NSE7 Advanced Networking and SD-WAN Practice Question
A FortiGate is experiencing asymmetric routing due to route leaking between VRFs. The administrator wants to ensure that traffic using a specific VRF returns via the same path. Which THREE actions should be taken? (Choose three.)
⚠ Common exam trap
Watch out — candidates often confuse route leaking with routing asymmetry and assume that disabling or deprioritizing leaked routes (options D or E) will fix the issue, when in fact the correct solution is to enforce symmetric forwarding at the policy level using PBR symmetry or explicit return-path PBR rules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable 'set pbr-enforce-symmetric' on the VRF interfaces
Enabling 'set pbr-enforce-symmetric' on VRF interfaces forces the FortiGate to use policy-based routing (PBR) rules bidirectionally, ensuring that return traffic for a session follows the same path as the forward traffic. This is critical in asymmetric routing scenarios caused by route leaking between VRFs, as it overrides the default per-packet forwarding behavior and enforces symmetry at the session level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable 'set pbr-enforce-symmetric' on the VRF interfaces
Why this is correct
This feature forces symmetric routing for policy-based routes.
- ✓
Configure policy-based routing with set-next-hop to force return traffic through the same interface
Why this is correct
PBR can steer return traffic to match the inbound path.
- ✓
Use a route map to set the next-hop on routes leaked into the VRF
Why this is correct
Route maps can modify routes to prefer a specific next-hop.
- ✗
Disable route leaking between VRFs
Why it's wrong here
Disabling route leaking would break connectivity, not fix asymmetry.
- ✗
Increase the administrative distance of the leaked routes
Why it's wrong here
Changing administrative distance may affect route selection but does not enforce symmetry.
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.