NSE7 Advanced Networking and SD-WAN — Timed 10 Questions

Question 1

Which TWO statements are true regarding BGP path selection in a FortiGate SD-WAN environment?

Accepted Answer

BGP best path selection is independent of SD-WAN rules unless explicitly overridden.. BGP best path selection operates independently of SD-WAN rules because BGP selects the best route based on its own path attributes (e.g., weight, local preference, AS path length, MED) as defined in RFC 4271. SD-WAN rules can only override this selection if explicitly configured to do so, typically by using route maps or policy-based routing to influence the decision. Additionally, SD-WAN rules can use BGP community values as match criteria in SD-WAN rules, allowing for more granular traffic control based on BGP attributes. Therefore, both statements A and E are correct.

Answer

SD-WAN cannot be applied to routes learned via BGP.

Answer

SD-WAN can modify BGP MED values to influence path selection.

Answer

SD-WAN rules always follow the BGP best path selection.

Question 2

An administrator configures an SD-WAN rule to steer traffic from a specific subnet to an SD-WAN member with the lowest cost. Which load balancing algorithm should be selected in the SD-WAN rule to achieve this behavior?

Accepted Answer

Lowest-cost. The 'Lowest-cost' algorithm is correct because it directs traffic to the SD-WAN member with the lowest configured cost metric, which directly matches the administrator's requirement to steer traffic from a specific subnet to the member with the lowest cost. In Fortinet SD-WAN, the cost is a static metric assigned per SD-WAN member interface, and the Lowest-cost algorithm selects the member with the smallest cost value for each new session, ensuring traffic follows the least-cost path.

Answer

Volume

Answer

Sessions

Answer

Source-dest-IP

Question 3

An administrator needs to configure VRF to separate traffic for two departments. Which TWO components must be configured for each VRF?

Accepted Answer

A VRF instance. For basic VRF operation, only a VRF instance (A) and interface binding (B) are strictly required. The VRF instance creates the separate routing table, and interface binding associates the interface with that table. The other options are not mandatory: a dedicated VDOM (C) is not needed because VRF operates within a VDOM; route leaking (D) is only for inter-VRF communication; and separate firewall policies (E) are optional and not a routing component. Although the question asks for three components, only two are essential for VRF separation.

Answer

A dedicated VDOM

Answer

Route leaking configuration

Answer

A separate firewall policy for each VRF

Question 4

A FortiGate is running OSPF in a multi-area network. The administrator notices that routes from area 1 are not being redistributed into area 0. The configuration includes 'redistribute connected' under OSPF. What is the most likely cause?

Accepted Answer

Area 1 is a stub area. The question states that the configuration includes 'redistribute connected' under OSPF. If Area 1 is a stub area, external routes (such as those redistributed from connected interfaces) are not allowed into the area. Therefore, the redistributed connected routes will not be present in Area 1 and cannot be propagated to Area 0 by the ABR. This is the most likely cause given the scenario.

Answer

The OSPF network type is not broadcast

Answer

The ABR is not configured with 'area 0'

Answer

The 'redistribute connected' command is missing under the OSPF process

Question 5

A network administrator is configuring SD-WAN on a FortiGate and wants to ensure that VoIP traffic uses the link with the lowest latency while bulk download traffic uses the link with the highest bandwidth. Which TWO configuration steps are required?

Accepted Answer

Create an SD-WAN rule for VoIP traffic with 'best quality' strategy. Create an SD-WAN rule for VoIP with 'best quality' strategy (B) and a performance SLA to measure latency (E). This ensures VoIP uses the lowest-latency link. Bulk download traffic, not matching this rule, will use the highest-bandwidth link by default due to the SD-WAN default strategy (e.g., 'lowest cost' based on bandwidth), satisfying both requirements.

Answer

Assign a static route for the VoIP subnet

Answer

Enable BFD on all WAN interfaces

Answer

Configure a route map for VoIP traffic

Question 6

A FortiGate is configured with OSPF and multiple areas. The administrator wants to prevent type 3 LSAs from entering a specific area, while still allowing inter-area routing. Which TWO configurations can achieve this?

