NSE7 Advanced Networking and SD-WAN Practice Test 8 — 15 Questions

Question 1

A FortiGate is acting as an ABR between OSPF area 0 and area 1. The administrator needs to redistribute a static route into OSPF so that it appears as an inter-area route (Type 3 LSA). Which three steps are required? (Choose THREE.)

Accepted Answer

Verify the OSPF process has network statements covering all interfaces. Redistribution is configured under OSPF process. The static route must exist. To propagate as Type 3, the redistribution must occur on the ABR and the route should be injected into area 0 so it can be converted to Type 3. Optionally, a route map can filter.

Answer

Disable route summarization on the ABR

Answer

Configure a route map to set the metric type to Type 1

Question 2

An administrator deploys a FortiGate in a remote office with a FortiSwitch and FortiAP. The LAN edge management features are used to manage these devices. The FortiGate is configured as a controller. Which three steps are required to manage the FortiAP via the FortiGate? (Choose THREE.)

Accepted Answer

Configure DHCP option 138 or DNS to point FortiAP to FortiGate. The FortiGate must have CAPWAP enabled to act as a wireless controller. The FortiAP must be authorized (by serial number). The FortiGate must be reachable by the FortiAP via Layer 3 connectivity (e.g., DHCP option 138).

Answer

Enable LLDP on the FortiSwitch

Answer

Configure an SSID under the FortiAP profile

Question 3

A network administrator is configuring SD-WAN on a FortiGate with two WAN links (port1 and port2). They want traffic to destination 10.0.0.0/8 to use port1 as long as its latency is below 50ms and jitter below 10ms; otherwise, fail over to port2. Which SD-WAN configuration components are required?

Accepted Answer

SD-WAN members, one performance SLA, one SD-WAN rule with the performance SLA as a strategy. To implement failover based on link quality, you need SD-WAN members (interfaces), a performance SLA to monitor the links, and an SD-WAN rule that uses the SLA to determine which member to use. The 'best quality' strategy automatically switches when thresholds are not met.

Answer

SD-WAN members, one performance SLA, one SD-WAN member with a static route

Answer

SD-WAN members, two performance SLAs (one per interface), one SD-WAN rule

Answer

SD-WAN members, one performance SLA, two SD-WAN rules (one for each interface)

Question 4

A FortiGate is configured with SD-WAN using load balancing algorithm 'source-dest-ip'. What is the primary characteristic of this algorithm?

Accepted Answer

All traffic from the same source IP to the same destination IP uses the same SD-WAN member.. The source-dest-ip algorithm uses a hash of source and destination IP addresses to select the outgoing interface, ensuring that all packets of a given session go through the same link.

Answer

Traffic is sent to the member with the highest bandwidth.

Answer

Traffic is sent to the member with the lowest cost metric.

Answer

Traffic is distributed evenly across all SD-WAN members regardless of source or destination.

Question 5

A FortiGate is running OSPF with multiple areas. The administrator notices that routes from area 1 are not being redistributed into area 0. The ABR has the following configuration: 'config router ospf
 config area
  edit 0.0.0.0
  set type nssa
 end
 config area
  edit 0.0.0.1
  set type standard
 end
 end'. What is the issue?

Accepted Answer

Area 0 is configured as NSSA, which does not accept type 3 LSAs from other areas.. In OSPF, area 0 must be a standard area (or at least not NSSA) for inter-area routes to be advertised. NSSA areas block type 3 LSAs by default.

Answer

The ABR must have 'set type standard' for area 0.

Answer

The ABR is missing a 'redistribute connected' command.

Answer

Area 1 is not configured as NSSA, so routes cannot be redistributed.

Question 6

An administrator is troubleshooting BGP with SD-WAN. They have configured BGP on the FortiGate and the SD-WAN rule uses 'best quality' strategy. However, failover does not happen when a WAN link goes down. The BGP session is still up. What is the most likely reason?

Accepted Answer

The performance SLA is not configured to track the BGP next hop.. SD-WAN failover relies on performance SLA probes to measure link quality. If the BGP session is still up but the link is slow or lossy, the SLA will detect the degradation and trigger failover. Without SLA monitoring, link down events might not be detected if BGP session stays up via a backup path.

Answer

The SD-WAN rule is configured with 'set update-static-route disable'.

Answer

The BGP session is using eBGP multihop.

Answer

The load balancing algorithm is set to 'volume'.

Question 7

What is the purpose of configuring BFD (Bidirectional Forwarding Detection) on a FortiGate?

Accepted Answer

To provide rapid failure detection between two forwarding engines.. BFD is a lightweight protocol that detects forwarding path failures quickly, allowing routing protocols to converge faster.

