CCNA Advanced Networking and SD-WAN Questions — Page 3 of 3

151

MCQhard

You run the following command on a FortiGate: diagnose sys session filter dport 443 diagnose sys session list Output: proto=6 proto_state=01 duration=3600 expire=3599 What does the 'proto_state=01' indicate?

A.The session is fully established and in the 'established' state

B.The session is in the 'init' state, meaning the first SYN packet has been seen but the handshake is not complete

C.The session is a UDP or ICMP session with no state tracking

D.The session is being torn down (FIN or RST received)

AnswerB

proto_state=01 indicates the session is being initiated (SYN seen).

Why this answer

In FortiGate session diagnostics, 'proto_state=01' for TCP (proto=6) indicates the session is in the 'init' state, meaning only the initial SYN packet has been observed and the three-way handshake has not yet completed. This is a transient state before the session transitions to 'established' (proto_state=02) once the final ACK of the handshake is received.

Exam trap

The trap here is that candidates often assume 'proto_state=01' means 'established' because they associate '1' with 'active' or 'open', but FortiGate uses a specific state numbering where '01' explicitly means the TCP handshake is incomplete.

How to eliminate wrong answers

Option A is wrong because 'proto_state=01' is the init state, not the established state; the established state is represented by 'proto_state=02' in FortiGate session output. Option C is wrong because UDP and ICMP sessions do not use TCP state tracking and would not show 'proto_state=01' for TCP; they typically show 'proto_state=00' or no state value. Option D is wrong because a session being torn down (FIN or RST received) would show a different state, such as 'proto_state=04' (close) or 'proto_state=05' (timewait), not '01'.

Practice this question →

152

Multi-Selectmedium

A network administrator is configuring SD-WAN on a FortiGate with three WAN links: MPLS (10 Mbps), Broadband (50 Mbps), and LTE (20 Mbps). They want to load balance traffic based on link bandwidth, with the option to manually steer critical traffic to the MPLS link. Which TWO steps must be taken to achieve this?

Select 2 answers

A.Set the SD-WAN rule strategy to 'Maximize Bandwidth' with volume algorithm for general traffic.

B.Create a separate SD-WAN rule for critical traffic with strategy 'Manual' and select MPLS as the preferred member.

C.Set the load balancing algorithm to 'Spillover' on all rules.

D.Enable ECMP on the FortiGate.

E.Configure a performance SLA for each link.

AnswersA, B

This enables bandwidth-based load balancing.

Why this answer

Setting the SD-WAN rule strategy to 'Maximize Bandwidth' with the volume algorithm distributes traffic proportionally based on link bandwidth (10:50:20 ratio), achieving load balancing. Option B is correct because creating a separate SD-WAN rule with strategy 'Manual' and selecting MPLS as the preferred member allows manual steering of critical traffic to the MPLS link, overriding the load-balancing behavior for that traffic.

Exam trap

The trap here is that candidates often confuse 'Spillover' with bandwidth-based load balancing, or assume ECMP is required for SD-WAN load balancing, when in fact FortiGate SD-WAN uses policy-based routing with its own load-balancing algorithms independent of ECMP.

Practice this question →

153

Multi-Selectmedium

An administrator is configuring SD-WAN with two members: MPLS and Broadband. The requirement is that voice traffic (UDP ports 16384-32768) should use MPLS primarily, and if MPLS fails SLA, then use Broadband. Which two configurations are needed? (Choose TWO.)

Select 2 answers

A.Disable the Broadband member from the SD-WAN zone

B.Configure a performance SLA for the MPLS member

C.Create an SD-WAN rule that matches voice traffic and uses 'best quality' strategy

D.Configure policy-based routing for voice traffic

E.Set the load balancing algorithm to 'sessions'

AnswersB, C

Required to monitor link quality.

Why this answer

A performance SLA must be configured on the MPLS member to monitor its link quality (e.g., latency, jitter, packet loss). If the SLA fails, the SD-WAN rule can then trigger a failover to the Broadband member. Option C is correct because an SD-WAN rule matching voice traffic with the 'best quality' strategy ensures that the traffic uses the highest-quality link (MPLS) as long as its SLA is met, automatically switching to Broadband when MPLS fails SLA.

Exam trap

The trap here is that candidates often confuse SD-WAN rules with policy-based routing or assume that disabling a member is needed to force traffic to MPLS, but SD-WAN rules with SLA monitoring are the correct mechanism for primary/backup failover without manual intervention.

Practice this question →

154

MCQhard

An administrator configures OSPF on a FortiGate with multiple areas. After configuration, the FortiGate does not become an ABR. What is the most likely reason?

A.The router-id is not configured

B.The OSPF process is not enabled

C.The network type is set to point-to-point

D.There is no interface assigned to area 0

AnswerD

An ABR must have at least one interface in area 0 and one in another area.

Why this answer

For a FortiGate to function as an OSPF Area Border Router (ABR), it must have at least one interface assigned to the backbone area (area 0) and at least one interface assigned to a non-backbone area. Without an interface in area 0, the FortiGate cannot generate Type 3 summary LSAs or perform inter-area routing, so it remains an internal router. Option D is correct because the absence of an interface in area 0 is the most direct and common reason for a FortiGate not becoming an ABR.

Exam trap

The trap here is that candidates often assume ABR status is tied to router-id configuration or OSPF process enablement, but the critical requirement is the presence of an interface in area 0, which is a fundamental OSPF design rule that is frequently overlooked.

How to eliminate wrong answers

Option A is wrong because the router-id is used for OSPF router identification and DR/BDR election, but it does not determine ABR status; a router can become an ABR without a manually configured router-id (it will use the highest loopback or physical interface IP). Option B is wrong because if the OSPF process were not enabled, the FortiGate would not participate in OSPF at all, not simply fail to become an ABR; the question implies OSPF is configured but ABR status is missing. Option C is wrong because setting the network type to point-to-point affects neighbor adjacency behavior and LSA flooding, but it does not prevent a router from becoming an ABR as long as it has interfaces in both area 0 and another area.

Practice this question →

155

MCQeasy

Which load balancing algorithm in SD-WAN sends new sessions to the member interface with the least number of active sessions?

A.Sessions

B.Volume

C.Spillover

D.Source-dest IP

AnswerA

Sessions algorithm sends to the interface with the fewest active sessions.

Why this answer

The Sessions algorithm in Fortinet SD-WAN selects the member interface with the fewest active sessions when a new session is initiated. This is the default load-balancing method and ensures even distribution of session counts across WAN links, preventing any single interface from becoming overloaded with connections.

Exam trap

The trap here is that candidates often confuse 'Sessions' with 'Volume' because both involve load distribution, but Sessions focuses on connection count while Volume focuses on data throughput, and Fortinet explicitly tests this distinction in the SD-WAN configuration context.

How to eliminate wrong answers

Option B (Volume) is wrong because it distributes traffic based on the total bytes transferred through each interface, not the number of active sessions. Option C (Spillover) is wrong because it is not a load-balancing algorithm; it is a failover mechanism that sends traffic to a backup interface only when the primary interface exceeds a configured bandwidth threshold. Option D (Source-dest IP) is wrong because it uses a hash of source and destination IP addresses to consistently map sessions to the same interface, which does not consider the current number of active sessions.

Practice this question →

156

MCQeasy

Which SD-WAN load balancing algorithm distributes traffic based on the number of active sessions per interface?

A.Sessions

B.Volume

C.Source-destination IP

D.Spillover

AnswerA

Sessions algorithm distributes based on number of sessions per interface.

Why this answer

The Sessions algorithm in Fortinet SD-WAN distributes new sessions by selecting the interface with the fewest currently active sessions. This ensures balanced session distribution across WAN links, preventing any single interface from becoming overloaded with connections while others remain underutilized.

Exam trap

The trap here is that candidates often confuse 'Sessions' with 'Volume' because both involve traffic distribution, but Volume measures bytes while Sessions measures connection counts, and the exam expects you to distinguish between these two distinct load-balancing metrics.

