NSE7 Advanced Networking and SD-WAN Practice Test 9 — 15 Questions

Question 1

A FortiGate is configured with an SD-WAN zone containing three members: port1, port2, and port3. The administrator wants to distribute traffic across all three members based on the volume of traffic, with each member receiving an equal share. They configure an SD-WAN rule with the 'Volume' load balancing algorithm. After some time, they notice that port1 is receiving significantly more traffic than the other two. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The 'Volume' algorithm distributes traffic based on the configured bandwidth of each member, and port1 has a higher bandwidth setting.. The 'Volume' load balancing algorithm distributes traffic based on the bandwidth configured for each SD-WAN member. If one member has a higher bandwidth setting, it will receive a proportionally larger share of traffic. To achieve equal distribution, the administrator must ensure that all members have the same bandwidth value configured. This is a common pitfall when members have different physical link speeds or when bandwidth settings are not standardized.

Answer

The 'Volume' algorithm uses a round-robin method, but session persistence causes port1 to be selected more often due to existing sessions.

Answer

The SD-WAN rule is configured with a source IP-based load balancing method, which overrides the volume algorithm.

Answer

The performance SLA for port1 is passing, while the other members are failing, causing all traffic to be routed to port1.

Question 2

A FortiGate is configured with an SD-WAN zone containing three members: port1, port2, and port3. The administrator wants to distribute traffic across all three members based on the volume of traffic, with each member receiving an equal share. They configure an SD-WAN rule with the 'Volume' load balancing algorithm. After some time, they notice that port1 is receiving significantly more traffic than the other two. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The other WAN members are not meeting the SLA criteria, so they are excluded from the load-balancing pool.. The 'maximize-bandwidth (SLA)' strategy load-balances across members that meet the SLA, proportionally to their bandwidth. If only one member is used, the others are likely failing the SLA and thus excluded. The other options incorrectly attribute the behavior to logging, missing commands, or a misunderstanding of the strategy's selection logic.

Answer

The 'maximize-bandwidth (SLA)' strategy selects the member with the highest configured bandwidth, ignoring others if they are within SLA.

Answer

The performance SLA is configured with 'set sla-fail-log-period' too high, causing other members to be marked as failed.

Answer

The SD-WAN rule is missing the 'set load-balance' command, so it defaults to using the highest-bandwidth member.

Question 3

An administrator has configured an SD-WAN zone with three members: port1, port2, and port3. The administrator wants to ensure that if port1 fails, traffic is load-balanced between port2 and port3 using the 'source-ip-based' algorithm. Which configuration should the administrator use?

Accepted Answer

Create an SD-WAN rule with the 'source-ip-based' algorithm, reference a performance SLA that monitors all three members, and set the rule to use the SLA for failover.. To achieve failover, the SD-WAN rule must reference a performance SLA that monitors the members. When a member fails the SLA, it is excluded from the rule's member list. The 'source-ip-based' algorithm then load-balances traffic among the remaining healthy members. This ensures that if port1 fails, traffic is distributed between port2 and port3.

Answer

Create an SD-WAN rule with the 'source-ip-based' algorithm and set the priority of port1 higher than port2 and port3.

Answer

Create an SD-WAN rule with the 'source-ip-based' algorithm and enable 'link-failover' by configuring a performance SLA that includes all three members.

Answer

Create an SD-WAN rule with the 'source-ip-based' algorithm and set the 'failover' option to 'enable' in the SD-WAN settings.

Question 4

An administrator is deploying a FortiGate at a branch with two ISP links (wan1 and wan2) in an SD-WAN zone. They configure a performance SLA named 'Internet' that monitors 8.8.8.8 using ICMP probes, with the SLA status used to steer traffic away from a failed member. After a week, the administrator notices that when wan1's latency exceeds the SLA threshold, the SD-WAN rule still selects wan1 for new sessions. Which configuration change is required to make the SD-WAN rule react to SLA status changes?

