Courseiva

CCNA Nse7 Advanced Networking Questions

75 of 193 questions · Page 1/3 · Nse7 Advanced Networking topic · Answers revealed

Practice these questionsExam hubAll questions
1
MCQmedium

An administrator has configured OSPF on a FortiGate with multiple areas. They want to ensure that routes from area 0 are redistributed into area 1, but they notice that routes from area 1 are not appearing in area 0. What is the most likely configuration issue?

A.There is a firewall policy blocking OSPF packets
B.The ABR has 'area 1 stub' configured, preventing LSA type 5 redistribution
C.The redistribution is done with a route map that is not permitting the routes
D.The ABR is not configured with 'area 0' and 'area 1' on the same router
AnswerD

Correct. For a router to act as an ABR and exchange routes between areas, it must have interfaces in both area 0 and the other area (area 1). If the router lacks an interface in area 0, it cannot generate Type 3 LSAs, and routes from area 1 will not appear in area 0.

Why this answer

The most likely configuration issue is that the ABR is not properly configured as an ABR – it must have interfaces in both area 0 and area 1. Without an interface in area 0, the router cannot generate Type 3 LSAs (inter-area advertisements) between the areas, so routes from area 1 never appear in area 0. Option B is incorrect because a stub area blocks Type 5 LSAs from entering the stub area, but it does not block Type 3 LSAs from being advertised out of the stub area into the backbone; therefore, stub configuration would not prevent inter-area routes from reaching area 0.

Exam trap

The trap is that candidates often assume that any router connecting area 1 to area 0 is automatically an ABR, but it must have an interface in area 0 to function as an ABR. Without it, the router cannot perform inter-area route advertisement.

How to eliminate wrong answers

Option A is wrong because a firewall policy blocking OSPF packets would prevent OSPF neighbor formation entirely, not selectively block route redistribution from area 1 to area 0 while allowing redistribution from area 0 to area 1. Option C is wrong because redistribution with a route map is used for importing external routes into OSPF (e.g., from other protocols), not for controlling inter-area route advertisement between OSPF areas; inter-area routes are handled by ABR Type 3 LSA generation, not redistribution. Option D is wrong because an ABR must have interfaces in both area 0 and area 1 to function as an ABR; if the ABR were not configured with both areas, it would not be an ABR and inter-area routing would fail entirely, not just in one direction.

Practice this question →
2
MCQeasy

What is the purpose of BFD (Bidirectional Forwarding Detection) in a FortiGate routing configuration?

A.To encrypt routing protocol traffic
B.To detect forwarding path failures quickly
C.To authenticate routing peers
D.To provide load balancing across multiple paths
AnswerB

BFD rapidly detects failures for faster convergence.

Why this answer

BFD (Bidirectional Forwarding Detection) provides fast failure detection for forwarding paths between two adjacent routers, independent of any routing protocol. In FortiGate configurations, BFD is used to detect link or neighbor failures in sub-second intervals (e.g., 50-100 ms), enabling rapid convergence for dynamic routing protocols like OSPF or BGP. This is critical for SD-WAN and high-availability scenarios where traditional keepalive timers (e.g., OSPF Hello/Dead intervals of 10-40 seconds) are too slow.

Exam trap

The trap here is that candidates confuse BFD's role in fast failure detection with routing protocol features like authentication or encryption, or mistakenly think BFD itself provides load balancing, when in fact it only monitors path liveliness and triggers convergence.

How to eliminate wrong answers

Option A is wrong because BFD does not encrypt routing protocol traffic; encryption is handled by protocols like IPsec or authentication mechanisms within routing protocols (e.g., OSPF MD5 authentication). Option C is wrong because BFD does not authenticate routing peers; authentication is a separate feature of routing protocols (e.g., BGP MD5 password or OSPF authentication) and BFD itself has no authentication mechanism. Option D is wrong because BFD is a detection mechanism, not a load-balancing tool; load balancing across multiple paths is achieved by ECMP (Equal-Cost Multi-Path) routing or SD-WAN rules, while BFD simply detects failures on those paths.

Practice this question →
3
MCQmedium

An administrator configures a performance SLA to monitor a remote server. The SLA status shows 'dead' for one WAN member. The administrator checks the interface and sees that it is up and passing other traffic. What is the most likely cause?

A.The FortiGate's routing table does not have a route to the probe target
B.The interface is not added as an SD-WAN member
C.The SLA probe is using TCP port 80 but the server is only responding to ICMP
D.The SLA probe interval is set too high
AnswerC

If the probe type does not match the server's response, the SLA fails even if the link is up.

Why this answer

The performance SLA status shows 'dead' because the probe is failing to reach the remote server. The administrator configured the SLA to use TCP port 80, but the server only responds to ICMP. Since the probe packets (TCP SYN) are not being acknowledged, the SLA marks the member as dead, even though the interface is up and other traffic (e.g., ICMP) passes successfully.

Exam trap

The trap here is that candidates assume an 'up' interface and passing traffic guarantee SLA success, overlooking that the SLA probe uses a specific protocol and port that may not match the server's actual response behavior.

How to eliminate wrong answers

Option A is wrong because if the routing table lacked a route to the probe target, the probe would fail for all WAN members, not just one, and the interface would likely not pass other traffic to that destination. Option B is wrong because the interface is already an SD-WAN member (the SLA is monitoring one of its members), and the question states the interface is up and passing traffic. Option D is wrong because a high probe interval would delay detection of failure but would not cause a persistent 'dead' status; the probe would still succeed if the server responded correctly.

Practice this question →
4
MCQmedium

During an SD-WAN health check, an administrator observes that a performance SLA for wan1 shows 'Status: dead' even though the interface is up and can ping the SLA server. The SLA configuration uses a TCP echo probe to 8.8.8.8 port 443. What is the most likely cause?

A.The SLA server is blocking ICMP echo requests.
B.The performance SLA is configured with the wrong threshold.
C.The firewall policy allowing the probe traffic is missing.
D.The probe protocol is TCP echo, but the server at 8.8.8.8 does not support TCP echo on port 443.
AnswerD

TCP echo uses port 7 by default; using a different port will not elicit a proper echo response unless the server is configured for it.

Why this answer

The TCP echo probe sends a TCP SYN to the specified port and expects a SYN-ACK to confirm connectivity. 8.8.8.8 (Google DNS) does not run a TCP echo service on port 443; it serves HTTPS. The server will respond with a TCP RST or simply ignore the probe, causing the SLA to fail and show 'dead' even though the interface is up and ICMP ping works.

Exam trap

The trap here is that candidates assume a successful ICMP ping to the SLA server means all probes should work, overlooking that TCP echo probes require a specific service (TCP echo on port 7 or a custom port that echoes data) and that port 443 on 8.8.8.8 does not provide that service.

How to eliminate wrong answers

Option A is wrong because the SLA uses a TCP echo probe, not ICMP, so ICMP blocking is irrelevant to the probe's failure. Option B is wrong because threshold misconfiguration would cause latency/jitter SLA failures, not a complete inability to establish a TCP connection (the probe never gets a SYN-ACK). Option C is wrong because if the firewall policy were missing, the probe traffic would be dropped and the interface would likely show 'dead' for all probes, but the administrator confirms the interface can ping the SLA server, indicating policy allows outbound traffic.

Practice this question →
5
Multi-Selecthard

A FortiGate is configured with OSPF multi-area. The administrator needs to ensure that routes from area 2 are advertised into area 0. Which TWO configurations are necessary?

Select 2 answers
A.Configure a virtual-link between area 2 and area 0
B.Set the OSPF network type to point-to-point
C.Configure an Area Border Router (ABR) between area 2 and area 0
D.Disable OSPF on area 0
E.Enable route redistribution from OSPF into OSPF
AnswersA, C

A virtual-link is required to logically connect area 2 to area 0 when there is no direct physical connection, ensuring OSPF backbone continuity.

Why this answer

To advertise routes from area 2 into area 0, an Area Border Router (ABR) must connect the two areas. The ABR automatically generates Type 3 summary LSAs to propagate routes without explicit redistribution. However, in a multi-area OSPF design, if area 2 is not directly physically connected to backbone area 0, a virtual-link is required to provide logical connectivity.

Since the question asks for two necessary configurations and the topology implies a non-direct connection (common in multi-area setups), both an ABR and a virtual-link are needed.

Exam trap

Candidates often assume that OSPF requires explicit route redistribution for inter-area routing, but in a standard OSPF deployment, an ABR automatically advertises Type 3 LSAs. Also, virtual-links are only used when there is no direct physical connection to the backbone area, not as a substitute for an ABR.

Practice this question →
6
Multi-Selecthard

An administrator is troubleshooting an SD-WAN deployment where traffic from the branch to the datacenter is being sent over the backup LTE link even though the primary MPLS link has low latency and jitter. The SD-WAN rule uses 'Best Quality' strategy with latency and jitter metrics. The performance SLA for MPLS shows 'alive'. Which TWO configurations could cause this behavior?

Select 2 answers
A.BFD is enabled on MPLS but not on LTE.
B.The SD-WAN rule has 'set member' configured to only include LTE.
C.The performance SLA is not associated with the SD-WAN rule.
D.The route to the datacenter is learned via OSPF with a lower cost over LTE.
E.The latency threshold is set too low for MPLS.
AnswersB, C

If MPLS is not listed as a member in the rule, it won't be used.

Why this answer

If the SD-WAN rule uses 'set member' to include only the LTE interface, traffic will be forced over LTE regardless of the performance SLA status or the 'Best Quality' strategy. This overrides the dynamic path selection logic, causing the backup link to be used even when the primary MPLS link is healthy.

Exam trap

The trap here is that candidates assume 'Best Quality' strategy always evaluates all interfaces, but they overlook that the 'set member' configuration explicitly limits which interfaces the rule can use, overriding the strategy's dynamic selection.

Practice this question →
7
MCQmedium

An administrator wants to use FortiExtender to provide LTE WAN connectivity. After connecting the FortiExtender to the FortiGate, the LTE interface is not showing up. What is the first troubleshooting step?

