NSE7 Advanced Networking and SD-WAN — Timed 30 Questions

Question 1

A FortiGate is configured with SD-WAN and has two WAN members: Member1 (ISP1) with priority 10, and Member2 (ISP2) with priority 5. The SD-WAN rule for traffic from the internal network uses the 'best quality' strategy. During normal operation, traffic flows through Member1. After a link failure on Member1, traffic correctly fails over to Member2. However, when Member1 is restored, traffic does not fail back. What is the most likely cause?

30 minute time limit — choose an answer to begin.

Accepted Answer

The health-check for Member1 is configured with 'set probe-mode passive' and 'set update-static-route disable'.. When 'set probe-mode passive' is configured, the health-check server only monitors the link without actively generating probe traffic, and 'set update-static-route disable' prevents the static route associated with Member1 from being re-enabled after the link is restored. This means the route remains inactive, so SD-WAN cannot fail back to Member1 even though the physical link is up.

Answer

The static route for Member1 has a higher administrative distance than Member2.

Answer

The SD-WAN rule is configured with 'set fallback' disabled.

Answer

The priority of Member2 is higher than Member1.

Question 2

An enterprise uses FortiGate as an SD-WAN edge device with three WAN links: Link A (MPLS), Link B (broadband), and Link C (LTE). The SD-WAN rule for VoIP traffic uses the 'best quality' strategy with link-quality-measurement enabled. The VoIP traffic is routed via Link A. During peak hours, users report poor voice quality. The administrator checks the SD-WAN performance SLA logs and sees that Link A's jitter and latency are within acceptable thresholds, but packet loss is slightly elevated. Which action would most likely improve VoIP quality without manual intervention?

Accepted Answer

Configure a performance SLA for VoIP traffic with jitter < 10ms, latency < 100ms, and packet-loss < 0.5% and apply it to the SD-WAN rule.. Configuring a performance SLA with specific thresholds for jitter, latency, and packet loss allows FortiGate to dynamically failover VoIP traffic to another WAN link when Link A's packet loss exceeds the defined threshold (e.g., 0.5%). Since the 'best quality' strategy uses link-quality-measurement to select the link with the best SLA compliance, applying a performance SLA with a packet-loss threshold ensures that even if jitter and latency are acceptable, elevated packet loss triggers a switch to a healthier link, improving voice quality without manual intervention.

Answer

Increase the priority of Link A to ensure it remains the preferred link.

Answer

Disable link-quality-measurement to reduce overhead on Link A.

Answer

Add a new SD-WAN rule with 'lowest cost' strategy for VoIP traffic.

Question 3

Which TWO statements correctly describe the behavior of SD-WAN rules when using the 'maximize-bandwidth' strategy?

Accepted Answer

The administrator can assign different weights to members to influence the proportion of traffic each handles.. Option B is correct because the maximize-bandwidth strategy in SD-WAN rules supports weighted load balancing, letting the administrator assign weights to each member so that traffic is distributed proportionally to those weights rather than equally. Option C is correct because SD-WAN rules only consider members that pass their configured health-checks; a member that fails its SLA/health-check is removed from the eligible member set and traffic is steered to the remaining healthy members. Option A is incorrect because the strategy does not simply send all traffic to the single highest-bandwidth member; it load-balances across eligible members according to weights. Option D is incorrect because SD-WAN rules operate on a per-session/per-flow basis and do not split a single session's packets across multiple members, which would cause reordering and break stateful inspection. Option E is incorrect because distribution is not based on session count for equal utilization; that describes a session-based or round-robin balancing method, not maximize-bandwidth with weights.

Answer

The strategy ensures that all traffic uses the member with the highest bandwidth.

Answer

Traffic from a single session can be split across multiple members for better performance.

Answer

Traffic is distributed based on session count to keep each link equally utilized.

Question 4

An organization is deploying SD-WAN across multiple sites with two internet links (MPLS and broadband) at the main branch. They want voice traffic to use the MPLS link unless it fails, in which case failover to broadband should occur. Which SD-WAN rule configuration achieves this?

Accepted Answer

Configure an SD-WAN rule for voice with strategy 'best quality', set MPLS as preferred member, and define SLA targets for MPLS.. The 'best quality' strategy with a preferred member and SLA targets allows voice traffic to use the MPLS link as long as it meets the defined SLA (e.g., latency, jitter, packet loss). If the MPLS link fails or degrades below the SLA threshold, the SD-WAN rule automatically fails over to the broadband link, ensuring voice traffic continuity.

