NSE7 Advanced Networking and SD-WAN Practice Test 9 — 15 Questions

Question 1

A FortiGate has multiple VRFs configured. An administrator wants to allow traffic from VRF 1 to reach a server in VRF 2. What configuration is required?

Accepted Answer

Configure a VRF leak policy using route maps or policy routes.. VRF leaking is the standard method to allow traffic between different VRFs on a FortiGate. This is achieved by configuring route maps or policy routes to selectively import/export routes between VRFs, enabling inter-VRF communication without merging the VRFs or using VDOMs.

Answer

Use a single VDOM and enable inter-VDOM links.

Answer

Place both interfaces in the same VRF.

Answer

Create a static route from one VRF to another.

Question 2

An administrator runs 'diagnose sys session filter dport 443' and sees:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is a TCP session in established state that has been up for 3600 seconds and will expire in 3599 seconds.. The output shows proto=6, which is TCP, and proto_state=01, which indicates the TCP session is in an established state (TCP_ESTABLISHED). The duration=3600 means the session has been active for 3600 seconds, and expire=3599 means it will expire in 3599 seconds (i.e., the idle timeout is counting down). This is a standard TCP session in the established state, not a multicast or UDP session.

Answer

The session is a multicast session with a duration of 3600 seconds.

Answer

The session is in SYN_SENT state and has timed out after 3600 seconds.

Answer

The session is a UDP session that has been active for 3600 seconds.

Question 3

A FortiGate is configured with policy-based routing (PBR) to route certain traffic through a specific next hop. However, some traffic that should match the PBR rule is not being affected. What is a likely reason?

Accepted Answer

The PBR rule is applied on the wrong interface or direction.. Policy-based routing (PBR) in FortiOS is applied per interface and per direction (incoming or outgoing). If the PBR rule is applied on the wrong interface or in the wrong direction, traffic will never be evaluated against the route map, causing the rule to have no effect. This is the most common misconfiguration when PBR does not work as expected.

Answer

The PBR rule uses a route map that references an incorrect prefix list.

Answer

The PBR rule has a higher priority than the SD-WAN rule, but the traffic is hitting the SD-WAN rule first because of firewall policy order.

Answer

The traffic is generated locally from the FortiGate and PBR does not affect locally generated traffic.

Question 4

What is the function of a route map in FortiGate routing?

Accepted Answer

To filter and modify routing information during redistribution.. A route map in FortiGate routing is primarily used to filter and modify routing information during route redistribution between different routing protocols (e.g., OSPF, BGP, RIP). It allows granular control over which routes are accepted, advertised, or tagged with attributes like metric or community values, ensuring policy-based routing decisions.

Answer

To configure load balancing between multiple WAN links.

Answer

To enable BFD on a specific interface.

Answer

To create a static route for a specific destination.

Question 5

A FortiGate is configured with ECMP load balancing for multiple equal-cost routes. The administrator wants to ensure that all packets belonging to the same session go out the same interface. Which ECMP load balancing method should be used?

Accepted Answer

Source-dest-IP-based. Source-dest-IP-based ECMP (often called per-flow load balancing) uses a hash of both source and destination IP addresses to consistently map all packets of a session to the same next-hop interface. This ensures session integrity because the hash remains constant for the entire flow, preventing out-of-order delivery or packet drops that would occur if packets from the same session took different paths.

Answer

Weighted

Answer

Source-IP-based

Answer

Spillover

Question 6

What is the purpose of a prefix list in FortiGate routing?

Accepted Answer

To match routes based on their network prefix and subnet mask.. A prefix list in FortiGate is used to match routes based on their network prefix and subnet mask (prefix length). It is commonly applied in route maps or BGP configurations to filter or manipulate routing information, such as in redistribution or neighbor policy statements. Unlike access lists, prefix lists match the exact prefix and length, providing more granular control over route advertisement and acceptance.

Answer

To configure NAT rules.

Answer

To define SD-WAN members.

Answer

To assign IP addresses to interfaces.

Question 7

A network administrator is configuring SD-WAN rules with load balancing. They want to distribute HTTP traffic evenly across two WAN links based on the number of sessions. Which TWO settings should they use? (Choose two.)

Accepted Answer

Ensure the SD-WAN rule matches HTTP traffic (e.g., using protocol or port criteria).. The SD-WAN rule must match HTTP traffic (e.g., using destination port 80 or protocol 6) to ensure only HTTP sessions are load-balanced. Option E is correct because setting the load balancing algorithm to 'session' distributes traffic based on the number of sessions, which aligns with the requirement to distribute HTTP traffic evenly across two WAN links by session count.

Answer

Set the load balancing algorithm to 'volume'.

Answer

Create a performance SLA to monitor the links.

Answer

Enable 'set update-static-route' on the SD-WAN rule.

Question 8

A FortiGate is in a multi-area OSPF environment. The administrator needs to redistribute connected routes from area 1 into OSPF. Which THREE steps are required? (Choose three.)

Accepted Answer

Configure 'redistribute connected' under the OSPF configuration.. The 'redistribute connected' command under OSPF configuration is the fundamental step to inject connected routes into the OSPF domain. Without this command, OSPF will not advertise any connected routes that are not already part of an OSPF-enabled interface.

Answer

Configure the connected interfaces as OSPF passive interfaces.

Answer

Enable 'default-information originate' to advertise a default route.

Question 9

An administrator wants to deploy FortiSwitch and FortiAP using LAN edge management from a FortiGate. Which TWO conditions must be met? (Choose two.)