How to eliminate wrong answers

Option B is wrong because Volume distributes traffic based on the total bytes transferred per interface, not the number of active sessions. Option C is wrong because Source-destination IP uses a hash of source and destination IP addresses to consistently route traffic from the same flow to the same interface, ignoring session counts. Option D is wrong because Spillover forwards traffic to a preferred interface until its bandwidth or session threshold is exceeded, then spills over to a backup interface, rather than balancing based on active session counts.

Practice this question →

157

Multi-Selectmedium

An administrator needs to integrate a FortiSwitch with a FortiGate for LAN edge management. The FortiSwitch will be used to provide access ports for end users. Which THREE configuration steps are required on the FortiGate?

Select 3 answers

A.Create a port profile that defines VLAN and security settings for the access ports

B.Configure a DHCP server on the FortiGate to assign IP addresses to FortiSwitch management

C.Enable STP on the FortiGate interface

D.Enable CAPWAP on the FortiGate interface connected to the FortiSwitch

E.Authorize the FortiSwitch in the FortiGate's managed switch list

AnswersA, D, E

Port profiles are used to configure the switch ports from the FortiGate.

Why this answer

A port profile on the FortiGate defines the VLAN membership, allowed VLANs, and security policies (e.g., 802.1X, MAC authentication bypass) that are pushed to the FortiSwitch for its access ports. This is the primary mechanism for centrally managing access port configuration in a FortiSwitch deployment.

Exam trap

The trap here is that candidates often confuse the DHCP server requirement with the need for IP address assignment, but the FortiSwitch can use an existing DHCP server or static IP, making option B unnecessary and incorrect.

Practice this question →

158

MCQhard

A FortiGate has ECMP configured with two equal-cost routes to a destination. The administrator wants to ensure that all packets from a given source IP use the same next-hop. Which ECMP load balancing method should be configured?

A.Source IP

B.Destination IP

C.Source-destination IP

D.Round robin

AnswerA

Source IP hash ensures all traffic from the same source uses the same path, regardless of destination.

Why this answer

Source IP-based ECMP load balancing uses the source IP address to select the next-hop for all packets in a flow. This ensures that packets from a given source IP always take the same path, maintaining session consistency without requiring stateful inspection.

Exam trap

The trap here is that candidates often confuse 'source IP' with 'source-destination IP' or 'round robin', mistakenly thinking that more hash inputs or per-packet distribution provides better load balancing, but the question specifically requires per-source-IP stickiness, which only source IP-based hashing guarantees.

How to eliminate wrong answers

Option B (Destination IP) is wrong because it uses only the destination IP for hash calculation, which would not guarantee that packets from the same source IP use the same next-hop if the destination varies. Option C (Source-destination IP) is wrong because it hashes both source and destination IPs together, which could still cause different flows from the same source IP to different destinations to use different next-hops, but the question specifically requires all packets from a given source IP to use the same next-hop regardless of destination. Option D (Round robin) is wrong because it distributes packets sequentially across next-hops without any affinity to source IP, causing packets from the same source IP to potentially take different paths.

Practice this question →

159

Multi-Selecteasy

An administrator wants to integrate a FortiSwitch with a FortiGate for LAN edge management. Which TWO steps are required for initial setup? (Choose two.)

Select 2 answers

A.Configure OSPF on the FortiSwitch

B.Connect the FortiSwitch to the FortiGate's managed switch port

C.Set the FortiSwitch to 'transparent' mode

D.Authorize the FortiSwitch in the FortiGate's switch controller

E.Create a firewall policy allowing traffic between FortiSwitch and FortiGate

AnswersB, D

The switch must be physically connected to a port that is configured as a managed switch port.

Why this answer

A FortiSwitch must be physically connected to a FortiGate port that has been configured as a managed switch port (via config system interface and set type switch). This dedicated port enables the FortiGate to discover and manage the FortiSwitch using the FortiLink protocol, which encapsulates control and data traffic over a single link. Without this physical connection to a managed switch port, the FortiGate cannot establish the FortiLink adjacency required for LAN edge management.

Exam trap

The trap here is that candidates often assume a firewall policy is required for all traffic between devices, but FortiLink management traffic bypasses firewall rules because it uses a dedicated control channel that is implicitly permitted by the FortiGate's internal switch controller logic.

Practice this question →

160

MCQeasy

Which SD-WAN load balancing algorithm distributes new sessions based on the number of active sessions on each link?

A.Source-dest IP

B.Spillover

C.Volume

D.Sessions

AnswerD

Sessions algorithm distributes based on the number of active sessions.

Why this answer

The Sessions algorithm distributes new sessions based on the current number of active sessions on each SD-WAN link. When a new session is initiated, the SD-WAN controller selects the link with the fewest active sessions, ensuring a balanced load across all available transport interfaces. This is distinct from algorithms that consider source/destination IP pairs, traffic volume, or bandwidth thresholds.

Exam trap

The trap here is that candidates often confuse 'Sessions' with 'Volume' because both involve load balancing, but Sessions counts active connections while Volume measures data throughput, leading to incorrect selection of Volume when the question explicitly mentions 'number of active sessions'.

How to eliminate wrong answers

Option A is wrong because Source-dest IP uses a hash of the source and destination IP addresses to consistently map sessions to a specific link, not the number of active sessions. Option B is wrong because Spillover is a bandwidth-based algorithm that shifts traffic to another link only when a predefined bandwidth threshold is exceeded, not based on session count. Option C is wrong because Volume distributes traffic based on the total volume of data (bytes) transmitted over each link, not the number of active sessions.

Practice this question →

161

Multi-Selectmedium

A FortiGate is integrated with FortiSwitch and FortiAP. The administrator wants to manage both devices from the FortiGate GUI using the LAN edge management features. Which THREE conditions must be met for this integration to work?

Select 3 answers

A.FortiAP must be in CAPWAP mode to connect to the FortiGate.

B.The FortiGate must be in NAT mode.

C.FortiSwitch must be in the same Layer 2 domain as the FortiGate management interface.

D.The FortiGate must operate in transparent mode.

E.The FortiGate must have a separate VDOM for each managed device.

AnswersA, B, C

FortiAP uses CAPWAP to tunnel traffic to the FortiGate.

Why this answer

FortiAP must operate in CAPWAP (Control and Provisioning of Wireless Access Points) mode to establish a control tunnel to the FortiGate. This allows the FortiGate to act as the wireless controller, managing AP configuration, firmware, and client traffic via CAPWAP encapsulation. Without CAPWAP mode, the FortiAP cannot be discovered or managed through the FortiGate's LAN edge management features.

Exam trap

The trap here is that candidates often assume transparent mode is acceptable for wireless management, but FortiGate must be in NAT mode to route CAPWAP traffic and provide the necessary network address translation for AP management.

Practice this question →

162

MCQhard

A FortiGate with FortiExtender is using LTE as a backup WAN link. When the primary link fails, the LTE link does not take over. What could be the cause?

A.The primary link's performance SLA is still passing.

B.The FortiExtender is not configured in pass-through mode.

C.The FortiExtender firmware is out of date.

D.The LTE interface is not added as an SD-WAN member.

AnswerD

Without adding to SD-WAN, the backup link won't be used for failover.

Why this answer

For an LTE interface to be used as a backup WAN link in an SD-WAN setup, it must be explicitly added as an SD-WAN member. Without this, the FortiGate will not consider the LTE interface for traffic steering or failover, even if the primary link fails. The SD-WAN rules and performance SLA are only evaluated against interfaces that are members of the SD-WAN zone.

Exam trap

The trap here is that candidates often assume any working backup interface will automatically take over when the primary fails, but FortiGate SD-WAN requires explicit membership in the SD-WAN zone for failover to occur.

How to eliminate wrong answers

Option A is wrong because if the primary link's performance SLA is still passing, the SD-WAN logic would not trigger a failover to the backup link; the LTE link would not take over because the primary is considered healthy. Option B is wrong because pass-through mode is relevant for extending the FortiGate's interfaces via the FortiExtender, but it is not a prerequisite for LTE failover; the LTE interface can be used in normal mode as long as it is properly configured and added to SD-WAN. Option C is wrong while outdated firmware can cause various issues, the most direct and common reason for LTE not taking over is that the interface is not a member of the SD-WAN zone, not a firmware version problem.