A.Run 'execute lte test' command
B.Configure an SD-WAN rule for LTE traffic
C.Verify the FortiExtender is connected to the correct port and powered on
D.Check the signal strength of the LTE connection
AnswerC

Physical connectivity is the first check.

Why this answer

The first troubleshooting step is to verify the physical connection and power status of the FortiExtender. If the FortiExtender is not connected to the correct port (typically a USB or PoE port) or is not powered on, the FortiGate will not detect the LTE interface at all, making any software-level checks premature.

Exam trap

The trap here is that candidates jump to software-level troubleshooting (like running diagnostic commands or checking signal strength) without first confirming the basic physical connectivity and power status of the FortiExtender.

How to eliminate wrong answers

Option A is wrong because 'execute lte test' is a diagnostic command that requires the LTE interface to already be present and operational; running it before verifying physical connectivity will fail or return irrelevant errors. Option B is wrong because configuring an SD-WAN rule for LTE traffic assumes the LTE interface is already recognized and available, which is not the case here. Option D is wrong because checking signal strength presupposes that the LTE interface is up and has established a connection to the cellular network, which cannot happen if the FortiExtender is not physically connected or powered.

Practice this question →
8
MCQmedium

A FortiGate is configured with two VRF instances (VRF1 and VRF2). The admin needs to allow traffic from VRF1 to reach a server in VRF2. The server is directly connected to the FortiGate on an interface in VRF2. What configuration is required?

A.Add both VRFs to the same VDOM
B.Use VRF route leaking with route maps to export necessary routes between VRFs
C.Configure a static route in VRF1 pointing to the server's IP via the VRF2 interface
D.Configure a firewall policy with source VRF1 and destination VRF2
AnswerB

Route leaking allows redistribution of routes between VRFs, enabling inter-VRF communication.

Why this answer

B is correct because VRF route leaking is the standard method to enable communication between separate VRF instances on a FortiGate. This involves using route maps to selectively export routes from VRF2 into VRF1, allowing traffic from VRF1 to reach the server in VRF2. Without route leaking, VRFs are isolated by default, and no other mechanism (like static routes or firewall policies alone) can bridge the routing table separation.

Exam trap

The trap here is that candidates often assume a firewall policy with source and destination VRF selection is sufficient to allow inter-VRF traffic, but they overlook that routing must first be established via route leaking before any policy can be applied.

How to eliminate wrong answers

Option A is wrong because adding both VRFs to the same VDOM does not enable inter-VRF routing; VRFs within a VDOM remain isolated unless explicit route leaking is configured. Option C is wrong because a static route in VRF1 pointing to the server's IP via the VRF2 interface is invalid—the interface belongs to a different VRF, and the FortiGate will not forward traffic across VRF boundaries based solely on a static route. Option D is wrong because a firewall policy alone cannot route traffic between VRFs; it only controls permitted traffic after routing decisions are made, and without route leaking, the packets from VRF1 will not have a route to the VRF2 server.

Practice this question →
9
MCQmedium

A network admin configures OSPF on a FortiGate with multiple areas, including one area that is not directly connected to the backbone (Area 0). To ensure that routes from that area are advertised into other areas, which OSPF feature must be properly configured?

A.OSPF route redistribution
B.OSPF passive interface
C.OSPF virtual-link
D.OSPF network type
AnswerC

Correct. OSPF virtual-links create a logical connection from a non-backbone area to the backbone area, enabling inter-area route advertisement through Type 3 LSAs generated by ABRs.

Why this answer

OSPF virtual-links are used to connect a non-backbone area to the backbone area through a transit area. This ensures that the area has a logical path to the backbone, allowing ABRs to generate Type 3 summary LSAs and advertise routes between areas. Without proper virtual-link configuration, routes from an area not directly connected to the backbone cannot be advertised to other areas.

Exam trap

The trap is that candidates may think OSPF route redistribution is needed for inter-area routes, but OSPF internally uses ABRs to automatically generate Type 3 LSAs. Virtual-links are a specific feature to connect isolated areas to the backbone, which is necessary for inter-area routing in such topologies.

How to eliminate wrong answers

Option B (OSPF passive interface) is wrong because it prevents OSPF hello packets from being sent on an interface, suppressing neighbor discovery and route exchange, but it does not control inter-area route advertisement. Option C (OSPF virtual-link) is wrong because it is used to connect a non-backbone area to the backbone area through a transit area when a direct physical connection is missing, not to advertise routes between areas. Option D (OSPF network type) is wrong because it determines how OSPF operates on a given interface (e.g., broadcast, point-to-point) and affects neighbor formation and LSA flooding, but it does not enable inter-area route propagation.

Practice this question →
10
MCQeasy

Which SD-WAN load balancing algorithm is best for ensuring that all traffic from a specific source-destination pair uses the same WAN link?

A.Spillover
B.Source-dest IP
C.Volume
D.Lowest-cost
AnswerB

Source-dest IP hashes both IPs, ensuring same pair goes to same link.

Why this answer

Source-dest IP (B) is the correct algorithm because it uses a hash of both the source and destination IP addresses to deterministically select a WAN link. This ensures that all packets belonging to the same flow (same source-destination pair) are consistently forwarded over the same link, preserving packet order and avoiding reordering issues.

Exam trap

The trap here is that candidates often confuse 'Spillover' with a load-balancing algorithm, but Spillover is actually a bandwidth-based failover or overflow mechanism, not a deterministic per-flow hashing method.

How to eliminate wrong answers

Option A (Spillover) is wrong because it is a traffic-steering method that shifts traffic to another link only after a configured bandwidth threshold is exceeded, not a load-balancing algorithm that ensures per-flow stickiness. Option C (Volume) is wrong because it balances traffic based on the volume of data sent over each link, which can cause flows to be split across multiple links and break source-destination pair consistency. Option D (Lowest-cost) is wrong because it selects the link with the lowest cost metric (e.g., based on link quality or administrative weight), which does not guarantee that all traffic from a specific source-destination pair will use the same link; cost-based decisions can change dynamically.

Practice this question →
11
MCQeasy

A FortiGate is configured with multiple virtual routers (VRFs). The administrator wants to allow communication between two VRFs using a firewall policy. Which type of interface is required for the policy?

A.VDOM link
B.VLAN subinterface
C.Loopback interface
D.Virtual-wire pair
AnswerA

VDOM links are used to connect VDOMs or VRFs; firewall policies can be applied to allow traffic between VRFs.

Why this answer

A VDOM link is a virtual interface that connects two VDOMs (Virtual Domains) and inherently supports routing between different VRFs (Virtual Routing and Forwarding instances) within a FortiGate. When a firewall policy is applied to a VDOM link, it can control traffic flowing between the two VRFs, as the link itself is a Layer 3 interface that belongs to both VDOMs and can be assigned to different VRFs on each side. This is the only interface type that natively allows inter-VRF communication with firewall policy enforcement.

Exam trap

The trap here is that candidates often confuse VDOM links with VLAN subinterfaces, assuming that VLAN tagging alone can separate VRFs, but VLAN subinterfaces cannot cross VRF boundaries without additional routing constructs like route leaking, which is not handled by a firewall policy directly.

How to eliminate wrong answers

Option B (VLAN subinterface) is wrong because VLAN subinterfaces operate within a single VRF and cannot directly route traffic between different VRFs; they are used for segmenting traffic within the same VRF or VDOM. Option C (Loopback interface) is wrong because loopback interfaces are virtual interfaces used for management, routing protocol stability, or as tunnel endpoints, and they cannot be used to forward traffic between VRFs via a firewall policy. Option D (Virtual-wire pair) is wrong because virtual-wire pairs are transparent Layer 2 interfaces that bridge traffic without routing, and they do not support VRF separation or inter-VRF firewall policies.

Practice this question →
12
MCQhard

You have configured a route map named 'RM-BGP' to filter routes redistributed from OSPF into BGP. The route map uses 'set community 65000:100' and 'set metric 50'. After applying the route map under 'config router bgp' with 'redistribute ospf route-map RM-BGP', you see that routes are being redistributed but without the community and metric. What is wrong?

A.The route map does not have any 'match' criteria, so it never applies
B.The route map is missing a 'set community' statement with 'additive' option
C.The BGP neighbor requires 'soft-reconfiguration inbound' to see the changes
D.The 'set metric' command is not supported for BGP redistribution
AnswerA

Without match statements, the route map may not be applied. A common configuration error.

Why this answer

A route map without any 'match' statements is considered a 'permit all' by default, but it does not apply 'set' actions unless a 'match' condition is explicitly met. In FortiOS, a route map with only 'set' commands and no 'match' criteria will not execute those 'set' actions during redistribution. Therefore, the routes are redistributed with default BGP attributes, not the configured community or metric.

Exam trap

The trap here is that candidates assume a route map with only 'set' commands will always apply those actions, but FortiOS requires at least one 'match' statement to trigger the 'set' operations during redistribution.

How to eliminate wrong answers

Option A is correct because the route map lacks 'match' criteria, so the 'set' actions are never applied. Option B is wrong because the 'additive' keyword is only needed when you want to append a community to an existing community list, not when setting a community for the first time; the core issue is the missing 'match' statement. Option C is wrong because 'soft-reconfiguration inbound' is used to store inbound updates from a neighbor for policy changes, not for outbound redistribution policies applied under 'redistribute ospf'.

Option D is wrong because 'set metric' is fully supported for BGP redistribution in FortiOS; it is a standard attribute that can be set via route maps.

Practice this question →
13
MCQmedium

A FortiGate has OSPF configured in multiple areas. The administrator wants to redistribute routes from area 0 into area 1 with a metric of 10. Which command is correct?

A.config router ospf config redistribute "ospf" set status enable set metric 10 end
B.config router ospf config redistribute "connected" set metric 10 end
C.config router ospf config area edit 1 set type nssa end
D.config router ospf set redistribute "ospf" metric 10
AnswerD

It directly sets the metric for redistributed OSPF routes to 10 using the proper FortiOS command syntax.

