NSE7 Advanced Networking and SD-WAN Practice Test 8 — 15 Questions

Question 1

A network administrator is configuring SD-WAN on a FortiGate to control outbound internet traffic. The requirement is to load balance traffic across two WAN interfaces (port1 and port2) based on the number of new sessions, but only when both links are healthy. The administrator has added both interfaces to the SD-WAN zone and configured performance SLAs. Which TWO additional configuration steps are necessary to implement this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the SD-WAN rule to use a performance SLA for health checking. Option B is correct because the SD-WAN rule must reference the performance SLA (via the 'sla' setting in the rule) so that the FortiGate only uses a member link when it passes the SLA health check, ensuring traffic is load balanced only while both links are healthy. Option C is correct because the SD-WAN rule's load-balancing algorithm must be set to 'sessions' (config system sdwan > config service > set load-balance-mode sessions) to distribute traffic based on the number of new sessions across port1 and port2. Option A is not needed because SD-WAN load balancing is handled by the SD-WAN rule itself, not by enabling ECMP in the routing settings. Option D is incorrect because traffic is steered to the SD-WAN zone through a normal firewall policy referencing the SD-WAN zone, not a policy-based routing rule. Option E is incorrect because there is no 'sla-check' setting under 'config system sdwan'; SLA health checking is defined per performance-SLA object and referenced by the SD-WAN rule.

Answer

Enable 'ECMP load balancing' in the routing settings

Answer

Configure a policy-based routing rule to direct traffic to the SD-WAN zone

Answer

Set the 'sla-check' under config system sdwan to 'enable'

Question 2

A FortiGate is configured with OSPF in a multi-area design. An administrator needs to redistribute static routes from another router into OSPF on the FortiGate, but only for prefixes that match a route map. The administrator has configured 'config router ospf' with 'redistribute static route-map RM_STATIC'. However, the static routes are not appearing in the OSPF database. Which THREE troubleshooting steps should the administrator take?

Accepted Answer

Verify that the route map 'RM_STATIC' exists and has appropriate match and set statements. If the route map 'RM_STATIC' does not exist or lacks proper match/set statements, OSPF will not redistribute any static routes. The 'redistribute static route-map RM_STATIC' command requires a valid route map to filter prefixes; without it, redistribution silently fails.

Answer

Verify that OSPF is enabled on at least one interface (config router ospf -> network)

Answer

Check if a prefix-list is applied that filters the redistributed routes

Question 3

A FortiGate is configured with multiple VRFs to segregate traffic from different departments. The administrator needs to allow the Finance VRF to access a shared printer in the default VRF. Which TWO steps are required to enable inter-VRF communication?

Accepted Answer

Configure a leak route from the Finance VRF to the default VRF for the printer's subnet. Option C is correct because inter-VRF routing on a FortiGate requires an inter-VRF route leak (configured with the 'config router static' or 'set vrf' leak mechanism) so that the Finance VRF has a route to the printer's subnet in the default VRF; without a leaked route, traffic cannot be routed between the two routing tables. Option D is correct because even with the leak route in place, FortiGate applies firewall policies to inter-VRF traffic, so a policy must be created between the VRF interfaces (or the relevant source/destination interfaces) permitting the required traffic. Option A is incorrect because OSPF redistribution between VRFs is not required for a simple static inter-VRF access scenario and FortiGate does not use OSPF to leak routes between VRFs by default. Option B is incorrect because placing interfaces from different VRFs into the same zone is not supported and does not enable inter-VRF routing. Option E is incorrect because assigning the printer's IP to the Finance VRF would move the printer into that VRF rather than allow inter-VRF communication to the default VRF.

Answer

Configure OSPF to redistribute routes between VRFs

Answer

Place both the Finance and default VRF interfaces into the same zone

Answer

Assign the printer's IP address to an interface in the Finance VRF

Question 4

A FortiGate administrator runs 'diagnose sys session list' and sees a session for which the destination interface is 'sdwan'. The session is marked with 'state=01000048'. What does this state indicate about the session?

Accepted Answer

The session is being held until the SD-WAN load balancing decision is made. The session state value 0x01000048 corresponds to the flag 'SES_STATE_SD_WAN_HOLD' in FortiOS. This flag indicates that the session is temporarily held in a pending state while the SD-WAN load balancing decision is being made. The session will not be forwarded until the SD-WAN rule selects the appropriate member interface, preventing premature routing before the load balancing logic completes.