Answer

Configure an SD-WAN rule for voice with strategy 'maximize bandwidth' and members MPLS and broadband.

Answer

Configure an SD-WAN rule for voice with strategy 'lowest cost' and members MPLS and broadband.

Answer

Configure an SD-WAN rule for voice with strategy 'manual' and members MPLS and broadband.

Question 5

A network engineer is troubleshooting an SD-WAN setup where traffic from a specific subnet is not being load-balanced as expected. The SD-WAN rule uses 'source IP' hashing. The engineer notices that the traffic originates from multiple hosts in the same /24 subnet. What is the most likely cause of poor load distribution?

Accepted Answer

The source IP hashing algorithm causes multiple hosts in the same subnet to map to the same member.. Source IP hashing in SD-WAN uses a hash of the source IP address to select a member for each flow. When multiple hosts reside in the same /24 subnet, their source IPs share the same first 24 bits, which can cause the hash algorithm to map them to the same SD-WAN member if the hash function is not sufficiently granular or if the number of members is small. This results in poor load distribution despite multiple sources.

Answer

The SD-WAN rule is not matching the traffic.

Answer

The SD-WAN members have different bandwidths.

Answer

Traffic is using a single destination IP and port.

Question 6

A FortiGate is configured with two static routes to the same destination 0.0.0.0/0 with equal distance but different priorities. The priority values are 10 and 20. Which route will be used for traffic matching the default route?

Accepted Answer

The route with priority 10 will be used.. In FortiGate, when multiple static routes have the same distance (administrative distance) to the same destination, the route with the lowest priority value is selected. Priority is a FortiGate-specific metric that breaks ties among routes with equal distance. Since priority 10 is lower than 20, the route with priority 10 will be installed in the routing table and used for traffic matching 0.0.0.0/0.

Answer

The route with priority 20 will be used.

Answer

The route with lower distance will be used.

Answer

Both routes will be used for load balancing.

Question 7

Which TWO statements are true regarding BGP path selection in a FortiGate SD-WAN environment?

Accepted Answer

BGP best path selection is independent of SD-WAN rules unless explicitly overridden.. Option A is correct because in a FortiGate SD-WAN deployment, the BGP best-path algorithm (weight, local preference, AS-path, origin, MED, etc.) runs independently and selects the active route, while SD-WAN rules operate on top of that routing decision; SD-WAN only overrides BGP's choice when an SD-WAN rule explicitly matches and steers the traffic. Option E is correct because FortiGate SD-WAN rules can match on BGP community values (via the community attribute carried in BGP updates), allowing administrators to steer traffic based on communities attached to learned routes. Option B is incorrect because SD-WAN can absolutely be applied to BGP-learned routes; SD-WAN rules and health checks can steer traffic over interfaces whose routes were learned via BGP. Option C is incorrect because SD-WAN itself does not rewrite or modify BGP MED values; MED is a BGP attribute manipulated through route-maps or BGP configuration, not by SD-WAN rule processing. Option D is incorrect because SD-WAN rules do not always follow the BGP best path; an SD-WAN rule can override the BGP-selected path when its match criteria and priority dictate a different member, which is the whole point of SD-WAN steering.

Answer

SD-WAN cannot be applied to routes learned via BGP.

Answer

SD-WAN can modify BGP MED values to influence path selection.

Answer

SD-WAN rules always follow the BGP best path selection.

Question 8

An administrator is configuring SD-WAN on a FortiGate to route traffic between two internet connections (ISP1 and ISP2). The SD-WAN rules use performance SLA to measure latency. Which TWO statements are true about SD-WAN rule matching and failover?

Accepted Answer

When the SD-WAN rule action is set to 'best quality' and no member meets the SLA, the FortiGate will still forward traffic using the member with the best SLA status.. When an SD-WAN rule is configured with 'best quality' strategy, the FortiGate selects the member with the best SLA status even if no member fully meets the SLA threshold. This ensures traffic is still forwarded using the least-bad option rather than being dropped, maintaining connectivity under degraded conditions.

Answer

SD-WAN automatically fails over all sessions to the backup member if the primary member exceeds the SLA threshold.

Answer

If multiple SD-WAN rules match, the rule with the highest bandwidth member is used.

Answer

When the SD-WAN rule action is set to 'lowest cost' and no member meets the SLA, the FortiGate drops the traffic.

Question 9

Drag and drop the steps to troubleshoot a FortiGate SSL VPN connection failure into the correct order.