Why this answer

None of the provided commands correctly set the metric for inter-area OSPF routes. OSPF automatically floods Type 3 LSAs between areas; the metric is determined by interface costs and cannot be directly set via redistribution. Redistributing OSPF into the same process is not a supported method for inter-area metric control.

Exam trap

The trap is that candidates may assume the 'set redistribute' command can be used to influence inter-area OSPF metrics, but this is invalid for routes already within the same OSPF process.

How to eliminate wrong answers

Option B is wrong because 'redistribute connected' redistributes directly connected routes into OSPF, not OSPF routes between areas, and it does not target area 0 to area 1 redistribution. Option C is wrong because setting area 1 as NSSA changes the area type but does not redistribute routes from area 0 into area 1 with a specific metric; NSSA controls which external routes are allowed, not inter-area redistribution. Option D is wrong because 'set redistribute ospf metric 10' is not a valid command at the top level of OSPF configuration; redistribution must be configured under the 'redistribute' subcommand, not as a direct attribute of the OSPF process.

Practice this question →
14
MCQmedium

A multi-area OSPF network includes a FortiGate as an ABR. The administrator needs to redistribute a static route into OSPF. Which command is required on the FortiGate to achieve this?

A.config router ospf config redistribute edit 'static' set status enable end
B.config router prefix-list edit 'static' set action permit end
C.config router policy set src 0.0.0.0/0 set dst 0.0.0.0/0 end
D.config router static set redistribute ospf enable end
AnswerA

Correct method to enable redistribution of static into OSPF.

Why this answer

To redistribute a static route into OSPF on a FortiGate, you must enter the OSPF configuration context, navigate to the 'redistribute' subcommand, select the 'static' route type, and set its status to 'enable'. This is the standard method for enabling route redistribution from one routing protocol (or static routes) into OSPF, as defined in the FortiGate CLI reference.

Exam trap

The trap here is that candidates often confuse redistribution configuration with route filtering or policy routing, mistakenly thinking a prefix-list (Option B) or policy-based routing (Option C) is needed, or they incorrectly assume static routes have a 'redistribute' knob (Option D) instead of configuring it under the OSPF process.

How to eliminate wrong answers

Option B is wrong because a prefix-list is used for filtering route advertisements (e.g., in route maps or distribute lists), not for enabling redistribution; it does not inject static routes into OSPF. Option C is wrong because 'config router policy' configures policy-based routing (PBR) to override the routing table for specific traffic, not OSPF redistribution. Option D is wrong because 'config router static' does not have a 'set redistribute ospf enable' command; redistribution is configured under the OSPF process, not under static routes.

Practice this question →
15
MCQmedium

An administrator wants to integrate a FortiExtender with a FortiGate to provide cellular WAN connectivity. Which configuration step is required on the FortiGate to use the FortiExtender as an SD-WAN member?

A.Enable BGP on the FortiExtender interface
B.Create a firewall policy allowing traffic from the FortiExtender
C.Add the FortiExtender's interface to the SD-WAN zone
D.Configure a static route pointing to the FortiExtender
AnswerC

The interface representing the FortiExtender must be added as an SD-WAN member.

Why this answer

To use a FortiExtender as an SD-WAN member, the FortiExtender's physical or logical interface must be added to the SD-WAN zone on the FortiGate. This allows the FortiGate to apply SD-WAN rules, load balancing, and SLA-based path selection to traffic traversing the cellular WAN link. Without this step, the interface remains a standard WAN interface and cannot participate in SD-WAN policies.

Exam trap

The trap here is that candidates often confuse the need for a firewall policy or static route with the SD-WAN membership requirement, but the FortiGate treats the FortiExtender interface as a local interface, so only adding it to the SD-WAN zone is necessary for SD-WAN participation.

How to eliminate wrong answers

Option A is wrong because BGP is not required on the FortiExtender interface for SD-WAN membership; SD-WAN operates at the interface level and does not mandate dynamic routing protocols. Option B is wrong because a firewall policy is needed for traffic to pass through the FortiExtender interface, but it is not a prerequisite for adding the interface to the SD-WAN zone; the SD-WAN membership is configured independently of firewall policies. Option D is wrong because a static route pointing to the FortiExtender is not required; the FortiExtender appears as a directly connected interface on the FortiGate, and SD-WAN uses the interface itself, not a next-hop route.

Practice this question →
16
MCQeasy

Which load balancing algorithm in SD-WAN distributes new sessions based on the source and destination IP addresses, ensuring that all sessions from a given source-destination pair go to the same member?

A.Lowest cost
B.Volume
C.Source-dest IP
D.Sessions
AnswerC

Hashes source and destination IP.

Why this answer

The Source-dest IP algorithm in Fortinet SD-WAN uses a hash of the source and destination IP addresses to determine the outbound member for each new session. This ensures that all sessions between the same source-destination pair are consistently forwarded to the same WAN member, preserving flow affinity without requiring session-based state tracking.

Exam trap

The trap here is that candidates often confuse 'Source-dest IP' with 'Sessions' because both involve distribution, but Sessions uses round-robin and does not guarantee source-destination affinity, while Source-dest IP uses a hash to ensure consistent member selection for the same pair.

How to eliminate wrong answers

Option A is wrong because Lowest cost selects the member with the lowest measured cost (e.g., latency or jitter) for each new session, which does not guarantee that sessions from the same source-destination pair go to the same member. Option B is wrong because Volume distributes sessions based on the current traffic volume on each member, aiming to balance load rather than enforce source-destination affinity. Option D is wrong because Sessions distributes sessions in a round-robin fashion across members, which can send sessions from the same source-destination pair to different members.

Practice this question →
17
MCQeasy

What is the purpose of BFD on a FortiGate?

A.To load balance traffic across multiple paths.
B.To provide fast detection of link failures.
C.To authenticate OSPF neighbors.
D.To encrypt traffic between two FortiGates.
AnswerB

BFD detects failures faster than routing protocol hello timers.

Why this answer

BFD (Bidirectional Forwarding Detection) provides sub-second failure detection for routing protocols like OSPF and BGP, independent of the routing protocol's own hello timers. On a FortiGate, BFD is used to rapidly detect link or neighbor failures, enabling faster convergence in SD-WAN and dynamic routing scenarios.

Exam trap

The trap here is that candidates confuse BFD's fast failure detection with load balancing or authentication functions, but BFD is strictly a liveness detection mechanism with no role in traffic distribution or security.

How to eliminate wrong answers

Option A is wrong because BFD does not perform load balancing; load balancing is handled by ECMP (Equal-Cost Multi-Path) or SD-WAN rules, not BFD. Option C is wrong because OSPF neighbor authentication is performed using MD5 or SHA authentication keys, not BFD; BFD only monitors link liveliness. Option D is wrong because traffic encryption between FortiGates is achieved via IPsec VPN tunnels, not BFD, which is a lightweight hello-based protocol with no encryption capabilities.

Practice this question →
18
MCQeasy

An administrator wants to load balance traffic across two WAN links by session count. Which SD-WAN load balancing algorithm should they use?

A.Sessions
B.Spillover
C.Lowest-cost
D.Volume
AnswerA

The sessions algorithm distributes sessions based on the number of active sessions per interface.

Why this answer

The Sessions algorithm distributes new sessions across WAN links based on the current session count, ensuring each link handles a roughly equal number of active sessions. This directly matches the administrator's requirement to load balance by session count, as it uses the session counter as the metric for link selection.

Exam trap

The trap here is that candidates often confuse 'session count' with 'volume' or 'spillover,' assuming that any load balancing algorithm that distributes traffic equally must use data volume or bandwidth thresholds, rather than recognizing that Sessions is the explicit algorithm for session-based distribution.

How to eliminate wrong answers

Option B is wrong because Spillover is not a load balancing algorithm; it is a traffic steering method that sends traffic to a primary link until its bandwidth threshold is exceeded, then spills over to backup links, which does not balance by session count. Option C is wrong because Lowest-cost selects the link with the lowest cost metric (e.g., latency, jitter, or loss) for each session, not based on session count. Option D is wrong because Volume balances traffic by the amount of data transferred (bytes) across links, not by the number of sessions.

Practice this question →
19
MCQmedium

An administrator wants to ensure that traffic from a specific source IP uses a particular SD-WAN member regardless of performance SLA results. Which SD-WAN configuration element should be used?

A.SD-WAN rule with manual strategy
B.Route map
C.Policy-based routing on the firewall policy
D.Performance SLA
AnswerA

SD-WAN rules can use manual strategy to force traffic to a specific member.

Why this answer

A is correct because an SD-WAN rule with a manual strategy allows the administrator to explicitly pin traffic from a specific source IP to a particular SD-WAN member interface, overriding any performance SLA-based path selection. This is achieved by configuring the rule's 'strategy' as 'manual' and specifying the preferred member, which forces all matching traffic to use that interface regardless of SLA health.

Exam trap

The trap here is that candidates confuse Performance SLA as a steering mechanism rather than a monitoring tool, or mistakenly think policy-based routing can achieve the same result within an SD-WAN context, but Fortinet's SD-WAN architecture requires the rule's strategy to be set to 'manual' for explicit member pinning.

How to eliminate wrong answers

Option B is wrong because route maps are used for route redistribution, filtering, or modifying routing attributes (e.g., metric, next-hop) in routing protocols like BGP or OSPF; they do not provide per-source-IP traffic steering within an SD-WAN zone. Option C is wrong because policy-based routing (PBR) on a firewall policy can direct traffic based on source IP, but it operates at the routing level and does not integrate with SD-WAN member selection or SLA awareness; it would bypass the SD-WAN logic entirely. Option D is wrong because a Performance SLA is a monitoring mechanism that measures link quality (e.g., latency, jitter, packet loss) and is used by SD-WAN rules with 'best quality' or 'load balancing' strategies, but it cannot force traffic to a specific member; it only provides data for dynamic path decisions.