Practice this question →

163

MCQmedium

An administrator configures SD-WAN with two members (wan1, wan2) and a performance SLA for ICMP to 1.1.1.1. The SD-WAN rule is set to 'Best Quality' with 'latency' metric. The admin notices that traffic sometimes switches to the other link even when the current link has acceptable latency. Which action can reduce unnecessary flapping?

A.Configure a hysteresis value for the SLA

B.Increase the SLA probe interval

C.Use 'manual' strategy instead

D.Increase the 'update-cascade-interface' setting

AnswerA

Hysteresis adds a buffer: the link must be significantly better before switching, reducing flapping.

Why this answer

Configuring a hysteresis value for the SLA introduces a buffer or deadband around the latency threshold. This prevents the SD-WAN from switching links when latency fluctuates slightly above and below the threshold, which is the root cause of flapping. Without hysteresis, even a minor transient spike in latency can trigger a switch, even if the link's overall performance is acceptable.

Exam trap

The trap here is that candidates often confuse 'hysteresis' with 'increasing the probe interval' (Option B), thinking that less frequent measurements will reduce flapping, but hysteresis is the correct mechanism because it introduces a deadband to prevent switching on minor fluctuations, whereas a longer interval only delays detection and does not prevent the oscillation.

How to eliminate wrong answers

Option B is wrong because increasing the SLA probe interval reduces the frequency of measurements, which can delay the detection of actual link degradation but does not prevent flapping caused by minor latency fluctuations around the threshold. Option C is wrong because using a 'manual' strategy would disable automatic link selection based on SLA metrics entirely, which is an overreaction and does not address the flapping issue while sacrificing the benefits of dynamic path selection. Option D is wrong because 'update-cascade-interface' is a FortiGate setting related to updating routing tables when an interface's status changes, not a mechanism to dampen SLA-triggered path switching.

Practice this question →

164

MCQeasy

A FortiGate administrator needs to configure BFD (Bidirectional Forwarding Detection) on a BGP peer to quickly detect link failures. Which CLI command enables BFD on the BGP neighbor 10.1.1.1?

A.config router policy set bfd enable end

B.config system interface edit port1 set bfd enable next end

C.config router static set bfd enable end

D.config router bgp config neighbor edit 10.1.1.1 set bfd enable next end end

AnswerD

BFD is enabled per neighbor under the BGP configuration.

Why this answer

BFD must be enabled specifically under the BGP neighbor configuration to associate BFD with the BGP session. The `config router bgp` → `config neighbor` → `set bfd enable` command activates BFD for that neighbor, allowing rapid link failure detection independent of BGP hold timers.

Exam trap

The trap here is that candidates often confuse enabling BFD on the interface (Option B) with enabling it on the BGP neighbor, not realizing that interface-level BFD only supports protocols like OSPF or static routes, not BGP sessions directly.

How to eliminate wrong answers

Option A is wrong because `config router policy` is not a valid FortiGate CLI context; BFD is not configured under a router policy. Option B is wrong because `set bfd enable` under `config system interface` enables BFD on the interface itself (for routing protocols like OSPF or static routes), but it does not bind BFD to a specific BGP neighbor session. Option C is wrong because `config router static` with `set bfd enable` enables BFD for static routes, not for BGP peers.

Practice this question →

165

MCQhard

A FortiGate is configured with policy-based routing (PBR) to route certain traffic through a specific next hop. However, some traffic that should match the PBR rule is not being affected. What is a likely reason?

A.The PBR rule uses a route map that references an incorrect prefix list.

B.The PBR rule is applied on the wrong interface or direction.

C.The PBR rule has a higher priority than the SD-WAN rule, but the traffic is hitting the SD-WAN rule first because of firewall policy order.

D.The traffic is generated locally from the FortiGate and PBR does not affect locally generated traffic.

AnswerB

PBR must be applied to the ingress interface where traffic arrives. If applied to the wrong interface or direction, traffic will not match.

Why this answer

Policy-based routing (PBR) in FortiOS is applied per interface and per direction (incoming or outgoing). If the PBR rule is applied on the wrong interface or in the wrong direction, traffic will never be evaluated against the route map, causing the rule to have no effect. This is the most common misconfiguration when PBR does not work as expected.

Exam trap

The trap here is that candidates often assume PBR is applied globally or at the firewall policy level, when in fact it is strictly interface- and direction-specific in FortiOS, and misapplying it on the wrong interface or direction is the most frequent root cause of PBR not working.

How to eliminate wrong answers

Option A is wrong because an incorrect prefix list in the route map would cause the PBR rule to match no traffic or the wrong traffic, but it would not cause traffic that should match to be unaffected—it would simply not match. Option C is wrong because PBR is evaluated before SD-WAN rules and before firewall policy order; PBR operates at the routing decision level, not at the firewall policy level, so priority between PBR and SD-WAN is not determined by firewall policy order. Option D is wrong because PBR does affect locally generated traffic on FortiGate; locally originated traffic can be subject to PBR if the route map matches the source or destination, though special considerations apply for management traffic.

Practice this question →

166

MCQeasy

A FortiGate is configured with OSPF multi-area. The administrator wants to ensure that routes from area 0 are redistributed into area 1. Which OSPF configuration is required?

A.Enable 'redistribute connected' on the ABR

B.Set the 'area type' to 'nssa' on area 1

C.Configure a route redistribution policy under OSPF

D.No additional configuration is needed; ABRs automatically advertise inter-area routes

AnswerD

OSPF ABRs by default advertise routes from one area to another.

Why this answer

OSPF ABRs (Area Border Routers) automatically advertise inter-area routes between areas by default. In a multi-area OSPF setup, the ABR learns Type 3 LSAs from area 0 and floods them into other areas (like area 1) without any additional redistribution configuration. No explicit redistribution policy is needed for inter-area route advertisement.

Exam trap

The trap here is that candidates confuse route redistribution (importing external routes) with the automatic inter-area route advertisement performed by ABRs, leading them to select options involving redistribution policies or area type modifications.

How to eliminate wrong answers

Option A is wrong because 'redistribute connected' is used to inject directly connected routes into OSPF, not to advertise routes between areas; inter-area routes are handled natively by ABRs via Type 3 LSAs. Option B is wrong because setting area 1 as NSSA would actually restrict Type 5 LSAs and require special handling for external routes, but it does not affect the automatic advertisement of inter-area routes from area 0; in fact, NSSA still allows Type 3 LSAs by default. Option C is wrong because a route redistribution policy under OSPF is used for importing routes from other protocols (e.g., BGP, static) or from different OSPF processes, not for inter-area route propagation within the same OSPF domain.

Practice this question →

167

MCQmedium

An administrator configures a route map to control redistribution of connected routes into OSPF. The route map uses a prefix list to match routes. After applying the redistribution, no routes are redistributed. What is the most likely oversight?

A.The route map is missing a 'permit' action, so it denies all routes

B.The prefix list is configured with the wrong sequence number

C.OSPF process ID is incorrect

D.The connected routes are not in the routing table

AnswerA

A route map must have an explicit 'permit' action to allow routes; without it, the implicit deny blocks all routes.

Why this answer

The route map used for redistribution into OSPF must have at least one 'permit' statement to allow routes. If only a prefix list is referenced in the route map without an explicit 'permit' action, the implicit deny at the end of the route map blocks all routes. The common mistake is to assume that simply matching with a prefix list is sufficient; however, an explicit 'permit' action is required.

Exam trap

The trap here is that candidates assume a route map with a matching prefix list automatically permits routes, forgetting that route maps require an explicit 'permit' action and that the default action is deny, not permit.

How to eliminate wrong answers

Option B is wrong because a prefix list with a wrong sequence number would still match routes if the sequence numbers are correctly ordered; the issue is not about sequence numbers but about the route map lacking a permit action. Option C is wrong because an incorrect OSPF process ID would prevent the redistribution command from being applied to the correct OSPF instance, but the question states redistribution was configured, so the process ID is likely correct. Option D is wrong because connected routes are automatically present in the routing table when an interface is up and has an IP address; if they were missing, the administrator would see no connected routes at all, not just a redistribution failure.

Practice this question →

168

MCQhard

A FortiGate has two WAN links and uses ECMP load balancing for default routes. The administrator wants to ensure that all packets belonging to the same TCP session go out the same interface. Which setting should be enabled?

