NSE7 Advanced VPN and Zero Trust Practice Question
An administrator has configured an OSPF overlay over an IPsec VPN between two FortiGates. The OSPF neighbors are established, but routes from one side are not being installed in the routing table on the other side. 'get router info ospf neighbor' shows FULL state. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The route's OSPF cost is higher than an existing route with a lower administrative distance
Even though OSPF neighbors are FULL, routes may not be installed if they are not selected as best paths. One common reason is that the OSPF cost is higher than a static route or another routing protocol's metric. The other options would prevent neighbor from reaching FULL state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The IPsec tunnel is using transport mode instead of tunnel mode
Why it's wrong here
Transport mode vs tunnel mode does not affect OSPF route installation.
- ✓
The route's OSPF cost is higher than an existing route with a lower administrative distance
Why this is correct
OSPF routes have an AD of 110. If a static route (AD 10) or other protocol has a lower AD, the OSPF route may not be installed.
- ✗
OSPF authentication is mismatched
Why it's wrong here
Mismatched authentication would prevent neighbor from reaching FULL state.
- ✗
The OSPF network type is not set to point-to-point
Why it's wrong here
Network type affects neighbor establishment, but they are FULL, so this is not an issue.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.