Practice this question →
20
MCQeasy

Which feature allows a FortiGate to maintain separate routing tables for different customers or departments on the same device?

A.Route maps
B.VDOM
C.VRF (Virtual Routing and Forwarding)
D.Policy-based routing
AnswerC

VRF allows multiple independent routing table instances on the same FortiGate.

Why this answer

VRF (Virtual Routing and Forwarding) allows a FortiGate to maintain separate, isolated routing tables and forwarding instances for different customers or departments on the same physical device. Each VRF has its own routing table, forwarding table, and interfaces, ensuring traffic from one VRF never crosses into another without explicit route leaking. This is the correct feature for multi-tenant or multi-department routing isolation.

Exam trap

The trap here is that candidates often confuse VDOMs with VRFs, thinking VDOMs provide routing isolation, but VDOMs primarily isolate administrative domains and firewall policies, while VRFs specifically provide separate routing tables and forwarding instances.

How to eliminate wrong answers

Option A is wrong because route maps are used for route filtering and policy-based manipulation (e.g., BGP attribute modification), not for maintaining separate routing tables. Option B is wrong because VDOMs (Virtual Domains) provide separate administrative domains and firewall policies, but they do not inherently create separate routing tables; VDOMs can use VRFs for routing isolation, but VDOM alone is not the feature for separate routing tables. Option D is wrong because policy-based routing (PBR) allows traffic to be forwarded based on policies (e.g., source/destination), but it does not create separate routing tables; it overrides the routing table for specific traffic, not isolate routing instances.

Practice this question →
21
MCQmedium

A FortiGate has multiple VRFs configured. An administrator wants to allow traffic from VRF 1 to reach a server in VRF 2. What configuration is required?

A.Use a single VDOM and enable inter-VDOM links.
B.Place both interfaces in the same VRF.
C.Create a static route from one VRF to another.
D.Configure a VRF leak policy using route maps or policy routes.
AnswerD

VRF leaking can be achieved by using route maps with the 'set vrf' command or by using policy routes to forward traffic between VRFs.

Why this answer

VRF leaking is the standard method to allow traffic between different VRFs on a FortiGate. This is achieved by configuring route maps or policy routes to selectively import/export routes between VRFs, enabling inter-VRF communication without merging the VRFs or using VDOMs.

Exam trap

The trap here is that candidates confuse VRF leaking with inter-VDOM routing or assume a simple static route can bridge VRFs, but FortiGate enforces strict VRF isolation unless an explicit leak policy is configured.

How to eliminate wrong answers

Option A is wrong because inter-VDOM links are used for communication between different VDOMs, not between VRFs within the same VDOM; VRFs are a routing table segmentation feature within a single VDOM. Option B is wrong because placing both interfaces in the same VRF would defeat the purpose of VRF segmentation, merging the routing tables and removing isolation. Option C is wrong because a static route alone cannot leak traffic between VRFs; FortiGate requires explicit VRF leak configuration (e.g., route maps or policy routes) to allow inter-VRF forwarding, as static routes are VRF-scoped by default.

Practice this question →
22
MCQmedium

An administrator runs 'diagnose sys session filter dport 443' and sees: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate about the session?

A.The session is a multicast session with a duration of 3600 seconds.
B.The session is a TCP session in established state that has been up for 3600 seconds and will expire in 3599 seconds.
C.The session is in SYN_SENT state and has timed out after 3600 seconds.
D.The session is a UDP session that has been active for 3600 seconds.
AnswerB

proto=6 means TCP, proto_state=01 typically indicates established state. Duration is the time since session creation, expire is the remaining time before the session is removed if idle.

Why this answer

The output shows proto=6, which is TCP, and proto_state=01, which indicates the TCP session is in an established state (TCP_ESTABLISHED). The duration=3600 means the session has been active for 3600 seconds, and expire=3599 means it will expire in 3599 seconds (i.e., the idle timeout is counting down). This is a standard TCP session in the established state, not a multicast or UDP session.

Exam trap

The trap here is that candidates confuse proto_state=01 with a SYN_SENT or timed-out state, or misinterpret proto=6 as UDP, because they do not memorize the TCP state codes or protocol numbers used in FortiOS session diagnostics.

How to eliminate wrong answers

Option A is wrong because proto=6 is TCP, not multicast; multicast sessions use UDP (proto=17) and have different state codes. Option C is wrong because proto_state=01 represents TCP_ESTABLISHED, not SYN_SENT (which would be state 02); also, the session has not timed out—it is still active with an expiry counter. Option D is wrong because proto=6 is TCP, not UDP (UDP uses proto=17), and UDP sessions do not have a TCP state machine.

Practice this question →
23
MCQmedium

A FortiGate has multiple equal-cost routes to the same destination via two different interfaces. ECMP load balancing is enabled. What determines how traffic is distributed among the routes?

A.The interface speed
B.A hash of source and destination IP addresses
C.Round-robin per packet
D.The route metric
AnswerB

Default ECMP uses source-dest-ip hashing.

Why this answer

When ECMP load balancing is enabled on a FortiGate, traffic distribution among equal-cost routes is determined by a hash algorithm that uses source and destination IP addresses (and optionally ports) to select the egress interface. This ensures that all packets belonging to the same flow are consistently forwarded via the same path, preserving packet order and avoiding reordering issues.

Exam trap

The trap here is that candidates often assume ECMP uses round-robin or interface speed weighting, but FortiGate strictly uses a hash-based algorithm to maintain flow affinity and avoid packet reordering.

How to eliminate wrong answers

Option A is wrong because interface speed does not influence ECMP load balancing; FortiGate uses a hash-based selection, not a weighted distribution based on link speed. Option C is wrong because FortiGate does not use per-packet round-robin for ECMP; such a method would cause severe packet reordering and is not implemented in FortiGate's ECMP logic. Option D is wrong because the route metric is identical for all equal-cost routes by definition; ECMP only applies when metrics are equal, so metric does not determine distribution.

Practice this question →
24
MCQmedium

A network administrator configures an SD-WAN zone with two members (port1 and port2) and sets the load balancing algorithm to 'spillover'. The spillover threshold is set to 100 Mbps on port1. If traffic reaches 120 Mbps on port1, what happens to new sessions?

A.All traffic is dropped because the threshold exceeded
B.New sessions are sent to port2 until port1 drops below the threshold
C.Port1 continues to receive all new sessions but packets are queued
D.New sessions are distributed equally between port1 and port2
AnswerB

Correct spillover behavior.

Why this answer

When the spillover algorithm is configured with a threshold of 100 Mbps on port1 and traffic reaches 120 Mbps, port1 is considered saturated. The SD-WAN zone then directs all new sessions to port2 until the traffic on port1 drops below the threshold. This is the defined behavior of spillover load balancing in Fortinet SD-WAN, where traffic is shifted away from an overloaded member to maintain performance.

Exam trap

The trap here is that candidates often confuse spillover with load balancing algorithms like 'lowest latency' or 'round-robin', incorrectly assuming that traffic is dropped, queued, or evenly distributed when the threshold is exceeded, rather than understanding that spillover is a failover-like mechanism that shifts new sessions to the next available member.

How to eliminate wrong answers

Option A is wrong because spillover does not drop traffic; it redirects new sessions to another member when the threshold is exceeded. Option C is wrong because spillover does not queue packets on the overloaded port; it actively moves new sessions to an alternate member. Option D is wrong because spillover does not distribute sessions equally; it sends all new sessions to the underutilized member (port2) until the primary member's load drops below the threshold.

Practice this question →
25
Multi-Selecthard

A FortiGate is configured with multiple VRFs. An administrator notices that routes from VRF A are not being advertised to VRF B via BGP, even though the BGP configuration is correct. Which TWO actions could resolve this issue?

Select 2 answers
A.Enable 'route-flap damping' on the BGP session between VRFs
B.Configure a route leak from VRF A to VRF B under config router vrf
C.Disable 'bgp enforce-first-as' to allow cross-VRF advertisements
D.Configure 'set import-route' under the BGP VRF configuration
E.Use 'set next-hop-self' on the BGP neighbor in each VRF
AnswersB, E

Why this answer

Configuring a route leak from VRF A to VRF B under 'config router vrf' explicitly allows routes to be imported/exported between VRFs using route targets, which is required for cross-VRF BGP route advertisement. Option E is correct because 'set next-hop-self' on the BGP neighbor in each VRF ensures that the next hop is reachable from the receiving VRF, preventing next-hop unreachability issues that can block route advertisement.

Exam trap

The trap here is that candidates often confuse BGP session-level settings (like enforce-first-as or damping) with VRF route leaking mechanisms, assuming any BGP tweak can fix cross-VRF issues, when in fact explicit VRF export/import configuration is required.

Practice this question →
26
MCQmedium

An administrator wants to segment traffic between two departments (Engineering and Finance) using the same FortiGate. Each department must have its own routing table with overlapping IP addresses. Which feature should be enabled to achieve this without creating separate VDOMs?

A.VRF
B.Policy-based routing
C.Virtual IP (VIP)
D.Multiple VDOMs
AnswerA

VRF provides separate routing tables within a VDOM, allowing overlapping IP addresses.

Why this answer

VRF (Virtual Routing and Forwarding) allows a single FortiGate to maintain multiple independent routing tables, enabling overlapping IP address spaces for different departments without requiring separate VDOMs. Each VRF instance isolates routing decisions, forwarding tables, and interfaces, meeting the segmentation requirement while preserving a unified management plane.

Exam trap

The trap here is that candidates confuse VRF with VDOMs, assuming that only VDOMs can provide routing isolation, but VRF achieves the same within a single VDOM without the overhead of separate management domains.

How to eliminate wrong answers

Option B is wrong because policy-based routing (PBR) only influences traffic path selection based on policies (e.g., source/destination), but does not create separate routing tables or support overlapping IP addresses; all routes still reside in the global routing table. Option C is wrong because Virtual IP (VIP) is a destination NAT feature used to map public IPs to private IPs, not a mechanism for routing table isolation or overlapping address spaces. Option D is wrong because multiple VDOMs would achieve the goal but the question explicitly asks for a solution without creating separate VDOMs; VRF provides the same isolation within a single VDOM.

