CCNA Advanced Networking and SD-WAN Questions — Page 2 of 3

MCQhard

A FortiGate has an SD-WAN configuration with two members (wan1, wan2). The performance SLA monitors latency to 8.8.8.8. The admin notices that even when the SLA is satisfied on both members, all traffic uses wan1. The SD-WAN rule is configured with 'strategy = best quality'. What is the most likely cause?

A.A firewall policy is overriding the SD-WAN rule

B.The best quality strategy selects the member with the best SLA metric, which is wan1 by default when both meet SLA

C.The performance SLA is incorrectly configured, causing wan2 to be ignored

D.The SD-WAN rule has 'set match-vip disable' which forces all traffic to wan1

AnswerB

Best quality uses a tie-breaking order; it does not load balance equally.

Why this answer

When the SD-WAN rule uses 'best quality' strategy and both members meet the performance SLA, FortiGate selects the member with the best (lowest) latency metric. By default, if both members have equal SLA satisfaction, the first member in the SD-WAN configuration (wan1) is chosen as the tie-breaker. This explains why all traffic uses wan1 even though both links are healthy.

Exam trap

The trap here is that candidates assume 'best quality' always selects the best-performing link, but they overlook the implicit tie-breaking rule that defaults to the first configured member when SLA metrics are equal.

How to eliminate wrong answers

Option A is wrong because firewall policies in FortiGate do not override SD-WAN rules; SD-WAN rules are evaluated before firewall policies, and traffic matching an SD-WAN rule is forwarded according to that rule. Option C is wrong because the performance SLA is correctly configured (monitoring 8.8.8.8) and both members satisfy it, so the issue is not misconfiguration but the tie-breaking behavior of 'best quality'. Option D is wrong because 'set match-vip disable' controls whether virtual IP (VIP) objects are matched in the SD-WAN rule, not which WAN member is selected; it has no effect on member selection.

Practice this question →

MCQmedium

You want to use policy-based routing (PBR) to send traffic from a specific subnet to a different next-hop than the default route. Which configuration is required?

A.Configure a route map under 'config router policy'

B.Create a firewall policy with 'set policy-based-route enable'

C.Enable 'set pbr-enforce-symmetric' on the interface

D.Configure a prefix list and apply to the static route

AnswerA

PBR uses route maps with set-next-hop in the policy route configuration.

Why this answer

Policy-based routing (PBR) on FortiGate is configured under 'config router policy' using route maps. This allows you to match traffic based on criteria such as source subnet and set a specific next-hop, overriding the default route. Option A correctly identifies the required configuration path for PBR.

Exam trap

The trap here is that candidates confuse PBR configuration with firewall policy settings or static route modifications, but FortiGate requires the explicit 'config router policy' and route map syntax to define policy-based routing rules.

How to eliminate wrong answers

Option B is wrong because 'set policy-based-route enable' is not a valid command; firewall policies use 'set action accept' and policy-based routing is applied via route maps, not a firewall policy toggle. Option C is wrong because 'set pbr-enforce-symmetric' is used to enforce symmetric routing for PBR traffic on an interface, but it is not the configuration required to define the PBR rule itself. Option D is wrong because a prefix list applied to a static route can influence route selection but does not implement PBR, which requires a route map under 'config router policy' to match and set next-hop.

Practice this question →

MCQmedium

An administrator configures a route map on a FortiGate to redistribute connected routes into OSPF. The route map sets a metric of 100. After applying, the redistributed routes appear with metric 20. What is the most likely reason?

A.The route map is applied to the wrong direction

B.OSPF does not allow metric setting via route maps

C.The route map is not applied to the redistribution configuration

D.The metric type is set to type 1

AnswerC

If the route map is not referenced in the 'redistribute connected' command, it has no effect.

Why this answer

The most likely reason the redistributed routes appear with metric 20 instead of the configured 100 is that the route map was not applied to the redistribution configuration. In FortiGate OSPF redistribution, a route map must be explicitly referenced under the 'redistribute connected' command; otherwise, the route map is ignored, and OSPF uses its default metric of 20 for redistributed connected routes.

Exam trap

The trap here is that candidates assume creating a route map automatically applies it to redistribution, but FortiGate requires explicit application under the redistribution command, and the default metric of 20 is used if no route map is referenced.

How to eliminate wrong answers

Option A is wrong because route maps in OSPF redistribution do not have a 'direction' like in route filtering; they are applied as a filter or modifier during the redistribution process itself, so direction is not a factor. Option B is wrong because OSPF does allow metric setting via route maps using the 'set metric' action, which is a standard feature in FortiGate OSPF configuration. Option D is wrong because setting the metric type to type 1 does not affect the metric value; it changes how the metric is calculated (adding internal cost), but the base metric would still be set by the route map if applied correctly.

Practice this question →

MCQmedium

An administrator configures a route-map to match prefix-list 'PREFIX' and set metric 20. Which OSPF route redistribution uses this route-map correctly?

A.config router ospf config redistribute "connected" set route-map "RM" end

B.config router policy config route-map edit "RM" config rule set match-ip-address "PREFIX" set set-metric 20 end end

C.config router ospf set route-map "RM"

D.config router prefix-list edit "PREFIX" set rule permit 10.0.0.0/8 end

AnswerA

Route-map is applied in the redistribute configuration.

Why this answer

In FortiOS, the route-map is applied to a specific redistribution rule under 'config router ospf' using the 'set route-map' command within the 'config redistribute' block. This correctly associates the route-map 'RM' with the redistribution of connected routes into OSPF, matching the prefix-list 'PREFIX' and setting the metric to 20.

Exam trap

The trap here is that candidates often confuse the global 'set route-map' under 'config router ospf' (which is not a valid command in FortiOS) with the per-redistribution 'set route-map' inside 'config redistribute', leading them to select option C instead of A.

How to eliminate wrong answers

Option B is wrong because it shows the route-map configuration itself, not the OSPF redistribution command that uses it; the question asks which OSPF route redistribution uses the route-map correctly, and this option omits the OSPF configuration entirely. Option C is wrong because 'set route-map' under 'config router ospf' is a global OSPF setting that applies to all redistributions, but it is not the correct syntax for applying a route-map to a specific redistribution source; the correct method is to use 'set route-map' within the 'config redistribute' block for the specific protocol (e.g., connected). Option D is wrong because it shows the prefix-list configuration, not the OSPF redistribution command; the prefix-list is a match condition within the route-map, not the redistribution itself.

Practice this question →

MCQmedium

A FortiGate is configured with VRF. Which statement about VRF is true?

A.Interfaces can belong to multiple VRFs simultaneously.

B.VRF allows multiple routing tables to coexist on the same FortiGate.

C.Routes from different VRFs can be automatically redistributed without configuration.

D.VRF can only be used when OSPF is enabled.

AnswerB

VRF creates separate routing tables for segmentation.

Why this answer

VRF (Virtual Routing and Forwarding) allows a single FortiGate to maintain multiple independent routing tables, each with its own set of interfaces, routes, and forwarding decisions. This enables network segmentation and traffic isolation without requiring separate physical devices, making option B correct.

Exam trap

The trap here is that candidates often assume interfaces can belong to multiple VRFs (like VLAN sub-interfaces can belong to multiple VLANs), but in VRF, each interface is exclusively bound to a single VRF instance.

How to eliminate wrong answers

Option A is wrong because a physical or logical interface can belong to only one VRF at a time; an interface is assigned to a specific VRF instance and cannot be shared across multiple VRFs simultaneously. Option C is wrong because routes between VRFs are not automatically redistributed; explicit route leaking or inter-VRF routing policies (e.g., using route maps or VRF leak commands) must be configured to share routes between VRFs. Option D is wrong because VRF is independent of any specific routing protocol; it works with static routes, BGP, OSPF, RIP, or any combination, and does not require OSPF to be enabled.

Practice this question →

MCQhard

You are troubleshooting BFD on a FortiGate SD-WAN deployment. BFD is configured on two WAN interfaces (wan1, wan2) with a minimum transmit interval of 100 ms and a multiplier of 3. The network experiences occasional jitter causing packet loss. After a brief outage, the BFD session does not recover. Which setting should be adjusted to improve BFD resilience without significantly increasing failover time?

A.Disable BFD and rely on route timers.

B.Enable BFD on the management interface.

C.Increase the BFD minimum transmit interval on both interfaces.

D.Increase the BFD multiplier to 4 or higher.

AnswerD

A higher multiplier allows more missed packets, making BFD more tolerant to transient jitter.

Why this answer

Increasing the BFD multiplier (from 3 to 4 or higher) allows the session to tolerate more lost BFD control packets before declaring a failure. This directly addresses the jitter-induced packet loss without changing the detection timing for sustained outages, as the multiplier only affects the number of missed packets required to trigger a failure. The minimum transmit interval remains at 100 ms, so the base detection time (multiplier × interval) increases only slightly, preserving fast failover for true link failures.

Exam trap

The trap here is that candidates mistakenly increase the transmit interval (Option C) thinking it reduces jitter sensitivity, but that actually increases failover time for all failures, whereas adjusting the multiplier provides resilience against intermittent loss without proportionally increasing detection time for sustained outages.

How to eliminate wrong answers

Option A is wrong because disabling BFD removes sub-second failure detection entirely, reverting to slower routing protocol timers (e.g., OSPF dead interval of 40 seconds), which would significantly increase failover time. Option B is wrong because enabling BFD on the management interface is irrelevant to SD-WAN WAN link resilience; BFD on the management interface monitors management-plane connectivity, not data-plane SD-WAN paths. Option C is wrong because increasing the minimum transmit interval (e.g., to 200 ms) would directly increase the base detection time for all failures, including sustained outages, thereby increasing failover time, which contradicts the requirement to not significantly increase failover time.

Practice this question →

MCQmedium

An organization is deploying SD-WAN across multiple sites with two internet links (MPLS and broadband) at the main branch. They want voice traffic to use the MPLS link unless it fails, in which case failover to broadband should occur. Which SD-WAN rule configuration achieves this?

A.Configure an SD-WAN rule for voice with strategy 'maximize bandwidth' and members MPLS and broadband.

B.Configure an SD-WAN rule for voice with strategy 'lowest cost' and members MPLS and broadband.

C.Configure an SD-WAN rule for voice with strategy 'best quality', set MPLS as preferred member, and define SLA targets for MPLS.

D.Configure an SD-WAN rule for voice with strategy 'manual' and members MPLS and broadband.

AnswerC

Best quality with preferred member and SLA ensures MPLS used unless SLA fails.

Why this answer

The 'best quality' strategy with a preferred member and SLA targets allows voice traffic to use the MPLS link as long as it meets the defined SLA (e.g., latency, jitter, packet loss). If the MPLS link fails or degrades below the SLA threshold, the SD-WAN rule automatically fails over to the broadband link, ensuring voice traffic continuity.

Exam trap

The trap here is that candidates often confuse 'best quality' with 'lowest cost' or 'maximize bandwidth', not realizing that 'best quality' with a preferred member provides the exact active/passive failover behavior required for voice traffic.

How to eliminate wrong answers

Option A is wrong because 'maximize bandwidth' strategy load-balances traffic across all members, not providing the required active/passive failover behavior. Option B is wrong because 'lowest cost' strategy selects the link with the lowest cost metric, which does not guarantee MPLS as the primary link or failover based on link health. Option D is wrong because 'manual' strategy requires explicit user intervention to switch links, lacking automatic failover based on link failure or SLA degradation.

Practice this question →

Multi-Selectmedium

An administrator is configuring SD-WAN on a FortiGate to route traffic between two internet connections (ISP1 and ISP2). The SD-WAN rules use performance SLA to measure latency. Which TWO statements are true about SD-WAN rule matching and failover?

Select 2 answers

A.When the SD-WAN rule action is set to 'best quality' and no member meets the SLA, the FortiGate will still forward traffic using the member with the best SLA status.

B.SD-WAN rules can use multiple members and the best member is selected based on performance SLA measurements.

C.SD-WAN automatically fails over all sessions to the backup member if the primary member exceeds the SLA threshold.

D.If multiple SD-WAN rules match, the rule with the highest bandwidth member is used.

E.When the SD-WAN rule action is set to 'lowest cost' and no member meets the SLA, the FortiGate drops the traffic.

AnswersA, B

Correct. If no member meets the SLA, the FortiGate uses the member with the best SLA status (least bad) to forward traffic.

Why this answer

When an SD-WAN rule is configured with 'best quality' strategy, the FortiGate selects the member with the best SLA status even if no member fully meets the SLA threshold. This ensures traffic is still forwarded using the least-bad option rather than being dropped, maintaining connectivity under degraded conditions.

Exam trap

The trap here is that candidates often assume 'best quality' or 'lowest cost' actions will drop traffic when no member meets the SLA, but FortiGate always forwards traffic using the best available member to avoid connectivity loss.

Practice this question →

MCQeasy

Which FortiGate feature allows the creation of multiple virtual routing tables within a single VDOM?

A.VRF

B.Policy-based routing

C.VDOM

D.ECMP

AnswerA

VRF (Virtual Routing and Forwarding) allows multiple routing tables within a VDOM.

Why this answer

VRF (Virtual Routing and Forwarding) allows a single FortiGate VDOM to maintain multiple independent routing tables, each with its own forwarding decisions. This is achieved by creating separate VRF instances (identified by VRF IDs 1-255) within the same VDOM, enabling traffic isolation and overlapping IP address spaces without requiring separate VDOMs.

Exam trap

The trap here is confusing VDOM with VRF: candidates often think VDOMs are the only way to create multiple routing tables, but VRF achieves this within a single VDOM, which is a more granular and resource-efficient approach for network segmentation.

