NSE7 Advanced Networking and SD-WAN Practice Test 6 — 15 Questions

Question 1

Which BGP attribute is used by FortiGate SD-WAN to influence outbound traffic path selection?

Accepted Answer

Local Preference

Answer

Next Hop

Answer

MED

Answer

AS Path

Question 2

An administrator configures a route-map to match prefix-list 'PREFIX' and set metric 20. Which OSPF route redistribution uses this route-map correctly?

Accepted Answer

config router ospf
  config redistribute "connected"
    set route-map "RM"
  end. In FortiOS, the route-map is applied to a specific redistribution rule under 'config router ospf' using the 'set route-map' command within the 'config redistribute' block. This correctly associates the route-map 'RM' with the redistribution of connected routes into OSPF, matching the prefix-list 'PREFIX' and setting the metric to 20.

Answer

config router policy
  config route-map
    edit "RM"
      config rule
        set match-ip-address "PREFIX"
        set set-metric 20
      end
    end

Answer

config router ospf
  set route-map "RM"

Answer

config router prefix-list
  edit "PREFIX"
    set rule permit 10.0.0.0/8
  end

Question 3

An administrator needs to configure a FortiGate to use two WAN links for internet traffic with failover and load balancing. Which TWO steps are required?

Accepted Answer

Define SD-WAN rules to match internet-bound traffic.. Option E is correct because SD-WAN functionality requires each participating WAN link to be added as an SD-WAN member interface, which is the foundational step before any failover or load-balancing behavior can occur. Option D is correct because SD-WAN rules define how traffic is matched and steered across those members, so a rule matching internet-bound traffic is needed to apply load balancing and failover to that traffic. Option A is not required for basic failover and load balancing, since performance SLAs are used for advanced health checks and quality-based routing, not as a mandatory step for simple SD-WAN operation. Option B is incorrect because 'spillover' is not an SD-WAN zone mode; load balancing and failover are controlled through SD-WAN rules and member configuration. Option C is incorrect because NAT is configured on firewall policies or the outgoing interface, not enabled on the SD-WAN zone itself as a required SD-WAN setup step.

Answer

Configure a performance SLA for each SD-WAN member.

Answer

Set the SD-WAN zone to 'spillover' mode.

Answer

Enable NAT on the SD-WAN zone.

Question 4

A FortiGate in a multi-area OSPF network is not learning routes from area 1. Which THREE items could be causing this?

Accepted Answer

There is a firewall policy blocking OSPF traffic between areas.. Option C is correct because OSPF relies on IP protocol 89 (and multicast 224.0.0.5/224.0.0.6) for adjacency and LSA exchange, so a firewall policy blocking OSPF between areas would prevent area 1 routes from being learned. Option E is correct because if the interface in area 1 is administratively down, no OSPF adjacency can form on that link, so no LSAs from area 1 will be received. Option A is not correct because 'set type' is not a valid OSPF area configuration parameter on FortiGate; area type is set with commands like 'set type stub' under 'config router ospf' area settings, and its absence would not by itself stop normal area 1 routes. Option B is not correct because redistribution controls importing external routes into OSPF, not learning intra-area routes from area 1. Option D is not correct because a stub area still accepts and advertises intra-area and inter-area routes; it only blocks Type 5 external LSAs, so it would not prevent learning area 1 routes.

Answer

The ABR is not configured with 'set type' for area 1.

Answer

The 'set redistribute' option is missing on the ABR.

Answer

Area 1 is configured as a stub area and does not accept external routes.

Question 5

An administrator wants to use policy-based routing to forward traffic from subnet 192.168.1.0/24 to a specific next-hop via port2. Which TWO configuration elements are needed?

Accepted Answer

A route-map that matches the source subnet and sets the next-hop.. Policy-based routing (PBR) on FortiGate is implemented with a route-map that matches traffic and sets the next-hop, so option B is required: the route-map's match clause identifies the source subnet 192.168.1.0/24 and its set clause redirects the traffic to the specific next-hop reachable via port2. Option D is also required because the match condition for the source subnet is typically expressed with a prefix-list (or an access-list) referencing 192.168.1.0/24, which the route-map then calls; without this matching object the route-map has nothing to select the subnet with. Option A is not needed because SD-WAN rules are a separate SD-WAN feature, not the mechanism used for classic policy-based routing. Option C is wrong because a static route with a higher administrative distance only affects normal destination-based route selection and cannot match a source subnet or force a next-hop per source. Option E is wrong because a firewall policy with action 'accept' only permits traffic and does not perform next-hop selection.