Practice this question →
27
MCQmedium

An administrator wants to use BFD to detect failures in an OSPF neighbor relationship faster than OSPF hello timers. They configure 'config router ospf' and 'set bfd enable'. However, BFD sessions are not coming up. What is a possible reason?

A.The interface has 'set bfd enable' missing under config system interface
B.OSPF is configured with 'network point-to-multipoint'
C.The neighbor does not have BFD enabled on its OSPF configuration
D.The FortiGate's BFD transmit interval is set too high
AnswerA

Correct. The interface-level BFD enablement is required for BFD sessions to form over OSPF, and it is a common omission.

Why this answer

On FortiGate, enabling BFD under the OSPF process alone does not activate BFD on the interface. The interface itself must also have 'set bfd enable' under 'config system interface' to allow BFD session establishment. Option C is incorrect because while BFD generally requires both ends to enable it, the question specifically asks for a reason on the local FortiGate's configuration; the neighbor's configuration is outside the administrator's control for this scenario, and the most common oversight is the interface-level setting.

Exam trap

The trap here is that candidates assume enabling BFD under the OSPF process alone is sufficient, overlooking the separate interface-level BFD configuration required on FortiGate, unlike some other vendors where a single command enables BFD across all OSPF interfaces.

How to eliminate wrong answers

Option B is wrong because OSPF network type 'point-to-multipoint' does not inherently prevent BFD sessions; BFD can operate over point-to-multipoint links as long as the interface has BFD enabled. Option C is wrong because the question asks for a reason why BFD sessions are not coming up on the local FortiGate; while BFD requires both sides to be enabled, the local configuration is the focus, and the neighbor not having BFD enabled would cause sessions to fail, but the question implies the local side is misconfigured. Option D is wrong because setting the BFD transmit interval too high would only affect detection speed, not prevent BFD sessions from coming up entirely.

Practice this question →
28
MCQeasy

An administrator wants to ensure that voice traffic (UDP 16384-32768) always uses the MPLS link, while internet-bound traffic uses broadband. Which SD-WAN feature should be configured to achieve this?

A.Performance SLA
B.SD-WAN member configuration
C.Load balancing algorithm
D.SD-WAN rule
AnswerD

SD-WAN rules control traffic steering based on criteria.

Why this answer

SD-WAN rules (option D) allow administrators to define policy-based forwarding by matching specific traffic characteristics—such as UDP ports 16384-32768 for voice—and steering that traffic to a preferred interface or link (e.g., the MPLS link). This is the correct feature because it directly controls traffic steering based on application or service, overriding any default load-balancing or failover behavior.

Exam trap

The trap here is that candidates confuse Performance SLA (which monitors and reacts to link quality) with the policy engine that actually decides which traffic goes where, leading them to select option A instead of the correct SD-WAN rule.

How to eliminate wrong answers

Option A is wrong because Performance SLA measures link quality (latency, jitter, packet loss) and triggers link failover or path selection changes, but it does not define which traffic uses which link; it only reacts to link degradation. Option B is wrong because SD-WAN member configuration defines the physical or logical interfaces participating in the SD-WAN zone and their roles (e.g., gateway, cost), but it does not contain the policy logic to steer specific UDP port ranges to a particular link. Option C is wrong because the load balancing algorithm (e.g., source-destination-IP hash, volume-based) distributes traffic across multiple links based on a mathematical formula, not on application-level criteria like UDP port ranges; it cannot guarantee voice traffic always uses the MPLS link.

Practice this question →
29
MCQeasy

A FortiGate administrator wants to use BFD to quickly detect link failures in an SD-WAN deployment. Which statement about BFD configuration on FortiGate is correct?

A.BFD is enabled by default on all FortiGate interfaces
B.BFD can be configured under the interface or routing protocol to detect forwarding path failures
C.BFD sessions are established automatically when OSPF neighbors form
D.BFD uses performance SLA probes to determine link health
AnswerB

Why this answer

BFD (Bidirectional Forwarding Detection) on FortiGate can be configured either directly on an interface or under a dynamic routing protocol (such as OSPF or BGP). When configured under the interface, BFD monitors the forwarding path to that specific neighbor; when configured under the routing protocol, it provides sub-second failure detection for routes learned via that protocol. This flexibility allows the administrator to tailor BFD to the SD-WAN deployment's needs, ensuring rapid link failure detection without relying on routing protocol timers.

Exam trap

The trap here is that candidates often confuse BFD with performance SLA probes or assume BFD is automatically enabled with routing protocols, but FortiGate requires explicit BFD configuration and BFD does not measure link quality metrics like jitter or packet loss.

How to eliminate wrong answers

Option A is wrong because BFD is not enabled by default on any FortiGate interface; it must be explicitly enabled per interface or per routing protocol. Option C is wrong because BFD sessions are not automatically established when OSPF neighbors form; BFD must be explicitly enabled under the OSPF configuration (e.g., 'set bfd enable' under the OSPF interface or process) for the sessions to be created. Option D is wrong because BFD does not use performance SLA probes; BFD uses its own lightweight hello and echo packets to detect failures, while performance SLA probes are used by SD-WAN rules for link quality measurement (jitter, latency, packet loss).

Practice this question →
30
MCQmedium

A FortiGate is configured with SD-WAN and uses performance SLA to monitor link quality. The administrator sets the SLA threshold to jitter < 30ms. If a link has average jitter of 35ms, what is the status of that link in the SD-WAN health check?

A.Dead
B.Unavailable
C.Degraded
D.Alive
AnswerC

Degraded means the link does not meet one or more SLA thresholds.

Why this answer

In FortiGate SD-WAN, when a link's measured jitter exceeds the configured Performance SLA threshold (30ms) but does not fail the SLA entirely, the link is marked as 'Degraded'. The SLA threshold defines the acceptable quality; exceeding it means the link is still alive but not meeting the desired performance, hence degraded.

Exam trap

The trap here is that candidates often confuse 'Degraded' with 'Dead' or 'Unavailable', not realizing that exceeding a threshold (like jitter > 30ms) only degrades the link, while complete probe failure is required for a 'Dead' status.

How to eliminate wrong answers

Option A is wrong because 'Dead' indicates a complete link failure (e.g., no response to probes), not a jitter value above the threshold. Option B is wrong because 'Unavailable' is not a standard SD-WAN health status in FortiGate; the correct terms are Alive, Dead, and Degraded. Option D is wrong because 'Alive' means the link meets all SLA thresholds, which is not the case when jitter is 35ms against a 30ms threshold.

Practice this question →
31
MCQeasy

A company has two internet connections: a primary fiber link (port1, 100 Mbps) and a backup DSL link (port2, 20 Mbps). They are using SD-WAN to load balance traffic based on volume, with a rule that sends 70% of traffic to port1 and 30% to port2. Recently, users report that video conferencing applications are experiencing high latency and jitter. The network team finds that the SD-WAN performance SLA for the fiber link shows 80% packet loss and high latency. The SD-WAN rule action is set to 'best quality' with a latency threshold of 150 ms. The current latency on port1 is 200 ms, and on port2 is 40 ms. What should the administrator do to ensure that video conferencing traffic uses the DSL link while the fiber link is degraded?

A.Increase the SLA latency threshold to 250 ms so that the fiber link is considered acceptable.
B.Change the SD-WAN rule action to 'lowest cost' to favor the DSL link.
C.Adjust the volume ratio to send 100% of traffic to port2 until the fiber link recovers.
D.No changes are needed; the SD-WAN rule with 'best quality' will automatically use port2 for new sessions because port1 does not meet the SLA.
AnswerD

Correct. With 'best quality' action, if a member fails SLA, new sessions will be directed to the best performing member.

Why this answer

The SD-WAN rule action is set to 'best quality', which means the FortiGate will automatically steer new sessions away from any interface that fails the performance SLA. Since port1 has 80% packet loss and 200 ms latency (exceeding the 150 ms threshold), it is considered degraded, and new video conferencing traffic will be directed to port2 (40 ms latency) without manual intervention.

Exam trap

The trap here is that candidates often assume manual configuration (like changing thresholds or ratios) is required to fix a degraded link, when in fact the 'best quality' action with performance SLA already provides automatic failover to the best-performing link.

How to eliminate wrong answers

Option A is wrong because increasing the SLA latency threshold to 250 ms would make the degraded fiber link appear acceptable, causing traffic to continue using the high-latency, high-packet-loss link and defeating the purpose of SLA monitoring. Option B is wrong because changing the rule action to 'lowest cost' would select the link based on cost metrics (e.g., bandwidth cost), not performance, and the DSL link might not be the lowest cost; even if it were, this action does not consider SLA compliance for latency and jitter. Option C is wrong because manually adjusting the volume ratio to 100% on port2 is a static workaround that bypasses the dynamic SLA-based steering, which is less efficient and not necessary when the 'best quality' action already handles failover automatically.

Practice this question →
32
MCQeasy

A FortiGate is configured with two ISPs in an SD-WAN. The administrator wants to use the link with the highest bandwidth for bulk downloads, but if that link fails, all traffic should automatically use the backup link. Which load balancing algorithm should be used?

A.Sessions
B.Volume
C.Spillover
D.Source-destination IP
AnswerC

Spillover uses a configured bandwidth threshold; traffic is sent to the primary link until it reaches the threshold, then spills over to the backup. If the primary fails, all traffic goes to backup.

Why this answer

The Spillover algorithm is designed to use a preferred link until its bandwidth capacity is reached, then 'spill over' traffic to a backup link. In this scenario, the administrator wants to use the highest-bandwidth link for bulk downloads and fail over to the backup link only when the primary link fails. Spillover matches this requirement because it can be configured with a bandwidth threshold; once the primary link's bandwidth is exhausted or the link fails, traffic automatically shifts to the backup link.