How to eliminate wrong answers

Option B (Policy-based routing) is wrong because it overrides the routing table for specific traffic based on policies, but does not create multiple independent routing tables; it only redirects traffic within a single routing table. Option C (VDOM) is wrong because VDOMs create separate virtual firewalls with their own routing tables, but the question asks for multiple routing tables within a single VDOM, not separate VDOMs. Option D (ECMP) is wrong because ECMP (Equal-Cost Multi-Path) is a load-balancing technique that distributes traffic across multiple paths within a single routing table, not a mechanism to create multiple routing tables.

Practice this question →

MCQmedium

A FortiGate is configured with ECMP load balancing for equal-cost routes. The administrator wants to ensure that all traffic from a specific source IP uses the same next hop. Which ECMP load balancing method should be selected?

A.Destination-IP-based

B.Source-IP-based

C.Weighted random

D.Round-robin

AnswerB

Source-IP-based ECMP hashes the source IP to select a next hop, ensuring all traffic from the same source uses the same path.

Why this answer

Source-IP-based ECMP load balancing ensures that all packets from a specific source IP address are forwarded to the same next hop by hashing only the source IP field. This maintains session consistency for traffic originating from a single host, which is critical for stateful inspection and applications that require symmetric routing.

Exam trap

The trap here is that candidates often confuse 'per-flow' load balancing (which uses source and destination IP) with 'source-IP-based' persistence, assuming that any hash including the source IP will keep all traffic from that source on the same path, but only a hash using exclusively the source IP achieves that guarantee.

How to eliminate wrong answers

Option A is wrong because Destination-IP-based hashing uses only the destination IP, which would not guarantee that traffic from the same source IP uses the same next hop; different destinations could be load-balanced to different paths. Option C is wrong because Weighted random distributes traffic probabilistically based on weights, not deterministically by source IP, so packets from the same source could take different paths. Option D is wrong because Round-robin cycles through next hops in order without any per-source affinity, breaking source-IP stickiness.

Practice this question →

MCQmedium

An administrator wants to integrate a FortiExtender with a FortiGate to provide additional WAN connectivity. Which configuration is required on the FortiGate to enable the FortiExtender to operate as a secondary WAN interface?

A.Configure the FortiExtender under Network > FortiExtender and assign it to a WAN interface

B.Enable LLDP on the port connected to the FortiExtender

C.Set the FortiExtender to bridge mode

D.Create a VLAN interface for the FortiExtender

AnswerA

The FortiGate creates a virtual interface for the FortiExtender.

Why this answer

When a FortiExtender is configured under Network > FortiExtender and assigned to a WAN interface, the FortiGate treats it as a secondary WAN link, allowing it to participate in SD-WAN or load-balancing policies. The FortiExtender operates in its default routed mode, where it receives a public IP from the cellular network and the FortiGate uses it as an additional gateway for outbound traffic.

Exam trap

The trap here is that candidates often assume bridge mode is required to integrate the FortiExtender, but in reality, bridge mode is used only for specific passthrough scenarios (e.g., extending a LAN segment), while the default routed mode is what enables it as a secondary WAN interface with its own NAT and gateway capabilities.

How to eliminate wrong answers

Option B is wrong because LLDP (Link Layer Discovery Protocol) is used for neighbor discovery and topology mapping, not for enabling a FortiExtender as a WAN interface; the FortiGate does not require LLDP to recognize or manage the FortiExtender. Option C is wrong because bridge mode would cause the FortiExtender to act as a transparent bridge, forwarding traffic without performing NAT or routing, which prevents it from functioning as a secondary WAN interface that provides its own public IP and gateway. Option D is wrong because creating a VLAN interface for the FortiExtender is unnecessary; the FortiExtender connects via a physical port or USB, and the FortiGate manages it through a dedicated management interface, not a VLAN sub-interface.

Practice this question →

Multi-Selecthard

A FortiGate is configured with BGP and OSPF. The administrator wants to ensure that routes learned via BGP are redistributed into OSPF, but only specific prefixes. Which three components are needed? (Select THREE.)

Select 3 answers

A.A route map that references the prefix list and sets OSPF parameters

B.Redistribution of BGP into OSPF under router ospf with the route map applied

C.A VRF to separate the routing tables

D.A prefix list to match the desired BGP routes

E.A distribute list in OSPF to filter incoming routes

AnswersA, B, D

Route map ties together match (prefix list) and set actions (metric, tag).

Why this answer

A route map is required to match the specific prefixes (via the prefix list) and to set OSPF metric or metric-type parameters when redistributing BGP routes into OSPF. Without the route map, redistribution would apply to all BGP routes or use default OSPF parameters, which does not meet the requirement of controlling which prefixes are redistributed.

Exam trap

The trap here is that candidates often confuse distribute lists (which filter OSPF routes received from neighbors) with route maps used for redistribution filtering, leading them to select option E instead of understanding that redistribution filtering requires a route map referencing a prefix list.

Practice this question →

MCQeasy

What is the purpose of configuring BFD (Bidirectional Forwarding Detection) on a FortiGate?

A.To provide rapid failure detection between two forwarding engines.

B.To load balance traffic across multiple links.

C.To encrypt BGP updates between peers.

D.To authenticate OSPF neighbors.

AnswerA

BFD provides sub-second detection of link failures, complementing routing protocol convergence.

Why this answer

BFD (Bidirectional Forwarding Detection) provides sub-second failure detection between two forwarding engines, such as FortiGate peers running OSPF or BGP. It operates independently of the routing protocol, using a lightweight hello mechanism to detect link or neighbor failures faster than protocol-native timers (e.g., OSPF dead interval of 40 seconds). This enables rapid convergence in SD-WAN and advanced networking scenarios.

Exam trap

The trap here is that candidates confuse BFD with routing protocol features like authentication or load balancing, but BFD is exclusively a fast failure detection mechanism that works alongside, not instead of, routing protocols.

How to eliminate wrong answers

Option B is wrong because load balancing across multiple links is achieved through ECMP (Equal-Cost Multi-Path) routing or SD-WAN load-balancing rules, not BFD, which only detects failures. Option C is wrong because encrypting BGP updates between peers is done using IPsec or MD5/TCP-AO authentication, not BFD, which has no encryption capability. Option D is wrong because authenticating OSPF neighbors is performed using OSPF authentication (plaintext, MD5, or SHA) in the OSPF packet header, not BFD, which focuses solely on bidirectional liveness detection.

Practice this question →

MCQmedium

An administrator configures SD-WAN with two members (port1 and port2). A performance SLA monitors latency to 8.8.8.8. The SD-WAN rule uses 'Best Quality' strategy based on latency. When the link on port1 becomes slow, the FortiGate continues using port1 even though port2 has lower latency. What is the most likely cause?

A.The FortiGate is not receiving ICMP replies from 8.8.8.8

B.The SD-WAN rule is configured with 'Manual' strategy

C.The performance SLA is not associated with the SD-WAN members

D.The load balancing algorithm is set to 'volume' instead of 'lowest-latency'

AnswerC

If the performance SLA is not applied to the SD-WAN member interface, the FortiGate does not know the latency status and cannot failover.

Why this answer

The performance SLA must be explicitly associated with the SD-WAN members (port1 and port2) for the 'Best Quality' strategy to use latency measurements. Without this association, the FortiGate cannot compare the SLA results per interface and defaults to using the current active member, even if its latency is higher. The SLA monitors 8.8.8.8, but the SD-WAN rule has no link to those measurements, so port1 continues to be used.

Exam trap

The trap here is that candidates assume configuring a performance SLA automatically applies to all SD-WAN members, but FortiOS requires explicit association per member for the SLA to influence path selection.

How to eliminate wrong answers

Option A is wrong because if the FortiGate were not receiving ICMP replies from 8.8.8.8, the performance SLA would mark the link as dead and fail over to port2, which is not the described behavior. Option B is wrong because 'Manual' strategy requires explicit interface selection and does not use performance SLA data at all, but the question states 'Best Quality' strategy is configured. Option D is wrong because 'volume' is a load-balancing algorithm for distributing traffic, not a strategy for selecting the best link based on latency; 'lowest-latency' is not a valid SD-WAN strategy option in FortiOS.

Practice this question →

MCQhard

A FortiGate is configured with OSPF in multiple areas and redistributes connected routes into OSPF. The administrator notices that routes from area 1 are not appearing in area 0. The area 0 routers show the routes as 'O E2' but with an invalid metric. What is the most likely cause?

A.OSPF network type is broadcast on one side and point-to-point on the other

B.Redistribution is configured without a route map

C.The interface costs are misconfigured

D.The ABR has 'area 0 stub' configured

AnswerB

Without a route map, redistributed routes may get default metric values that can be invalid.

Why this answer

When a route is redistributed into OSPF without a route map, it is advertised as a Type 5 LSA (external) with a default metric of 20. However, if the redistribution is not properly filtered or the metric is not explicitly set, the route may appear with an invalid metric (e.g., 0 or unexpected value) on the ABR. The ABR will flood this LSA into area 0, but the metric inconsistency causes the routes to be seen as 'O E2' with an invalid metric, preventing proper route installation.

Exam trap

The trap here is that candidates often assume mismatched network types or interface costs cause metric issues, but the real problem is that OSPF requires explicit metric configuration (via route map or 'metric' keyword) for redistributed routes to be valid, and a missing route map leads to an invalid metric on the ABR.

How to eliminate wrong answers

Option A is wrong because mismatched OSPF network types (broadcast vs. point-to-point) affect neighbor adjacency formation and LSA flooding, not the metric of redistributed routes. Option C is wrong because interface costs influence OSPF intra-area and inter-area path selection, but they do not affect the metric of redistributed external routes (E2). Option D is wrong because configuring area 0 as a stub would block Type 5 LSAs entirely, preventing any external routes (including redistributed ones) from appearing in area 0, whereas the question states the routes appear as 'O E2' with an invalid metric.

Practice this question →

MCQhard

A FortiGate is configured with ECMP load balancing for multiple equal-cost routes. The administrator wants to ensure that all packets belonging to the same session go out the same interface. Which ECMP load balancing method should be used?

A.Weighted

B.Source-dest-IP-based

C.Source-IP-based

D.Spillover

AnswerB

Source-dest-IP hashing ensures that all packets in a session (same src/dst) go through the same interface, maintaining session integrity.

Why this answer

Source-dest-IP-based ECMP (often called per-flow load balancing) uses a hash of both source and destination IP addresses to consistently map all packets of a session to the same next-hop interface. This ensures session integrity because the hash remains constant for the entire flow, preventing out-of-order delivery or packet drops that would occur if packets from the same session took different paths.

Exam trap

The trap here is that candidates often confuse 'source-dest-IP-based' with 'source-IP-based' or assume that any ECMP method inherently preserves session affinity, but only the source-dest-IP-based (or per-flow) method guarantees that all packets of a session use the same interface.

How to eliminate wrong answers

Option A is wrong because Weighted ECMP distributes traffic based on configured weight ratios, but it still uses per-packet or per-flow hashing depending on the underlying method; it does not inherently guarantee session persistence unless combined with a per-flow hash. Option C is wrong because Source-IP-based hashing only considers the source IP, which can cause packets from the same session (same source and destination) to be split if the source IP alone does not uniquely identify the flow, leading to asymmetric routing. Option D is wrong because Spillover is a load balancing method that sends traffic to a secondary link only when the primary link's bandwidth threshold is exceeded; it does not use hashing and can break session continuity when traffic spills over mid-session.

Practice this question →

MCQmedium

A FortiGate with SD-WAN has two members: MPLS (port1) and Broadband (port2). The performance SLA is configured to monitor latency and packet loss. The administrator notices that after a brief outage on the MPLS link, traffic fails over to Broadband but does not fail back when MPLS recovers. What is the likely cause?

A.The SD-WAN rule for the traffic has 'set failback disable'.

B.The SLA threshold is set too aggressively, causing the link to be considered down long after recovery.

C.The Broadband link has a higher cost, so the FortiGate prefers to keep traffic there.

D.The SLA probe interval is longer than the outage duration, so the SLA never detected the outage.

AnswerA

The 'failback' setting controls whether traffic returns to the preferred member when it becomes healthy again. If disabled, traffic stays on the backup link.

Why this answer

The 'set failback disable' command in the SD-WAN rule prevents traffic from automatically returning to the preferred MPLS link after it recovers. By default, failback is enabled, meaning traffic will revert to the higher-priority member once the performance SLA is satisfied again. When disabled, the FortiGate keeps traffic on the backup link indefinitely, which matches the described behavior.

Exam trap

The trap here is that candidates often confuse failback with failover triggers or SLA thresholds, assuming the issue is with detection or cost rather than the explicit failback disable setting in the SD-WAN rule.

How to eliminate wrong answers

Option B is wrong because an overly aggressive SLA threshold would cause the link to be considered down more easily, not prevent failback after recovery; the issue is about failback, not detection. Option C is wrong because cost influences initial path selection and load balancing, not failback behavior; a higher-cost link would not be preferred for failback, and the FortiGate does not use cost to decide whether to revert traffic. Option D is wrong because if the SLA probe interval were longer than the outage, the SLA would never detect the outage, so traffic would not fail over at all; the scenario states failover occurred, so the probe interval is not the cause.

Practice this question →

MCQeasy

A network administrator wants to configure SD-WAN on a FortiGate with two internet connections (port1 and port2). The requirement is to use the link with the lowest cost as the primary path for all traffic, unless it exceeds a threshold. Which SD-WAN load balancing algorithm should the administrator choose?

A.Spillover

B.Sessions

C.Lowest-cost

D.Volume

AnswerC

Lowest-cost selects the member with the lowest cost. If the cost exceeds a threshold, the next best member is used.

Why this answer

The 'Lowest-cost' algorithm (option C) is correct because it allows the administrator to assign a cost metric to each SD-WAN link and designate the link with the lowest cost as the primary path. Traffic will use this primary link until its cost exceeds a defined threshold, at which point the FortiGate will spill over traffic to the next lowest-cost link. This directly matches the requirement of using the lowest-cost link as primary unless a threshold is exceeded.