Accepted Answer

Basic configuration, then user authentication, then policies, then debug, then routing. Start with basic configuration, then user authentication, then policies, then debug, then routing.

Answer

User authentication, then basic configuration, then policies, then debug, then routing

Answer

Basic configuration, then policies, then user authentication, then debug, then routing

Answer

Basic configuration, then user authentication, then debug, then policies, then routing

Question 10

Match each IPsec VPN term to its definition.

Accepted Answer

IKE: Protocol used to establish security associations and authenticate peers.. Correct matches: IKE establishes SAs and authenticates peers; SPI is an index to identify SAs; ESP provides confidentiality, authentication, and integrity. Common confusions include swapping IKE and SA definitions.

Answer

IKE: A set of parameters defining how IPsec processes traffic between peers.

Answer

IPsec SA: Protocol used to establish security associations and authenticate peers.

Question 11

Match each FortiGate interface type to its usage.

Accepted Answer

Physical interface: A hardware port that provides direct network connectivity. The correct matches: Physical Interface → hardware port; VLAN Interface → logical interface for 802.1Q tagging; Loopback Interface → always-up virtual interface; Aggregate Interface → combines multiple physical interfaces. Common confusions include mixing the definitions of loopback and VLAN, or confusing physical interfaces with aggregate interfaces.

Answer

Physical interface: A logical interface that combines multiple physical interfaces

Answer

VLAN interface: A virtual interface that is always up

Question 12

A network engineer is configuring SD-WAN on a FortiGate. They have three WAN interfaces (wan1, wan2, lte) and want traffic to the primary datacenter (10.10.10.0/24) to use wan1 unless its latency exceeds 50 ms, in which case failover to wan2. The engineer created an SD-WAN rule with a strategy of 'Manual' and selected 'wan1' as the preferred member. What additional configuration is required to achieve automatic failover based on latency?

Accepted Answer

Configure a performance SLA for wan1 with a latency threshold of 50 ms and associate it with the SD-WAN rule.. SD-WAN automatic failover based on latency requires a Performance SLA (performance-sla) configured with a latency threshold of 50 ms, and that SLA must be associated with the SD-WAN rule. The rule's strategy should be set to 'Manual' with wan1 as preferred member, but the SLA triggers the failover when the latency exceeds the threshold, causing the rule to select the next available member (wan2). Without the SLA, the Manual strategy simply pins traffic to wan1 and never fails over.

Answer

Create a route map to prefer wan1 and apply it to the SD-WAN rule.

Answer

Set the SD-WAN rule strategy to 'Best Quality' and select latency as the metric.

Answer

Enable BFD on wan1 and wan2 with a minimum interval of 50 ms.

Question 13

An administrator wants to load balance traffic across two ISP links using SD-WAN. The requirement is that sessions from the same source IP address must always use the same ISP link. Which SD-WAN load balancing algorithm should be used?

Accepted Answer

Source-destination IP. The Source-destination IP algorithm creates a hash based on both the source and destination IP addresses, ensuring that all packets belonging to sessions from the same source IP to the same destination IP are consistently forwarded over the same ISP link. This meets the requirement of session persistence for traffic from a given source IP without relying on stateful inspection or session tracking.

Answer

Sessions

Answer

Volume

Answer

Spillover

Question 14

An administrator needs to ensure that traffic from the internal network (10.0.0.0/8) destined to the Internet is routed through a specific next-hop (192.168.1.1) only if a more specific route for the destination does not exist. Which routing feature should be used?

Accepted Answer

Use policy-based routing with a deny rule for the specific prefixes that have more specific routes.. Policy-based routing (PBR) allows you to define a policy that matches traffic destined to specific prefixes and applies a deny action, effectively bypassing the PBR for those destinations. This ensures that traffic with a more specific route in the routing table uses that route, while all other traffic (without a more specific route) is forced through the next-hop 192.168.1.1 via a set ip next-hop command in the PBR policy.

Answer

Configure route redistribution from BGP to OSPF.

Answer

Enable ECMP load balancing.

Answer

Create a static default route with a higher administrative distance.

Question 15

During an SD-WAN health check, an administrator observes that a performance SLA for wan1 shows 'Status: dead' even though the interface is up and can ping the SLA server. The SLA configuration uses a TCP echo probe to 8.8.8.8 port 443. What is the most likely cause?

