NSE7 Advanced Networking and SD-WAN Practice Test 8 — 15 Questions

Question 1

Which load balancing algorithm in SD-WAN distributes new sessions based on the source and destination IP addresses, ensuring that all sessions from a given source-destination pair go to the same member?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Source-dest IP. The Source-dest IP algorithm in Fortinet SD-WAN uses a hash of the source and destination IP addresses to determine the outbound member for each new session. This ensures that all sessions between the same source-destination pair are consistently forwarded to the same WAN member, preserving flow affinity without requiring session-based state tracking.

Answer

Lowest cost

Answer

Volume

Answer

Sessions

Question 2

An administrator configures BFD on a BGP session between two FortiGates. After enabling BFD, the BGP session flaps intermittently. What is the most likely cause?

Accepted Answer

The BFD failure detection intervals are too low, causing false positives. When BFD is enabled on a BGP session, the BFD failure detection intervals (typically the minimum transmit and receive intervals) determine how quickly a link failure is detected. If these intervals are set too low, BFD may generate false positives due to transient network jitter or minor packet loss, causing the BGP session to flap as BFD triggers a session reset even though the underlying link is stable. This is the most likely cause because the symptom appeared immediately after enabling BFD, and the default or misconfigured intervals can be too aggressive for the network conditions.

Answer

BFD is incompatible with BGP and should not be used together

Answer

BGP hold timer is shorter than BFD detection time

Answer

The BFD minimum transmit and receive intervals are set too high

Question 3

A FortiGate is configured with multiple VRF instances. The administrator needs to ensure that traffic from VRF 10 can reach a server in VRF 20. Which configuration is required?

Accepted Answer

Use static routes with the appropriate VRF tags to leak routes between VRFs. Inter-VRF route leaking in FortiGate is achieved by configuring static routes with the 'vrf' tag to specify the source VRF and using the 'dst-vrf' or 'vrf-leak' settings to export routes into the destination VRF. This allows traffic from VRF 10 to reach a server in VRF 20 by ensuring the necessary routes are present in both VRFs without merging the VRFs.

Answer

Enable inter-VRF routing by setting 'vrf-leak enable' on the VRF instances

Answer

Configure a firewall policy that allows traffic between the VRFs

Answer

Place both interfaces in the same VRF

Question 4

An administrator wants to use FortiExtender to provide LTE WAN connectivity. After connecting the FortiExtender to the FortiGate, the LTE interface is not showing up. What is the first troubleshooting step?

Accepted Answer

Verify the FortiExtender is connected to the correct port and powered on. The first troubleshooting step is to verify the physical connection and power status of the FortiExtender. If the FortiExtender is not connected to the correct port (typically a USB or PoE port) or is not powered on, the FortiGate will not detect the LTE interface at all, making any software-level checks premature.

Answer

Run 'execute lte test' command

Answer

Configure an SD-WAN rule for LTE traffic

Answer

Check the signal strength of the LTE connection

Question 5

Which BFD mode is used to detect forwarding path failures between two FortiGates that are directly connected?

Accepted Answer

Asynchronous mode. Asynchronous mode is the default BFD mode used between two directly connected FortiGates to detect forwarding path failures. In this mode, both peers periodically send control packets at negotiated intervals, and if a peer stops receiving these packets within the detection multiplier, the session is declared down. This allows rapid detection of link or forwarding failures without relying on echo packets or on-demand triggers.

Answer

Synchronous mode

Answer

Echo mode

Answer

Demand mode

Question 6

A FortiGate has two equal-cost paths to a destination network. ECMP is enabled. The administrator notices that all traffic uses the first path. What is the most likely cause?

Accepted Answer

ECMP is configured to use 'source-dest-ip' hash and all sessions are from same source to same destination. When ECMP is configured with the 'source-dest-ip' hash algorithm, traffic is load-balanced based on a hash of both source and destination IP addresses. If all sessions originate from the same source IP and go to the same destination IP, the hash value is identical for every session, causing all traffic to be forwarded over the same path. This is the most likely cause because the administrator sees all traffic using the first path despite ECMP being enabled.

Answer

ECMP is configured with 'spillover' mode

Answer

The second path is administratively down

Answer

The route metric is not equal

Question 7

An administrator configures a route map to control redistribution of connected routes into OSPF. The route map uses a prefix list to match routes. After applying the redistribution, no routes are redistributed. What is the most likely oversight?

Accepted Answer

The route map is missing a 'permit' action, so it denies all routes. The route map used for redistribution into OSPF must have at least one 'permit' statement to allow routes. If only a prefix list is referenced in the route map without an explicit 'permit' action, the implicit deny at the end of the route map blocks all routes. The common mistake is to assume that simply matching with a prefix list is sufficient; however, an explicit 'permit' action is required.

Answer

The prefix list is configured with the wrong sequence number

Answer

OSPF process ID is incorrect

Answer

The connected routes are not in the routing table

Question 8

An administrator is configuring SD-WAN with two members: MPLS and Broadband. The requirement is that voice traffic (UDP ports 16384-32768) should use MPLS primarily, and if MPLS fails SLA, then use Broadband. Which two configurations are needed? (Choose TWO.)

Accepted Answer

Configure a performance SLA for the MPLS member. A performance SLA must be configured on the MPLS member to monitor its link quality (e.g., latency, jitter, packet loss). If the SLA fails, the SD-WAN rule can then trigger a failover to the Broadband member. Option C is correct because an SD-WAN rule matching voice traffic with the 'best quality' strategy ensures that the traffic uses the highest-quality link (MPLS) as long as its SLA is met, automatically switching to Broadband when MPLS fails SLA.

