Answer

SD-WAN performance SLA can override BGP best path selection. BGP learned routes can be used as SD-WAN members and can influence path selection based on attributes like AS path. SD-WAN rules can use BGP attributes for load balancing.

Answer

BGP must be disabled on interfaces used for SD-WAN

Answer

BGP learned routes cannot be used as SD-WAN members

Answer

BGP route redistribution is not supported with SD-WAN

Question 3

A network administrator configures SD-WAN on a FortiGate with two WAN members (port1, port2). They set up a performance SLA to measure latency to 8.8.8.8. The SLA shows both members are 'alive'. However, traffic matching an SD-WAN rule with 'best quality' strategy is not using the lowest-latency link. What is the MOST likely cause?

Accepted Answer

The performance SLA does not have 'latency' as the first metric in the priority order. The 'best quality' strategy selects based on the highest priority metric. By default, latency is not the highest priority; jitter and packet loss are considered first. The admin must configure the SLA to prioritize latency or adjust the SD-WAN rule strategy.

Answer

Both WAN members have the same cost in the SD-WAN configuration

Answer

The SD-WAN rule is configured with 'manual' strategy

Answer

The SD-WAN rule has 'set-match' enabled for source IP

Question 4

An administrator runs 'get router info bgp summary' and sees that the BGP session to a neighbor is in the 'Idle' state. The neighbor IP is reachable via ping. The BGP configuration uses loopback interfaces with 'update-source loopback1'. What is the MOST likely reason for the Idle state?

Accepted Answer

There is no route on the neighbor back to the FortiGate's loopback IP. BGP Idle state often indicates a TCP connection issue. If the update source is a loopback, the neighbor must have a route to that loopback IP, or the update-source must match the neighbor's configured remote-as and reachability.

Answer

The loopback interface is down or has no IP address assigned

Answer

The BGP neighbor's remote-as is misconfigured

Answer

The BGP timer values (keepalive/hold) are mismatched

Question 5

A FortiGate is configured with OSPF multi-area. The administrator wants to ensure that routes from area 0 are redistributed into area 1. Which OSPF configuration is required?

Accepted Answer

No additional configuration is needed; ABRs automatically advertise inter-area routes. OSPF automatically redistributes routes between areas. No special redistribution is needed; ABRs (Area Border Routers) advertise inter-area routes by default.

Answer

Enable 'redistribute connected' on the ABR

Answer

Set the 'area type' to 'nssa' on area 1

Answer

Configure a route redistribution policy under OSPF

Question 6

An administrator wants to use BFD to detect failures in an OSPF neighbor relationship faster than OSPF hello timers. They configure 'config router ospf' and 'set bfd enable'. However, BFD sessions are not coming up. What is a possible reason?

Accepted Answer

The interface has 'set bfd enable' missing under config system interface. BFD requires that the interface has BFD enabled at the interface level and that the OSPF neighbor also supports BFD.

Answer

OSPF is configured with 'network point-to-multipoint'

Answer

The FortiGate's BFD transmit interval is set too high

Question 7

You have configured a route map named 'RM-BGP' to filter routes redistributed from OSPF into BGP. The route map uses 'set community 65000:100' and 'set metric 50'. After applying the route map under 'config router bgp' with 'redistribute ospf route-map RM-BGP', you see that routes are being redistributed but without the community and metric. What is wrong?

Accepted Answer

The route map does not have any 'match' criteria, so it never applies. Route-map statements require 'match' conditions; if no match is specified, the route map may not match any routes. Also, the route map must have a sequence number with 'match ip address' or similar.

Answer

The route map is missing a 'set community' statement with 'additive' option

Answer

The BGP neighbor requires 'soft-reconfiguration inbound' to see the changes

Answer

The 'set metric' command is not supported for BGP redistribution

Question 8

A FortiGate has two equal-cost paths to a destination network through two different ISPs. The administrator wants to load balance traffic across both links using ECMP, but notices that all traffic uses only one link. What should the administrator check first?