Exam trap

The trap here is that candidates often confuse 'Spillover' with 'Volume' or 'Sessions' because they think bandwidth-based algorithms automatically handle failover, but only Spillover explicitly supports a threshold-based failover to a backup link when the primary link fails or is overloaded.

How to eliminate wrong answers

Option A is wrong because the Sessions algorithm distributes traffic based on the number of sessions per link, not bandwidth utilization or link failure, so it would not prioritize the highest-bandwidth link for bulk downloads. Option B is wrong because the Volume algorithm balances traffic based on the volume of data transferred per link, but it does not provide a failover mechanism; it continues to use both links even if one fails, which does not meet the requirement for automatic backup. Option D is wrong because the Source-destination IP algorithm uses a hash of source and destination IP addresses to select a link, which is deterministic and does not consider bandwidth or link failure, so it cannot ensure that bulk downloads use the highest-bandwidth link or fail over to a backup.

Practice this question →
33
Multi-Selecthard

A FortiGate is in a multi-area OSPF environment. The administrator needs to redistribute connected routes from area 1 into OSPF. Which THREE steps are required? (Choose three.)

Select 3 answers
A.Configure the connected interfaces as OSPF passive interfaces.
B.Configure 'redistribute connected' under the OSPF configuration.
C.Create a route map to filter which connected routes are redistributed.
D.Set the 'redistribute connected' metric and metric-type.
E.Enable 'default-information originate' to advertise a default route.
AnswersB, C, D

Redistribution of connected routes must be enabled in the OSPF process.

Why this answer

The 'redistribute connected' command under OSPF configuration is the fundamental step to inject connected routes into the OSPF domain. Without this command, OSPF will not advertise any connected routes that are not already part of an OSPF-enabled interface.

Exam trap

The trap here is that candidates often confuse 'redistribute connected' with simply enabling OSPF on an interface or using passive interfaces, forgetting that redistribution is a separate process requiring explicit configuration and optional tuning with route maps and metric settings.

Practice this question →
34
MCQmedium

A FortiGate has two equal-cost paths to a destination network through two different ISPs. The administrator wants to load balance traffic across both links using ECMP, but notices that all traffic uses only one link. What should the administrator check first?

A.Check that both routes have the same administrative distance and priority
B.Configure 'set v4-ecmp-mode' to 'source-ip-based'
C.Verify that 'set load-balance-eligible' is enabled on both WAN interfaces
D.Disable 'anti-replay' on the security policy
AnswerA

ECMP requires equal cost; if distances differ, the lower distance route is preferred.

Why this answer

ECMP requires that all candidate routes have identical administrative distance and priority values. If either differs, FortiGate will select only the route with the lower distance/priority, breaking load balancing. The administrator should verify these parameters first because they directly control route selection before ECMP is applied.

Exam trap

The trap here is that candidates often jump to configuring ECMP hashing modes or interface settings, overlooking the fundamental requirement that routes must be truly equal in administrative distance and priority before ECMP can function.

How to eliminate wrong answers

Option B is wrong because 'set v4-ecmp-mode' controls the hashing algorithm (e.g., source-ip-based, weighted) for distributing traffic across ECMP paths, but it does not fix the root cause of routes not being considered equal. Option C is wrong because 'load-balance-eligible' is a per-interface setting for SD-WAN rules, not for standard ECMP routing; ECMP eligibility is determined by route attributes, not this interface flag. Option D is wrong because disabling anti-replay on the security policy affects session state tracking and asymmetric traffic handling, not the selection of ECMP paths.

Practice this question →
35
Multi-Selecthard

A FortiGate is configured with OSPF in a multi-area design. An administrator needs to redistribute static routes from another router into OSPF on the FortiGate, but only for prefixes that match a route map. The administrator has configured 'config router ospf' with 'redistribute static route-map RM_STATIC'. However, the static routes are not appearing in the OSPF database. Which THREE troubleshooting steps should the administrator take?

Select 3 answers
A.Verify that OSPF is enabled on at least one interface (config router ospf -> network)
B.Verify that the route map 'RM_STATIC' exists and has appropriate match and set statements
C.Check if a prefix-list is applied that filters the redistributed routes
D.Run 'get router info ospf route' to see the redistributed routes in the routing table
E.Confirm that 'redistribute' is configured under the OSPF process, not just under the router
AnswersB, D, E

If the route map doesn't exist or lacks match conditions, redistribution fails.

Why this answer

If the route map 'RM_STATIC' does not exist or lacks proper match/set statements, OSPF will not redistribute any static routes. The 'redistribute static route-map RM_STATIC' command requires a valid route map to filter prefixes; without it, redistribution silently fails.

Exam trap

The trap here is that candidates assume 'redistribute static' alone works without a route map, or they confuse OSPF database verification commands (like 'get router info ospf route') with routing table commands, leading them to miss the need for a valid route map and proper command placement.

Practice this question →
36
MCQhard

A FortiGate is configured with an SD-WAN rule using 'spillover' algorithm. The primary member has a spillover threshold of 100 Mbps. Traffic of 80 Mbps is currently flowing through the primary member. A new session requiring 30 Mbps arrives. What will happen?

A.The new session is sent to the primary member because the current load is below the threshold.
B.The new session is sent to the secondary member because the primary threshold would be exceeded.
C.The new session is dropped because no member can handle it.
D.The primary member's threshold is dynamically increased.
AnswerB

Spillover sends the session to the next available member when adding it would exceed the threshold.

Why this answer

The SD-WAN 'spillover' algorithm forwards traffic to the primary member until its load reaches the configured threshold (100 Mbps). With 80 Mbps already flowing, adding a new 30 Mbps session would push the total to 110 Mbps, exceeding the threshold. Therefore, the new session is sent to the secondary member to avoid oversubscription, as per the spillover logic.

Exam trap

The trap here is that candidates often assume the algorithm checks if the *new session alone* exceeds the threshold, rather than evaluating the *cumulative load* after adding the new session, leading them to incorrectly select option A.

How to eliminate wrong answers

Option A is wrong because the current load of 80 Mbps plus the new 30 Mbps session would exceed the 100 Mbps spillover threshold, so the session cannot be sent to the primary member. Option C is wrong because the secondary member is available and can handle the traffic; the session is not dropped. Option D is wrong because the spillover threshold is a static configured value and is not dynamically adjusted by the FortiGate based on traffic load.

Practice this question →
37
Multi-Selectmedium

An administrator wants to deploy FortiSwitch and FortiAP using LAN edge management from a FortiGate. Which TWO conditions must be met? (Choose two.)

Select 2 answers
A.The FortiSwitch and FortiAP must be factory reset before connecting.
B.The FortiGate must be configured with the FortiLink interface for FortiSwitch and a CAPWAP interface for FortiAP.
C.The FortiSwitch and FortiAP must be in the same broadcast domain as the FortiGate management interface.
D.The FortiGate must have a valid FortiCare contract for unified management.
E.The FortiGate must have the 'set allowaccess' command enabled for HTTPS or SSH on the managing interface.
AnswersB, C

FortiSwitch uses FortiLink (a dedicated interface or VLAN), and FortiAP uses a CAPWAP interface for management.

Why this answer

FortiGate uses a dedicated FortiLink interface (typically a hardware switch or aggregate interface) to manage FortiSwitch devices via L2 protocols, and a CAPWAP interface (a loopback or IP interface) to terminate CAPWAP tunnels from FortiAPs. These are the required interface types for LAN edge management, as specified in the FortiOS LAN edge deployment guide.

Exam trap

The trap here is that candidates often confuse the requirement for a FortiCare contract (which is for cloud services) with the basic LAN edge management feature, or they mistakenly think a factory reset is mandatory when in fact the FortiGate can adopt devices with existing configurations as long as they are in the same broadcast domain.

Practice this question →
38
MCQeasy

A FortiGate administrator wants to enable load balancing for equal-cost paths to the same destination. The FortiGate has two equal-cost routes via two different next-hop routers. Which feature should the admin enable to load balance traffic across both paths?

A.BFD (Bidirectional Forwarding Detection)
B.ECMP (Equal Cost Multi-Path)
C.Policy-based routing
D.SD-WAN load balancing
AnswerB

ECMP distributes traffic across multiple routes with the same metric and administrative distance.

Why this answer

ECMP (Equal Cost Multi-Path) is the correct feature because it enables a FortiGate to distribute traffic across multiple equal-cost routes to the same destination. When the routing table contains two or more routes with identical administrative distance and metric, ECMP automatically load-balances sessions across those paths using a hash-based algorithm (e.g., source-destination IP hash), without requiring additional configuration beyond enabling the feature globally or per-VDOM.

Exam trap

The trap here is that candidates confuse SD-WAN load balancing with ECMP, but SD-WAN is a separate overlay technology that requires SD-WAN zones and performance SLA rules, whereas ECMP is a simple, direct routing-table feature for equal-cost paths without any overlay or application-awareness.

How to eliminate wrong answers

Option A is wrong because BFD (Bidirectional Forwarding Detection) is a fast failure detection protocol that monitors link or neighbor liveness, not a load-balancing mechanism; it can be used with ECMP to quickly remove dead paths but does not distribute traffic. Option C is wrong because policy-based routing (PBR) overrides the routing table with user-defined policies to steer traffic based on attributes like source IP or port, but it does not automatically load-balance across equal-cost paths; it is a manual, rule-based approach that can disrupt ECMP behavior. Option D is wrong because SD-WAN load balancing is a higher-level feature that uses performance SLA rules and application steering to distribute traffic across WAN links, but it is not designed for simple equal-cost path load balancing within a single routing domain; ECMP is the native, lightweight solution for this scenario.

Practice this question →
39
MCQeasy

An administrator wants to integrate a FortiExtender with a FortiGate to provide WAN connectivity. Which interface type is used on the FortiGate to connect to the FortiExtender?

A.wan
B.lan
C.dmz
D.loopback
AnswerA

The FortiExtender connects to a WAN interface, and FortiGate creates a wwan interface.