Exam trap

The trap here is that candidates confuse the 'Lowest-cost' algorithm with the 'Spillover' algorithm, mistakenly thinking Spillover uses cost thresholds when it actually uses volume-based thresholds, leading them to select option A instead of C.

How to eliminate wrong answers

Option A (Spillover) is wrong because the Spillover algorithm uses a traffic volume threshold (in Mbps or sessions) to determine when to shift traffic to another link, not a cost metric; it does not consider link cost as the primary selection criterion. Option B (Sessions) is wrong because the Sessions algorithm distributes traffic based on the number of active sessions per link, aiming for session count balance, not cost-based primary path selection with a threshold. Option D (Volume) is wrong because the Volume algorithm balances traffic based on the total bytes transferred per link, not on a cost metric or a threshold that triggers spillover from the lowest-cost link.

Practice this question →

MCQhard

An administrator has configured BGP on a FortiGate with two upstream ISPs. They notice that traffic to a specific prefix is not load-balanced as expected; all traffic goes through ISP1 even though both paths are available. 'get router info bgp network' shows the prefix with two next hops. What is the MOST likely cause?

A.The prefix is being learned via an IGP with a lower administrative distance

B.The BGP multi-path is disabled

C.The administrative distance of BGP is higher than OSPF

D.The eBGP multihop is not configured

AnswerB

BGP load balancing requires multi-path to be enabled. Even with multiple paths, if multi-path is off, only the best path is installed.

Why this answer

BGP multi-path must be explicitly enabled to allow load balancing across multiple equal-cost paths. Even if both next hops are present in the BGP table, without the 'set multipath' or 'set multipath number' configuration under the BGP process, the FortiGate will select only the best path (lowest weight, local preference, AS-path length, etc.) and install that single route in the routing table. This is why all traffic uses ISP1 despite both paths being available.

Exam trap

The trap here is that candidates assume BGP automatically load-balances across multiple equal-cost paths, but BGP requires explicit multi-path configuration to enable ECMP, unlike IGPs such as OSPF or EIGRP which do so by default.

How to eliminate wrong answers

Option A is wrong because the prefix is learned via BGP (as shown by 'get router info bgp network'), not an IGP; administrative distance only affects route selection between different protocols, not BGP multi-path behavior. Option C is wrong because administrative distance is irrelevant when comparing two BGP-learned routes from the same protocol; BGP uses its own path selection algorithm (weight, local preference, AS-path, etc.) to choose the best path. Option D is wrong because eBGP multihop is only needed when the BGP peers are not directly connected (TTL=1 default); it has no effect on load balancing across multiple paths to the same prefix.

Practice this question →

MCQeasy

What is the purpose of using a prefix list in route redistribution?

A.To match routes based on IP prefix and prefix length

B.To define a list of allowed source IPs for management access

C.To specify the next-hop for a set of routes

D.To set BGP community values on matched prefixes

AnswerA

Prefix lists match routes by network and subnet mask.

Why this answer

A prefix list is used in route redistribution to match routes based on their IP prefix and prefix length (e.g., 192.168.0.0/16). This allows granular control over which routes are redistributed from one routing protocol to another, such as from OSPF to BGP, by filtering based on the network address and subnet mask.

Exam trap

The trap here is that candidates often confuse prefix lists with route maps or ACLs, thinking prefix lists can modify route attributes or specify next-hops, when in reality prefix lists only perform matching based on prefix and length, while route maps handle attribute manipulation.

How to eliminate wrong answers

Option B is wrong because defining a list of allowed source IPs for management access is the purpose of an access control list (ACL) or a local-in policy, not a prefix list. Option C is wrong because specifying the next-hop for a set of routes is done using a route map with the set next-hop command or a static route, not a prefix list. Option D is wrong because setting BGP community values on matched prefixes is performed using a route map with the set community command, while a prefix list only matches routes and does not modify attributes.

Practice this question →

MCQeasy

A network administrator is configuring SD-WAN on a FortiGate. The organization has two internet links: MPLS (primary) and broadband (backup). The administrator wants all traffic to use the MPLS link unless it fails, in which case traffic should fail over to the broadband link. Which SD-WAN configuration best achieves this requirement?

A.Set the MPLS link priority to 10 and the broadband link priority to 5, then configure an SD-WAN rule with the 'best quality' strategy.

B.Enable 'set role' on the MPLS link as 'primary' and on the broadband link as 'standby' with the 'redundant' strategy.

C.Configure both links in the SD-WAN zone with equal priority and use the 'lowest cost' strategy.

D.Create two static routes: one with higher distance for MPLS and one with lower distance for broadband.

AnswerA

Higher priority for MPLS ensures it is preferred. The 'best quality' strategy selects the member with the highest priority when available, providing failover.

Why this answer

Setting the MPLS link priority to 10 (higher) and broadband to 5 (lower) ensures the SD-WAN rule with 'best quality' strategy selects the MPLS link as the preferred path. The 'best quality' strategy evaluates link quality metrics and, when priorities differ, prefers the higher-priority link. If the MPLS link fails, the strategy automatically fails over to the broadband link, meeting the requirement.

Exam trap

The trap here is that candidates often confuse SD-WAN failover with traditional static route failover using administrative distance, or incorrectly assume that role-based 'primary/standby' settings exist in FortiGate SD-WAN, leading them to choose options B or D instead of understanding that SD-WAN uses priority and strategy-based path selection.

How to eliminate wrong answers

Option B is wrong because 'set role' with 'primary' and 'standby' is not a valid SD-WAN configuration; FortiGate SD-WAN uses priority values and strategies, not role-based primary/standby assignments, and the 'redundant' strategy is for load balancing, not failover. Option C is wrong because equal priority with 'lowest cost' strategy would load-balance traffic across both links based on cost, not enforce MPLS as primary and broadband as backup. Option D is wrong because static routes with different distances control routing table selection, not SD-WAN link failover; SD-WAN rules override static route behavior and require SD-WAN-specific configuration to achieve policy-based failover.

Practice this question →

MCQeasy

Which of the following is the primary purpose of BFD (Bidirectional Forwarding Detection) on a FortiGate?

A.To synchronize routing tables between peers

B.To load balance traffic across multiple paths

C.To provide fast detection of link failures

D.To encrypt routing updates between peers

AnswerC

BFD detects failures in sub-second intervals, much faster than routing protocol timers.

Why this answer

BFD (Bidirectional Forwarding Detection) is a lightweight protocol designed to provide sub-second failure detection between two forwarding engines, such as FortiGate peers. Unlike routing protocol hellos (e.g., OSPF Hello at 10-second intervals), BFD can detect link or neighbor failures in as little as 50–100 ms, enabling faster convergence. This makes it the primary mechanism for rapid link failure detection in high-availability and SD-WAN deployments.

Exam trap

The trap here is that candidates confuse BFD with routing protocol keepalives or assume it performs routing table synchronization, when in fact BFD is purely a fast failure detection mechanism that operates independently of the routing protocol.

How to eliminate wrong answers

Option A is wrong because BFD does not exchange or synchronize routing tables; it only monitors the bidirectional forwarding path between peers. Option B is wrong because BFD does not perform load balancing; it is a detection mechanism that can be used alongside ECMP or SD-WAN to trigger path changes upon failure. Option D is wrong because BFD does not encrypt routing updates; it sends simple, unencrypted control packets (RFC 5880) and relies on the underlying transport for security if needed.

Practice this question →

MCQhard

An administrator configures BFD on a BGP session between two FortiGates. After enabling BFD, the BGP session flaps intermittently. What is the most likely cause?

A.The BFD failure detection intervals are too low, causing false positives

B.BFD is incompatible with BGP and should not be used together

C.BGP hold timer is shorter than BFD detection time

D.The BFD minimum transmit and receive intervals are set too high

AnswerA

Low intervals cause premature detection of failure.

Why this answer

When BFD is enabled on a BGP session, the BFD failure detection intervals (typically the minimum transmit and receive intervals) determine how quickly a link failure is detected. If these intervals are set too low, BFD may generate false positives due to transient network jitter or minor packet loss, causing the BGP session to flap as BFD triggers a session reset even though the underlying link is stable. This is the most likely cause because the symptom appeared immediately after enabling BFD, and the default or misconfigured intervals can be too aggressive for the network conditions.

Exam trap

The trap here is that candidates often assume BFD is always beneficial and that lower intervals are better, but the question tests the understanding that overly aggressive BFD timers can cause instability due to false positives, not that BFD is incompatible or that higher intervals cause flapping.

How to eliminate wrong answers

Option B is wrong because BFD is fully compatible with BGP and is commonly used to accelerate link failure detection in BGP sessions; RFC 5880 and RFC 5881 define BFD for IP links, and FortiGate supports BFD for BGP. Option C is wrong because if the BGP hold timer were shorter than the BFD detection time, BGP would time out before BFD detects a failure, but the problem is intermittent flapping, not BGP hold timer expiration; in fact, BFD detection times are typically much shorter than BGP hold timers (e.g., 150ms vs 3 seconds). Option D is wrong because setting BFD minimum transmit and receive intervals too high would make BFD less sensitive, reducing false positives and flapping, not causing it; the issue is intervals being too low, not too high.

Practice this question →

MCQmedium

An administrator sees the following output from 'get router info routing-table': S 0.0.0.0/0 [10/0] via 192.168.1.1, port1 S 0.0.0.0/0 [10/0] via 192.168.2.1, port2 They have configured ECMP load balancing. However, traffic to a specific destination IP is always using port1. What is the likely reason?

A.The firewall policy only allows traffic on port1

B.ECMP uses per-packet load balancing by default and the traffic is a single flow

C.One of the static routes has a lower administrative distance

D.The destination IP hash results in the same link for all sessions due to the load balancing algorithm

AnswerD

FortiGate's ECMP uses a hash of source/dest IP and port. If only one flow exists, it will consistently use the same link.

Why this answer

D is correct because FortiGate ECMP load balancing uses a hash-based algorithm (source-destination IP, port, or protocol) by default, not per-packet. When the hash of the destination IP consistently maps to the same link (port1), all sessions to that specific IP will use that interface, even though multiple routes exist with equal administrative distance and cost.

Exam trap

The trap here is that candidates confuse per-packet load balancing (which would alternate packets within a single flow) with FortiGate's default per-session hash-based ECMP, leading them to incorrectly select Option B.

How to eliminate wrong answers

Option A is wrong because firewall policies are stateful and apply to traffic after routing decisions are made; they do not influence which route is selected for a given destination. Option B is wrong because FortiGate ECMP does not use per-packet load balancing by default; it uses per-session load balancing based on a hash of the 5-tuple (or source/destination IP), so a single flow will always use the same link. Option C is wrong because both static routes show the same administrative distance [10] and cost [0], so they are equal-cost paths; a lower administrative distance would cause one route to be preferred over the other, but that is not the case here.

Practice this question →

100

Multi-Selectmedium

An administrator needs to integrate a FortiSwitch with a FortiGate for LAN edge management. The FortiGate will manage the switch via the LAN interface. Which TWO steps are required? (Choose two.)

Select 2 answers

A.Enable switch controller on the FortiGate.

B.Assign an IP address to the FortiSwitch's management VLAN on the FortiGate.

C.Configure the FortiSwitch in standalone mode.

D.Disable STP on the FortiSwitch ports connected to the FortiGate.

E.Connect the FortiSwitch to a port configured as a 'switch' interface type.

AnswersA, E

The switch controller feature must be enabled to manage FortiSwitch devices.

Why this answer

Enabling the switch controller on the FortiGate activates the FortiLink management protocol, which is required for the FortiGate to discover, configure, and manage the FortiSwitch as a managed switch. Option E is correct because the physical port connecting the FortiSwitch must be configured as a 'switch' interface type (FortiLink interface) to establish the proprietary control and data plane communication between the devices.

Exam trap

The trap here is that candidates often think they need to manually assign a management IP or disable STP, but FortiLink automates these functions, making manual configuration unnecessary and even disruptive.

Practice this question →

101

MCQeasy

Which SD-WAN load balancing algorithm distributes traffic based on the number of active sessions per SD-WAN member?

A.Sessions

B.Source-dest-IP

C.Spillover

D.Volume

AnswerA

Sessions balances by number of active sessions.

Why this answer

The Sessions algorithm in Fortinet SD-WAN distributes traffic by counting the number of active sessions currently traversing each SD-WAN member interface. The member with the fewest active sessions receives the next new session, ensuring a balanced session load across the SD-WAN links. This is distinct from volume-based or hash-based algorithms, as it directly uses session count as the metric.

Exam trap

The trap here is that candidates often confuse 'Sessions' with 'Volume' or 'Spillover', assuming traffic distribution is always based on bandwidth usage rather than session count, which is a distinct metric in Fortinet SD-WAN load balancing.

How to eliminate wrong answers

Option B (Source-dest-IP) is wrong because it uses a hash of source and destination IP addresses to deterministically map traffic to a member, not the number of active sessions. Option C (Spillover) is wrong because it directs traffic to a primary member until a configured bandwidth threshold is exceeded, then spills over to a backup member; it does not consider session counts. Option D (Volume) is wrong because it distributes traffic based on the total bytes transferred per member, not the number of active sessions.

Practice this question →

102

MCQhard

An administrator is integrating a FortiExtender with a FortiGate. The FortiExtender is connected to port5 and configured with a cellular WAN connection. What must be configured on the FortiGate to allow the FortiExtender to provide WAN connectivity as an SD-WAN member?

A.Create a static route to the FortiExtender's management IP to use it as a gateway.

B.Configure port5 as a physical member and assign the FortiExtender's SIM card details.

C.Enable the 'fortiextender' option on port5 and configure the FortiExtender as an SD-WAN member using the virtual wan interface.

D.Use the FortiExtender as a standalone router and configure policy-based routing on the FortiGate.

AnswerC

The FortiExtender creates a virtual interface (e.g., wan or lte) that can be added as an SD-WAN member. Port5 must have the FortiExtender feature enabled.