Accepted Answer

Check that both routes have the same administrative distance and priority. ECMP requires that routes have the same distance and priority. Additionally, FortiGate uses source-destination IP hash by default; if sessions are sticky, one link may carry all traffic.

Answer

Configure 'set v4-ecmp-mode' to 'source-ip-based'

Answer

Verify that 'set load-balance-eligible' is enabled on both WAN interfaces

Answer

Disable 'anti-replay' on the security policy

Question 9

What is the purpose of using a prefix list in route redistribution?

Accepted Answer

To match routes based on IP prefix and prefix length. Prefix lists are used to match specific IP prefixes and prefix lengths, commonly used in route maps to filter routes.

Answer

To define a list of allowed source IPs for management access

Answer

To specify the next-hop for a set of routes

Answer

To set BGP community values on matched prefixes

Question 10

An administrator connects a FortiExtender to the FortiGate's USB port. The FortiGate detects the FortiExtender and creates a virtual interface 'wwan1'. However, the link status shows 'down'. The SIM card is inserted and the cellular plan is active. What should the administrator check?

Accepted Answer

The APN settings are not configured under the FortiExtender interface. FortiExtender requires provisioning from the FortiGate; the APN must be configured correctly, and the extender may need to be activated.

Answer

The FortiGate needs a security policy allowing traffic from wwan1

Answer

The FortiExtender firmware is not compatible with the FortiGate

Answer

The FortiExtender is not powered on

Question 11

You have configured VRF on a FortiGate with two VRFs: VRF 1 for guest traffic and VRF 2 for corporate traffic. You want to allow limited communication from guests to a corporate DNS server. What is the correct configuration step?

Accepted Answer

Configure route leaking between VRF 1 and VRF 2 for the DNS server's IP. VRF leaking requires route leaking between VRFs; a firewall policy alone does not cross VRFs unless routes are leaked.

Answer

Create a firewall policy from VRF 1 to VRF 2 allowing DNS traffic

Answer

Enable 'set allow-vrf' on the DNS server's interface

Answer

Place the DNS server in a management VDOM and use inter-VDOM links

Question 12

Which SD-WAN load balancing algorithm distributes traffic based on the number of active sessions per interface?

Accepted Answer

Sessions. The 'sessions' algorithm balances by session count. Other algorithms use volume, spillover, source-dest IP hash, or lowest cost.

Answer

Volume

Answer

Source-destination IP

Answer

Spillover

Question 13

An administrator configures a performance SLA to monitor a remote server. The SLA status shows 'dead' for one WAN member. The administrator checks the interface and sees that it is up and passing other traffic. What is the most likely cause?

Accepted Answer

The SLA probe is using TCP port 80 but the server is only responding to ICMP. Performance SLA probes may fail due to firewall rules blocking ICMP or the probe port, or the server not responding to the probe type.

Answer

The FortiGate's routing table does not have a route to the probe target

Answer

The interface is not added as an SD-WAN member

Answer

The SLA probe interval is set too high

Question 14

You want to use policy-based routing (PBR) to send traffic from a specific subnet to a different next-hop than the default route. Which configuration is required?

Accepted Answer

Configure a route map under 'config router policy'. Policy-based routing is configured under 'config router policy' with source/destination addresses and a set-next-hop action.

Answer

Create a firewall policy with 'set policy-based-route enable'

Answer

Enable 'set pbr-enforce-symmetric' on the interface

Answer

Configure a prefix list and apply to the static route

Question 15

A network administrator is configuring SD-WAN rules and wants to ensure that voice traffic is sent over the link with the lowest jitter. Which TWO configurations should the administrator apply? (Choose two.)

Accepted Answer

Set the SD-WAN rule strategy to 'best quality'. To use jitter as the selection metric, the performance SLA must include jitter measurement, and the SD-WAN rule strategy should be 'best quality' with jitter as the highest priority metric.

Answer

Set the SD-WAN rule strategy to 'lowest cost'

Answer

Configure the SD-WAN rule to use 'volume' load balancing

Answer

Enable 'set jitter-threshold' on the SD-WAN rule