NSE7 Advanced Networking and SD-WAN Practice Test 7 — 15 Questions

Question 1

A FortiGate is experiencing asymmetric routing due to route leaking between VRFs. The administrator wants to ensure that traffic using a specific VRF returns via the same path. Which THREE actions should be taken? (Choose three.)

Accepted Answer

Enable 'set pbr-enforce-symmetric' on the VRF interfaces. To handle asymmetric routing, the administrator can enable 'set pbr-enforce-symmetric', configure policy-based routing to enforce symmetric paths, or use route maps to influence route selection.

Answer

Disable route leaking between VRFs

Answer

Increase the administrative distance of the leaked routes

Question 2

An administrator wants to integrate a FortiSwitch with a FortiGate for LAN edge management. Which TWO steps are required for initial setup? (Choose two.)

Accepted Answer

Connect the FortiSwitch to the FortiGate's managed switch port. Option B is correct because a FortiSwitch must be physically connected to a FortiGate port that has been configured as a managed switch port (via config system interface and set type switch). This dedicated port enables the FortiGate to discover and manage the FortiSwitch using the FortiLink protocol, which encapsulates control and data traffic over a single link. Without this physical connection to a managed switch port, the FortiGate cannot establish the FortiLink adjacency required for LAN edge management.

Answer

Configure OSPF on the FortiSwitch

Answer

Set the FortiSwitch to 'transparent' mode

Answer

Create a firewall policy allowing traffic between FortiSwitch and FortiGate

Question 3

A network administrator configures an SD-WAN zone with two members (port1 and port2) and sets the load balancing algorithm to 'spillover'. The spillover threshold is set to 100 Mbps on port1. If traffic reaches 120 Mbps on port1, what happens to new sessions?

Accepted Answer

New sessions are sent to port2 until port1 drops below the threshold. Spillover algorithm sends traffic to the preferred member (lowest cost or first in order) until its bandwidth exceeds the threshold. When the threshold is exceeded, new sessions are sent to the next available member. Port2 will handle new sessions until port1 drops below the threshold.

Answer

All traffic is dropped because the threshold exceeded

Answer

Port1 continues to receive all new sessions but packets are queued

Answer

New sessions are distributed equally between port1 and port2

Question 4

An administrator wants to ensure that voice traffic (UDP 16384-32768) always uses the MPLS link, while internet-bound traffic uses broadband. Which SD-WAN feature should be configured to achieve this?

Accepted Answer

SD-WAN rule. SD-WAN rules allow matching specific traffic patterns and forcing them to use particular members or strategies. The rule can match the voice traffic UDP port range and set the strategy to 'manual' or 'best quality' with preferred member as MPLS.

Answer

Performance SLA

Answer

SD-WAN member configuration

Answer

Load balancing algorithm

Question 5

A FortiGate is configured with two WAN members in an SD-WAN zone. The performance SLA monitors latency to a probe server. The rule uses 'best quality' strategy. After some time, one member fails the SLA. Which action does the FortiGate take for existing sessions that were using that member?

Accepted Answer

Existing sessions continue on the failed member until they timeout. When a member fails the SLA, only new sessions are redirected to other members that meet the SLA. Existing sessions continue on the failed member until they expire or are terminated. The 'best quality' strategy does not preemptively move existing sessions.

Answer

All sessions are dropped and the member is removed from the zone

Answer

Existing sessions are re-evaluated and may be moved based on policy

Answer

Existing sessions are immediately moved to another member

Question 6

An administrator runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session has been active for 1 hour and will expire in about 1 hour. The output shows a TCP session (proto=6) in state 01 (established), duration of 3600 seconds (1 hour), and expire time of 3599 seconds (almost 1 hour remaining). This indicates a long-running HTTPS session that is still active.

Answer

The session is about to expire and will be removed soon

Answer

The session is using UDP protocol

Answer

The session is in a half-open state

Question 7

A multi-area OSPF network includes a FortiGate as an ABR. The administrator needs to redistribute a static route into OSPF. Which command is required on the FortiGate to achieve this?

Accepted Answer

config router ospf
config redistribute
edit 'static'
set status enable
end. Redistribution of static routes into OSPF is done under the OSPF process configuration using 'redistribute static' with optional metric and metric-type. The command 'config router ospf' then 'redistribute static' enables redistribution.

Answer

config router prefix-list
edit 'static'
set action permit
end

Answer

config router policy
set src 0.0.0.0/0
set dst 0.0.0.0/0
end

Answer

config router static
set redistribute ospf enable
end

Question 8

Which load balancing algorithm in SD-WAN distributes new sessions based on the source and destination IP addresses, ensuring that all sessions from a given source-destination pair go to the same member?