Why this answer

To integrate a FortiExtender as an SD-WAN member, the FortiGate must enable the 'fortiextender' option on the physical port (port5) to which the FortiExtender is connected. This creates a virtual wan interface that represents the FortiExtender's cellular WAN connection, allowing it to be added as an SD-WAN member for load balancing and failover policies. No static route or SIM card configuration is needed on the FortiGate, as the FortiExtender handles cellular authentication and routing internally.

Exam trap

The trap here is that candidates assume the FortiExtender must be configured as a separate router or that SIM details must be entered on the FortiGate, when in fact the FortiGate only needs to enable the 'fortiextender' option to treat the FortiExtender as a logical SD-WAN member.

How to eliminate wrong answers

Option A is wrong because a static route to the FortiExtender's management IP is not required; the FortiExtender acts as a WAN extension, not a gateway that needs a separate route. Option B is wrong because SIM card details are configured on the FortiExtender itself, not on the FortiGate; port5 must be configured with the 'fortiextender' option, not as a physical SD-WAN member. Option D is wrong because using the FortiExtender as a standalone router with policy-based routing defeats the purpose of SD-WAN integration; the FortiExtender must be managed as a virtual interface on the FortiGate to participate in SD-WAN rules.

Practice this question →

103

MCQhard

A FortiGate is running OSPF with multiple areas. The admin wants to redistribute a static route for 192.168.100.0/24 into OSPF. After configuring 'config router ospf' with 'redistribute static' enabled, the route appears in the OSPF database but is not being advertised to other areas. What is the most likely cause?

A.The 'redistribute static' command needs a route map to filter the route correctly.

B.The static route's administrative distance is too high for OSPF.

C.The router is an ABR and the static route is being redistributed as a type 5 LSA, which is not flooded into stub areas.

D.OSPF must be configured with 'default-information originate' to allow redistribution.

AnswerC

Type 5 LSAs are blocked in stub areas. To redistribute into stub areas, the route must be advertised as a type 7 LSA.

Why this answer

An ABR does not flood Type 5 LSAs (which are generated by redistribution) into stub areas or NSSAs. Since the route appears in the OSPF database on the ABR but is not advertised to other areas, the most likely cause is that the receiving area is a stub area, which by design blocks Type 5 LSAs. The redistribution of a static route into OSPF creates a Type 5 LSA, which is only flooded throughout the AS except into stub areas and NSSAs.

Exam trap

The trap here is that candidates often overlook the impact of stub area restrictions on Type 5 LSAs and mistakenly focus on redistribution syntax or administrative distance, rather than understanding that ABR behavior in stub areas blocks external routes by default.

How to eliminate wrong answers

Option A is wrong because a route map is not required for basic redistribution of a static route; it is optional for filtering or modifying attributes. Option B is wrong because administrative distance is a Cisco concept used for route selection within a router's routing table, not a factor in OSPF LSA flooding or redistribution behavior. Option D is wrong because 'default-information originate' is used to inject a default route into OSPF, not to enable redistribution of static routes; redistribution is already configured with 'redistribute static'.

Practice this question →

104

Multi-Selectmedium

A FortiGate is deployed as a LAN edge switch with multiple FortiSwitch units connected. The administrator wants to configure VLANs and manage the switches centrally. Which TWO features must be enabled on the FortiGate to achieve this? (Select TWO.)

Select 2 answers

A.LLDP-MED

B.Configure a separate management VRF

C.Create VLAN interfaces on the FortiGate and assign them to the FortiLink interface

D.FortiLink on the interface connecting to the FortiSwitch

E.STP (Spanning Tree Protocol) on the FortiGate

AnswersC, D

VLANs are defined on the FortiGate and communicated to switches via FortiLink.

Why this answer

VLAN interfaces must be created on the FortiGate and assigned to the FortiLink interface to enable centralized VLAN management. The FortiGate acts as the controller, pushing VLAN configurations to connected FortiSwitch units via the FortiLink tunnel, allowing the administrator to manage all VLANs from a single point without logging into each switch individually.

Exam trap

The trap here is that candidates often think LLDP-MED or STP must be manually configured for switch management, but FortiLink abstracts these protocols and handles them automatically, making options A and E red herrings.

Practice this question →

105

MCQhard

An administrator runs 'get router info routing-table bgp' and sees that a route for 10.20.0.0/16 is learned via BGP from a neighbor. However, the route does not appear in the routing table. The administrator checks the BGP configuration and sees that 'network 10.20.0.0 255.255.0.0' is not configured under BGP. What is the most likely reason?

A.A route map is filtering the received route

B.The route is a default route (0.0.0.0/0) and is being suppressed

C.The BGP neighbor is not in the Established state

D.The route is not in the routing table because BGP requires the network statement to originate the route

AnswerA

Even though the route is learned, it may be filtered by an inbound route map before being installed in the routing table.

Why this answer

The route for 10.20.0.0/16 is learned via BGP from a neighbor and appears in the BGP table, but it is not installed in the routing table. The most likely reason is that a route map is filtering the received route, preventing it from being installed. Since the network statement is not configured under BGP, the route is not originated locally, but it can still be received from a neighbor; however, an inbound or outbound route map can deny the route from entering the routing table.

Exam trap

The trap here is that candidates often assume a missing 'network' statement prevents any BGP route from being installed, but the network statement only affects route origination, not the installation of received routes from a neighbor.

How to eliminate wrong answers

Option B is wrong because the route is a specific prefix (10.20.0.0/16), not a default route (0.0.0.0/0), and default route suppression is unrelated to the absence of a network statement. Option C is wrong because the BGP table shows the route is learned from a neighbor, which requires the BGP session to be in the Established state; if the neighbor were not Established, the route would not appear in the BGP table at all. Option D is wrong because the network statement is only required for originating a route into BGP, not for receiving routes from a neighbor; received routes can be installed in the routing table without a network statement, provided no filters block them.

Practice this question →

106

MCQhard

A FortiGate is deployed with two ISPs and SD-WAN. The organization uses OSPF to exchange routes with a remote branch. The administrator notices that the FortiGate is not installing OSPF-learned routes into the routing table. The OSPF configuration is verified to be correct, and neighbors are established. Which configuration could be causing the issue?

A.The SD-WAN health-check is configured with 'update-static-route' and is overriding OSPF routes.

B.The administrative distance of OSPF is set to 200, which is higher than the default 110.

C.A distribute-list configured under OSPF is filtering the routes from being installed.

D.The OSPF interface is configured as 'passive', which prevents route exchange.

AnswerC

A distribute-list in OSPF can filter which routes are installed into the routing table, even if neighbors are up.

Why this answer

A distribute-list applied under OSPF can filter routes from being installed into the routing table even when OSPF neighbors are fully established and the OSPF database contains the routes. This is a common cause of routes being learned but not installed, as the filter operates after the SPF calculation and before route insertion.

Exam trap

The trap here is that candidates assume OSPF neighbors being up and routes appearing in the OSPF database guarantee route installation, but a distribute-list can silently block installation without affecting neighbor adjacency or the LSDB.

How to eliminate wrong answers

Option A is wrong because the SD-WAN health-check with 'update-static-route' only affects static routes, not OSPF-learned routes; it cannot override OSPF routes in the routing table. Option B is wrong because the default administrative distance for OSPF is 110, and setting it to 200 would make OSPF routes less preferred but would not prevent them from being installed if no better route exists; the question states routes are not installed at all, not that they are overridden. Option D is wrong because a passive OSPF interface prevents sending or receiving OSPF hellos and thus prevents neighbor formation, but the question states neighbors are established, so passive configuration cannot be the issue.

Practice this question →

107

MCQmedium

A FortiGate is configured with multiple VRF instances. The administrator needs to ensure that traffic from VRF 10 can reach a server in VRF 20. Which configuration is required?

A.Enable inter-VRF routing by setting 'vrf-leak enable' on the VRF instances

B.Configure a firewall policy that allows traffic between the VRFs

C.Place both interfaces in the same VRF

D.Use static routes with the appropriate VRF tags to leak routes between VRFs

AnswerD

Route leaking can be done with static routes or redistribution.

Why this answer

Inter-VRF route leaking in FortiGate is achieved by configuring static routes with the 'vrf' tag to specify the source VRF and using the 'dst-vrf' or 'vrf-leak' settings to export routes into the destination VRF. This allows traffic from VRF 10 to reach a server in VRF 20 by ensuring the necessary routes are present in both VRFs without merging the VRFs.

Exam trap

The trap here is that candidates often assume a firewall policy alone can enable inter-VRF communication, forgetting that routing must first be established between the VRFs via route leaking or static routes with VRF tags.

How to eliminate wrong answers

Option A is wrong because 'vrf-leak enable' is not a valid command in FortiGate; route leaking is done via static routes or policy-based routing, not by enabling a VRF-level toggle. Option B is wrong because a firewall policy alone cannot route traffic between VRFs; it only controls access, but without proper route leaking, the traffic will not have a valid path to the destination VRF. Option C is wrong because placing both interfaces in the same VRF defeats the purpose of VRF segmentation and does not achieve inter-VRF routing; it simply merges the VRFs.

Practice this question →

108

MCQmedium

A FortiGate is running OSPF with multiple areas. The administrator needs to redistribute a static route into OSPF. Which command will correctly configure redistribution of static routes into OSPF process 10?

A.config router ospf config redistribute edit static set status enable next end end

B.config router policy set redistribute static end

C.config router static set redistribute ospf end

D.config router ospf set redistribute static enable end

AnswerD

This is the correct syntax to enable redistribution of static routes into OSPF.

Why this answer

In FortiOS, the command to redistribute static routes into OSPF is configured directly under the OSPF process using `set redistribute static enable` within `config router ospf`. This enables the redistribution of static routes into OSPF process 10, as specified in the question.

Exam trap

The trap here is that candidates often confuse the FortiOS syntax with Cisco IOS, where redistribution is configured under `router ospf` with `redistribute static subnets`, leading them to choose Option A which mimics a Cisco-style configuration block, but FortiOS uses a flat `set redistribute static enable` command instead.

How to eliminate wrong answers

Option A is wrong because the `config redistribute` subcommand under OSPF is used for route redistribution within OSPF, but the correct syntax for enabling redistribution of static routes is `set redistribute static enable` at the OSPF process level, not a separate `edit static` block. Option B is wrong because `config router policy` is not a valid command in FortiOS for OSPF redistribution; route policies are configured under `config router policy` but redistribution is set within the OSPF process itself. Option C is wrong because `config router static` is used for static route configuration, not for OSPF redistribution; the `set redistribute ospf` command does not exist in this context.

Practice this question →

109

Multi-Selecthard

A FortiGate is configured with BGP to an SD-WAN member link. The administrator wants to prefer one link over another for specific routes based on AS path length. Which THREE configurations can influence BGP path selection? (Choose three.)

Select 3 answers

A.Set the metric (MED) to a lower value on the desired link.

B.Use a route map to prepend AS numbers to the AS path for the less preferred link.

C.Configure the 'set aspath' command in a route map to change the AS path.

D.Set a higher local preference on the desired link.

E.Configure weight on the neighbor to prefer routes from that neighbor.

AnswersB, D, E

AS path prepending makes the path longer, thus less preferred.

Why this answer

Prepending AS numbers to the AS path of the less preferred link artificially lengthens the AS path, making that route less attractive in BGP path selection. BGP prefers the shortest AS path, so the link without prepending will be chosen for the specific routes.

Exam trap

The trap here is that candidates confuse 'set aspath' (which replaces the entire AS path) with AS path prepending, or they incorrectly think MED directly relates to AS path length, when in fact MED is a separate metric that only applies within the same AS.

Practice this question →

110

MCQmedium

An administrator configures a prefix list to filter routes received from a BGP neighbor. The prefix list permits 192.168.0.0/16 le 24. Which routes are permitted?

A.Only routes with prefix length exactly 16 within 192.168.0.0/16

B.Only routes with prefix length exactly 24 within 192.168.0.0/16

C.Any route with prefix length greater than 24 within 192.168.0.0/16

D.Any route with prefix length between 16 and 24 inclusive, starting with 192.168

AnswerD

The prefix list allows 192.168.0.0/16 and any more specific route up to /24 (i.e., le 24).

Why this answer

The prefix list `192.168.0.0/16 le 24` permits any route that matches the prefix `192.168.0.0/16` and has a prefix length between 16 and 24 inclusive. The `le` (less-than-or-equal-to) operator sets the maximum prefix length, so routes with lengths 16, 17, 18, 19, 20, 21, 22, 23, and 24 are all allowed, as long as they fall within the 192.168.0.0/16 network.

Exam trap

The trap here is that candidates often misinterpret `le 24` as meaning 'length exactly 24' or 'lengths less than 24', when in fact it means 'lengths from the network prefix length up to and including 24'.

How to eliminate wrong answers

Option A is wrong because it incorrectly restricts the prefix length to exactly 16, ignoring the `le 24` modifier that permits longer prefixes up to 24. Option B is wrong because it incorrectly restricts the prefix length to exactly 24, ignoring the base prefix length of 16 and the range allowed by `le`. Option C is wrong because it states prefix lengths greater than 24 are permitted, but `le 24` explicitly limits the maximum prefix length to 24, so lengths 25 or longer are denied.

Practice this question →

111

MCQeasy

A network administrator needs to configure SD-WAN on a FortiGate to distribute traffic across two WAN links based on session count. Which load balancing algorithm should be selected in the SD-WAN rule?

A.Volume

B.Lowest-cost

C.Spillover

D.Sessions

AnswerD

Sessions algorithm balances based on the number of active sessions.

Why this answer

The 'Sessions' load balancing algorithm distributes new sessions across SD-WAN members based on the current session count, ensuring an even distribution of sessions. This directly matches the requirement to distribute traffic based on session count, as it selects the member with the fewest active sessions for each new session.

Exam trap

The trap here is confusing 'Sessions' with 'Volume' or 'Spillover', as candidates often assume bandwidth-based algorithms (like Volume) are the default for session distribution, but FortiGate's SD-WAN explicitly separates session count from byte volume in its load balancing options.