Answer

An SD-WAN rule overriding the routing decision.

Answer

A static route with a higher administrative distance.

Answer

A firewall policy matching the traffic with action 'accept'.

Question 6

A FortiGate is running OSPF with multiple areas. The administrator needs to redistribute a static route into OSPF. Which command will correctly configure redistribution of static routes into OSPF process 10?

Accepted Answer

config router ospf
 set redistribute static enable
end. In FortiOS, the command to redistribute static routes into OSPF is configured directly under the OSPF process using `set redistribute static enable` within `config router ospf`. This enables the redistribution of static routes into OSPF process 10, as specified in the question.

Answer

config router ospf
 config redistribute
  edit static
   set status enable
  next
 end
end

Answer

config router policy
 set redistribute static
end

Answer

config router static
 set redistribute ospf
end

Question 7

A FortiGate administrator needs to configure BFD (Bidirectional Forwarding Detection) on a BGP peer to quickly detect link failures. Which CLI command enables BFD on the BGP neighbor 10.1.1.1?

Accepted Answer

config router bgp
 config neighbor
  edit 10.1.1.1
   set bfd enable
  next
 end
end. BFD must be enabled specifically under the BGP neighbor configuration to associate BFD with the BGP session. The `config router bgp` → `config neighbor` → `set bfd enable` command activates BFD for that neighbor, allowing rapid link failure detection independent of BGP hold timers.

Answer

config router policy
 set bfd enable
end

Answer

config system interface
 edit port1
  set bfd enable
 next
end

Answer

config router static
 set bfd enable
end

Question 8

A FortiGate has multiple VRFs. The administrator wants to leak a route from VRF1 to VRF2. Which configuration is required?

Accepted Answer

Configure route leaking using route maps and set vrf command under VRF1's routing process. Route leaking between VRFs on a FortiGate is achieved by configuring route maps with the `set vrf` command under the source VRF's routing process. This allows specific routes from VRF1 to be imported into VRF2, enabling controlled inter-VRF communication without requiring a VDOM or static route workaround.

Answer

Use the config router vrf-leak command to define leaking rules

Answer

Enable inter-VRF routing on the VDOM

Answer

Configure a static route in VRF2 pointing to the next-hop in VRF1 with a different administrative distance

Question 9

An administrator configures policy-based routing (PBR) on a FortiGate to route traffic from a specific subnet through an MPLS link. The PBR is configured under config router policy. However, traffic from that subnet is still using the default route. What is the most likely issue?

Accepted Answer

The firewall policy is not allowing traffic to use the PBR. On FortiGate, PBR is evaluated before the firewall policy lookup. However, if the firewall policy denies the traffic (e.g., no matching policy or action is deny), the traffic is dropped before it reaches the routing table, so PBR never applies. Additionally, if the matching firewall policy has a 'set routing' override or uses a different route, it can bypass the PBR rule. The most common issue is that the firewall policy is not properly configured to allow traffic from the specified subnet, or it has a policy-based route override that supersedes the PBR rule. There is no requirement to enable PBR on the firewall policy for classic PBR.

Answer

The PBR policy does not have a set tos or set dscp value

Answer

The PBR policy has a higher priority number than the default route

Answer

The MPLS link is down

Question 10

A FortiGate is configured with a route map named RM_OSPF that sets a metric of 100 for redistributed routes. The route map is applied to redistribution into OSPF. After applying, the redistributed routes have a metric of 20. What could be the cause?

Accepted Answer

The OSPF process has a default-metric of 20 that overrides the route map. In FortiOS, when redistributing routes into OSPF with a route map that sets a metric, the route map's set command should override the default-metric configured under the OSPF process. However, if the OSPF process has a default-metric of 20, and the route map is applied correctly, the metric set by the route map will be used. The fact that the redistributed routes have a metric of 20 indicates that the route map was not applied as expected. The most common reason is that the OSPF default-metric value overrides the route map's set metric when the route map is not properly configured or referenced, but in this case the route map is applied but the default-metric takes precedence due to a known behavior in certain FortiOS versions where the default-metric command overrides the route map's set metric. Therefore, option C correctly identifies the cause.

Answer

The route map does not have a match statement and therefore is not applied

Answer

The route map is applied in the wrong direction

Answer

The redistributed route is already in OSPF with a metric of 20

Question 11

An administrator is troubleshooting an SD-WAN rule that is not matching expected traffic. The SD-WAN rule uses a custom application category and has a performance SLA attached. Which two conditions must be true for the traffic to be matched by the SD-WAN rule? (Select TWO.)