Answer

The session is bypassing SD-WAN load balancing and using policy-based routing

Answer

The session has completed load balancing and is being forwarded out the sdwan interface

Answer

The session has been dropped because the selected SD-WAN member is down

Question 5

An administrator is configuring SD-WAN rules to steer traffic based on application performance. The requirement is to use VoIP traffic over the WAN link that has the lowest latency, but if latency exceeds 100ms, fail over to a backup link. The administrator has already created performance SLAs for both links. Which THREE configuration steps are required?

Accepted Answer

Configure the SLA metric to 'latency' in the performance SLA. Option B is correct because the performance SLA must be configured with the 'latency' metric so the SD-WAN rule can evaluate link quality against the 100ms threshold. Option C is correct because creating an SD-WAN rule that matches VoIP traffic and uses the 'best quality' load balancing method makes the rule select the member with the best measured SLA performance, which for latency-based SLAs means the lowest-latency link. Option E is correct because the SD-WAN rule must reference the SLA with an 'sla-constraint' set to 'sla' and a latency threshold of 100ms, which causes traffic to fail over to a backup link when the primary link exceeds that latency. Option A is not correct because 'failover-threshold' is not the SD-WAN mechanism for latency-based failover; the SLA constraint and performance SLA handle this. Option D is not correct because adding members with weights based on latency is not the required configuration for SLA-driven best-quality steering; weights are used for weighted load balancing, not latency-based failover.

Answer

Set the 'failover-threshold' on each SD-WAN member to 100

Answer

Add both WAN interfaces to the rule as members and set weight based on latency

Question 6

A FortiGate is connected to a FortiSwitch via a trunk port. The administrator wants to manage the FortiSwitch using FortiLink. Which of the following is a prerequisite for FortiLink to function?

Accepted Answer

A dedicated FortiLink interface (physical or VLAN) must be configured on the FortiGate. FortiLink requires a dedicated interface on the FortiGate, either a physical port or a VLAN sub-interface, to establish the proprietary control and management channel with the FortiSwitch. This interface is automatically configured with the necessary FortiLink settings, including an internal management IP range and DHCP server, to discover and manage the switch. Without this dedicated interface, the FortiGate cannot initiate the FortiLink adjacency.

Answer

The FortiSwitch must be running a firmware version that supports CAPWAP

Answer

The FortiSwitch must be configured with a DHCP server to assign IP addresses

Answer

The FortiSwitch must have a management IP in the same subnet as the FortiGate's management IP

Question 7

A FortiGate running FortiOS 7.2 has multiple WAN interfaces. The administrator is configuring SD-WAN load balancing with the 'volume' algorithm. The requirement is that each interface carries a percentage of total traffic based on its bandwidth capacity. The administrator sets the 'weight' of each interface accordingly. However, traffic distribution is not as expected. Which TWO factors could cause this discrepancy?

Accepted Answer

The interface bandwidth settings (speed) do not reflect actual link capacity. Option A is correct because the SD-WAN 'volume' algorithm calculates each member's share from its configured interface bandwidth (the 'speed' setting under the interface), so if those values do not match the real link capacity, the weighted distribution will be wrong. Option C is correct because 'volume' load balancing distributes traffic based on session volume, and a few high-volume sessions can skew the actual byte distribution away from the intended weighted percentages. Option B is incorrect because weight values are not restricted to 1-100 in a way that would cause this specific mismatch; weights are relative values used to compute proportions. Option D is incorrect because 'per-packet' is not a valid SD-WAN load-balancing algorithm setting in this context, and the scenario already specifies the 'volume' algorithm. Option E is incorrect because a disabled performance SLA does not by itself exclude an interface from volume-based load balancing; SLA state affects health checking and failover, not the weight computation.

Answer

The weight values are not in the range 1-100

Answer

The load balancing algorithm is set to 'per-packet' instead of 'volume'

Answer

The performance SLA is set to 'disable' on some interfaces, causing them to be excluded

Question 8

A network administrator is troubleshooting a BGP session between a FortiGate and an ISP router. The administrator runs 'get router info bgp summary' and sees that the BGP state is 'Active'. What does this state indicate?