A.Persistent NAT

B.ECMP source-destination-ip hash

C.ECMP with source-ip hash

D.ECMP with 'session-based' algorithm

AnswerD

Session-based ECMP uses a hash of the 5-tuple (src IP, dst IP, protocol, src port, dst port) to ensure all packets of a session use the same interface.

Why this answer

The 'session-based' algorithm (also known as 'source-ip-based' or 'ECMP with session-based' in FortiOS) ensures that all packets belonging to the same TCP session are forwarded out the same interface by hashing the 5-tuple (source IP, destination IP, source port, destination port, protocol). This guarantees session stickiness across ECMP paths, preventing out-of-order delivery and TCP retransmissions. Option D is correct because it directly addresses the requirement for per-session interface consistency.

Exam trap

The trap here is that candidates often confuse 'source-ip hash' or 'source-destination-ip hash' with session-based stickiness, but FortiOS requires the 'session-based' algorithm to include Layer 4 port information in the hash, which is the only way to guarantee per-session path consistency in ECMP.

How to eliminate wrong answers

Option A is wrong because Persistent NAT is a NAT feature that maintains the same source IP/port for all connections from a host, but it does not control ECMP path selection or ensure session stickiness across WAN links. Option B is wrong because ECMP source-destination-ip hash uses only source and destination IP addresses for hashing, which can cause packets from the same TCP session to take different paths if the source or destination IP changes (e.g., due to NAT or asymmetric routing), breaking session affinity. Option C is wrong because ECMP with source-ip hash uses only the source IP address, which is insufficient for session stickiness when multiple sessions share the same source IP (e.g., from a single client), as it may still spread packets across interfaces for different sessions but does not guarantee per-session consistency.

Practice this question →

169

MCQhard

You have configured VRF on a FortiGate with two VRFs: VRF 1 for guest traffic and VRF 2 for corporate traffic. You want to allow limited communication from guests to a corporate DNS server. What is the correct configuration step?

A.Create a firewall policy from VRF 1 to VRF 2 allowing DNS traffic

B.Enable 'set allow-vrf' on the DNS server's interface

C.Configure route leaking between VRF 1 and VRF 2 for the DNS server's IP

D.Place the DNS server in a management VDOM and use inter-VDOM links

AnswerC

Route leaking allows one VRF to know routes of another, enabling inter-VRF communication.

Why this answer

VRF isolation by default prevents traffic from crossing between VRFs. To allow a guest in VRF 1 to reach a corporate DNS server in VRF 2, you must leak the DNS server's route from VRF 2 into VRF 1. This is achieved by configuring route leaking (e.g., using route maps or VRF route leaking on FortiGate), which installs the DNS server's IP prefix into the guest VRF's routing table, enabling reachability without breaking VRF separation for other traffic.

Exam trap

The trap here is that candidates assume a firewall policy between VRFs is sufficient, but without route leaking, the source VRF has no route to the destination, so the firewall policy never sees the traffic.

How to eliminate wrong answers

Option A is wrong because a firewall policy alone cannot forward traffic between VRFs; VRFs are separate routing tables, and inter-VRF traffic requires route leaking to make the destination reachable in the source VRF's routing table. Option B is wrong because 'set allow-vrf' is not a valid FortiGate command; FortiGate uses route leaking or inter-VRF policies with proper routing, not an interface-level VRF permission flag. Option D is wrong because placing the DNS server in a management VDOM and using inter-VDOM links is an unnecessary and complex approach for a simple DNS access requirement; VRF route leaking is the correct and lightweight method for inter-VRF communication within the same VDOM.

Practice this question →

170

MCQmedium

A FortiGate is configured with SD-WAN using BGP. The administrator wants to influence outbound traffic to prefer one SD-WAN member over another based on BGP attributes. Which BGP attribute, when modified on the FortiGate, can achieve this for outbound traffic?

A.Local-preference

B.Weight

C.AS-Path prepending

D.MED

AnswerA

Local-preference is used to influence outbound traffic within the local AS. Higher local-preference makes a route more preferred for outbound traffic.

Why this answer

Local-preference is a well-known mandatory BGP attribute that is propagated within an AS to influence outbound traffic by indicating the preferred exit point. When modified on the FortiGate, a higher local-preference value makes the route more preferred for outbound traffic, allowing the administrator to steer traffic toward a specific SD-WAN member without affecting inbound routing.

Exam trap

The trap here is that candidates often confuse outbound and inbound traffic influence, mistakenly selecting AS-Path prepending or MED, which are designed to affect how other ASes route traffic toward the local network, not how the local FortiGate chooses its outbound path.

How to eliminate wrong answers

Option B (Weight) is wrong because weight is a Cisco-proprietary attribute that is local to the router and not supported in FortiGate's BGP implementation; FortiGate uses local-preference for similar outbound path selection. Option C (AS-Path prepending) is wrong because it influences inbound traffic by making the AS path longer, discouraging others from sending traffic to that router, not outbound traffic from the FortiGate. Option D (MED) is wrong because MED is a non-transitive attribute used to influence inbound traffic from neighboring ASes by suggesting a preferred entry point, not for outbound traffic control within the local AS.

Practice this question →

171

MCQeasy

An administrator wants to load balance traffic across two ISP links using SD-WAN. The requirement is that sessions from the same source IP address must always use the same ISP link. Which SD-WAN load balancing algorithm should be used?

A.Source-destination IP

B.Sessions

C.Volume

D.Spillover

AnswerA

This algorithm hashes source and destination IP to consistently select the same member for flows between the same two hosts.

Why this answer

The Source-destination IP algorithm creates a hash based on both the source and destination IP addresses, ensuring that all packets belonging to sessions from the same source IP to the same destination IP are consistently forwarded over the same ISP link. This meets the requirement of session persistence for traffic from a given source IP without relying on stateful inspection or session tracking.

Exam trap

The trap here is that candidates often confuse 'source IP persistence' with 'session-based load balancing' and select 'Sessions' (Option B), not realizing that Sessions algorithm distributes individual sessions arbitrarily and does not guarantee that all sessions from the same source IP use the same link.

How to eliminate wrong answers

Option B (Sessions) is wrong because it distributes traffic based on the number of active sessions, not on source IP consistency, so a source IP could use different ISP links for different sessions. Option C (Volume) is wrong because it balances based on traffic volume (bytes transferred), which has no correlation with source IP stickiness and can cause sessions from the same source to be split across links. Option D (Spillover) is wrong because it sends traffic to a secondary link only when the primary link's bandwidth threshold is exceeded, which does not guarantee that sessions from the same source IP always use the same ISP link.

Practice this question →

172

MCQmedium

A network administrator configures SD-WAN on a FortiGate with two WAN members (port1, port2). They set up a performance SLA to measure latency to 8.8.8.8. The SLA shows both members are 'alive'. However, traffic matching an SD-WAN rule with 'best quality' strategy is not using the lowest-latency link. What is the MOST likely cause?

A.Both WAN members have the same cost in the SD-WAN configuration

B.The SD-WAN rule is configured with 'manual' strategy

C.The SD-WAN rule has 'set-match' enabled for source IP

D.The performance SLA does not have 'latency' as the first metric in the priority order

AnswerD

Best quality uses the configured metric order; if latency is not first, another metric determines the selection.

Why this answer

The 'best quality' strategy selects the link with the highest priority based on the performance SLA's metric order. If latency is not the first metric in the priority list (e.g., jitter or packet loss is first), the algorithm will prefer the link that best satisfies the first metric, not necessarily the lowest latency. Thus, even though both links are alive, the link with lower latency may be deprioritized if it performs worse on the first metric.

Exam trap

The trap here is that candidates assume 'best quality' always means lowest latency, but FortiGate's implementation uses a configurable metric priority order, so the first metric in the list determines the 'best' link, not latency by default.

How to eliminate wrong answers

Option A is wrong because equal cost does not affect the 'best quality' strategy; cost is used for load-balancing strategies like 'lowest cost', not for quality-based selection. Option B is wrong because a 'manual' strategy would require explicit interface selection and would not use SLA metrics at all, so the scenario of SLA showing 'alive' would be irrelevant. Option C is wrong because 'set-match' for source IP is a matching condition for the rule, not a factor in how the 'best quality' strategy selects the link; it only determines which traffic is subject to the rule.