Accepted Answer

The FortiGate must be configured with the FortiLink interface for FortiSwitch and a CAPWAP interface for FortiAP.. FortiGate uses a dedicated FortiLink interface (typically a hardware switch or aggregate interface) to manage FortiSwitch devices via L2 protocols, and a CAPWAP interface (a loopback or IP interface) to terminate CAPWAP tunnels from FortiAPs. These are the required interface types for LAN edge management, as specified in the FortiOS LAN edge deployment guide.

Answer

The FortiSwitch and FortiAP must be factory reset before connecting.

Answer

The FortiGate must have a valid FortiCare contract for unified management.

Answer

The FortiGate must have the 'set allowaccess' command enabled for HTTPS or SSH on the managing interface.

Question 10

A network admin is configuring SD-WAN on a FortiGate with two WAN members (port1, port2). The requirement is that traffic for Office 365 (source IP 10.1.1.0/24, destination IP 132.245.0.0/16) should use port1 primarily unless it fails the performance SLA, in which case it should use port2. Which SD-WAN rule configuration should the admin use?

Accepted Answer

Configure the rule with 'strategy = best quality', and enable 'set match-vip enable'. Use performance SLA to monitor port1. 'best quality' strategy allows SD-WAN to use performance SLA to monitor port1 and automatically fail over to port2 when port1 fails the SLA. This matches the requirement of using port1 primarily unless it fails the performance SLA. The 'set match-vip enable' is not directly relevant here but does not invalidate the rule; the core mechanism is the performance SLA-driven failover.

Answer

Configure the rule with 'strategy = spillover' and set spillover thresholds

Answer

Configure the rule with 'strategy = source-dest-ip' and include port1 and port2

Answer

Configure the rule with 'strategy = manual' and set the preferred member to port1

Question 11

A FortiGate is running OSPF with multiple areas. The admin wants to redistribute a static route (192.168.100.0/24) into OSPF area 0. The route is configured as a static route on the FortiGate. Which configuration step is essential to ensure the static route is redistributed into OSPF?

Accepted Answer

Enable 'redistribute static' under the OSPF router configuration. The 'redistribute static' command under OSPF router configuration is the essential step to inject static routes into the OSPF domain. Without this explicit redistribution command, OSPF will not advertise any static routes, regardless of other filtering or metric settings. This is a fundamental requirement for route redistribution in OSPF.

Answer

Create a prefix list to allow the static route and apply it to the OSPF area

Answer

Set the administrative distance of the static route to 110

Answer

Configure a route map to match the static route and set OSPF type

Question 12

A FortiGate administrator wants to enable load balancing for equal-cost paths to the same destination. The FortiGate has two equal-cost routes via two different next-hop routers. Which feature should the admin enable to load balance traffic across both paths?

Accepted Answer

ECMP (Equal Cost Multi-Path). ECMP (Equal Cost Multi-Path) is the correct feature because it enables a FortiGate to distribute traffic across multiple equal-cost routes to the same destination. When the routing table contains two or more routes with identical administrative distance and metric, ECMP automatically load-balances sessions across those paths using a hash-based algorithm (e.g., source-destination IP hash), without requiring additional configuration beyond enabling the feature globally or per-VDOM.

Answer

BFD (Bidirectional Forwarding Detection)

Answer

Policy-based routing

Answer

SD-WAN load balancing

Question 13

An administrator configures an SD-WAN rule with the 'volume' load balancing algorithm. The two WAN members have bandwidth capacities: port1 = 100 Mbps, port2 = 50 Mbps. Traffic is HTTP and HTTPS from internal users to the internet. How will the traffic be distributed?

Accepted Answer

Traffic is sent to the member with the least number of bytes transmitted, resulting in a balanced distribution proportional to bandwidth. The 'volume' load balancing algorithm distributes traffic based on the cumulative bytes transmitted on each WAN member, sending new traffic to the member with the least total bytes transmitted. This results in a distribution proportional to the bandwidth capacities (port1: 100 Mbps, port2: 50 Mbps), ensuring that port1 carries approximately twice the traffic volume of port2 over time.

Answer

All traffic uses port1 until it reaches 100 Mbps, then uses port2

Answer

Traffic is distributed evenly session-by-session (round-robin)

Answer

Source-destination IP pairs are hashed to a specific member

Question 14

You run the following command on a FortiGate:

diagnose sys session filter dport 443
diagnose sys session list

Output:
proto=6 proto_state=01 duration=3600 expire=3599

What does the 'proto_state=01' indicate?

Accepted Answer

The session is in the 'init' state, meaning the first SYN packet has been seen but the handshake is not complete. In FortiGate session diagnostics, 'proto_state=01' for TCP (proto=6) indicates the session is in the 'init' state, meaning only the initial SYN packet has been observed and the three-way handshake has not yet completed. This is a transient state before the session transitions to 'established' (proto_state=02) once the final ACK of the handshake is received.

Answer

The session is fully established and in the 'established' state

Answer

The session is a UDP or ICMP session with no state tracking

Answer

The session is being torn down (FIN or RST received)

Question 15

A FortiGate is configured with two VRF instances (VRF1 and VRF2). The admin needs to allow traffic from VRF1 to reach a server in VRF2. The server is directly connected to the FortiGate on an interface in VRF2. What configuration is required?

Accepted Answer

Use VRF route leaking with route maps to export necessary routes between VRFs. B is correct because VRF route leaking is the standard method to enable communication between separate VRF instances on a FortiGate. This involves using route maps to selectively export routes from VRF2 into VRF1, allowing traffic from VRF1 to reach the server in VRF2. Without route leaking, VRFs are isolated by default, and no other mechanism (like static routes or firewall policies alone) can bridge the routing table separation.

Answer

Add both VRFs to the same VDOM

Answer

Configure a static route in VRF1 pointing to the server's IP via the VRF2 interface

Answer

Configure a firewall policy with source VRF1 and destination VRF2