How to eliminate wrong answers

Option A is wrong because 'Volume' distributes traffic based on the total bytes transferred, not session count. Option B is wrong because 'Lowest-cost' selects the link with the lowest cost (based on cost metric), not session count. Option C is wrong because 'Spillover' forwards traffic to a primary link until a configured bandwidth threshold is exceeded, then spills over to a backup link, which is unrelated to session count.

Practice this question →

112

Multi-Selectmedium

A network admin needs to configure a FortiGate to load balance traffic across two ISP links using SD-WAN. The requirement is to use both links simultaneously for different sessions based on source-destination IP hash. Which two settings are required? (Select TWO.)

Select 2 answers

A.Create an SD-WAN zone with both WAN members

B.Configure an SD-WAN rule with load balancing algorithm 'source-dest-ip-hash'

C.Add a performance SLA for each member

D.Set the rule strategy to 'best quality'

E.Enable 'spillover' under the SD-WAN rule

AnswersA, B

Members must be added to the SD-WAN zone.

Why this answer

An SD-WAN zone is a logical grouping of WAN members (interfaces) that allows FortiGate to treat multiple ISP links as a single entity for load balancing and redundancy. Without creating a zone that includes both WAN members, the SD-WAN rules cannot reference them collectively for traffic distribution. Option B is correct because the 'source-dest-ip-hash' load balancing algorithm ensures that sessions with the same source and destination IP pair are consistently forwarded over the same link, enabling per-session load balancing across both ISPs simultaneously.

Exam trap

The trap here is that candidates often confuse 'load balancing algorithm' (like source-dest-ip-hash) with 'strategy' (like best quality) or assume that performance SLAs are mandatory for any SD-WAN rule, when in fact SLAs are only needed for dynamic path selection based on link quality.

Practice this question →

113

MCQmedium

A network engineer is configuring SD-WAN on a FortiGate. They have three WAN interfaces (wan1, wan2, lte) and want traffic to the primary datacenter (10.10.10.0/24) to use wan1 unless its latency exceeds 50 ms, in which case failover to wan2. The engineer created an SD-WAN rule with a strategy of 'Manual' and selected 'wan1' as the preferred member. What additional configuration is required to achieve automatic failover based on latency?

A.Create a route map to prefer wan1 and apply it to the SD-WAN rule.

B.Set the SD-WAN rule strategy to 'Best Quality' and select latency as the metric.

C.Enable BFD on wan1 and wan2 with a minimum interval of 50 ms.

D.Configure a performance SLA for wan1 with a latency threshold of 50 ms and associate it with the SD-WAN rule.

AnswerD

The performance SLA measures latency and triggers failover when the threshold is exceeded.

Why this answer

SD-WAN automatic failover based on latency requires a Performance SLA (performance-sla) configured with a latency threshold of 50 ms, and that SLA must be associated with the SD-WAN rule. The rule's strategy should be set to 'Manual' with wan1 as preferred member, but the SLA triggers the failover when the latency exceeds the threshold, causing the rule to select the next available member (wan2). Without the SLA, the Manual strategy simply pins traffic to wan1 and never fails over.

Exam trap

The trap here is that candidates confuse BFD (which detects link failures) with Performance SLA (which measures latency and triggers failover based on quality thresholds), leading them to choose Option C instead of D.

How to eliminate wrong answers

Option A is wrong because route maps are used for policy-based routing or BGP manipulation, not for SD-WAN failover decisions; SD-WAN rules use performance SLAs and strategies, not route maps. Option B is wrong because 'Best Quality' strategy dynamically selects the best member based on metrics like latency, but the question requires a Manual strategy with failover triggered by a specific latency threshold, not continuous best-path selection. Option C is wrong because BFD (Bidirectional Forwarding Detection) detects link failures (up/down) with sub-second intervals, but it does not measure latency or trigger failover based on latency thresholds; BFD is for link liveliness, not performance-based SLA monitoring.

Practice this question →

114

MCQeasy

Which BFD mode is used to detect forwarding path failures between two FortiGates that are directly connected?

A.Synchronous mode

B.Echo mode

C.Demand mode

D.Asynchronous mode

AnswerD

Default mode with periodic hello packets.

Why this answer

Asynchronous mode is the default BFD mode used between two directly connected FortiGates to detect forwarding path failures. In this mode, both peers periodically send control packets at negotiated intervals, and if a peer stops receiving these packets within the detection multiplier, the session is declared down. This allows rapid detection of link or forwarding failures without relying on echo packets or on-demand triggers.

Exam trap

The trap here is that candidates confuse 'echo mode' with the default mode because echo mode can be used to reduce overhead, but asynchronous mode is the standard and mandatory mode for BFD operation between directly connected peers.

How to eliminate wrong answers

Option A is wrong because synchronous mode is not a BFD mode; BFD uses asynchronous, demand, and echo modes, and synchronous mode is unrelated to BFD operation. Option B is wrong because echo mode is an optional BFD mechanism where one end sends echo packets that the other end loops back, but it is not the primary mode for detecting forwarding path failures between directly connected FortiGates; it is used to reduce control packet overhead. Option C is wrong because demand mode is a BFD mode where control packets are sent only when there is a change or on demand, not periodically, and it is typically used in scenarios where reducing control traffic is critical, not for default direct-connect failure detection.

Practice this question →

115

Multi-Selectmedium

An administrator is troubleshooting an SD-WAN rule that is not matching expected traffic. The SD-WAN rule uses a custom application category and has a performance SLA attached. Which two conditions must be true for the traffic to be matched by the SD-WAN rule? (Select TWO.)

Select 2 answers

A.The performance SLA must be marked as 'up' for at least one member in the SD-WAN zone

B.The destination port must be 80 or 443

C.The traffic must be identified by the application control sensor as the configured application category

D.The source IP must be in the same subnet as the SD-WAN member's IP

E.The traffic must match the firewall policy that has SD-WAN enabled

AnswersC, E

If the rule matches on application category, the traffic must be identified accordingly by App Control.

Why this answer

SD-WAN rules in FortiOS rely on application control sensors to classify traffic into custom application categories. If the traffic is not identified by the application control sensor as belonging to the configured category, the SD-WAN rule cannot match it, regardless of other conditions.

Exam trap

The trap here is that candidates often confuse the role of the performance SLA (which affects path selection after matching) with a match condition, leading them to select option A, when in fact the SLA status does not determine whether traffic matches the rule.

Practice this question →

116

Multi-Selectmedium

An administrator is configuring SD-WAN rules to direct specific traffic types. Which TWO of the following criteria can be used in an SD-WAN rule to match traffic?

Select 2 answers

A.Source interface

B.Time of day

C.Destination IP address

D.Application

E.URL category

AnswersC, D

Destination IP can be used as a match criterion.

Why this answer

Destination IP address (C) is a valid SD-WAN rule match criterion because SD-WAN rules can use destination IP address ranges or prefixes to steer traffic over specific transport interfaces or SD-WAN members. This allows administrators to route traffic to particular destinations (e.g., a branch office subnet or a cloud service) through preferred WAN links based on IP-based policy. Application (D) is also a valid criterion because SD-WAN rules can match traffic based on application signatures (e.g., Office365, YouTube) to apply appropriate steering policies, ensuring critical applications use optimal paths while non-critical traffic can be directed over lower-cost links.

Exam trap

The trap here is that candidates confuse SD-WAN rule match criteria with firewall policy match criteria, mistakenly thinking that source interface or URL category are valid SD-WAN rule options when they are actually only applicable in firewall policies or web-filtering profiles.

Practice this question →

117

Multi-Selecthard

An administrator deploys a FortiGate in a remote office with a FortiSwitch and FortiAP. The LAN edge management features are used to manage these devices. The FortiGate is configured as a controller. Which three steps are required to manage the FortiAP via the FortiGate? (Choose THREE.)

Select 3 answers

A.Configure DHCP option 138 or DNS to point FortiAP to FortiGate

B.Authorize the FortiAP by serial number on the FortiGate

C.Enable CAPWAP on the FortiGate

D.Enable LLDP on the FortiSwitch

E.Configure an SSID under the FortiAP profile

AnswersA, B, C

FortiAP discovers the controller via DHCP or DNS.

Why this answer

FortiAPs use DHCP option 138 or DNS to discover the FortiGate controller. DHCP option 138 provides the IP address of the FortiGate, while DNS resolves a predefined hostname (e.g., 'fortigate' or 'fg') to the controller's IP. Without this discovery mechanism, the FortiAP cannot locate the FortiGate to establish CAPWAP control and data tunnels.

Exam trap

The trap here is that candidates confuse the steps for initial AP discovery and authorization with later configuration tasks like SSID creation or switch-level protocols like LLDP, which are not required for the FortiGate to manage the FortiAP.

Practice this question →

118

MCQmedium

A network admin is configuring SD-WAN on a FortiGate with two WAN members (port1, port2). The requirement is that traffic for Office 365 (source IP 10.1.1.0/24, destination IP 132.245.0.0/16) should use port1 primarily unless it fails the performance SLA, in which case it should use port2. Which SD-WAN rule configuration should the admin use?

A.Configure the rule with 'strategy = spillover' and set spillover thresholds

B.Configure the rule with 'strategy = source-dest-ip' and include port1 and port2

C.Configure the rule with 'strategy = best quality', and enable 'set match-vip enable'. Use performance SLA to monitor port1

D.Configure the rule with 'strategy = manual' and set the preferred member to port1

AnswerC

Best quality uses the performance SLA to select the best member. When the primary member fails SLA, traffic moves to the next best.

Why this answer

'best quality' strategy allows SD-WAN to use performance SLA to monitor port1 and automatically fail over to port2 when port1 fails the SLA. This matches the requirement of using port1 primarily unless it fails the performance SLA. The 'set match-vip enable' is not directly relevant here but does not invalidate the rule; the core mechanism is the performance SLA-driven failover.

Exam trap

The trap here is that candidates often confuse 'manual' strategy with a simple preferred member setting, but 'manual' lacks automatic SLA-based failover, which is essential for this requirement.

How to eliminate wrong answers

Option A is wrong because 'spillover' strategy is used for load balancing based on traffic volume thresholds, not for performance-based failover; it does not use performance SLA to trigger a switch. Option B is wrong because 'source-dest-ip' strategy is a load-balancing algorithm that distributes traffic based on source and destination IP hashing, not a primary/backup failover based on SLA. Option D is wrong because 'manual' strategy requires explicit manual selection of the preferred member and does not automatically fail over based on performance SLA; it lacks the dynamic SLA monitoring needed for the requirement.

Practice this question →

119

MCQhard

You run 'diagnose sys session filter dport 179' on a FortiGate and see many sessions with proto=6 and proto_state=01. What does this indicate about the BGP sessions?

A.BGP sessions are fully established and exchanging routes.

B.BGP sessions are being actively torn down.

C.BGP sessions are in the process of being established, but not yet fully up.

D.BGP sessions are using TCP port 179 but are idle.

AnswerC

proto_state=01 means SYN_SENT, indicating TCP handshake is incomplete.

Why this answer

Proto=6 indicates TCP, and proto_state=01 corresponds to TCP SYN_SENT (state 1 in the Linux TCP state model used by FortiGate). This means the BGP session has sent a SYN but has not yet received a SYN-ACK, so the three-way handshake is incomplete and the session is not established. BGP uses TCP port 179, so seeing many sessions in this state indicates ongoing connection attempts that have not yet completed.

Exam trap

The trap here is that candidates often assume any session on port 179 with proto=6 (TCP) means BGP is working, but they overlook the TCP state field; FortiGate's proto_state values directly map to TCP connection phases, and 01 specifically indicates the session is still in the handshake phase, not established.

How to eliminate wrong answers

Option A is wrong because a fully established BGP session would show proto_state=08 (TCP ESTABLISHED), not 01. Option B is wrong because sessions being torn down would show states like FIN_WAIT (proto_state=09 or 0A) or CLOSE_WAIT (proto_state=0B), not SYN_SENT. Option D is wrong because an idle TCP session on port 179 would still be in ESTABLISHED state (08) if the connection was previously successful, or would not exist if never established; proto_state=01 indicates active connection initiation, not idleness.

Practice this question →

120

MCQeasy

Which FortiGate feature is used to detect link failures within milliseconds, allowing rapid convergence for routing protocols like OSPF and BGP?

A.ECMP

B.OSPF Fast Hello

C.BFD

D.Route tagging

AnswerC

BFD offers fast failure detection.

Why this answer

Bidirectional Forwarding Detection (BFD) is the correct answer because it provides sub-second (millisecond) link failure detection independent of routing protocols. Unlike OSPF or BGP's own keepalive mechanisms, BFD can detect failures in as little as 50-100 ms, enabling rapid convergence for protocols like OSPF and BGP by immediately notifying them of a neighbor loss.

Exam trap

The trap here is that candidates confuse OSPF Fast Hello (which still operates in the hundreds-of-milliseconds range) with BFD's true sub-100 ms detection, or they mistakenly think ECMP or route tagging are involved in failure detection.

How to eliminate wrong answers

Option A is wrong because ECMP (Equal-Cost Multi-Path) is a load-balancing technique that distributes traffic across multiple equal-cost paths, not a failure detection mechanism. Option B is wrong because OSPF Fast Hello reduces the hello interval to achieve faster neighbor loss detection (e.g., 1 second), but it still relies on OSPF's own timers and cannot reach the millisecond detection speeds that BFD offers. Option D is wrong because route tagging is used for policy-based routing or redistribution control (e.g., marking routes with tags to filter or manipulate them), not for detecting link failures.

Practice this question →

121

MCQeasy

Which routing protocol is commonly used in SD-WAN deployments to exchange routes between FortiGate and the provider edge router in an MPLS network?