Accepted Answer

Assign the performance SLA to the SD-WAN rule and set the rule's criteria to use the SLA target.. The SD-WAN rule must be explicitly linked to the performance SLA and configured to use the SLA target as a criterion for member selection. Without this linkage, the rule ignores SLA status and continues to select members based on other criteria. Assigning the performance SLA to the rule and using it as the SLA target ensures that when wan1's latency exceeds the threshold, the rule automatically steers new sessions to wan2, providing the desired SLA-based steering.

Answer

Set the SD-WAN rule's 'SLA target' to the performance SLA and enable 'Link status' in the rule.

Answer

Configure the performance SLA to send probes from both wan1 and wan2 by enabling 'Probe mode' as passive.

Answer

Enable 'Update static route' in the performance SLA configuration.

Question 5

An administrator is configuring an SD-WAN rule on a FortiGate to route VoIP traffic over the best-performing WAN link. They want to ensure that if the primary link fails the SLA, traffic automatically switches to a backup link. Which two configuration steps are required to achieve this? (Choose two.)

Accepted Answer

Configure the SD-WAN rule to use the 'SLA' strategy and specify the SLA.. To enable SLA-based failover for VoIP traffic, you must configure a performance SLA to monitor the WAN links and assign it to the SD-WAN members. Then, configure the SD-WAN rule to use an SLA-aware strategy, such as 'lowest-cost' with SLA targets or the 'SLA' strategy, specifying the SLA. This ensures that when the primary link violates the SLA, traffic is switched to a backup link that meets the SLA.

Answer

Set the SD-WAN rule's strategy to 'lowest-cost' and enable 'fail-detect'.

Answer

Enable 'link-health-check' on the SD-WAN interfaces.

Answer

Create a static route for VoIP traffic pointing to the backup link.

Question 6

An administrator is troubleshooting an SD-WAN performance SLA that uses a ping probe to monitor a remote server. The probe is configured with a 2-second interval and a 5-second timeout. The administrator observes that the SLA status for one WAN member frequently flips between 'alive' and 'dead', even though the link appears stable. Which setting should the administrator adjust to reduce flapping?

Accepted Answer

Increase the timeout to a value greater than the probe interval, such as 6 seconds.. The flapping occurs because the timeout is only slightly longer than the interval, causing probes to overlap and some to time out while others succeed. Increasing the timeout to exceed the interval prevents premature failures, leading to a more stable SLA status. This is a common tuning step in SD-WAN performance SLA configuration.

Answer

Enable the 'update-static-route' option.

Answer

Decrease the timeout to 1 second.

Answer

Increase the probe interval to 10 seconds.

Question 7

An administrator is configuring an SD-WAN rule to route VoIP traffic over the best available link based on latency and jitter. The SD-WAN zone contains three members: port1 (MPLS), port2 (Internet), and port3 (LTE). The performance SLA 'VoIP-SLA' monitors latency and jitter with thresholds of 30 ms and 5 ms respectively. The administrator wants the rule to use the member with the lowest latency that meets both thresholds, and to fall back to the next best member if the best fails. Which two configuration steps are required to achieve this? (Choose two.)

Accepted Answer

Set the SD-WAN rule's strategy to 'lowest-cost' and enable 'link-cost-factor' with latency and jitter.. To select the best link based on latency and jitter, the SD-WAN rule must use a strategy that considers those metrics. The 'lowest-cost' strategy with link-cost-factor set to latency and jitter will compute a cost and choose the member with the lowest cost. Additionally, the rule must reference the performance SLA so that only members meeting the thresholds are considered. The other options either use inappropriate strategies or do not affect the selection logic.

Answer

Enable 'quality' in the SD-WAN rule to prioritize VoIP traffic over other traffic.

Answer

Set the SD-WAN rule's strategy to 'maximize-bandwidth' to ensure enough bandwidth for VoIP.

Answer

Configure the performance SLA to use HTTP probes to measure latency and jitter accurately.

Question 8

An administrator has configured a performance SLA named 'CriticalSLA' that monitors two servers: 8.8.8.8 and 1.1.1.1. The SLA is used in an SD-WAN rule with two members: port1 and port2. The administrator notices that when 8.8.8.8 is unreachable, both members are marked as 'dead' and traffic fails over to a backup rule. Which configuration change should be made to ensure that the SLA only marks a member as dead if both servers are unreachable?