Why this answer

The FortiGate uses a dedicated 'wan' interface type to connect to a FortiExtender, as this interface is specifically designed to manage the cellular or broadband WAN link provided by the extender. The FortiExtender appears as a WAN-facing device, and the 'wan' interface type allows the FortiGate to apply SD-WAN rules, load balancing, and failover policies directly to that connection.

Exam trap

The trap here is that candidates may confuse the 'wan' interface type with a generic physical port (like port1 or port2) and assume any interface can be used, but FortiGate specifically requires the 'wan' interface type to enable FortiExtender integration and its associated management features.

How to eliminate wrong answers

Option B (lan) is wrong because the 'lan' interface type is used for internal network segments, not for connecting to an external WAN device like a FortiExtender. Option C (dmz) is wrong because the 'dmz' interface type is intended for demilitarized zone networks hosting public-facing services, not for WAN uplink management. Option D (loopback) is wrong because a 'loopback' interface is a virtual interface used for management or routing protocol peering, not for physical connectivity to a FortiExtender.

Practice this question →
40
MCQmedium

A FortiGate with SD-WAN configured has a Performance SLA monitoring Google DNS (8.8.8.8). The SLA is configured with latency threshold 100 ms and jitter threshold 20 ms. The link is currently meeting both thresholds. The administrator wants to ensure that if the SLA fails, traffic moves to another link. Which SD-WAN rule strategy should be used?

A.Best quality
B.Manual selection
C.Maximize bandwidth (SLA)
D.Failover (SLA)
AnswerD

Failover strategy uses the first member that meets SLA; if that fails, it moves to the next member in the list.

Why this answer

The Failover (SLA) strategy is correct because it ensures that traffic is moved to another link only when the Performance SLA fails, while the primary link is used as long as it meets the configured latency (100 ms) and jitter (20 ms) thresholds. This strategy provides deterministic failover behavior, matching the administrator's requirement to switch traffic only upon SLA failure.

Exam trap

The trap here is that candidates often confuse 'Failover (SLA)' with 'Best quality', thinking that any SLA degradation should trigger a switch, but Best quality would switch even if thresholds are still met, while Failover (SLA) only switches upon threshold violation.

How to eliminate wrong answers

Option A (Best quality) is wrong because it continuously selects the link with the best SLA metrics (lowest latency/jitter), not just failing over when thresholds are exceeded, which can cause unnecessary link switching even when the primary link is still meeting thresholds. Option B (Manual selection) is wrong because it requires explicit administrator intervention to change the active link and does not automatically failover based on SLA conditions. Option C (Maximize bandwidth (SLA)) is wrong because it load-balances traffic across multiple links based on SLA health, rather than providing a primary/backup failover behavior when the SLA fails.

Practice this question →
41
MCQmedium

An administrator configures a performance SLA for SD-WAN health checks. The SLA uses a ping probe to 8.8.8.8 every 2 seconds with a latency threshold of 150 ms and jitter threshold of 20 ms. After some time, the SD-WAN rule still shows the member as 'dead'. Which command should the administrator use to verify the probe results?

A.show system sdwan health-check
B.diagnose sys sdwan health-check
C.diagnose sys session list
D.execute ping-options source 8.8.8.8
AnswerB

This command displays real-time health check statistics.

Why this answer

The 'diagnose sys sdwan health-check' command is the correct tool because it provides real-time, detailed probe results for each SD-WAN health-check member, including latency, jitter, packet loss, and SLA status. This allows the administrator to see exactly why the member is marked as 'dead', such as exceeding the 150 ms latency or 20 ms jitter thresholds. The 'show system sdwan health-check' command only displays configured parameters, not live probe data.

Exam trap

The trap here is that candidates confuse the configuration display command ('show system sdwan health-check') with the diagnostic command ('diagnose sys sdwan health-check'), assuming the former shows live results when it only shows static configuration.

How to eliminate wrong answers

Option A is wrong because 'show system sdwan health-check' displays only the configured SLA parameters (e.g., probe target, thresholds) and not the actual live probe results or current member status. Option C is wrong because 'diagnose sys session list' shows active session entries in the session table, which is unrelated to SD-WAN health-check probe results or SLA compliance. Option D is wrong because 'execute ping-options source 8.8.8.8' sets the source IP for ping commands but does not verify SD-WAN health-check probe results; it is a configuration command, not a diagnostic one.

Practice this question →
42
MCQeasy

What is the purpose of a route map when used with route redistribution on a FortiGate?

A.To create a prefix list for BGP
B.To define the administrative distance of redistributed routes
C.To enable the redistribution process
D.To filter or modify route attributes during redistribution
AnswerD

Route maps allow granular control over which routes are redistributed and how.

Why this answer

Route maps are used with route redistribution to filter which routes are redistributed and to modify route attributes (such as metric, tag, or next-hop) as they are injected from one routing protocol into another. Option D is correct because route maps provide granular control over the redistribution process, allowing administrators to match specific routes using prefix lists or ACLs and then set attributes like metric or tag before the routes are redistributed.

Exam trap

The trap here is that candidates often confuse the route map's role as a filter or modifier with the enabling of redistribution itself, thinking the route map is required to start redistribution, when in fact redistribution is enabled by the 'redistribute' command and the route map is an optional parameter.

How to eliminate wrong answers

Option A is wrong because a prefix list is a separate tool used to match IP prefixes, not a route map; route maps can reference prefix lists, but the route map itself is not a prefix list. Option B is wrong because administrative distance is a property of the routing protocol or static route, not something set by a route map during redistribution; route maps can set metric, tag, or next-hop, but not administrative distance. Option C is wrong because the redistribution process is enabled by the 'redistribute' command under the routing protocol configuration, not by a route map; the route map is an optional filter applied to that redistribution.

Practice this question →
43
MCQmedium

A network administrator is configuring SD-WAN on a FortiGate. They have multiple WAN links and want to ensure that traffic for a critical application uses the link with the lowest latency. Which SD-WAN configuration component should be used to achieve this?

A.Performance SLA with latency threshold and SD-WAN rule using best-quality strategy
B.SD-WAN rule with spillover load balancing
C.SD-WAN members with static priority
D.Load balancing algorithm set to lowest-cost (SLA)
AnswerA

Performance SLA measures latency, and a best-quality rule selects the link with lowest latency within the threshold.

Why this answer

The Performance SLA monitors latency (and other metrics) against a configured threshold, and the SD-WAN rule with the 'best-quality' strategy dynamically selects the WAN link that currently has the lowest latency. This ensures the critical application traffic is steered to the optimal link based on real-time performance measurements.

Exam trap

The trap here is that candidates confuse 'static priority' (which is a fixed preference) with dynamic SLA-based selection, or they incorrectly assume 'spillover' or 'lowest-cost' algorithms can react to latency changes in real time.

How to eliminate wrong answers

Option B is wrong because spillover load balancing uses bandwidth utilization thresholds to shift traffic, not latency, so it cannot ensure the lowest-latency link is selected. Option C is wrong because static priority assigns fixed preference to links regardless of current performance; if the highest-priority link has high latency, traffic will still use it. Option D is wrong because 'lowest-cost (SLA)' is not a valid load balancing algorithm in FortiOS; the correct term for SLA-based selection is 'best-quality' or 'SLA' strategy, and 'lowest-cost' typically refers to routing protocol metrics, not SD-WAN link quality.

Practice this question →
44
MCQeasy

A FortiGate is configured with ECMP load balancing. What is the default behavior when multiple routes have equal cost?

A.The route with the lowest metric is always preferred
B.The administrator must enable per-packet load balancing
C.Traffic is load balanced across the routes using a hash algorithm
D.All traffic is sent over the first route until it fails
AnswerC

ECMP uses source-destination hashing to distribute sessions.

Why this answer

When ECMP load balancing is configured on a FortiGate, the default behavior is to distribute traffic across multiple equal-cost routes using a hash algorithm. This hash algorithm considers fields such as source/destination IP, protocol, and ports to ensure session consistency, meaning all packets belonging to the same session follow the same path. This is the standard ECMP behavior in FortiOS, as documented in the FortiGate Administration Guide.

Exam trap

The trap here is that candidates often confuse ECMP with per-packet load balancing or assume that FortiGate defaults to a failover model, but the NSE7 exam expects you to know that ECMP uses a hash algorithm for per-session load balancing by default, not per-packet or primary-backup.

How to eliminate wrong answers

Option A is wrong because in ECMP, all routes have equal cost (metric), so no single route is preferred based on metric; the FortiGate uses a hash algorithm instead. Option B is wrong because per-packet load balancing is not the default and must be explicitly enabled via CLI (e.g., 'set load-balance-mode per-packet'), and even then it is rarely used due to packet reordering issues; the default is per-session load balancing using a hash. Option D is wrong because that describes a failover or primary/backup routing behavior, not ECMP; FortiGate does not send all traffic over the first route until failure unless 'set priority' or 'set weight' is used to create unequal costs.

Practice this question →
45
Multi-Selectmedium

An administrator is configuring SD-WAN rules to steer traffic based on application performance. The requirement is to use VoIP traffic over the WAN link that has the lowest latency, but if latency exceeds 100ms, fail over to a backup link. The administrator has already created performance SLAs for both links. Which THREE configuration steps are required?

Select 3 answers
A.Set the 'failover-threshold' on each SD-WAN member to 100
B.Configure the SLA metric to 'latency' in the performance SLA
C.Create an SD-WAN rule for VoIP traffic and set the load balancing method to 'best quality'
D.Add both WAN interfaces to the rule as members and set weight based on latency
E.In the SD-WAN rule, set the 'sla-constraint' to 'sla' and define the latency threshold of 100ms
AnswersB, C, E

Why this answer

The performance SLA must be configured to monitor latency as the metric to measure link quality. Without setting the SLA metric to 'latency', the SD-WAN rule cannot evaluate which link has the lowest latency for VoIP traffic, which is the core requirement.

Exam trap

The trap here is confusing the 'failover-threshold' parameter on SD-WAN members with the SLA constraint in the SD-WAN rule, where the actual latency threshold for failover is defined.