A.RIP

B.BGP

C.IS-IS

D.OSPF

AnswerB

BGP is the preferred protocol for exchanging routes with MPLS provider edge routers due to its scalability and policy control.

Why this answer

BGP is the correct answer because it is the standard exterior gateway protocol used in MPLS Layer 3 VPNs to exchange customer routes between a FortiGate (CE router) and the provider edge (PE) router. BGP supports advanced features like route filtering, load balancing, and traffic engineering, which are essential for SD-WAN overlay integration with MPLS underlay networks.

Exam trap

The trap here is that candidates often default to OSPF as a 'common' routing protocol in enterprise networks, failing to recognize that MPLS VPNs specifically require BGP for inter-domain route exchange and SD-WAN overlay integration.

How to eliminate wrong answers

Option A is wrong because RIP is a distance-vector protocol with a maximum hop count of 15, making it unsuitable for the scalable, policy-rich route exchange required between a FortiGate and an MPLS PE router. Option C is wrong because IS-IS is a link-state IGP typically used within service provider networks for internal routing, not for exchanging customer routes with a CE device in an MPLS VPN context. Option D is wrong because OSPF is an IGP designed for intra-domain routing and lacks the path-vector attributes (e.g., AS_PATH, MED) needed for MPLS VPN route distribution and SD-WAN policy-based path selection.

Practice this question →

122

Multi-Selecthard

A FortiGate is configured with OSPF multi-area. The administrator wants to redistribute a static route into OSPF area 0 and ensure it is propagated to all areas. Which THREE steps are required? (Choose three.)

Select 3 answers

A.Set the OSPF network type to point-to-multipoint

B.Ensure the static route has a valid next-hop and is in the routing table

C.Configure 'redistribute static' under OSPF router configuration

D.Disable OSPF on all interfaces to prevent loops

E.Configure a route map to set the metric type to E1

AnswersB, C, E

Only routes in the routing table can be redistributed.

Why this answer

OSPF can only redistribute routes that are present in the routing table. If the static route is not valid (e.g., missing next-hop or interface down), it will not be installed, and redistribution will fail. The 'redistribute static' command under OSPF router configuration (Option C) is the fundamental step to inject the route into OSPF.

A route map with metric type E1 (Option E) is required to ensure the redistributed route is advertised as an external type 1 (E1) metric, which carries the internal cost to the ASBR, allowing proper path selection across all areas.

Exam trap

The trap here is that candidates often forget to verify the static route is actually installed in the routing table (Option B) and assume that simply configuring 'redistribute static' (Option C) is sufficient, overlooking the prerequisite of a valid next-hop.

Practice this question →

123

MCQeasy

Which feature allows a FortiGate to participate in multiple routing tables simultaneously, enabling network segmentation and overlapping IP address spaces?

A.VDOM

B.Policy-based routing

C.VRF

D.Route redistribution

AnswerC

VRF creates separate routing tables within a VDOM or global.

Why this answer

C is correct because VRF (Virtual Routing and Forwarding) allows a FortiGate to maintain multiple separate routing tables (RIB) on the same physical device. Each VRF instance operates as an independent routing domain, enabling network segmentation and the use of overlapping IP address spaces without conflict, which is essential for MPLS L3VPN and multi-tenant environments.

Exam trap

The trap here is that candidates often confuse VDOMs with VRFs, assuming VDOMs alone provide routing table separation, but VDOMs are a management and security context while VRFs are the actual mechanism for multiple routing tables and overlapping IP spaces.

How to eliminate wrong answers

Option A is wrong because VDOMs (Virtual Domains) provide administrative separation and independent firewall policies, but they do not inherently create multiple routing tables for overlapping IP spaces; VDOMs can use VRFs internally, but the feature directly responsible for multiple routing tables is VRF. Option B is wrong because policy-based routing (PBR) allows traffic to be forwarded based on policies (e.g., source/destination) rather than the routing table, but it does not create multiple independent routing tables; it only overrides the default routing decision for specific traffic. Option D is wrong because route redistribution is a mechanism to exchange routes between different routing protocols or routing tables, but it does not enable the existence of multiple routing tables; it assumes they already exist.

Practice this question →

124

MCQmedium

Which BGP attribute is used by FortiGate SD-WAN to influence outbound traffic path selection?

A.Next Hop

B.Local Preference

C.MED

D.AS Path

AnswerB

Local Preference is used to influence outbound traffic decision.

Practice this question →

125

MCQmedium

An administrator is troubleshooting SD-WAN and runs the following CLI command: 'execute sdwan-health-check status' The output shows that one SD-WAN member has a status of 'dead'. What does this indicate?

A.The member interface is administratively down

B.The member is not meeting the performance SLA thresholds

C.The SD-WAN member is not included in any SD-WAN rule

D.The member has failed the health check probe to the target server

AnswerD

'Dead' indicates that the health check has failed, meaning no response from the target.

Why this answer

The 'execute sdwan-health-check status' command displays the results of active health-check probes sent to configured target servers. A status of 'dead' means that the SD-WAN member has failed to receive a successful response from the target server within the configured probe interval and retry count, indicating a loss of connectivity or reachability to that target. This is distinct from interface administrative status or SLA compliance, as the health check specifically tests end-to-end reachability to the probe target.

Exam trap

The trap here is confusing 'dead' (probe failure) with 'SLA violation' (performance threshold breach), as candidates often assume a dead member means it failed SLA metrics, but the health check status is binary—alive or dead—based solely on probe reachability, not on latency or jitter thresholds.

How to eliminate wrong answers

Option A is wrong because 'administratively down' is a separate interface state shown by 'show interface' or 'get system interface', not by the SD-WAN health check status command; a dead health check does not imply the interface is disabled. Option B is wrong because performance SLA thresholds (e.g., latency, jitter, packet loss) are measured separately and a member can be 'dead' even if it meets SLA metrics, as 'dead' indicates probe failure, not SLA violation. Option C is wrong because an SD-WAN member not included in any rule would simply not be used for traffic steering, but its health check status would still be reported as 'alive' or 'dead' based on probe results; exclusion from rules does not cause a 'dead' status.

Practice this question →

126

Multi-Selectmedium

A network engineer is troubleshooting an OSPF multi-area setup on a FortiGate. The FortiGate is an ABR (Area Border Router) connecting area 0 and area 1. The engineer notices that routes from area 1 are not being advertised into area 0. Which TWO of the following are possible causes? (Select TWO.)

Select 2 answers

A.OSPF is not enabled on the interface in area 1, or the network type is mismatched

B.The 'redistribute connected' command is missing

C.The FortiGate does not have a direct connection to area 0

D.The FortiGate has a static route to area 1 that overrides OSPF

E.The administrative distance for OSPF is set too high

AnswersA, C

Without OSPF on the interface, no adjacency forms, and routes are not learned.

Why this answer

If OSPF is not enabled on the interface in area 1, the FortiGate cannot form adjacencies or exchange routes within that area. A network type mismatch (e.g., broadcast vs. point-to-point) can prevent neighbor relationships from forming, which would block Type 3 LSA generation by the ABR. Without OSPF running correctly on the area 1 interface, the ABR cannot inject area 1 routes into area 0.

Exam trap

The trap here is that candidates often assume missing 'redistribute connected' or static route interference is the cause, but OSPF inter-area route propagation relies solely on proper adjacency formation and ABR functionality, not redistribution or administrative distance.

Practice this question →

127

MCQmedium

A FortiGate is configured with policy-based routing to force traffic from subnet 10.0.1.0/24 to go through a WAN interface. The administrator notices that traffic from 10.0.1.0/24 is still using the default route. Which debug command can confirm if the policy-based routing is being applied?

A.diagnose debug routing ip-probe 10.0.1.1 8.8.8.8

B.diagnose debug flow policy-based-route

C.diagnose debug enable && diagnose debug router policy

D.get router info policy-based-route

AnswerB

This command shows details of policy-based routing matches and actions.

Why this answer

The `diagnose debug flow policy-based-route` command enables flow-based debugging specifically for policy-based routing (PBR) decisions. This command shows real-time details on how the FortiGate processes packets against PBR rules, including which policy matches and which egress interface is selected, allowing the administrator to confirm whether PBR is being applied to traffic from 10.0.1.0/24.

Exam trap

The trap here is that candidates confuse `diagnose debug routing policy` (which debugs route-map-based policy routing, not PBR) with the correct flow-based PBR debug command, or they mistakenly think `get router info policy-based-route` (which only shows configuration) can confirm real-time application of PBR.

How to eliminate wrong answers

Option A is wrong because `diagnose debug routing ip-probe` is used to debug IP probe (link-monitor) probes, not to verify policy-based routing application. Option C is wrong because `diagnose debug router policy` is not a valid command; the correct command for debugging routing policy is `diagnose debug routing policy`, but even that shows routing policy (e.g., route maps), not PBR flow decisions. Option D is wrong because `get router info policy-based-route` is a valid command to display the configured PBR rules, but it only shows static configuration, not real-time per-packet debugging of whether the PBR is actually being applied to traffic.

Practice this question →

128

MCQmedium

An administrator is configuring a FortiGate as a LAN edge device with FortiSwitch and FortiAP. Which feature must be enabled on the FortiGate to centrally manage the FortiSwitch and FortiAP devices?

A.CAPWAP

B.LLDP

C.SNMP

D.FortiLink

AnswerD

FortiLink is the proprietary protocol for managing FortiSwitch and FortiAP from FortiGate.

Why this answer

FortiLink is the proprietary protocol that enables a FortiGate to centrally manage FortiSwitch and FortiAP devices as logical extensions of the FortiGate itself. When FortiLink is enabled on a FortiGate interface, the FortiGate automatically discovers, provisions, and manages connected FortiSwitch and FortiAP units, handling VLAN assignment, PoE control, and firmware synchronization without requiring separate management platforms.

Exam trap

The trap here is that candidates often confuse CAPWAP (a standard wireless control protocol) with FortiLink, not realizing that Fortinet uses FortiLink as a unified management protocol for both wired and wireless devices, and that CAPWAP is not the correct answer even though it is a valid wireless management protocol in other ecosystems.

How to eliminate wrong answers

Option A is wrong because CAPWAP (Control and Provisioning of Wireless Access Points) is a standard protocol used by Cisco and other vendors for wireless AP management, but Fortinet uses FortiLink (which encapsulates CAPWAP-like control within its proprietary tunnel) for both wired and wireless management. Option B is wrong because LLDP (Link Layer Discovery Protocol) is a vendor-neutral neighbor discovery protocol used for topology discovery and device identification, not for centralized management or control of FortiSwitch and FortiAP devices. Option C is wrong because SNMP (Simple Network Management Protocol) is used for monitoring and read-only or limited write access to device statistics, but it does not provide the full lifecycle management, configuration push, or automatic provisioning required for FortiSwitch and FortiAP management.

Practice this question →

129

MCQhard

You run the following command on a FortiGate: `diagnose sys session filter dport 443` Output: `proto=6 proto_state=01 duration=3600 expire=3599` What does this output indicate?

A.The session is for UDP port 443, is in state ESTABLISHED, and has 3599 bytes remaining.

B.The session is for TCP port 443, is in state SYN_SENT, and has been active for 3600 seconds.

C.The session is for TCP port 443, is in state TIME_WAIT, and will expire in 3600 seconds.

D.The session is for TCP port 443, is in state FIN_WAIT, and will expire in 3599 seconds.

AnswerB

proto=6 is TCP, proto_state=01 is SYN_SENT, duration is 3600 seconds, expire is 3599 seconds remaining.

Why this answer

The output shows `proto=6`, which is the protocol number for TCP, and `dport 443` filters for destination port 443. The `proto_state=01` indicates the TCP state is SYN_SENT (state 1 in the FortiGate session table). The `duration=3600` means the session has been active for 3600 seconds, and `expire=3599` shows the remaining time in seconds before the session times out.

Thus, Option B correctly interprets these fields.

Exam trap

The trap here is that candidates confuse the `proto_state` value (0x01) with a common TCP state like ESTABLISHED (0x0A) or TIME_WAIT, or misinterpret `expire` as bytes remaining instead of seconds, leading them to select Option A or C.

How to eliminate wrong answers

Option A is wrong because `proto=6` is TCP, not UDP (UDP is protocol 17), and `expire=3599` represents seconds remaining, not bytes. Option C is wrong because `proto_state=01` corresponds to SYN_SENT, not TIME_WAIT (which would be state 11 or 12 depending on the implementation). Option D is wrong because `proto_state=01` is SYN_SENT, not FIN_WAIT (state 5 or 6), and `expire=3599` is the remaining time, not the time until expiration in 3600 seconds.

Practice this question →

130

Multi-Selectmedium

An administrator wants to integrate a FortiExtender into an existing SD-WAN deployment. Which TWO steps are required for proper integration?

Select 2 answers

A.Disable all other WAN interfaces

B.Authorize the FortiExtender on the FortiGate

C.Enable NAT on the FortiExtender interface

D.Configure a separate VDOM for the FortiExtender

E.Configure the FortiExtender as an SD-WAN member

AnswersB, E

Authorization is needed for management and integration.

Why this answer

The FortiExtender must first be authorized on the FortiGate to establish a secure management and data plane connection. Once authorized, it must be added as an SD-WAN member interface so that SD-WAN rules and load-balancing algorithms can be applied to traffic traversing the FortiExtender's cellular or LTE link.

Exam trap

The trap here is that candidates assume the FortiExtender requires a separate VDOM or NAT configuration, when in fact it simply needs authorization and SD-WAN membership to function as a standard WAN interface within the existing SD-WAN topology.

Practice this question →

131

MCQmedium

An administrator needs to ensure that traffic from the internal network (10.0.0.0/8) destined to the Internet is routed through a specific next-hop (192.168.1.1) only if a more specific route for the destination does not exist. Which routing feature should be used?

A.Configure route redistribution from BGP to OSPF.

B.Enable ECMP load balancing.

C.Use policy-based routing with a deny rule for the specific prefixes that have more specific routes.

