NSE7 Advanced Networking and SD-WAN Practice Test 7 — 15 Questions

Question 1

You have configured a route map named 'RM-BGP' to filter routes redistributed from OSPF into BGP. The route map uses 'set community 65000:100' and 'set metric 50'. After applying the route map under 'config router bgp' with 'redistribute ospf route-map RM-BGP', you see that routes are being redistributed but without the community and metric. What is wrong?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The route map does not have any 'match' criteria, so it never applies. A route map without any 'match' statements is considered a 'permit all' by default, but it does not apply 'set' actions unless a 'match' condition is explicitly met. In FortiOS, a route map with only 'set' commands and no 'match' criteria will not execute those 'set' actions during redistribution. Therefore, the routes are redistributed with default BGP attributes, not the configured community or metric.

Answer

The route map is missing a 'set community' statement with 'additive' option

Answer

The BGP neighbor requires 'soft-reconfiguration inbound' to see the changes

Answer

The 'set metric' command is not supported for BGP redistribution

Question 2

A FortiGate has two equal-cost paths to a destination network through two different ISPs. The administrator wants to load balance traffic across both links using ECMP, but notices that all traffic uses only one link. What should the administrator check first?

Accepted Answer

Check that both routes have the same administrative distance and priority. ECMP requires that all candidate routes have identical administrative distance and priority values. If either differs, FortiGate will select only the route with the lower distance/priority, breaking load balancing. The administrator should verify these parameters first because they directly control route selection before ECMP is applied.

Answer

Configure 'set v4-ecmp-mode' to 'source-ip-based'

Answer

Verify that 'set load-balance-eligible' is enabled on both WAN interfaces

Answer

Disable 'anti-replay' on the security policy

Question 3

What is the purpose of using a prefix list in route redistribution?

Accepted Answer

To match routes based on IP prefix and prefix length. A prefix list is used in route redistribution to match routes based on their IP prefix and prefix length (e.g., 192.168.0.0/16). This allows granular control over which routes are redistributed from one routing protocol to another, such as from OSPF to BGP, by filtering based on the network address and subnet mask.

Answer

To define a list of allowed source IPs for management access

Answer

To specify the next-hop for a set of routes

Answer

To set BGP community values on matched prefixes

Question 4

An administrator connects a FortiExtender to the FortiGate's USB port. The FortiGate detects the FortiExtender and creates a virtual interface 'wwan1'. However, the link status shows 'down'. The SIM card is inserted and the cellular plan is active. What should the administrator check?

Accepted Answer

The APN settings are not configured under the FortiExtender interface. The link status of the wwan1 interface remains 'down' because the FortiExtender requires the Access Point Name (APN) to be configured to establish a cellular data connection. Without the correct APN, the modem cannot attach to the mobile network, even with an active SIM card and power. The APN is configured under the FortiExtender interface settings on the FortiGate, not on the FortiExtender itself.

Answer

The FortiGate needs a security policy allowing traffic from wwan1

Answer

The FortiExtender firmware is not compatible with the FortiGate

Answer

The FortiExtender is not powered on

Question 5

You have configured VRF on a FortiGate with two VRFs: VRF 1 for guest traffic and VRF 2 for corporate traffic. You want to allow limited communication from guests to a corporate DNS server. What is the correct configuration step?

Accepted Answer

Configure route leaking between VRF 1 and VRF 2 for the DNS server's IP. VRF isolation by default prevents traffic from crossing between VRFs. To allow a guest in VRF 1 to reach a corporate DNS server in VRF 2, you must leak the DNS server's route from VRF 2 into VRF 1. This is achieved by configuring route leaking (e.g., using route maps or VRF route leaking on FortiGate), which installs the DNS server's IP prefix into the guest VRF's routing table, enabling reachability without breaking VRF separation for other traffic.

Answer

Create a firewall policy from VRF 1 to VRF 2 allowing DNS traffic

Answer

Enable 'set allow-vrf' on the DNS server's interface

Answer

Place the DNS server in a management VDOM and use inter-VDOM links

Question 6

Which SD-WAN load balancing algorithm distributes traffic based on the number of active sessions per interface?

Accepted Answer

Sessions. The Sessions algorithm in Fortinet SD-WAN distributes new sessions by selecting the interface with the fewest currently active sessions. This ensures balanced session distribution across WAN links, preventing any single interface from becoming overloaded with connections while others remain underutilized.

Answer

Volume

Answer

Source-destination IP

Answer

Spillover

Question 7

An administrator configures a performance SLA to monitor a remote server. The SLA status shows 'dead' for one WAN member. The administrator checks the interface and sees that it is up and passing other traffic. What is the most likely cause?

Accepted Answer

The SLA probe is using TCP port 80 but the server is only responding to ICMP. The performance SLA status shows 'dead' because the probe is failing to reach the remote server. The administrator configured the SLA to use TCP port 80, but the server only responds to ICMP. Since the probe packets (TCP SYN) are not being acknowledged, the SLA marks the member as dead, even though the interface is up and other traffic (e.g., ICMP) passes successfully.

Answer

The FortiGate's routing table does not have a route to the probe target

Answer

The interface is not added as an SD-WAN member

Answer

The SLA probe interval is set too high

Question 8

You want to use policy-based routing (PBR) to send traffic from a specific subnet to a different next-hop than the default route. Which configuration is required?

Accepted Answer

Configure a route map under 'config router policy'. Policy-based routing (PBR) on FortiGate is configured under 'config router policy' using route maps. This allows you to match traffic based on criteria such as source subnet and set a specific next-hop, overriding the default route. Option A correctly identifies the required configuration path for PBR.