Practice this question →

173

Multi-Selecteasy

An administrator is configuring BGP with SD-WAN on a FortiGate. Which TWO statements are true about BGP and SD-WAN integration? (Choose two.)

Select 2 answers

A.BGP must be disabled on interfaces used for SD-WAN

B.BGP learned routes cannot be used as SD-WAN members

C.SD-WAN performance SLA can override BGP best path selection

D.SD-WAN rules can use BGP attributes such as AS path to influence path selection

E.BGP route redistribution is not supported with SD-WAN

AnswersC, D

SD-WAN can choose a different path based on SLA metrics.

Why this answer

SD-WAN performance SLA rules can override BGP best path selection by steering traffic over a different SD-WAN member interface, even if BGP would have chosen a different path. This is achieved through SD-WAN rules that match traffic and apply an action like 'best quality' or 'lowest cost', which takes precedence over the BGP routing table decision.

Exam trap

The trap here is that candidates often assume BGP always dictates the forwarding path in an SD-WAN setup, but FortiGate's SD-WAN rules can override BGP best path selection based on performance SLA metrics.

Practice this question →

174

MCQmedium

An administrator configured an SD-WAN rule to steer traffic to a specific member interface using the 'lowest-cost' strategy. After applying, the traffic is not being load-balanced as expected. Which configuration element is MOST likely missing?

A.The 'best-quality' strategy was inadvertently selected instead.

B.A performance SLA has not been assigned to the SD-WAN member interfaces.

C.The SD-WAN member interfaces are not in the same zone.

D.The 'update-static-route' option is disabled on the SD-WAN member.

AnswerB

The lowest-cost strategy relies on performance SLA metrics to determine cost. Without an SLA, the cost is not calculated.

Why this answer

The 'lowest-cost' strategy in Fortinet SD-WAN selects the member interface with the lowest cost value. However, without a performance SLA assigned to the SD-WAN member interfaces, the SD-WAN rule cannot dynamically measure link quality or update interface costs based on real-time conditions. As a result, the rule defaults to static cost values or may not load-balance traffic at all, because the SLA is required to trigger cost-based path selection and failover.

Assigning an SLA enables the FortiGate to monitor link performance and adjust the effective cost, allowing proper load balancing across multiple members.

Exam trap

The trap here is that candidates often assume the 'lowest-cost' strategy inherently load-balances across multiple interfaces with the same cost, but without a performance SLA, the FortiGate does not dynamically adjust costs or distribute traffic, leading to a single active path and no load balancing.

How to eliminate wrong answers

Option A is wrong because the 'best-quality' strategy selects the interface with the best SLA performance metrics (e.g., lowest latency or jitter), not cost; the administrator explicitly configured 'lowest-cost', so an inadvertent selection of 'best-quality' would change the strategy entirely, not cause a missing load-balance behavior due to missing SLA configuration. Option C is wrong because SD-WAN member interfaces do not need to be in the same zone; zones are used for firewall policy grouping, not for SD-WAN load balancing or cost-based steering. Option D is wrong because the 'update-static-route' option controls whether the FortiGate automatically updates static routes when an SD-WAN member interface goes down; disabling it would affect failover behavior but not prevent load balancing when the interfaces are up.

Practice this question →

175

MCQhard

A FortiGate has two equal-cost paths to a destination network. ECMP is enabled. The administrator notices that all traffic uses the first path. What is the most likely cause?

A.ECMP is configured with 'spillover' mode

B.The second path is administratively down

C.ECMP is configured to use 'source-dest-ip' hash and all sessions are from same source to same destination

D.The route metric is not equal

AnswerC

That hash would send all to same path.

Why this answer

When ECMP is configured with the 'source-dest-ip' hash algorithm, traffic is load-balanced based on a hash of both source and destination IP addresses. If all sessions originate from the same source IP and go to the same destination IP, the hash value is identical for every session, causing all traffic to be forwarded over the same path. This is the most likely cause because the administrator sees all traffic using the first path despite ECMP being enabled.

Exam trap

The trap here is that candidates assume ECMP always distributes traffic evenly across all paths, but they overlook that the hash algorithm's behavior depends on the diversity of source-destination pairs; when all sessions share the same IP pair, the hash produces the same result, causing all traffic to follow one path.

How to eliminate wrong answers

Option A is wrong because 'spillover' mode is an SD-WAN feature that shifts traffic to another path only when a bandwidth threshold is exceeded, but it does not cause all traffic to use a single path by default; it would still distribute traffic until the threshold is reached. Option B is wrong because if the second path were administratively down, the route would not be present in the routing table as an equal-cost path, and ECMP would not consider it; the question states two equal-cost paths exist. Option D is wrong because the question explicitly states the paths have equal cost, so the route metric is equal; unequal metrics would prevent ECMP from load-balancing, but that contradicts the given condition.

Practice this question →

176

MCQmedium

A FortiGate with SD-WAN enabled uses two members: MPLS (10 ms latency) and Internet (40 ms latency). The SD-WAN rule uses 'Best Quality' strategy with latency as the metric. Traffic to a critical application (10.1.1.0/24) is currently using the MPLS link. The MPLS link's latency increases to 60 ms due to a routing issue. How will FortiGate handle new sessions to 10.1.1.0/24?

A.New sessions will use the Internet link; existing sessions continue on MPLS.

B.FortiGate will wait for the MPLS link to recover before sending new traffic.

C.All sessions immediately switch to the Internet link.

D.Existing sessions continue on MPLS; new sessions will use MPLS until the next SLA probe.

AnswerA

Best Quality uses SLA metrics to steer new sessions to the best member, but does not affect existing sessions.

Why this answer

The 'Best Quality' strategy with latency metric selects the link with the lowest latency for new sessions. When MPLS latency rises to 60 ms, it exceeds the Internet link's 40 ms, so new sessions will be steered to the Internet. However, SD-WAN does not preemptively rehash existing sessions; they remain on the original link (MPLS) until they expire or are torn down.

Exam trap

The trap here is that candidates assume SD-WAN automatically re-routes all traffic (including existing sessions) when link quality degrades, but in reality, only new sessions are affected unless a session-based failover mechanism like session TTL or manual intervention is configured.

How to eliminate wrong answers

Option B is wrong because FortiGate does not wait for link recovery; it actively selects the best link based on current SLA metrics. Option C is wrong because SD-WAN does not force an immediate failover of all sessions; only new sessions are affected by the updated latency measurement. Option D is wrong because new sessions are evaluated immediately based on the latest SLA probe results, not deferred until the next probe cycle.

Practice this question →

177

Multi-Selectmedium

An administrator wants to use policy-based routing to forward traffic from subnet 192.168.1.0/24 to a specific next-hop via port2. Which TWO configuration elements are needed?

Select 2 answers

A.An SD-WAN rule overriding the routing decision.

B.A route-map that matches the source subnet and sets the next-hop.

C.A static route with a higher administrative distance.

D.A prefix-list matching 192.168.1.0/24.

E.A firewall policy matching the traffic with action 'accept'.

AnswersB, D

PBR uses route-maps to match and set next-hop.

Why this answer

Policy-based routing (PBR) on FortiGate uses a route-map to override the normal routing table lookup. Option B is correct because the route-map must match the source subnet (e.g., via a prefix-list or access-list) and set the next-hop to the desired gateway. Option D is also correct because a prefix-list is the standard method to define the subnet match condition within the route-map.

Exam trap

The trap here is that candidates often confuse PBR with static routing or SD-WAN rules, mistakenly thinking a static route with higher administrative distance or an SD-WAN rule can achieve the same next-hop override, but PBR requires explicit route-map and prefix-list configuration.

Practice this question →

178

Multi-Selectmedium

A network administrator is configuring SD-WAN on a FortiGate to control outbound internet traffic. The requirement is to load balance traffic across two WAN interfaces (port1 and port2) based on the number of new sessions, but only when both links are healthy. The administrator has added both interfaces to the SD-WAN zone and configured performance SLAs. Which TWO additional configuration steps are necessary to implement this requirement?