Answer

To load balance traffic across multiple links.

Answer

To encrypt BGP updates between peers.

Answer

To authenticate OSPF neighbors.

Question 8

A FortiGate has multiple VRFs configured. An administrator wants to allow traffic from VRF 1 to reach a server in VRF 2. What configuration is required?

Accepted Answer

Configure a VRF leak policy using route maps or policy routes.. VRF leaking is the process of sharing routes between VRFs. This is done by configuring route maps that match specific routes and setting the target VRF, or by using policy routes that override the VRF lookup.

Answer

Use a single VDOM and enable inter-VDOM links.

Answer

Place both interfaces in the same VRF.

Answer

Create a static route from one VRF to another.

Question 9

An administrator runs 'diagnose sys session filter dport 443' and sees:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is a TCP session in established state that has been up for 3600 seconds and will expire in 3599 seconds.. The output shows a TCP session in established state (proto_state=01) that has been alive for 3600 seconds and the idle timeout will expire in 3599 seconds if no packets are sent.

Answer

The session is a multicast session with a duration of 3600 seconds.

Answer

The session is in SYN_SENT state and has timed out after 3600 seconds.

Answer

The session is a UDP session that has been active for 3600 seconds.

Question 10

A FortiGate is configured with policy-based routing (PBR) to route certain traffic through a specific next hop. However, some traffic that should match the PBR rule is not being affected. What is a likely reason?

Accepted Answer

The PBR rule is applied on the wrong interface or direction.. Policy-based routing is applied on the ingress interface. If the administrator applied it to the egress interface or forgot to apply it to the correct ingress interface, the traffic will not match.

Answer

The PBR rule uses a route map that references an incorrect prefix list.

Answer

The PBR rule has a higher priority than the SD-WAN rule, but the traffic is hitting the SD-WAN rule first because of firewall policy order.

Answer

The traffic is generated locally from the FortiGate and PBR does not affect locally generated traffic.

Question 11

What is the function of a route map in FortiGate routing?

Accepted Answer

To filter and modify routing information during redistribution.. Route maps provide granular control over route redistribution by matching prefix lists or other attributes and then applying actions like set metric, set next hop, or permit/deny.

Answer

To configure load balancing between multiple WAN links.

Answer

To enable BFD on a specific interface.

Answer

To create a static route for a specific destination.

Question 12

An administrator wants to integrate a FortiExtender with a FortiGate for LTE backup. The FortiGate is using SD-WAN. What is the correct way to add the FortiExtender as an SD-WAN member?

Accepted Answer

Connect the FortiExtender to a physical port on the FortiGate and configure that port as an SD-WAN member.. FortiExtender connects to a physical port (e.g., USB or Ethernet) and appears as a WAN interface. This interface can be added to the SD-WAN interface table as a member.

Answer

Configure the FortiExtender as a standalone firewall and use IPsec between them.

Answer

Configure the FortiExtender as a separate VDOM and route between VDOMs.

Answer

Use a virtual-wire pair to connect the FortiExtender.

Question 13

A FortiGate is configured with ECMP load balancing for multiple equal-cost routes. The administrator wants to ensure that all packets belonging to the same session go out the same interface. Which ECMP load balancing method should be used?

Accepted Answer

Source-dest-IP-based. For ECMP, FortiGate supports source-dest-ip hashing to keep sessions on the same path. Other methods like round-robin may break sessions.

Answer

Weighted

Answer

Source-IP-based

Answer

Spillover

Question 14

What is the purpose of a prefix list in FortiGate routing?

Accepted Answer

To match routes based on their network prefix and subnet mask.. A prefix list in FortiGate is used to match routes based on their network prefix and subnet mask (prefix length). It is commonly applied in route maps or BGP configurations to filter or manipulate routing information, such as in redistribution or neighbor policy statements. Unlike access lists, prefix lists match the exact prefix and length, providing more granular control over route advertisement and acceptance.

Answer

To configure NAT rules.

Answer

To define SD-WAN members.

Answer

To assign IP addresses to interfaces.

Question 15

A network administrator is configuring SD-WAN rules with load balancing. They want to distribute HTTP traffic evenly across two WAN links based on the number of sessions. Which TWO settings should they use? (Choose two.)

Accepted Answer

Ensure the SD-WAN rule matches HTTP traffic (e.g., using protocol or port criteria).. To distribute HTTP sessions evenly, the load balancing algorithm should be 'session', and the SD-WAN rule must match HTTP traffic using appropriate criteria (e.g., destination port 80).

Answer

Set the load balancing algorithm to 'volume'.

Answer

Create a performance SLA to monitor the links.

Answer

Enable 'set update-static-route' on the SD-WAN rule.