Answer

Disable the Broadband member from the SD-WAN zone

Answer

Configure policy-based routing for voice traffic

Answer

Set the load balancing algorithm to 'sessions'

Question 9

A FortiGate is acting as an ABR between OSPF area 0 and area 1. The administrator needs to redistribute a static route into OSPF so that it appears as an inter-area route (Type 3 LSA). Which three steps are required? (Choose THREE.)

Accepted Answer

Verify the OSPF process has network statements covering all interfaces. For OSPF to generate Type 3 LSAs from redistributed routes, the ABR must have OSPF enabled on its interfaces via network statements. Without these statements, the ABR cannot form adjacencies or propagate LSAs between areas, which is essential for inter-area route advertisement.

Answer

Disable route summarization on the ABR

Answer

Configure a route map to set the metric type to Type 1

Question 10

An administrator deploys a FortiGate in a remote office with a FortiSwitch and FortiAP. The LAN edge management features are used to manage these devices. The FortiGate is configured as a controller. Which three steps are required to manage the FortiAP via the FortiGate? (Choose THREE.)

Accepted Answer

Configure DHCP option 138 or DNS to point FortiAP to FortiGate. FortiAPs use DHCP option 138 or DNS to discover the FortiGate controller. DHCP option 138 provides the IP address of the FortiGate, while DNS resolves a predefined hostname (e.g., 'fortigate' or 'fg') to the controller's IP. Without this discovery mechanism, the FortiAP cannot locate the FortiGate to establish CAPWAP control and data tunnels.

Answer

Enable LLDP on the FortiSwitch

Answer

Configure an SSID under the FortiAP profile

Question 11

A network administrator is configuring SD-WAN on a FortiGate with two WAN links (port1 and port2). They want traffic to destination 10.0.0.0/8 to use port1 as long as its latency is below 50ms and jitter below 10ms; otherwise, fail over to port2. Which SD-WAN configuration components are required?

Accepted Answer

SD-WAN members, one performance SLA, one SD-WAN rule with the performance SLA as a strategy. SD-WAN failover based on latency and jitter thresholds requires a single performance SLA to measure both metrics on the active link (port1), and one SD-WAN rule that uses that SLA as the strategy to determine best path. The rule defines the destination (10.0.0.0/8) and the SLA's thresholds trigger failover to port2 when exceeded. Only one SLA is needed since the condition is applied to the primary link, not both.

Answer

SD-WAN members, one performance SLA, one SD-WAN member with a static route

Answer

SD-WAN members, two performance SLAs (one per interface), one SD-WAN rule

Answer

SD-WAN members, one performance SLA, two SD-WAN rules (one for each interface)

Question 12

A FortiGate is configured with SD-WAN using load balancing algorithm 'source-dest-ip'. What is the primary characteristic of this algorithm?

Accepted Answer

All traffic from the same source IP to the same destination IP uses the same SD-WAN member.. The 'source-dest-ip' load balancing algorithm in SD-WAN uses a hash of both the source IP and destination IP to deterministically select an SD-WAN member. This ensures that all packets belonging to the same flow (same source-destination pair) are consistently forwarded over the same member, preserving per-flow stickiness and avoiding out-of-order delivery.

Answer

Traffic is sent to the member with the highest bandwidth.

Answer

Traffic is sent to the member with the lowest cost metric.

Answer

Traffic is distributed evenly across all SD-WAN members regardless of source or destination.

Question 13

A FortiGate is running OSPF with multiple areas. The administrator notices that routes from area 1 are not being redistributed into area 0. The ABR has the following configuration: 'config router ospf
 config area
  edit 0.0.0.0
  set type nssa
 end
 config area
  edit 0.0.0.1
  set type standard
 end
 end'. What is the issue?

Accepted Answer

Area 0 is configured as NSSA, which does not accept type 3 LSAs from other areas.. Area 0 is configured as an NSSA (Not-So-Stubby Area), which by default does not accept Type 3 summary LSAs from other areas. Since routes from area 1 (a standard area) are injected into the ABR as Type 3 LSAs, they are blocked by the NSSA area 0 boundary. This prevents inter-area route redistribution into area 0.

Answer

The ABR must have 'set type standard' for area 0.

Answer

The ABR is missing a 'redistribute connected' command.

Answer

Area 1 is not configured as NSSA, so routes cannot be redistributed.

Question 14

An administrator is troubleshooting BGP with SD-WAN. They have configured BGP on the FortiGate and the SD-WAN rule uses 'best quality' strategy. However, failover does not happen when a WAN link goes down. The BGP session is still up. What is the most likely reason?

Accepted Answer

The performance SLA is not configured to track the BGP next hop.. The 'best quality' SD-WAN strategy selects the best path based on performance SLA metrics. Without a performance SLA monitoring the BGP next hop, the FortiGate cannot detect that the link has failed from a BGP perspective, so it will not trigger a failover even if the physical interface goes down. The BGP session remains up because it is still receiving keepalives, but the SD-WAN rule does not consider the link unusable without SLA tracking.

Answer

The SD-WAN rule is configured with 'set update-static-route disable'.

Answer

The BGP session is using eBGP multihop.

Answer

The load balancing algorithm is set to 'volume'.

Question 15

What is the purpose of configuring BFD (Bidirectional Forwarding Detection) on a FortiGate?

Accepted Answer

To provide rapid failure detection between two forwarding engines.. BFD (Bidirectional Forwarding Detection) provides sub-second failure detection between two forwarding engines, such as FortiGate peers running OSPF or BGP. It operates independently of the routing protocol, using a lightweight hello mechanism to detect link or neighbor failures faster than protocol-native timers (e.g., OSPF dead interval of 40 seconds). This enables rapid convergence in SD-WAN and advanced networking scenarios.

Answer

To load balance traffic across multiple links.

Answer

To encrypt BGP updates between peers.

Answer

To authenticate OSPF neighbors.