Accepted Answer

Use the 'any' criteria for the SLA and adjust the failure threshold to 2.. The performance SLA criteria determine how multiple servers are evaluated. With 'any', the member is considered alive if at least one server responds. To mark a member as dead only when both servers are unreachable, the failure threshold must be set to 2, meaning two consecutive failed probes to both servers. This ensures that a single server failure does not mark the member as dead.

Answer

Configure the SLA to use the 'all' criteria and set the failure threshold appropriately.

Answer

Add both servers to the same SLA and set the failure threshold to 2.

Answer

Change the SLA criteria to 'any' instead of 'all'.

Question 9

A FortiGate is configured with two VRF instances: VRF10 (for a guest network) and VRF20 (for a corporate network). Each VRF has its own interface and routing table. The administrator needs to allow hosts in VRF10 to reach a server in VRF20 at 10.20.0.100. The FortiGate has a single physical interface connected to both networks via VLANs. Which two configurations are required to enable inter-VRF communication? (Choose two.)

Accepted Answer

Configure a route leaking policy or use a shared interface to allow route exchange between the VRFs.. Inter-VRF communication on FortiGate requires both a firewall policy to permit traffic between the interfaces in different VRFs and a mechanism to exchange routes between the VRFs, such as route leaking. Without the firewall policy, traffic is blocked. Without route leaking, the VRFs have no knowledge of each other's subnets, so packets cannot be routed. These two configurations together enable the required connectivity while maintaining VRF separation for other traffic.

Answer

Assign the same VRF ID to both interfaces, effectively merging the VRFs.

Answer

Configure a static route in VRF20's routing table pointing to the VRF10 subnet via the VRF10 interface.

Answer

Enable inter-VRF routing by configuring a static route in each VRF with the destination as the other VRF's subnet and the gateway as the FortiGate's interface in the other VRF.

Question 10

A FortiGate is configured with an SD-WAN zone containing two members: port1 (ISP1) and port2 (ISP2). The administrator wants to ensure that all traffic from the guest VLAN uses ISP2 unless ISP2 fails, in which case it should fall back to ISP1. Which SD-WAN configuration should the administrator use to achieve this?

Accepted Answer

Create an SD-WAN rule with 'manual' mode and set port2 as the primary member, port1 as standby.. The requirement is for a primary/standby SD-WAN rule where all guest traffic uses port2 unless it fails. Manual mode in SD-WAN rules allows the administrator to specify a preferred member and a standby member. When port2 is within SLA, it is used; if it fails, traffic switches to port1. This is the only option that guarantees the desired behavior.

Answer

Create an SD-WAN rule with the 'lowest-cost' algorithm and set the priority of port2 lower than port1.

Answer

Create an SD-WAN rule with 'maximize-bandwidth' algorithm and assign higher bandwidth to port2.

Answer

Create an SD-WAN rule with a priority sequence that places port2 first, and enable 'link-cost-factor' with 'priority'.

Question 11

An administrator is configuring an SD-WAN rule to route traffic based on application detection. The administrator wants to prioritize Microsoft Teams traffic over other traffic. Which two steps are required to achieve this? (Choose two.)

Accepted Answer

Ensure that the SD-WAN rule is placed above any other rules that might match the same traffic.. To prioritize Microsoft Teams traffic using application-based SD-WAN, you must enable application control in the firewall policy (which allows the FortiGate to identify the application) and create an SD-WAN rule that matches the Microsoft Teams application. Additionally, the rule must be ordered correctly to take precedence over other rules.

Answer

Configure a performance SLA for the SD-WAN members and reference it in the rule.

Answer

Enable application control in the firewall policy that allows the traffic.

Answer

Enable deep inspection in the firewall policy to allow application detection.

Question 12

A FortiGate is configured with two SD-WAN members: port1 (WAN1) and port2 (WAN2). An SD-WAN rule is set to use the 'lowest-cost' load balancing algorithm based on a performance SLA that measures latency. The administrator notices that all traffic is being sent over port1, even though port2 has lower latency according to the SLA. What is the most likely cause?