Select 2 answers

A.Enable 'ECMP load balancing' in the routing settings

B.Configure the SD-WAN rule to use a performance SLA for health checking

C.Set the load balancing algorithm to 'sessions' in the SD-WAN rule for the traffic

D.Configure a policy-based routing rule to direct traffic to the SD-WAN zone

E.Set the 'sla-check' under config system sdwan to 'enable'

AnswersB, C

Why this answer

Configuring a performance SLA for health checking in the SD-WAN rule ensures that the FortiGate monitors link quality (latency, jitter, packet loss) and only considers links that meet the SLA thresholds as active for traffic distribution. This satisfies the requirement that load balancing occurs only when both links are healthy. Option C is correct because setting the load balancing algorithm to 'sessions' in the SD-WAN rule ensures that traffic is distributed based on the number of new sessions, as required.

Without Option C, the default algorithm (e.g., source-destination IP) would not meet the session-based requirement. Options A, D, and E are incorrect: ECMP load balancing (A) is a routing-level feature independent of SD-WAN rules; policy-based routing (D) is not needed when using SD-WAN rules; and the global 'sla-check' enable (E) activates SLA monitoring but does not apply the per-rule health check and algorithm configuration required here.

Exam trap

The trap here is that candidates often confuse the global 'sla-check' enable command (Option E) with the per-rule SLA configuration, or they assume ECMP load balancing (Option A) is required for SD-WAN, when in fact SD-WAN uses its own load balancing algorithms and health checks independent of ECMP.

Practice this question →

179

MCQhard

A FortiGate is running OSPF in a multi-area topology. The administrator needs to redistribute connected routes from area 0 into area 1 but does not want to leak any other routes. Which configuration is correct?

A.Use policy-based routing to forward traffic to the connected networks.

B.Add the connected networks as networks in area 1 using 'network x.x.x.x 255.255.255.0 area 1'.

C.Configure route redistribution under OSPF with 'redistribute connected' and apply a route map that permits only the desired connected networks.

D.Use 'set redistribute connected' under the OSPF interface configuration for the connected interface in area 0.

AnswerC

Using redistribution with a route map allows selective advertisement of only the specified connected routes.

Why this answer

OSPF does not automatically redistribute connected routes between areas; it only advertises routes learned via OSPF. To inject connected routes from area 0 into area 1 without leaking other routes, you must use 'redistribute connected' under OSPF and apply a route map that explicitly permits only the desired connected networks. This ensures that only those specific prefixes are advertised as Type 5 or Type 7 LSAs into area 1, while all other routes remain unaffected.

Exam trap

The trap here is that candidates often confuse OSPF network statements (which enable OSPF on interfaces and advertise directly connected networks) with route redistribution, mistakenly thinking that adding a network statement in area 1 will selectively leak routes from area 0, when in fact network statements only advertise the interface's own subnet and cannot import routes from another area.

How to eliminate wrong answers

Option A is wrong because policy-based routing (PBR) controls forwarding decisions based on traffic attributes, not route advertisement; it cannot inject connected routes into OSPF or control which routes are leaked between areas. Option B is wrong because adding connected networks as networks in area 1 using 'network x.x.x.x 255.255.255.0 area 1' would cause OSPF to advertise those networks as intra-area routes, but it would also include any other networks matched by the network statement, and it does not selectively leak only specific connected routes from area 0; moreover, the connected interface itself is in area 0, so this approach would misrepresent the topology. Option D is wrong because 'set redistribute connected' is not a valid OSPF interface configuration command; redistribution is configured globally under the OSPF process, not per interface, and this option reflects a misunderstanding of where redistribution parameters are applied.

Practice this question →

180

MCQmedium

A FortiGate is using BFD for BGP fast failure detection. The administrator wants to ensure that if the BFD session goes down, the BGP neighbor is removed and routes are withdrawn immediately. Which configuration is necessary?

A.Enable BFD on the BGP neighbor and ensure BFD timers are set lower than BGP hold time

B.Configure BGP graceful restart

C.Set BGP hold time to 0

D.Use 'set bfd-desired-min-tx 100' on the interface

AnswerA

BFD must be enabled for the BGP neighbor; when BFD detects a failure, it notifies BGP to tear down the session.

Why this answer

BFD provides sub-second failure detection independent of BGP's hold timer. When BFD is enabled on a BGP neighbor and the BFD session goes down, the BGP neighbor is immediately declared dead and all routes from that neighbor are withdrawn, without waiting for the BGP hold timer to expire. This ensures rapid convergence as requested by the administrator.

Exam trap

The trap here is that candidates often think setting low BFD timers alone (Option D) is sufficient, but they forget that BFD must be explicitly enabled on the BGP neighbor configuration to link the BFD session to the BGP session and trigger route withdrawal.

How to eliminate wrong answers

Option B is wrong because BGP graceful restart is designed to preserve routes during a control plane restart, not to accelerate failure detection or withdrawal of routes when a BFD session fails. Option C is wrong because setting the BGP hold time to 0 disables keepalives and hold timers entirely, which would prevent BGP from detecting failures on its own and is not a recommended practice for fast failure detection. Option D is wrong because 'set bfd-desired-min-tx 100' only sets the minimum transmit interval for BFD packets on an interface, but without enabling BFD on the BGP neighbor itself, the BFD session will not be established for that neighbor and will not trigger route withdrawal.

Practice this question →

181

MCQmedium

Which command is used on a FortiGate to view the current routing table including VRF instances?

A.show ip route

B.get router info routing-table all

C.diagnose ip route list

D.execute router list

AnswerB

This shows all VRFs routing tables.

Why this answer

'get router info routing-table all' is the FortiGate CLI command that displays the complete routing table, including all VRF instances. This command retrieves the kernel routing table entries for every VRF, showing routes from all routing protocols (static, OSPF, BGP, etc.) and is the standard way to view the full routing context on FortiGate.

Exam trap

The trap here is that candidates familiar with Cisco IOS often default to 'show ip route' (Option A), not realizing that FortiGate uses a completely different CLI syntax where 'get router info' is the equivalent operational command for viewing routing tables.

How to eliminate wrong answers

Option A is wrong because 'show ip route' is a Cisco IOS command, not a FortiGate command; FortiGate uses a different CLI syntax and does not support 'show' for routing table display. Option C is wrong because 'diagnose ip route list' is a FortiGate diagnostic command used for debugging or troubleshooting the routing table, but it is not the standard operational command to view the current routing table including VRF instances; it may show additional internal details but is not the intended production command. Option D is wrong because 'execute router list' is not a valid FortiGate command; FortiGate uses 'execute' for actions like ping or traceroute, not for listing routing tables.

Practice this question →

182

MCQeasy

A FortiGate is connected to a FortiSwitch via a trunk port. The administrator wants to manage the FortiSwitch using FortiLink. Which of the following is a prerequisite for FortiLink to function?

A.The FortiSwitch must be running a firmware version that supports CAPWAP

B.The FortiSwitch must be configured with a DHCP server to assign IP addresses

C.The FortiSwitch must have a management IP in the same subnet as the FortiGate's management IP

D.A dedicated FortiLink interface (physical or VLAN) must be configured on the FortiGate

AnswerD

Why this answer

FortiLink requires a dedicated interface on the FortiGate, either a physical port or a VLAN sub-interface, to establish the proprietary control and management channel with the FortiSwitch. This interface is automatically configured with the necessary FortiLink settings, including an internal management IP range and DHCP server, to discover and manage the switch. Without this dedicated interface, the FortiGate cannot initiate the FortiLink adjacency.

Exam trap

The trap here is that candidates often confuse FortiLink with CAPWAP (Option A) because both involve centralized management, but FortiLink is a layer-2 Ethernet-based protocol specific to FortiSwitch, not a wireless control protocol.

How to eliminate wrong answers

Option A is wrong because FortiLink uses a proprietary protocol over a direct Ethernet or VLAN connection, not CAPWAP, which is used for wireless access point management. Option B is wrong because the DHCP server for FortiSwitch management IP assignment is automatically enabled on the FortiGate's FortiLink interface, not configured on the FortiSwitch itself. Option C is wrong because the FortiSwitch does not require a management IP in the same subnet as the FortiGate's management IP; the FortiLink interface on the FortiGate uses a dedicated link-local subnet (typically 169.254.0.0/16) for switch management.