Answer

Create a firewall policy with 'set policy-based-route enable'

Answer

Enable 'set pbr-enforce-symmetric' on the interface

Answer

Configure a prefix list and apply to the static route

Question 9

A network administrator is configuring SD-WAN rules and wants to ensure that voice traffic is sent over the link with the lowest jitter. Which TWO configurations should the administrator apply? (Choose two.)

Accepted Answer

Set the SD-WAN rule strategy to 'best quality'. Setting the SD-WAN rule strategy to 'best quality' instructs FortiGate to select the link with the best performance metrics, such as lowest jitter, based on the configured performance SLA. This strategy dynamically routes traffic to the interface that meets the SLA targets, ensuring voice traffic uses the link with the lowest jitter.

Answer

Set the SD-WAN rule strategy to 'lowest cost'

Answer

Configure the SD-WAN rule to use 'volume' load balancing

Answer

Enable 'set jitter-threshold' on the SD-WAN rule

Question 10

A FortiGate is experiencing asymmetric routing due to route leaking between VRFs. The administrator wants to ensure that traffic using a specific VRF returns via the same path. Which THREE actions should be taken? (Choose three.)

Accepted Answer

Enable 'set pbr-enforce-symmetric' on the VRF interfaces. Enabling 'set pbr-enforce-symmetric' on VRF interfaces forces the FortiGate to use policy-based routing (PBR) rules bidirectionally, ensuring that return traffic for a session follows the same path as the forward traffic. This is critical in asymmetric routing scenarios caused by route leaking between VRFs, as it overrides the default per-packet forwarding behavior and enforces symmetry at the session level.

Answer

Disable route leaking between VRFs

Answer

Increase the administrative distance of the leaked routes

Question 11

An administrator wants to integrate a FortiSwitch with a FortiGate for LAN edge management. Which TWO steps are required for initial setup? (Choose two.)

Accepted Answer

Connect the FortiSwitch to the FortiGate's managed switch port. A FortiSwitch must be physically connected to a FortiGate port that has been configured as a managed switch port (via config system interface and set type switch). This dedicated port enables the FortiGate to discover and manage the FortiSwitch using the FortiLink protocol, which encapsulates control and data traffic over a single link. Without this physical connection to a managed switch port, the FortiGate cannot establish the FortiLink adjacency required for LAN edge management.

Answer

Configure OSPF on the FortiSwitch

Answer

Set the FortiSwitch to 'transparent' mode

Answer

Create a firewall policy allowing traffic between FortiSwitch and FortiGate

Question 12

A network administrator configures an SD-WAN zone with two members (port1 and port2) and sets the load balancing algorithm to 'spillover'. The spillover threshold is set to 100 Mbps on port1. If traffic reaches 120 Mbps on port1, what happens to new sessions?

Accepted Answer

New sessions are sent to port2 until port1 drops below the threshold. When the spillover algorithm is configured with a threshold of 100 Mbps on port1 and traffic reaches 120 Mbps, port1 is considered saturated. The SD-WAN zone then directs all new sessions to port2 until the traffic on port1 drops below the threshold. This is the defined behavior of spillover load balancing in Fortinet SD-WAN, where traffic is shifted away from an overloaded member to maintain performance.

Answer

All traffic is dropped because the threshold exceeded

Answer

Port1 continues to receive all new sessions but packets are queued

Answer

New sessions are distributed equally between port1 and port2

Question 13

An administrator wants to ensure that voice traffic (UDP 16384-32768) always uses the MPLS link, while internet-bound traffic uses broadband. Which SD-WAN feature should be configured to achieve this?

Accepted Answer

SD-WAN rule. SD-WAN rules (option D) allow administrators to define policy-based forwarding by matching specific traffic characteristics—such as UDP ports 16384-32768 for voice—and steering that traffic to a preferred interface or link (e.g., the MPLS link). This is the correct feature because it directly controls traffic steering based on application or service, overriding any default load-balancing or failover behavior.

Answer

Performance SLA

Answer

SD-WAN member configuration

Answer

Load balancing algorithm

Question 14

A FortiGate is configured with two WAN members in an SD-WAN zone. The performance SLA monitors latency to a probe server. The rule uses 'best quality' strategy. After some time, one member fails the SLA. Which action does the FortiGate take for existing sessions that were using that member?

Accepted Answer

Existing sessions continue on the failed member until they timeout. When a WAN member fails the performance SLA in an SD-WAN 'best quality' strategy, FortiGate does not disrupt existing sessions that were already using that member. Instead, those sessions continue on the failed member until they naturally timeout or are torn down, because the SD-WAN rule only influences the path selection for new sessions. This behavior is by design to avoid breaking active connections due to transient SLA fluctuations.

Answer

All sessions are dropped and the member is removed from the zone

Answer

Existing sessions are re-evaluated and may be moved based on policy

Answer

Existing sessions are immediately moved to another member

Question 15

A multi-area OSPF network includes a FortiGate as an ABR. The administrator needs to redistribute a static route into OSPF. Which command is required on the FortiGate to achieve this?

Accepted Answer

config router ospf
config redistribute
edit 'static'
set status enable
end. To redistribute a static route into OSPF on a FortiGate, you must enter the OSPF configuration context, navigate to the 'redistribute' subcommand, select the 'static' route type, and set its status to 'enable'. This is the standard method for enabling route redistribution from one routing protocol (or static routes) into OSPF, as defined in the FortiGate CLI reference.

Answer

config router prefix-list
edit 'static'
set action permit
end

Answer

config router policy
set src 0.0.0.0/0
set dst 0.0.0.0/0
end

Answer

config router static
set redistribute ospf enable
end