Accepted Answer

The SD-WAN rule has a priority configured that favors port1.. The 'lowest-cost' algorithm selects the member with the lowest cost based on SLA metrics, but if a priority is set on the SD-WAN rule, it overrides the load balancing and forces traffic to the highest-priority member. In this case, port1 likely has a lower priority value, causing all traffic to use it. Removing the priority or equalizing priorities would allow load balancing to occur.

Answer

The SD-WAN rule is configured with a source address that only matches traffic from port1.

Answer

The SD-WAN rule is using the 'lowest-cost' algorithm, but the cost is based on the interface's configured cost, not the SLA latency.

Answer

The performance SLA is configured with a probe that only monitors port1.

Question 13

An administrator is configuring an SD-WAN rule that uses the 'lowest-cost (SLA)' strategy. The rule includes three members: port1 (cost 10), port2 (cost 20), and port3 (cost 30). A performance SLA is attached, and all members are within SLA. The administrator wants traffic to prefer port1, but also wants to use port2 and port3 if port1's available bandwidth drops below a threshold. Which additional configuration is required to achieve this?

Accepted Answer

Set the performance SLA to monitor bandwidth and configure the SD-WAN rule to use 'lowest-cost (SLA)' with the 'bandwidth' option enabled.. The 'lowest-cost (SLA)' strategy selects the member with the lowest cost that is within SLA. To incorporate bandwidth as a failover condition, the performance SLA must monitor bandwidth and have a threshold configured. When port1's bandwidth falls below the threshold, it is marked out-of-SLA, and the SD-WAN rule will then choose the next lowest-cost member that is within SLA. This requires the SLA to be configured with bandwidth monitoring and the SD-WAN rule to use that SLA.

Answer

Enable 'load-balance' mode and set the 'lowest-cost' strategy to use all members within SLA.

Answer

Configure a performance SLA with a bandwidth threshold and enable 'update-static-route' to trigger failover.

Answer

Create a separate SD-WAN rule for each member with different priority values and use 'manual' strategy.

Question 14

An administrator is deploying a FortiGate in an SD-WAN environment with two WAN links: port1 (100 Mbps) and port2 (50 Mbps). They configure an SD-WAN rule with the 'volume' load balancing algorithm. After some time, they notice that port1 is carrying approximately twice as much traffic as port2. What is the most likely reason for this distribution?

Accepted Answer

The 'volume' algorithm distributes traffic proportionally to the configured bandwidth of each member.. The 'volume' load balancing algorithm in FortiOS SD-WAN distributes traffic based on the volume of data sent over each member. When bandwidth is configured on the members, the algorithm uses the bandwidth values to proportionally distribute traffic. Since port1 has 100 Mbps and port2 has 50 Mbps, port1 receives twice the traffic volume, resulting in the observed distribution.

Answer

The 'volume' algorithm distributes traffic equally, but port1 has more sessions.

Answer

The 'volume' algorithm uses a round-robin approach, but port1 has a higher priority.

Answer

The 'volume' algorithm selects the member with the lowest latency, and port1 has lower latency.

Question 15

A FortiGate is running BGP with an ISP. The administrator wants to influence inbound traffic so that the ISP prefers a specific path to the FortiGate's network. The FortiGate advertises the same prefix to the ISP from two different WAN interfaces (port1 and port2). The administrator wants the ISP to prefer port1. Which BGP attribute should be manipulated on the FortiGate's outbound advertisements to achieve this?

Accepted Answer

MED (Multi-Exit Discriminator). To influence inbound traffic from an ISP, the FortiGate can use the MED attribute on its outbound BGP advertisements. By setting a lower MED on the advertisement from port1, the FortiGate makes that path more attractive to the ISP, which will prefer it over the path with a higher MED. AS-Path prepending could also work but is less efficient. Local Preference and Next-Hop do not affect the ISP's decision for inbound traffic.

Answer

Local Preference

Answer

AS-Path

Answer

Next-Hop