D.Create a static default route with a higher administrative distance.

AnswerC

PBR can be configured to not match traffic that matches a more specific route by using a deny policy in the route map or by setting a higher priority for the specific route.

Why this answer

Policy-based routing (PBR) allows you to define a policy that matches traffic destined to specific prefixes and applies a deny action, effectively bypassing the PBR for those destinations. This ensures that traffic with a more specific route in the routing table uses that route, while all other traffic (without a more specific route) is forced through the next-hop 192.168.1.1 via a set ip next-hop command in the PBR policy.

Exam trap

The trap here is that candidates often confuse policy-based routing with static routes and administrative distance, thinking that a higher AD default route will somehow be ignored when a more specific route exists, but in reality, the default route is only used when no other route matches, so it does not provide the conditional override that PBR with a deny rule does.

How to eliminate wrong answers

Option A is wrong because route redistribution from BGP to OSPF does not control the next-hop selection based on route specificity; it simply injects routes from one protocol into another, which could actually create more specific routes and defeat the requirement. Option B is wrong because ECMP load balancing distributes traffic across multiple equal-cost paths, but it does not provide a mechanism to force traffic through a specific next-hop only when no more specific route exists; it requires equal-cost routes to the same destination. Option D is wrong because creating a static default route with a higher administrative distance would only be used if no other route to the destination exists, but it would not allow traffic with a more specific route to be routed normally; the static default would still be used for all destinations not in the routing table, which is the same behavior as a normal default route, and it does not provide the conditional logic to skip the default when a more specific route is present.

Practice this question →

132

MCQeasy

What is the function of a route map in FortiGate routing?

A.To configure load balancing between multiple WAN links.

B.To filter and modify routing information during redistribution.

C.To enable BFD on a specific interface.

D.To create a static route for a specific destination.

AnswerB

Route maps are used to match routes based on criteria and then set attributes or permit/deny the route during redistribution or policy routing.

Why this answer

A route map in FortiGate routing is primarily used to filter and modify routing information during route redistribution between different routing protocols (e.g., OSPF, BGP, RIP). It allows granular control over which routes are accepted, advertised, or tagged with attributes like metric or community values, ensuring policy-based routing decisions.

Exam trap

The trap here is that candidates often confuse route maps with policy-based routing (PBR) or SD-WAN rules, but route maps are specifically for redistribution filtering and attribute manipulation, not for direct traffic steering or load balancing.

How to eliminate wrong answers

Option A is wrong because load balancing between multiple WAN links is typically achieved using ECMP (Equal-Cost Multi-Path) routing or SD-WAN rules, not a route map. Option C is wrong because BFD (Bidirectional Forwarding Detection) is enabled on an interface or neighbor using specific BFD configuration commands, not a route map. Option D is wrong because creating a static route for a specific destination is done via the 'config router static' CLI or GUI, and a route map is not used for static route creation.

Practice this question →

133

Multi-Selecthard

An administrator is configuring BGP on a FortiGate to peer with an ISP router. The FortiGate is advertising a prefix (203.0.113.0/24) to the ISP. To ensure that traffic to the prefix is load balanced across two WAN links (port1 and port2) using SD-WAN, the administrator must configure which THREE of the following? (Select THREE.)

Select 3 answers

A.Define both port1 and port2 as SD-WAN members

B.Configure a performance SLA to monitor each link

C.Enable 'set load-balance-mode' on the SD-WAN rule to 'sessions' or another algorithm

D.Configure BGP to use the same AS number on both members

E.Create an SD-WAN rule that matches traffic and uses a load balancing algorithm like 'sessions'

AnswersA, C, E

SD-WAN members are the interfaces to be load balanced.

Why this answer

SD-WAN load balancing requires that both WAN interfaces (port1 and port2) are defined as SD-WAN members. Without adding them to the SD-WAN zone, the FortiGate cannot distribute traffic across them using SD-WAN rules or load-balancing algorithms.

Exam trap

The trap here is that candidates often confuse performance SLA monitoring (which is for failover and link quality) with load balancing, or they incorrectly assume BGP AS number configuration affects SD-WAN load balancing, when in fact SD-WAN operates independently of BGP AS numbering.

Practice this question →

134

MCQeasy

A FortiGate is configured with two static routes to the same destination 0.0.0.0/0 with equal distance but different priorities. The priority values are 10 and 20. Which route will be used for traffic matching the default route?

A.The route with priority 20 will be used.

B.The route with lower distance will be used.

C.The route with priority 10 will be used.

D.Both routes will be used for load balancing.

AnswerC

Priority 10 is higher preference than 20.

Why this answer

In FortiGate, when multiple static routes have the same distance (administrative distance) to the same destination, the route with the lowest priority value is selected. Priority is a FortiGate-specific metric that breaks ties among routes with equal distance. Since priority 10 is lower than 20, the route with priority 10 will be installed in the routing table and used for traffic matching 0.0.0.0/0.

Exam trap

The trap here is that candidates often confuse priority with administrative distance or assume higher priority is better, but FortiGate uses lower priority values as more preferred, opposite to the common intuition from other vendors like Cisco where a lower metric is better but the term 'priority' can be misleading.

How to eliminate wrong answers

Option A is wrong because a higher priority value (20) is less preferred; FortiGate selects the route with the lowest priority, not the highest. Option B is wrong because the question states both routes have equal distance, so distance does not differentiate them; the selection is based on priority, not distance. Option D is wrong because load balancing between static routes requires equal distance and equal priority; with different priorities, only the lowest priority route is active, and the other serves as a backup.

Practice this question →

135

MCQmedium

An administrator configures an SD-WAN rule with the 'volume' load balancing algorithm. The two WAN members have bandwidth capacities: port1 = 100 Mbps, port2 = 50 Mbps. Traffic is HTTP and HTTPS from internal users to the internet. How will the traffic be distributed?

A.Traffic is sent to the member with the least number of bytes transmitted, resulting in a balanced distribution proportional to bandwidth

B.All traffic uses port1 until it reaches 100 Mbps, then uses port2

C.Traffic is distributed evenly session-by-session (round-robin)

D.Source-destination IP pairs are hashed to a specific member

AnswerA

Volume algorithm tracks bytes transmitted and sends new traffic to the least loaded member.

Why this answer

The 'volume' load balancing algorithm distributes traffic based on the cumulative bytes transmitted on each WAN member, sending new traffic to the member with the least total bytes transmitted. This results in a distribution proportional to the bandwidth capacities (port1: 100 Mbps, port2: 50 Mbps), ensuring that port1 carries approximately twice the traffic volume of port2 over time.

Exam trap

The trap here is that candidates confuse 'volume' with 'spillover' or 'session' algorithms, assuming traffic fills one link before using another, or that it distributes evenly per session, rather than understanding it balances based on cumulative bytes transmitted.

How to eliminate wrong answers

Option B is wrong because it describes a 'session-persistent' or 'failover' behavior, not the volume algorithm; volume does not fill one link to capacity before using the other. Option C is wrong because it describes round-robin session distribution, which is a different algorithm (e.g., 'session' or 'spillover' mode), not volume-based. Option D is wrong because it describes source-destination IP hashing, which is used in 'source-destination IP' or 'hash' algorithms, not in volume-based load balancing.

Practice this question →

136

Multi-Selecthard

An administrator is troubleshooting SD-WAN and wants to verify that performance SLA probes are being sent correctly. Which THREE CLI commands can provide information about the SLA probes and their results?

Select 3 answers

A.diagnose sys sdwan health-check

B.diagnose sys sdwan probe-detail

C.diagnose sys sdwan member-sla

D.diagnose sys sdwan route

E.diagnose sys sdwan config

AnswersA, B, C

This command shows health check results.

Why this answer

The 'diagnose sys sdwan health-check' command displays the current status and results of performance SLA probes for each SD-WAN health-check server, including metrics like latency, jitter, and packet loss. This allows the administrator to verify that probes are being sent and whether they meet the configured SLA thresholds.

Exam trap

The trap here is that candidates confuse configuration commands (like 'diagnose sys sdwan config') with diagnostic commands that show live probe results, or they assume 'route' commands include SLA data, but only the three listed commands (A, B, C) directly expose probe transmission and SLA compliance details.

Practice this question →

137

Multi-Selectmedium

A FortiGate is configured with an SD-WAN zone containing two WAN interfaces. The administrator wants to use the 'spillover' load balancing algorithm to ensure that the primary link carries traffic until its bandwidth reaches 80% utilization, after which new sessions are sent to the secondary link. Which THREE configuration steps are necessary?

Select 3 answers

A.Create a performance SLA to measure bandwidth utilization

B.Add both interfaces as members of the SD-WAN rule

C.Configure the 'spillover-threshold' on the primary interface to 80 percent

D.Assign a weight of 80 to the primary interface and 20 to the secondary

E.In the SD-WAN rule, set the load balancing method to 'spillover'

AnswersB, C, E

Why this answer

Both WAN interfaces must be added as members of the SD-WAN rule to define which interfaces participate in the spillover load balancing. Without adding them as members, the SD-WAN rule cannot distribute traffic between the primary and secondary links based on the spillover algorithm.

Exam trap

The trap here is confusing performance SLA (which measures link quality) with bandwidth utilization monitoring (which is a separate interface-level feature), leading candidates to incorrectly select Option A.

Practice this question →

138

MCQmedium

A network administrator is configuring SD-WAN on a FortiGate with two WAN links (port1 and port2). They want traffic to destination 10.0.0.0/8 to use port1 as long as its latency is below 50ms and jitter below 10ms; otherwise, fail over to port2. Which SD-WAN configuration components are required?

A.SD-WAN members, one performance SLA, one SD-WAN member with a static route

B.SD-WAN members, two performance SLAs (one per interface), one SD-WAN rule

C.SD-WAN members, one performance SLA, two SD-WAN rules (one for each interface)

D.SD-WAN members, one performance SLA, one SD-WAN rule with the performance SLA as a strategy

AnswerD

The performance SLA defines latency/jitter thresholds. The SD-WAN rule references the SLA and sets the strategy to 'best quality' or 'manual' to enforce failover based on SLA compliance.

Why this answer

SD-WAN failover based on latency and jitter thresholds requires a single performance SLA to measure both metrics on the active link (port1), and one SD-WAN rule that uses that SLA as the strategy to determine best path. The rule defines the destination (10.0.0.0/8) and the SLA's thresholds trigger failover to port2 when exceeded. Only one SLA is needed since the condition is applied to the primary link, not both.

Exam trap

The trap here is that candidates often think each interface needs its own performance SLA (Option B) or that multiple rules are required for failover (Option C), but FortiGate SD-WAN consolidates monitoring and policy into one SLA and one rule, with the SLA applied to the primary member and failover handled by the rule's member list.

How to eliminate wrong answers

Option A is wrong because a static route is not part of SD-WAN configuration; SD-WAN uses SD-WAN rules and performance SLAs, not static routes for policy-based forwarding. Option B is wrong because two performance SLAs are unnecessary—only one SLA is needed to monitor the primary link (port1) for latency and jitter; the second link (port2) is a backup and does not require its own SLA for this failover scenario. Option C is wrong because two SD-WAN rules are redundant; a single rule with the performance SLA as the strategy can handle both the primary path and failover to the secondary interface when thresholds are breached.

Practice this question →

139

MCQhard

A FortiGate with two WAN interfaces configured in an SD-WAN setup uses the 'lowest-cost' load balancing algorithm. The performance SLA monitors latency and jitter. If wan1 has a cost of 10 and wan2 has a cost of 20, but wan1 is experiencing 50% packet loss, what will happen to traffic?

A.Traffic is distributed equally between both links

B.Traffic is dropped until wan1 recovers

C.Traffic continues using wan1 because cost is lower

D.Traffic is sent to wan2 because wan1 is considered dead

AnswerD

wan1 fails SLA so it's dead, traffic uses wan2.

Why this answer

When an SD-WAN member interface fails the performance SLA (e.g., 50% packet loss), FortiGate marks it as 'dead' and removes it from the active member set. The 'lowest-cost' algorithm then selects the next lowest-cost member that is alive, which is wan2 (cost 20). Traffic is not load-balanced equally because wan1 is dead, and it is not dropped because wan2 is available.

Exam trap

The trap here is that candidates assume the 'lowest-cost' algorithm always uses the link with the lowest cost regardless of link health, but FortiGate SD-WAN first checks the SLA status and only considers active (alive) members for the cost comparison.

How to eliminate wrong answers

Option A is wrong because the 'lowest-cost' algorithm does not distribute traffic equally; it selects the link with the lowest cost among active members, and since wan1 is dead, all traffic goes to wan2. Option B is wrong because FortiGate does not drop traffic when a link fails; it fails over to the next available link in the SD-WAN zone. Option C is wrong because even though wan1 has a lower cost, it is marked dead due to SLA failure, so it is no longer considered for traffic forwarding.

Practice this question →

140

MCQhard

A FortiGate has two WAN interfaces (port1, port2) as SD-WAN members. The performance SLA monitor is configured for both with a latency threshold of 50 ms. The measured latency on port1 is 45 ms and on port2 is 55 ms. An SD-WAN rule uses 'lowest-cost' algorithm. Which interface will be selected for new sessions?

A.port1 because its latency is within threshold and lower than port2

B.port2 because port1's latency is close to threshold

C.The session is dropped

D.Both interfaces are used equally

AnswerA

port1 meets the SLA and has lower latency, hence lower cost.

Why this answer

The SD-WAN rule uses the 'lowest-cost' algorithm, which selects the interface with the lowest cost among those that meet the performance SLA threshold. Here, port1 has a measured latency of 45 ms, which is below the 50 ms threshold, while port2's latency of 55 ms exceeds the threshold, making port2 ineligible. Therefore, port1 is the only qualifying interface and is selected for new sessions.

Exam trap

The trap here is that candidates assume the 'lowest-cost' algorithm compares raw latency values directly, but it actually first filters out interfaces that fail the SLA threshold, so port2 is excluded despite having a lower cost or being otherwise functional.