Accepted Answer

The BGP speaker is trying to establish a TCP connection with the peer. The 'Active' state in BGP indicates that the router is actively trying to initiate a TCP connection to the configured peer. This means the BGP process has moved past the 'Connect' state (where it passively waits) and is now actively sending TCP SYN packets to the peer's port 179, but the three-way handshake has not yet completed. This state is normal during initial session establishment but becomes problematic if it persists, as it typically points to a Layer 3 reachability issue or a firewall blocking TCP/179.

Answer

The BGP session is administratively down due to a configuration error

Answer

The BGP speaker is waiting for a routing update from the peer

Answer

The BGP session is fully established and exchanging routes

Question 9

A FortiGate is configured with an SD-WAN zone containing two WAN interfaces. The administrator wants to use the 'spillover' load balancing algorithm to ensure that the primary link carries traffic until its bandwidth reaches 80% utilization, after which new sessions are sent to the secondary link. Which THREE configuration steps are necessary?

Accepted Answer

Add both interfaces as members of the SD-WAN rule. The spillover algorithm in an SD-WAN rule requires the rule itself to reference the SD-WAN zone members, so option B is correct because both WAN interfaces must be added as members of the SD-WAN rule for the rule to evaluate and distribute sessions across them. Option C is correct because the spillover behavior is driven by the spillover-threshold setting on the primary member interface, and setting it to 80 percent makes the primary link accept new sessions until it reaches 80% utilization, after which traffic spills to the secondary link. Option E is correct because the SD-WAN rule's load balancing method must be explicitly set to 'spillover' for this behavior to take effect. Option A is not required because spillover uses the interface bandwidth/volume thresholds rather than a performance SLA to trigger the spillover, and option D is incorrect because weights are used by the weighted load balancing method, not by spillover.

Answer

Create a performance SLA to measure bandwidth utilization

Answer

Assign a weight of 80 to the primary interface and 20 to the secondary

Question 10

A FortiGate is configured with ECMP routing to balance traffic across two default routes via two ISPs. The administrator wants to ensure that traffic from the same source-destination pair always uses the same ISP. Which ECMP load balancing method should be configured?

Accepted Answer

source-dest-ip. The source-dest-ip method hashes the source and destination IP addresses to compute a consistent path for all packets in a given flow. This ensures that traffic from the same source-destination pair always uses the same ISP, meeting the requirement for flow-based persistence without per-packet load balancing.

Answer

source-ip

Answer

per-packet

Answer

session

Question 11

A FortiGate is configured with multiple VRFs. An administrator notices that routes from VRF A are not being advertised to VRF B via BGP, even though the BGP configuration is correct. Which TWO actions could resolve this issue?

Accepted Answer

Configure a route leak from VRF A to VRF B under config router vrf. Option B is correct because in FortiGate, VRFs maintain separate routing tables, and routes are not shared between them by default; configuring a route leak from VRF A to VRF B under 'config router vrf' explicitly imports routes from one VRF's table into another, which is the standard mechanism to make VRF A's routes visible to VRF B. Option E is correct because when advertising routes between VRFs via BGP, the next-hop address may be unreachable in the receiving VRF's routing table; using 'set next-hop-self' on the BGP neighbor rewrites the next-hop to the advertising router's address within the receiving VRF, ensuring the BGP route is usable and propagated correctly. Option A is incorrect because route-flap damping only suppresses unstable routes and has nothing to do with cross-VRF route advertisement. Option C is incorrect because 'bgp enforce-first-as' validates the AS path of received updates and disabling it does not enable route sharing between VRFs. Option D is incorrect because 'set import-route' is not a valid FortiGate BGP VRF command for leaking routes between VRFs; route leaking is done under 'config router vrf', not as a BGP import-route setting.

Answer

Enable 'route-flap damping' on the BGP session between VRFs

Answer

Disable 'bgp enforce-first-as' to allow cross-VRF advertisements

Answer

Configure 'set import-route' under the BGP VRF configuration

Question 12

A FortiGate is configured with an SD-WAN rule using the 'lowest-cost' load balancing algorithm. The performance SLA monitors two WAN members: port1 (latency 50ms, jitter 10ms, packet loss 0%) and port2 (latency 30ms, jitter 5ms, packet loss 0%). The SLA thresholds are latency 100ms, jitter 20ms, packet loss 1%. Which WAN member will be selected for new sessions?