Accepted Answer

The probe protocol is TCP echo, but the server at 8.8.8.8 does not support TCP echo on port 443.. The TCP echo probe sends a TCP SYN to the specified port and expects a SYN-ACK to confirm connectivity. 8.8.8.8 (Google DNS) does not run a TCP echo service on port 443; it serves HTTPS. The server will respond with a TCP RST or simply ignore the probe, causing the SLA to fail and show 'dead' even though the interface is up and ICMP ping works.

Answer

The SLA server is blocking ICMP echo requests.

Answer

The performance SLA is configured with the wrong threshold.

Answer

The firewall policy allowing the probe traffic is missing.

Question 16

An administrator wants to segment traffic between two departments (Engineering and Finance) using the same FortiGate. Each department must have its own routing table with overlapping IP addresses. Which feature should be enabled to achieve this without creating separate VDOMs?

Accepted Answer

VRF. VRF (Virtual Routing and Forwarding) allows a single FortiGate to maintain multiple independent routing tables, enabling overlapping IP address spaces for different departments without requiring separate VDOMs. Each VRF instance isolates routing decisions, forwarding tables, and interfaces, meeting the segmentation requirement while preserving a unified management plane.

Answer

Policy-based routing

Answer

Virtual IP (VIP)

Answer

Multiple VDOMs

Question 17

A network administrator is configuring SD-WAN on a FortiGate with three WAN links: MPLS (10 Mbps), Broadband (50 Mbps), and LTE (20 Mbps). They want to load balance traffic based on link bandwidth, with the option to manually steer critical traffic to the MPLS link. Which TWO steps must be taken to achieve this?

Accepted Answer

Set the SD-WAN rule strategy to 'Maximize Bandwidth' with volume algorithm for general traffic.. Setting the SD-WAN rule strategy to 'Maximize Bandwidth' with the volume algorithm distributes traffic proportionally based on link bandwidth (10:50:20 ratio), achieving load balancing. Option B is correct because creating a separate SD-WAN rule with strategy 'Manual' and selecting MPLS as the preferred member allows manual steering of critical traffic to the MPLS link, overriding the load-balancing behavior for that traffic.

Answer

Set the load balancing algorithm to 'Spillover' on all rules.

Answer

Enable ECMP on the FortiGate.

Answer

Configure a performance SLA for each link.

Question 18

An administrator is troubleshooting an SD-WAN deployment where traffic from the branch to the datacenter is being sent over the backup LTE link even though the primary MPLS link has low latency and jitter. The SD-WAN rule uses 'Best Quality' strategy with latency and jitter metrics. The performance SLA for MPLS shows 'alive'. Which TWO configurations could cause this behavior?

Accepted Answer

The SD-WAN rule has 'set member' configured to only include LTE.. If the SD-WAN rule uses 'set member' to include only the LTE interface, traffic will be forced over LTE regardless of the performance SLA status or the 'Best Quality' strategy. This overrides the dynamic path selection logic, causing the backup link to be used even when the primary MPLS link is healthy.

Answer

BFD is enabled on MPLS but not on LTE.

Answer

The route to the datacenter is learned via OSPF with a lower cost over LTE.

Answer

The latency threshold is set too low for MPLS.

Question 19

A FortiGate is integrated with FortiSwitch and FortiAP. The administrator wants to manage both devices from the FortiGate GUI using the LAN edge management features. Which THREE conditions must be met for this integration to work?

Accepted Answer

FortiAP must be in CAPWAP mode to connect to the FortiGate.. FortiAP must operate in CAPWAP (Control and Provisioning of Wireless Access Points) mode to establish a control tunnel to the FortiGate. This allows the FortiGate to act as the wireless controller, managing AP configuration, firmware, and client traffic via CAPWAP encapsulation. Without CAPWAP mode, the FortiAP cannot be discovered or managed through the FortiGate's LAN edge management features.

Answer

The FortiGate must operate in transparent mode.

Answer

The FortiGate must have a separate VDOM for each managed device.

Question 20

Which command is used on a FortiGate to view the current state of BFD sessions?

Accepted Answer

diagnose sys bfd session list. 'diagnose sys bfd session list' is the FortiGate CLI command used to display the current state of Bidirectional Forwarding Detection (BFD) sessions, including session state, local/remote discriminators, and timers. This command is part of the 'diagnose' utility, which provides detailed operational and diagnostic information for troubleshooting BFD in SD-WAN or routing contexts.

Answer

get router info bfd

Answer

show bfd sessions

Answer

execute bfd show