How to eliminate wrong answers

Option B is wrong because port2's latency of 55 ms exceeds the 50 ms threshold, so it is considered out of SLA and is not eligible for selection by the lowest-cost algorithm, regardless of port1's proximity to the threshold. Option C is wrong because the session is not dropped; the SD-WAN rule will still select an interface that meets the SLA (port1), and if no interface meets the SLA, the session may use the best-effort path or fall back to a configured action, but not drop outright. Option D is wrong because the lowest-cost algorithm does not load-balance equally; it selects a single interface based on cost, and since only port1 meets the SLA, it is chosen exclusively.

Practice this question →

141

MCQhard

A FortiGate is running OSPF with multiple areas. The admin wants to redistribute a static route (192.168.100.0/24) into OSPF area 0. The route is configured as a static route on the FortiGate. Which configuration step is essential to ensure the static route is redistributed into OSPF?

A.Create a prefix list to allow the static route and apply it to the OSPF area

B.Set the administrative distance of the static route to 110

C.Configure a route map to match the static route and set OSPF type

D.Enable 'redistribute static' under the OSPF router configuration

AnswerD

Without enabling redistribution on the OSPF process, static routes will not be advertised.

Why this answer

The 'redistribute static' command under OSPF router configuration is the essential step to inject static routes into the OSPF domain. Without this explicit redistribution command, OSPF will not advertise any static routes, regardless of other filtering or metric settings. This is a fundamental requirement for route redistribution in OSPF.

Exam trap

The trap here is that candidates often think a route map or prefix list is mandatory for redistribution, but the essential step is simply enabling 'redistribute static' under OSPF; filters are optional refinements.

How to eliminate wrong answers

Option A is wrong because a prefix list controls which routes are allowed or denied during redistribution, but it is not essential; the redistribution itself must first be enabled. Option B is wrong because setting the administrative distance of the static route to 110 (the default OSPF distance) does not trigger redistribution; it only affects route preference within the routing table. Option C is wrong because a route map is optional for filtering or modifying route attributes during redistribution, but the core requirement is enabling 'redistribute static'.

Practice this question →

142

MCQmedium

Which command is used on a FortiGate to view the current state of BFD sessions?

A.get router info bfd

B.show bfd sessions

C.execute bfd show

D.diagnose sys bfd session list

AnswerD

This shows BFD session details.

Why this answer

'diagnose sys bfd session list' is the FortiGate CLI command used to display the current state of Bidirectional Forwarding Detection (BFD) sessions, including session state, local/remote discriminators, and timers. This command is part of the 'diagnose' utility, which provides detailed operational and diagnostic information for troubleshooting BFD in SD-WAN or routing contexts.

Exam trap

The trap here is that candidates familiar with Cisco IOS may instinctively choose 'show bfd sessions' (Option B), but FortiGate uses a different CLI syntax where 'diagnose' is the proper command for detailed operational state, not 'show' or 'execute'.

How to eliminate wrong answers

Option A is wrong because 'get router info bfd' is not a valid FortiGate command; the correct 'get' command for BFD is 'get router info bfd session' or 'get router info bfd neighbor', but the given syntax is incomplete and incorrect. Option B is wrong because 'show bfd sessions' is a Cisco IOS command, not a FortiGate command; FortiGate uses 'get' or 'diagnose' syntax, not 'show'. Option C is wrong because 'execute bfd show' is not a valid FortiGate command; 'execute' commands are used for actions like ping or traceroute, not for displaying BFD session state.

Practice this question →

143

Multi-Selectmedium

A network administrator is configuring SD-WAN rules with load balancing. They want to distribute HTTP traffic evenly across two WAN links based on the number of sessions. Which TWO settings should they use? (Choose two.)

Select 2 answers

A.Ensure the SD-WAN rule matches HTTP traffic (e.g., using protocol or port criteria).

B.Set the load balancing algorithm to 'volume'.

C.Create a performance SLA to monitor the links.

D.Enable 'set update-static-route' on the SD-WAN rule.

E.Set the load balancing algorithm to 'session'.

AnswersA, E

The rule must match HTTP traffic to apply the load balancing algorithm to that traffic.

Why this answer

The SD-WAN rule must match HTTP traffic (e.g., using destination port 80 or protocol 6) to ensure only HTTP sessions are load-balanced. Option E is correct because setting the load balancing algorithm to 'session' distributes traffic based on the number of sessions, which aligns with the requirement to distribute HTTP traffic evenly across two WAN links by session count.

Exam trap

The trap here is confusing 'session' with 'volume' or assuming that performance SLA monitoring is required for any SD-WAN rule, when in fact load balancing algorithms are independent of SLA-based path selection.

Practice this question →

144

MCQhard

A FortiGate has multiple VRFs. The administrator wants to leak a route from VRF1 to VRF2. Which configuration is required?

A.Configure route leaking using route maps and set vrf command under VRF1's routing process

B.Use the config router vrf-leak command to define leaking rules

C.Enable inter-VRF routing on the VDOM

D.Configure a static route in VRF2 pointing to the next-hop in VRF1 with a different administrative distance

AnswerA

Route leaking between VRFs is achieved by configuring route maps with set vrf and applying them under the routing process of the source VRF.

Why this answer

Route leaking between VRFs on a FortiGate is achieved by configuring route maps with the `set vrf` command under the source VRF's routing process. This allows specific routes from VRF1 to be imported into VRF2, enabling controlled inter-VRF communication without requiring a VDOM or static route workaround.

Exam trap

The trap here is that candidates confuse the FortiGate-specific route leaking method (route maps with `set vrf`) with generic Cisco-style VRF leaking commands or assume that a static route with a different administrative distance can bypass VRF isolation, which fails because VRFs are isolated at Layer 3 and require explicit route redistribution.

How to eliminate wrong answers

Option B is wrong because the `config router vrf-leak` command does not exist in FortiOS; route leaking is configured using route maps and the `set vrf` command under the routing process, not a dedicated vrf-leak command. Option C is wrong because enabling inter-VRF routing on a VDOM is a different concept—it allows all VRFs within a VDOM to communicate without explicit route leaking, which is not the same as selective route leaking between specific VRFs. Option D is wrong because configuring a static route in VRF2 pointing to a next-hop in VRF1 with a different administrative distance does not leak the route; it creates a static route that may fail because the next-hop is in a different VRF and not reachable without proper route leaking or inter-VRF connectivity.

Practice this question →

145

Multi-Selectmedium

A network administrator is configuring SD-WAN rules and wants to ensure that voice traffic is sent over the link with the lowest jitter. Which TWO configurations should the administrator apply? (Choose two.)

Select 2 answers

A.Set the SD-WAN rule strategy to 'lowest cost'

B.Configure the SD-WAN rule to use 'volume' load balancing

C.Set the SD-WAN rule strategy to 'best quality'

D.Enable 'set jitter-threshold' on the SD-WAN rule

E.Ensure the performance SLA measures jitter

AnswersC, E

Best quality uses the priority order of metrics, which can include jitter.

Why this answer

Setting the SD-WAN rule strategy to 'best quality' instructs FortiGate to select the link with the best performance metrics, such as lowest jitter, based on the configured performance SLA. This strategy dynamically routes traffic to the interface that meets the SLA targets, ensuring voice traffic uses the link with the lowest jitter.

Exam trap

The trap here is that candidates confuse 'set jitter-threshold' as a direct SD-WAN rule parameter, when in fact jitter thresholds are defined within the performance SLA configuration and the rule only references the SLA via the 'best quality' strategy.

Practice this question →

146

MCQmedium

An administrator wants to ensure that all traffic from a specific LAN subnet (192.168.10.0/24) to the internet uses a particular WAN interface (wan1) in an SD-WAN setup, while other traffic uses wan2. What is the correct configuration to achieve this?

A.Create a policy-based routing rule with source 192.168.10.0/24 and set outgoing interface to wan1

B.Configure an SD-WAN rule with source address matching 192.168.10.0/24 and set the preferred member to wan1

C.Set the default route for wan1 with a higher distance

D.Use a route map with prefix list to match the subnet and set next-hop to wan1

AnswerB

SD-WAN rules allow source-based matching and preferred member selection.

Why this answer

In Fortinet SD-WAN, traffic steering is achieved through SD-WAN rules, not policy routes. An SD-WAN rule with a source address matching 192.168.10.0/24 and a preferred member set to wan1 ensures that all traffic from that subnet is directed to wan1, while other traffic falls through to the default SD-WAN rule or other rules using wan2. This is the correct method because SD-WAN rules are evaluated before the routing table and provide granular control over member selection based on application, source, or destination.

Exam trap

The trap here is that candidates confuse policy-based routing (PBR) with SD-WAN rules, assuming PBR can achieve the same outcome, but Fortinet's SD-WAN requires explicit SD-WAN rules to control member selection within the SD-WAN zone.

How to eliminate wrong answers

Option A is wrong because policy-based routing (PBR) in FortiOS is used for specific traffic steering but does not integrate with SD-WAN member selection or load-balancing algorithms; it bypasses SD-WAN logic entirely. Option C is wrong because setting a higher distance on the default route for wan1 would make it less preferred in the routing table, causing traffic to use wan2 instead of wan1, which is the opposite of the requirement. Option D is wrong because route maps with prefix lists are used in BGP or OSPF route redistribution, not for SD-WAN traffic steering; they influence routing table entries, not SD-WAN member selection.

Practice this question →

147

MCQeasy

Which FortiGate feature allows multiple independent routing tables on a single device, enabling traffic separation for different departments or customers?

A.ECMP

B.VRF

C.VDOM

D.Policy-based routing

AnswerB

VRF creates independent routing tables on the same FortiGate.

Why this answer

VRF (Virtual Routing and Forwarding) allows a single FortiGate to maintain multiple independent routing tables, each with its own set of interfaces, routes, and forwarding decisions. This enables traffic separation for different departments or customers without requiring separate physical devices, as each VRF instance operates as a logically isolated router within the same hardware.

Exam trap

The trap here is that candidates often confuse VRF with VDOM, assuming both provide the same level of isolation, but VRF only virtualizes the routing table while VDOM virtualizes the entire device, making VRF the correct answer when the question specifically asks about 'multiple independent routing tables' rather than full device virtualization.

How to eliminate wrong answers

Option A (ECMP) is wrong because ECMP (Equal-Cost Multi-Path) is a load-balancing technique that distributes traffic across multiple equal-cost paths within a single routing table, not a mechanism for creating independent routing tables. Option C (VDOM) is wrong because while VDOMs (Virtual Domains) also provide traffic separation, they virtualize the entire FortiGate (including firewall policies, administrators, and routing tables) as separate logical devices, whereas VRF is specifically a routing-table-level virtualization that can be used within a single VDOM or global context. Option D (Policy-based routing) is wrong because PBR allows traffic to be forwarded based on policies (e.g., source/destination IP) rather than the destination-based routing table, but it does not create multiple independent routing tables; it overrides the routing table for specific traffic flows.

Practice this question →

148

MCQmedium

A FortiGate has two WAN interfaces configured as SD-WAN members. The administrator wants traffic to specific destination IP addresses to use a particular member. Which SD-WAN configuration object should be used to achieve this?

A.SD-WAN rule

B.Route map

C.Prefix list

D.Performance SLA

AnswerA

SD-WAN rules define which traffic goes to which member based on matching criteria.

Why this answer

SD-WAN rules are the correct configuration object because they allow you to define policy-based forwarding (PBF) criteria, such as source/destination IP addresses, to steer traffic to a specific SD-WAN member interface. Unlike static routes, SD-WAN rules evaluate traffic against match conditions and then apply an explicit action to use a designated member or strategy, making them the precise tool for this requirement.

Exam trap

The trap here is that candidates confuse Performance SLA with the actual traffic-steering mechanism, thinking that a Performance SLA object alone can direct traffic to a specific member, when in fact it only provides link quality data that must be referenced by an SD-WAN rule to influence path selection.

How to eliminate wrong answers

Option B is wrong because a route map is used for route redistribution and policy-based routing in traditional routing contexts, not for SD-WAN member selection; it cannot directly force traffic to a specific SD-WAN member interface. Option C is wrong because a prefix list is a filter used in route maps or BGP to match IP prefixes, not an object that defines traffic steering to an SD-WAN member. Option D is wrong because a Performance SLA is used to measure link quality (latency, jitter, packet loss) and can be referenced by SD-WAN rules, but it does not itself direct traffic to a specific member; it only provides metrics for dynamic path selection.

Practice this question →

149

Drag & Dropmedium

Drag and drop the steps to configure a FortiGate to use an external authentication server (e.g., RADIUS) for admin login into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct sequence ensures that the RADIUS server is defined with full details before it is referenced by a user group, which is then assigned to an admin profile. Testing validates the entire chain, confirming that authentication works as expected.

Practice this question →

150

Multi-Selectmedium

Which THREE statements are true about FortiGate SD-WAN health-check configuration?

Select 3 answers

A.Health-check probes can be sent from any interface, including loopback.

B.Health-check can only be configured on physical interfaces, not VLANs or subinterfaces.

C.Health-check can be configured with multiple thresholds for jitter, latency, and packet loss.

D.Health-check can update the routing table by setting 'update-static-route' to enable fallback.

E.Health-check can be configured to use HTTP or DNS protocols to verify link health.

AnswersC, D, E

Performance SLA thresholds can be defined for jitter, latency, and packet loss.

Why this answer

FortiGate SD-WAN health-check allows configuring multiple thresholds for jitter, latency, and packet loss. These thresholds are used to determine the quality of a link; if any threshold is exceeded, the link is considered failed. This enables granular control over link health assessment beyond simple reachability.

Exam trap

The trap here is that candidates often assume health-check can use any interface as a source (like loopback) or that it only works on physical interfaces, but FortiGate restricts probe source to the member interface and supports VLANs and aggregates.

Practice this question →