Practice this question →

183

MCQmedium

A FortiGate is configured with SD-WAN and has two WAN members: Member1 (ISP1) with priority 10, and Member2 (ISP2) with priority 5. The SD-WAN rule for traffic from the internal network uses the 'best quality' strategy. During normal operation, traffic flows through Member1. After a link failure on Member1, traffic correctly fails over to Member2. However, when Member1 is restored, traffic does not fail back. What is the most likely cause?

A.The static route for Member1 has a higher administrative distance than Member2.

B.The health-check for Member1 is configured with 'set probe-mode passive' and 'set update-static-route disable'.

C.The SD-WAN rule is configured with 'set fallback' disabled.

D.The priority of Member2 is higher than Member1.

AnswerB

Passive monitoring does not trigger fallback; update-static-route must be enabled for the route to be reinstated when the link recovers.

Why this answer

When 'set probe-mode passive' is configured, the health-check server only monitors the link without actively generating probe traffic, and 'set update-static-route disable' prevents the static route associated with Member1 from being re-enabled after the link is restored. This means the route remains inactive, so SD-WAN cannot fail back to Member1 even though the physical link is up.

Exam trap

The trap here is that candidates assume failback is automatic with SD-WAN, but FortiGate requires explicit configuration of route updates or probe modes to re-enable a restored link; the 'best quality' strategy alone does not handle failback without proper health-check settings.

How to eliminate wrong answers

Option A is wrong because a higher administrative distance would make the route less preferred, but the question states traffic flows through Member1 normally, so its route must have a lower or equal AD; the issue is about failback, not initial selection. Option C is wrong because 'set fallback' is not a valid SD-WAN rule parameter; the correct parameter for controlling failback behavior is 'set update-static-route' or 'set probe-mode', not a 'fallback' toggle. Option D is wrong because priority 10 is higher than 5, making Member1 preferred; if Member2 had higher priority, traffic would not have flowed through Member1 initially.

Practice this question →

184

MCQmedium

An administrator is troubleshooting BGP with SD-WAN. They have configured BGP on the FortiGate and the SD-WAN rule uses 'best quality' strategy. However, failover does not happen when a WAN link goes down. The BGP session is still up. What is the most likely reason?

A.The performance SLA is not configured to track the BGP next hop.

B.The SD-WAN rule is configured with 'set update-static-route disable'.

C.The BGP session is using eBGP multihop.

D.The load balancing algorithm is set to 'volume'.

AnswerA

For SD-WAN to detect link failure, the performance SLA must monitor the actual path to the BGP next hop or internet. BGP session may remain up via an alternate path, but the link may be degraded.

Why this answer

The 'best quality' SD-WAN strategy selects the best path based on performance SLA metrics. Without a performance SLA monitoring the BGP next hop, the FortiGate cannot detect that the link has failed from a BGP perspective, so it will not trigger a failover even if the physical interface goes down. The BGP session remains up because it is still receiving keepalives, but the SD-WAN rule does not consider the link unusable without SLA tracking.

Exam trap

The trap here is that candidates assume BGP session state alone determines link usability, but FortiGate SD-WAN requires explicit performance SLA monitoring of the BGP next hop to trigger failover in a 'best quality' strategy.

How to eliminate wrong answers

Option B is wrong because 'set update-static-route disable' only prevents the FortiGate from installing BGP routes into the static route table; it does not affect SD-WAN failover behavior. Option C is wrong because eBGP multihop allows BGP sessions across multiple hops but does not prevent failover when a link goes down; the issue is SLA tracking, not BGP hop count. Option D is wrong because the load balancing algorithm set to 'volume' affects how traffic is distributed among multiple paths, not whether failover occurs when a link fails.

Practice this question →

185

MCQeasy

A FortiGate is configured with SD-WAN using load balancing algorithm 'source-dest-ip'. What is the primary characteristic of this algorithm?

A.Traffic is sent to the member with the highest bandwidth.

B.Traffic is sent to the member with the lowest cost metric.

C.Traffic is distributed evenly across all SD-WAN members regardless of source or destination.

D.All traffic from the same source IP to the same destination IP uses the same SD-WAN member.

AnswerD

Source-dest-ip hashing ensures that traffic belonging to the same source-destination pair is consistently sent over the same link, preserving session affinity.

Why this answer

The 'source-dest-ip' load balancing algorithm in SD-WAN uses a hash of both the source IP and destination IP to deterministically select an SD-WAN member. This ensures that all packets belonging to the same flow (same source-destination pair) are consistently forwarded over the same member, preserving per-flow stickiness and avoiding out-of-order delivery.

Exam trap

The trap here is that candidates often confuse 'source-dest-ip' with 'round-robin' or 'bandwidth-based' algorithms, assuming it distributes traffic evenly, when in fact it prioritizes per-flow stickiness over load distribution.

How to eliminate wrong answers

Option A is wrong because the 'source-dest-ip' algorithm does not consider bandwidth; bandwidth-based load balancing is a separate feature (e.g., 'spillover' or 'max-bandwidth' settings). Option B is wrong because cost metric is used in route selection (e.g., via SD-WAN rules or static routes), not in the load balancing algorithm itself; 'source-dest-ip' hashes IPs, not cost. Option C is wrong because it describes round-robin or session-based load balancing, not 'source-dest-ip'; the latter is not evenly distributed across members but rather per-flow consistent.

Practice this question →

186

MCQmedium

An administrator needs to apply different routing policies for traffic based on source IP address, overriding the normal routing table. Which feature should be configured?

A.Prefix list

B.SD-WAN rule

C.Route map

D.Policy-based routing

AnswerD

PBR enables routing based on policies.

Why this answer

Policy-based routing (PBR) is the correct feature because it allows an administrator to override the normal routing table lookup based on criteria such as source IP address. Unlike static or dynamic routing, PBR uses route maps to match traffic (e.g., source IP) and apply a specific next-hop or interface, enabling granular traffic steering independent of the destination-based routing table.

Exam trap

The trap here is that candidates often confuse route maps (a policy tool) with policy-based routing (the feature that uses route maps to override forwarding), leading them to select 'Route map' instead of 'Policy-based routing' as the feature name.

How to eliminate wrong answers

Option A is wrong because a prefix list is used to match IP prefixes in routing protocols (e.g., BGP) or route redistribution, not to override routing decisions based on source IP. Option B is wrong because SD-WAN rules are designed for application-aware traffic steering and link load balancing in an SD-WAN fabric, not for overriding the routing table based solely on source IP in a traditional routing context. Option C is wrong because a route map is a tool used to manipulate routing information (e.g., set attributes, filter routes) during redistribution or policy application, but it does not itself override the routing table; it must be applied with PBR to achieve source-based forwarding.

Practice this question →

187

Matchingmedium

Match each FortiGate interface type to its usage.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Hardware network port

Virtual LAN subinterface

Virtual interface for management or routing

Combines multiple physical links for redundancy

Link aggregation (LAG) for increased bandwidth

Why these pairings

The correct matches: Physical Interface → hardware port; VLAN Interface → logical interface for 802.1Q tagging; Loopback Interface → always-up virtual interface; Aggregate Interface → combines multiple physical interfaces. Common confusions include mixing the definitions of loopback and VLAN, or confusing physical interfaces with aggregate interfaces.

Practice this question →

188

Multi-Selecthard

Which TWO statements correctly describe the behavior of SD-WAN rules when using the 'maximize-bandwidth' strategy?

Select 2 answers

A.The strategy ensures that all traffic uses the member with the highest bandwidth.

B.The administrator can assign different weights to members to influence the proportion of traffic each handles.

C.If a member fails its health-check, it is removed from the set of eligible members for the rule.

D.Traffic from a single session can be split across multiple members for better performance.

E.Traffic is distributed based on session count to keep each link equally utilized.

AnswersB, C

Weights can be set per member to control the load-balancing ratio.