Accepted Answer

The traffic must be identified by the application control sensor as the configured application category. Option C is correct because an SD-WAN rule that references a custom application category depends on the application control sensor to identify the traffic as belonging to that category; if the sensor does not classify the flow as the configured application, the SD-WAN rule cannot match it. Option E is correct because SD-WAN rules are evaluated only for traffic that is permitted and steered by a firewall policy with SD-WAN enabled; without that policy match, the traffic never reaches SD-WAN rule processing. Option A is not required because the performance SLA being up for a member affects member selection and failover, not whether the rule matches the traffic. Option B is not required because the rule is based on a custom application category, not on hardcoded ports 80 or 443. Option D is not required because SD-WAN matching does not require the source IP to be in the same subnet as the SD-WAN member's IP.

Answer

The performance SLA must be marked as 'up' for at least one member in the SD-WAN zone

Answer

The destination port must be 80 or 443

Answer

The source IP must be in the same subnet as the SD-WAN member's IP

Question 12

An administrator configures SD-WAN with two members (port1 and port2). A performance SLA monitors latency to 8.8.8.8. The SD-WAN rule uses 'Best Quality' strategy based on latency. When the link on port1 becomes slow, the FortiGate continues using port1 even though port2 has lower latency. What is the most likely cause?

Accepted Answer

The performance SLA is not associated with the SD-WAN members. The performance SLA must be explicitly associated with the SD-WAN members (port1 and port2) for the 'Best Quality' strategy to use latency measurements. Without this association, the FortiGate cannot compare the SLA results per interface and defaults to using the current active member, even if its latency is higher. The SLA monitors 8.8.8.8, but the SD-WAN rule has no link to those measurements, so port1 continues to be used.

Answer

The FortiGate is not receiving ICMP replies from 8.8.8.8

Answer

The SD-WAN rule is configured with 'Manual' strategy

Answer

The load balancing algorithm is set to 'volume' instead of 'lowest-latency'

Question 13

A FortiGate is configured with two ISPs in an SD-WAN. The administrator wants to use the link with the highest bandwidth for bulk downloads, but if that link fails, all traffic should automatically use the backup link. Which load balancing algorithm should be used?

Accepted Answer

Spillover. The Spillover algorithm is designed to use a preferred link until its bandwidth capacity is reached, then 'spill over' traffic to a backup link. In this scenario, the administrator wants to use the highest-bandwidth link for bulk downloads and fail over to the backup link only when the primary link fails. Spillover matches this requirement because it can be configured with a bandwidth threshold; once the primary link's bandwidth is exhausted or the link fails, traffic automatically shifts to the backup link.

Answer

Sessions

Answer

Volume

Answer

Source-destination IP

Question 14

An administrator runs 'get router info routing-table bgp' and sees that a route for 10.20.0.0/16 is learned via BGP from a neighbor. However, the route does not appear in the routing table. The administrator checks the BGP configuration and sees that 'network 10.20.0.0 255.255.0.0' is not configured under BGP. What is the most likely reason?

Accepted Answer

A route map is filtering the received route. The route for 10.20.0.0/16 is learned via BGP from a neighbor and appears in the BGP table, but it is not installed in the routing table. The most likely reason is that a route map is filtering the received route, preventing it from being installed. Since the network statement is not configured under BGP, the route is not originated locally, but it can still be received from a neighbor; however, an inbound or outbound route map can deny the route from entering the routing table.

Answer

The route is a default route (0.0.0.0/0) and is being suppressed

Answer

The BGP neighbor is not in the Established state

Answer

The route is not in the routing table because BGP requires the network statement to originate the route

Question 15

An administrator has configured OSPF on a FortiGate with multiple areas. They want to ensure that routes from area 0 are redistributed into area 1, but they notice that routes from area 1 are not appearing in area 0. What is the most likely configuration issue?

Accepted Answer

The ABR is not configured with 'area 0' and 'area 1' on the same router. The most likely configuration issue is that the ABR is not properly configured as an ABR – it must have interfaces in both area 0 and area 1. Without an interface in area 0, the router cannot generate Type 3 LSAs (inter-area advertisements) between the areas, so routes from area 1 never appear in area 0. Option B is incorrect because a stub area blocks Type 5 LSAs from entering the stub area, but it does not block Type 3 LSAs from being advertised out of the stub area into the backbone; therefore, stub configuration would not prevent inter-area routes from reaching area 0.

Answer

There is a firewall policy blocking OSPF packets

Answer

The ABR has 'area 1 stub' configured, preventing LSA type 5 redistribution

Answer

The redistribution is done with a route map that is not permitting the routes