Accepted Answer

port2 because it has the lowest latency and jitter. The 'lowest-cost' load balancing algorithm selects the WAN member with the lowest calculated cost based on performance metrics. Since port2 has lower latency and jitter than port1, it will have a lower cost and be chosen for new sessions. Both members meet the SLA thresholds, so both are considered alive, but port2 is preferred due to better performance.

Answer

Neither port1 nor port2 will be used because the SLA is not met

Answer

port1 because it has higher latency

Answer

Both port1 and port2 will be used equally

Question 13

An administrator has deployed a FortiGate at a branch office with two WAN links: port1 (primary) and port2 (backup). Both are members of an SD-WAN zone. The administrator wants traffic to prefer port1 and only use port2 when port1 fails. They configure a performance SLA named 'Critical' on both members with the same criteria. Which SD-WAN rule configuration achieves this requirement?

Accepted Answer

In the SD-WAN rule, select port1 as the preferred member and enable 'SLA target' with the 'Critical' SLA. Set the rule's strategy to 'Best Quality'.. The requirement is to prefer port1 and fail over to port2 only when port1 fails. The correct approach is to configure an SD-WAN rule with port1 as the preferred member and an SLA target referencing the performance SLA. The 'Best Quality' strategy ensures that the rule evaluates member health and selects the best member that meets the SLA, automatically failing over when needed. This provides deterministic preference and automatic failover without manual intervention.

Answer

Create a static route for port1 with a lower distance than port2, and reference the 'Critical' SLA in the SD-WAN rule using the 'Lowest Cost' strategy.

Answer

Set the rule's 'Priority' field to 1 for port1 and 2 for port2, and enable 'SLA target' with the 'Critical' SLA.

Answer

In the SD-WAN rule, select port1 as the preferred member and enable 'SLA target' with the 'Critical' SLA. Set the rule's strategy to 'Manual'.

Question 14

An administrator has configured a FortiGate with two VRF instances: VRF10 and VRF20. They need to allow traffic from a network in VRF10 to reach a server in VRF20. The administrator has already configured the necessary interfaces and static routes within each VRF. What additional configuration is required to enable inter-VRF communication?

Accepted Answer

Create a VRF leak to import routes from VRF20 into VRF10.. Inter-VRF communication on a FortiGate requires VRF leaking, which imports routes from one VRF into another. This allows the routing table of VRF10 to contain the route to the server in VRF20, enabling proper forwarding. Firewall policies are also needed to permit the traffic, but the fundamental routing issue is solved by VRF leaking.

Answer

Configure a firewall policy allowing traffic between the VRFs.

Answer

Enable inter-VRF routing using the 'set vrf' command on the interface.

Answer

Configure a static route in VRF10 pointing to VRF20's interface.

Question 15

An administrator is deploying a FortiGate in an SD-WAN environment with two WAN links: port1 (primary, 100 Mbps) and port2 (backup, 50 Mbps). They create an SD-WAN rule using the 'maximize-bandwidth (SLA)' strategy and attach a performance SLA that monitors both links. During normal operation, traffic is distributed across both links. After port2 fails the SLA, traffic is re-routed to port1. However, the administrator notices that some existing sessions on port2 are not immediately moved to port1. What is the most likely reason?

Accepted Answer

SD-WAN rules are applied only to new sessions; existing sessions continue on the original link until they time out or are cleared.. SD-WAN path selection is applied when a session is initiated. Once a session is established on a WAN member, it remains on that member unless the member becomes completely unavailable and the session is re-evaluated. When an SLA fails, FortiGate stops using that member for new sessions but does not proactively move existing sessions. This behavior ensures session continuity but can cause temporary traffic on a failed link until sessions expire.

Answer

The performance SLA is configured with a high latency threshold, causing FortiGate to wait before marking the link as dead.

Answer

The 'maximize-bandwidth (SLA)' strategy requires all links to be within the same cost range to allow session migration.

Answer

FortiGate uses a session table that is updated only when the routing table changes, not when an SLA fails.