Why this answer

The 'maximize-bandwidth' strategy in SD-WAN rules uses weighted load balancing, where the administrator assigns weights to each member link. The proportion of traffic each member handles is directly proportional to its assigned weight, allowing fine-grained control over bandwidth utilization across multiple WAN links.

Exam trap

The trap here is that candidates often confuse 'maximize-bandwidth' with simple 'load balancing' or assume it splits individual sessions, when in fact it uses weighted distribution while maintaining per-session stickiness and relying on health checks for member eligibility.

Practice this question →

189

MCQeasy

A FortiGate is configured with ECMP routing to balance traffic across two default routes via two ISPs. The administrator wants to ensure that traffic from the same source-destination pair always uses the same ISP. Which ECMP load balancing method should be configured?

A.source-dest-ip

B.source-ip

C.per-packet

D.session

AnswerA

Why this answer

The source-dest-ip method hashes the source and destination IP addresses to compute a consistent path for all packets in a given flow. This ensures that traffic from the same source-destination pair always uses the same ISP, meeting the requirement for flow-based persistence without per-packet load balancing.

Exam trap

The trap here is that candidates may confuse 'session' as a valid ECMP method, but FortiGate does not have a 'session' load balancing option; the correct flow-based method is 'source-dest-ip'.

How to eliminate wrong answers

Option B (source-ip) is wrong because it only hashes the source IP, so traffic from the same source to different destinations could use different ISPs, but traffic from the same source-destination pair might still be split if the source IP alone is used. Option C (per-packet) is wrong because it distributes each packet individually across links, breaking flow persistence and causing out-of-order delivery for TCP sessions. Option D (session) is wrong because it is not a valid ECMP load balancing method in FortiGate; the correct term is 'source-dest-ip' for session-based persistence.

Practice this question →

190

MCQmedium

Which feature allows a FortiGate to use multiple VRFs to separate routing tables for different customers or departments on the same physical device?

A.SD-WAN

B.VDOM

C.VRF

D.Policy-based routing

AnswerC

VRF creates separate routing tables.

Why this answer

C is correct because VRF (Virtual Routing and Forwarding) is the native feature that allows a FortiGate to maintain multiple independent routing tables within a single physical device. Each VRF instance has its own routing table, forwarding table, and interface associations, enabling traffic separation for different customers or departments without requiring separate hardware. This is distinct from VDOMs, which provide full virtualized security and management contexts, and from SD-WAN or policy-based routing, which do not create separate routing tables.

Exam trap

The trap here is that candidates often confuse VDOMs with VRFs, but VDOMs virtualize the entire device (including management and security policies), whereas VRFs specifically virtualize only the routing table, making VRF the correct answer for routing-table separation alone.

How to eliminate wrong answers

Option A is wrong because SD-WAN is a feature for intelligent path selection and load balancing across multiple WAN links, not for creating separate routing tables. Option B is wrong because VDOMs (Virtual Domains) provide full virtualized firewall and management contexts, including separate routing tables, but the question specifically asks about the feature that uses multiple VRFs to separate routing tables, and VRF is the direct routing-table separation mechanism within a VDOM or global context. Option D is wrong because policy-based routing (PBR) allows traffic to be forwarded based on policies (e.g., source/destination IP) rather than the routing table, but it does not create multiple independent routing tables.

Practice this question →

191

MCQmedium

A network administrator is troubleshooting a BGP session between a FortiGate and an ISP router. The administrator runs 'get router info bgp summary' and sees that the BGP state is 'Active'. What does this state indicate?

A.The BGP speaker is trying to establish a TCP connection with the peer

B.The BGP session is administratively down due to a configuration error

C.The BGP speaker is waiting for a routing update from the peer

D.The BGP session is fully established and exchanging routes

AnswerA

Why this answer

The 'Active' state in BGP indicates that the router is actively trying to initiate a TCP connection to the configured peer. This means the BGP process has moved past the 'Connect' state (where it passively waits) and is now actively sending TCP SYN packets to the peer's port 179, but the three-way handshake has not yet completed. This state is normal during initial session establishment but becomes problematic if it persists, as it typically points to a Layer 3 reachability issue or a firewall blocking TCP/179.

Exam trap

The trap here is that candidates confuse 'Active' with a session that is actively exchanging routes, but 'Active' specifically refers to the TCP connection phase, not the routing update phase, which only occurs after the session reaches the 'Established' state.

How to eliminate wrong answers

Option B is wrong because an administratively down session would show as 'Idle (Admin)' or 'Idle' in the BGP summary, not 'Active'. Option C is wrong because waiting for a routing update occurs in the 'Established' state, not 'Active'; the 'Active' state is about TCP connection setup, not routing information exchange. Option D is wrong because a fully established session is indicated by the 'Established' state with a number in the 'State/PfxRcd' column showing the count of received prefixes, not the 'Active' state.

Practice this question →

192

MCQhard

A FortiGate is configured with two WAN members in an SD-WAN zone. The performance SLA monitors latency to a probe server. The rule uses 'best quality' strategy. After some time, one member fails the SLA. Which action does the FortiGate take for existing sessions that were using that member?

A.All sessions are dropped and the member is removed from the zone

B.Existing sessions are re-evaluated and may be moved based on policy

C.Existing sessions are immediately moved to another member

D.Existing sessions continue on the failed member until they timeout

AnswerD

Only new sessions are affected.

Why this answer

When a WAN member fails the performance SLA in an SD-WAN 'best quality' strategy, FortiGate does not disrupt existing sessions that were already using that member. Instead, those sessions continue on the failed member until they naturally timeout or are torn down, because the SD-WAN rule only influences the path selection for new sessions. This behavior is by design to avoid breaking active connections due to transient SLA fluctuations.

Exam trap

The trap here is that candidates often assume SD-WAN 'best quality' strategy dynamically re-routes all traffic, including existing sessions, when an SLA fails, but FortiGate only applies path selection changes to new sessions to maintain session stability.

How to eliminate wrong answers

Option A is wrong because FortiGate does not drop all sessions or remove the member from the zone solely due to SLA failure; the member remains available for new sessions if it is the only path or if other rules permit. Option B is wrong because existing sessions are not re-evaluated or moved based on policy; only new session path selection is affected by SLA status. Option C is wrong because immediate session movement would cause disruption and is not supported; FortiGate relies on session timeout or application-specific mechanisms (like DNS or TCP retransmission) to naturally migrate traffic.

Practice this question →

193

MCQmedium

A FortiGate administrator is integrating a FortiSwitch managed by the FortiGate. They want to configure a VLAN interface on the FortiSwitch for user traffic. Which configuration is required on the FortiGate?

A.Enable DHCP relay on the FortiSwitch VLAN

B.Configure a VLAN on the FortiSwitch under the switch controller and assign it to a port

C.Use the config system interface to create a VLAN on the FortiGate and tag it on the trunk

D.Create a VLAN subinterface on the FortiGate's port that connects to the FortiSwitch

AnswerB

Under config switch-controller, you create a VLAN and assign it to switch ports.

Why this answer

When integrating a FortiSwitch managed by a FortiGate, VLANs for user traffic must be created under the switch controller on the FortiGate. This allows the FortiGate to push the VLAN configuration to the FortiSwitch, including assigning the VLAN to a specific port or port group. Option B correctly describes this process, as the switch controller manages the FortiSwitch as an extension of the FortiGate, not as a standalone device.

Exam trap

The trap here is that candidates confuse creating a VLAN on the FortiGate's own interfaces (using 'config system interface') with configuring a VLAN on a managed FortiSwitch, which requires the switch controller context.

How to eliminate wrong answers

Option A is wrong because DHCP relay is a separate feature that can be enabled on a VLAN interface, but it is not a required configuration for creating a VLAN on a FortiSwitch; the question asks for the required configuration to set up the VLAN itself. Option C is wrong because 'config system interface' is used to create VLAN interfaces on the FortiGate itself, not on a managed FortiSwitch; FortiSwitch VLANs are managed through the switch controller, not system interfaces. Option D is wrong because creating a VLAN subinterface on the FortiGate's physical port is used for router-on-a-stick or inter-VLAN routing on the FortiGate, but it does not configure the VLAN on the FortiSwitch; the FortiSwitch must be explicitly configured via the switch controller to carry that VLAN.

Practice this question →