Accepted Answer

Use an area filter list with 'prefix-list' to deny specific prefixes. To prevent Type 3 LSAs from entering a specific area while still allowing inter-area routing, the two correct configurations are using an area filter list with a prefix-list (Option C) and configuring the area as a totally stubby area (Option E). A totally stubby area blocks both Type 3 and Type 5 LSAs, but the default route is injected to enable inter-area routing. An area filter list with a prefix-list allows selective filtering of Type 3 LSAs based on prefixes. Option A (stub area) only blocks Type 5 LSAs, not Type 3 LSAs, so it does not meet the requirement. Option B (NSSA) also allows Type 3 LSAs and only blocks Type 5 LSAs. Option D (point-to-multipoint network type) does not affect LSA type filtering.

Answer

Configure the area as a stub area

Answer

Configure the area as an NSSA

Answer

Set the OSPF network type to point-to-multipoint

Question 7

A network administrator is troubleshooting an SD-WAN setup where traffic from a specific application is not being load-balanced as expected. The SD-WAN rule uses the 'volume' load balancing algorithm. Which TWO factors could cause traffic to not be distributed equally? (Choose two.)

Accepted Answer

One of the SD-WAN members is a PPPoE interface. A PPPoE interface introduces MTU overhead (typically 8 bytes) and possible fragmentation, which can disrupt session-based load balancing. The 'volume' algorithm distributes sessions based on traffic volume, but if encapsulation issues cause session drops or asymmetric handling, distribution becomes unequal. Option D is correct because asymmetric routing (forward and return traffic taking different paths) can cause sessions to be created on different SD-WAN members than intended. This breaks the consistent session-to-member mapping required for the 'volume' algorithm to distribute traffic equally, as sessions may be split or misdirected.

Answer

The SD-WAN rule is configured with 'mode = load-balance' but the algorithm is set to 'source-dest-ip'

Answer

The performance SLA has a high packet loss threshold causing the member to be dead

Answer

The traffic is encrypted and cannot be inspected

Question 8

An administrator runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session has been active for 1 hour and will expire in about 1 hour. The 'duration=3600' indicates the session has been active for 3600 seconds (1 hour), and 'expire=3599' shows the idle timeout remaining is approximately 1 hour. The proto_state=01 value indicates the session is in the INIT state (SYN sent, full handshake not yet complete); however, the duration shows it has been active for an hour, meaning this is a long-lived session that has not yet progressed to an established state—possibly due to no response. The key point is the duration and expire values, not the proto_state interpretation.

Answer

The session is about to expire and will be removed soon

Answer

The session is using UDP protocol

Answer

The session is in a half-open state

Question 9

An administrator wants to integrate a FortiExtender with a FortiGate for LTE backup. The FortiGate is using SD-WAN. What is the correct way to add the FortiExtender as an SD-WAN member?

Accepted Answer

Connect the FortiExtender to a physical port on the FortiGate and configure that port as an SD-WAN member.. When integrating a FortiExtender with a FortiGate for LTE backup in an SD-WAN setup, the correct method is to physically connect the FortiExtender to a physical port on the FortiGate. The physical port itself is then configured as an SD-WAN member, which allows the FortiGate to treat the LTE link as a standard SD-WAN interface, enabling SD-WAN rules, SLA monitoring, and automatic failover. The FortiExtender does not create a separate virtual interface; the physical port acts as the LTE interface.

Answer

Configure the FortiExtender as a standalone firewall and use IPsec between them.

Answer

Configure the FortiExtender as a separate VDOM and route between VDOMs.

Answer

Use a virtual-wire pair to connect the FortiExtender.

Question 10

An administrator configures two SD-WAN members (port1, port2) with performance SLAs. The SD-WAN rule uses 'best-quality' strategy. During a failover test, the primary member port1 becomes unavailable but traffic does not switch to port2. What should the administrator check first?

Accepted Answer

The SD-WAN rule is not configured to use the performance SLA.. When a physical interface goes down, FortiGate immediately marks the SD-WAN member as dead, regardless of SLA thresholds. Traffic should fail over to port2. The most likely reason is that the SD-WAN rule is not actually configured to use the performance SLA (option A) or the member is not part of the SLA. Option C is incorrect because SLA failover thresholds only matter when the interface is up but performance degrades; an interface-down event should trigger immediate failover.

Answer

The 'set status' on the performance SLA is 'passive'.

Answer

The performance SLA's failover threshold is not met.

Answer

The 'update-static-route' is enabled on port1.