Accepted Answer

Source-dest IP. The source-destination IP algorithm uses a hash of source and destination IP to consistently select the same member for the same pair, which is useful for stateful applications or to avoid asymmetric routing.

Answer

Lowest cost

Answer

Volume

Answer

Sessions

Question 9

An administrator configures BFD on a BGP session between two FortiGates. After enabling BFD, the BGP session flaps intermittently. What is the most likely cause?

Accepted Answer

The BFD failure detection intervals are too low, causing false positives. BFD detects failures faster than BGP keepalives. If the network has high latency or occasional packet loss, BFD may time out and declare the peer down, causing BGP to reset. The BFD timers might be too aggressive for the network conditions.

Answer

BFD is incompatible with BGP and should not be used together

Answer

BGP hold timer is shorter than BFD detection time

Answer

The BFD minimum transmit and receive intervals are set too high

Question 10

A FortiGate is configured with multiple VRF instances. The administrator needs to ensure that traffic from VRF 10 can reach a server in VRF 20. Which configuration is required?

Accepted Answer

Use static routes with the appropriate VRF tags to leak routes between VRFs. To route between VRFs, you must configure route leaking. This is done using 'config router leak' or by using route redistribution with VRF tags. Without route leaking, VRFs are isolated.

Answer

Enable inter-VRF routing by setting 'vrf-leak enable' on the VRF instances

Answer

Configure a firewall policy that allows traffic between the VRFs

Answer

Place both interfaces in the same VRF

Question 11

An administrator wants to use FortiExtender to provide LTE WAN connectivity. After connecting the FortiExtender to the FortiGate, the LTE interface is not showing up. What is the first troubleshooting step?

Accepted Answer

Verify the FortiExtender is connected to the correct port and powered on. Verify that the FortiExtender is properly connected and powered. Check the USB or Ethernet connection to the FortiGate. Also verify that the FortiExtender is recognized in the dashboard. Often a reboot of the FortiExtender or FortiGate can resolve detection issues.

Answer

Run 'execute lte test' command

Answer

Configure an SD-WAN rule for LTE traffic

Answer

Check the signal strength of the LTE connection

Question 12

Which BFD mode is used to detect forwarding path failures between two FortiGates that are directly connected?

Accepted Answer

Asynchronous mode. BFD operates in asynchronous mode by default, where both peers send hello packets. If a certain number of packets are missed, the session is considered down. This is the standard mode for directly connected FortiGates.

Answer

Synchronous mode

Answer

Echo mode

Answer

Demand mode

Question 13

A FortiGate has two equal-cost paths to a destination network. ECMP is enabled. The administrator notices that all traffic uses the first path. What is the most likely cause?

Accepted Answer

ECMP is configured to use 'source-dest-ip' hash and all sessions are from same source to same destination. ECMP distributes session flows, but if all traffic is using one path, it might be due to a session-based hash that results in the same path for all sessions, or the ECMP load balancing may be set to 'source-dest-ip' and the traffic is from one source to one destination. More likely, the ECMP load balancing mode is set to 'usage' or there is a policy-based route overriding.

Answer

ECMP is configured with 'spillover' mode

Answer

The second path is administratively down

Answer

The route metric is not equal

Question 14

An administrator configures a route map to control redistribution of connected routes into OSPF. The route map uses a prefix list to match routes. After applying the redistribution, no routes are redistributed. What is the most likely oversight?

Accepted Answer

The route map is missing a 'set' action, so it denies all routes. The route map must have a 'set' action or at least 'set metric' to actually redistribute. If the route map only matches but has no set statement, the routes are not injected. Also, the route map must be applied to the redistribution statement.

Answer

The prefix list is configured with the wrong sequence number

Answer

OSPF process ID is incorrect

Answer

The connected routes are not in the routing table

Question 15

An administrator is configuring SD-WAN with two members: MPLS and Broadband. The requirement is that voice traffic (UDP ports 16384-32768) should use MPLS primarily, and if MPLS fails SLA, then use Broadband. Which two configurations are needed? (Choose TWO.)

Accepted Answer

Configure a performance SLA for the MPLS member. A performance SLA monitors the MPLS link quality, and an SD-WAN rule is configured to match voice traffic with a strategy that prefers MPLS but falls back to Broadband if SLA fails. Without the SLA, the rule cannot detect failure.

Answer

Disable the Broadband member from the SD-WAN zone

Answer

Configure policy-based routing for voice traffic

Answer

Set the load balancing algorithm to 'sessions'