Practice this question →
46
Multi-Selectmedium

A network admin is troubleshooting an SD-WAN rule that should steer VoIP traffic to a low-latency link. The rule matches traffic from the VoIP subnet to any destination and uses the 'best-quality' strategy with SLA monitoring. However, traffic is still using the other link. Which TWO checks should the admin perform? (Choose two.)

Select 2 answers
A.Ensure that the FortiGate has a default route via each SD-WAN member.
B.Check that the SD-WAN rule has a higher priority than other rules that might match the traffic.
C.Disable the other SD-WAN members temporarily to force traffic to the desired link.
D.Confirm that the VoIP subnet is included in the SD-WAN zone.
E.Verify that the performance SLA is correctly configured and the VoIP traffic matches the SLA's server.
AnswersB, E

SD-WAN rules are evaluated in order; a rule with higher priority (lower number) takes precedence.

Practice this question →
47
Multi-Selectmedium

A FortiGate is acting as an ABR between OSPF area 0 and area 1. The administrator needs to redistribute a static route into OSPF so that it appears as an inter-area route (Type 3 LSA). Which three steps are required? (Choose THREE.)

Select 3 answers
A.Disable route summarization on the ABR
B.Configure a route map to set the metric type to Type 1
C.Verify the OSPF process has network statements covering all interfaces
D.Configure 'redistribute static' under OSPF on the ABR
E.Ensure the static route is present in the routing table
AnswersC, D, E

Necessary for OSPF adjacency and LSA propagation.

Why this answer

For OSPF to generate Type 3 LSAs from redistributed routes, the ABR must have OSPF enabled on its interfaces via network statements. Without these statements, the ABR cannot form adjacencies or propagate LSAs between areas, which is essential for inter-area route advertisement.

Exam trap

The trap here is that candidates often think a route map or metric type change is needed to produce Type 3 LSAs, but in reality, Type 3 LSAs are generated automatically by the ABR from redistributed routes when OSPF is properly enabled on interfaces, not from external route manipulation.

Practice this question →
48
MCQhard

A network engineer is troubleshooting an SD-WAN setup where traffic from a specific subnet is not being load-balanced as expected. The SD-WAN rule uses 'source IP' hashing. The engineer notices that the traffic originates from multiple hosts in the same /24 subnet. What is the most likely cause of poor load distribution?

A.The SD-WAN rule is not matching the traffic.
B.The SD-WAN members have different bandwidths.
C.Traffic is using a single destination IP and port.
D.The source IP hashing algorithm causes multiple hosts in the same subnet to map to the same member.
AnswerD

Source IP hashing can lead to poor distribution for similar IPs.

Why this answer

Source IP hashing in SD-WAN uses a hash of the source IP address to select a member for each flow. When multiple hosts reside in the same /24 subnet, their source IPs share the same first 24 bits, which can cause the hash algorithm to map them to the same SD-WAN member if the hash function is not sufficiently granular or if the number of members is small. This results in poor load distribution despite multiple sources.

Exam trap

The trap here is that candidates assume multiple hosts in the same subnet automatically distribute traffic evenly, forgetting that source IP hashing can produce identical hash values for IPs sharing the same network prefix, leading to poor load balancing.

How to eliminate wrong answers

Option A is wrong because if the SD-WAN rule were not matching the traffic, no load balancing would occur at all, not just poor distribution. Option B is wrong because different bandwidths among members affect capacity but do not cause the hash algorithm to map multiple hosts in the same subnet to the same member; bandwidth differences are handled by weighted load balancing, not source IP hashing. Option C is wrong because using a single destination IP and port would affect per-flow load balancing (e.g., session-based hashing), but source IP hashing is independent of destination; the issue here is specifically about source IPs in the same subnet mapping identically.

Practice this question →
49
Matchingmedium

Match each IPsec VPN term to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Internet Key Exchange version 1

Internet Key Exchange version 2

Encapsulating Security Payload

Authentication Header

Perfect Forward Secrecy

Why these pairings

Correct matches: IKE establishes SAs and authenticates peers; SPI is an index to identify SAs; ESP provides confidentiality, authentication, and integrity. Common confusions include swapping IKE and SA definitions.

Practice this question →
50
MCQmedium

An administrator notices that when a BGP session goes down, failover to the backup path takes about 30 seconds. The admin wants to reduce the failover time to less than 1 second. Which technology should the administrator implement?

A.Configure BGP fast external failover
B.Increase the BGP keepalive timer to 1 second
C.Use policy-based routing with SLA monitoring
D.Enable BFD on the BGP neighbor and the associated interface
AnswerD

BFD provides fast failure detection (milliseconds) for routing protocols.

Why this answer

BFD (Bidirectional Forwarding Detection) provides sub-second failure detection for BGP sessions by sending rapid hello packets independently of the BGP keepalive mechanism. By enabling BFD on both the BGP neighbor and the associated interface, the router can detect a link or neighbor failure in milliseconds (e.g., 50-300 ms), allowing BGP to converge and switch to the backup path in under 1 second, far faster than the default 30-second hold timer.

Exam trap

The trap here is that candidates often confuse BGP fast external failover (which only helps for directly connected interface flaps) with BFD (which provides sub-second detection for any failure along the path), leading them to select option A instead of D.

How to eliminate wrong answers

Option A is wrong because BGP fast external failover only triggers an immediate session reset when the directly connected interface goes down, but it does not provide sub-second detection for failures beyond the immediate link (e.g., a remote neighbor failure or intermediate switch failure). Option B is wrong because increasing the BGP keepalive timer to 1 second would actually require reducing the hold timer proportionally (e.g., to 3 seconds), which still results in detection times of several seconds and increases CPU/bandwidth overhead without achieving sub-second failover. Option C is wrong because policy-based routing with SLA monitoring can detect path failures using ICMP probes, but SLA polling intervals are typically 1-5 seconds, and the convergence process involves route removal and re-insertion, which cannot guarantee failover in under 1 second.

Practice this question →
51
MCQhard

A FortiGate administrator runs 'diagnose sys session list' and sees a session for which the destination interface is 'sdwan'. The session is marked with 'state=01000048'. What does this state indicate about the session?

A.The session is being held until the SD-WAN load balancing decision is made
B.The session is bypassing SD-WAN load balancing and using policy-based routing
C.The session has completed load balancing and is being forwarded out the sdwan interface
D.The session has been dropped because the selected SD-WAN member is down
AnswerA

Why this answer

The session state value 0x01000048 corresponds to the flag 'SES_STATE_SD_WAN_HOLD' in FortiOS. This flag indicates that the session is temporarily held in a pending state while the SD-WAN load balancing decision is being made. The session will not be forwarded until the SD-WAN rule selects the appropriate member interface, preventing premature routing before the load balancing logic completes.

Exam trap

The trap here is that candidates often misinterpret the 'sdwan' interface as a physical interface that forwards traffic directly, when in fact it is a logical placeholder that triggers a hold state until the SD-WAN rule selects a specific member interface.

How to eliminate wrong answers

Option B is wrong because the session is explicitly held for SD-WAN load balancing, not bypassing it; policy-based routing is a separate mechanism that would not use the 'sdwan' interface or this hold flag. Option C is wrong because a session that has completed load balancing would show a specific member interface (e.g., 'port1') as the destination, not 'sdwan', and the state would not include the hold flag. Option D is wrong because a dropped session due to a down member would not be listed in the session table; the session would be terminated or fail to establish, not held with state 0x01000048.

Practice this question →
52
MCQhard

An enterprise uses FortiGate as an SD-WAN edge device with three WAN links: Link A (MPLS), Link B (broadband), and Link C (LTE). The SD-WAN rule for VoIP traffic uses the 'best quality' strategy with link-quality-measurement enabled. The VoIP traffic is routed via Link A. During peak hours, users report poor voice quality. The administrator checks the SD-WAN performance SLA logs and sees that Link A's jitter and latency are within acceptable thresholds, but packet loss is slightly elevated. Which action would most likely improve VoIP quality without manual intervention?

A.Increase the priority of Link A to ensure it remains the preferred link.
B.Configure a performance SLA for VoIP traffic with jitter < 10ms, latency < 100ms, and packet-loss < 0.5% and apply it to the SD-WAN rule.
C.Disable link-quality-measurement to reduce overhead on Link A.
D.Add a new SD-WAN rule with 'lowest cost' strategy for VoIP traffic.
AnswerB

Applying a performance SLA with strict thresholds will cause the SD-WAN rule to select a link that meets the criteria, switching away from Link A if it fails the SLA.

Why this answer

Configuring a performance SLA with specific thresholds for jitter, latency, and packet loss allows FortiGate to dynamically failover VoIP traffic to another WAN link when Link A's packet loss exceeds the defined threshold (e.g., 0.5%). Since the 'best quality' strategy uses link-quality-measurement to select the link with the best SLA compliance, applying a performance SLA with a packet-loss threshold ensures that even if jitter and latency are acceptable, elevated packet loss triggers a switch to a healthier link, improving voice quality without manual intervention.

Exam trap

The trap here is that candidates assume 'best quality' automatically handles all quality metrics, but without a performance SLA with explicit thresholds, FortiGate only uses link-quality-measurement for ordering and does not failover based on packet loss alone.

How to eliminate wrong answers

Option A is wrong because increasing the priority of Link A would force it to remain the preferred link, preventing failover to a better-performing link when packet loss is elevated, which would not resolve the poor voice quality. Option C is wrong because disabling link-quality-measurement would stop FortiGate from monitoring link quality altogether, removing the ability to detect packet loss and make dynamic routing decisions, likely worsening VoIP quality. Option D is wrong because using the 'lowest cost' strategy for VoIP traffic would select links based on cost rather than quality, which could route traffic over a cheaper but lower-quality link, failing to address the packet loss issue on Link A.

Practice this question →
53
MCQeasy

Which routing technique allows a FortiGate to forward packets based on source IP address, destination IP address, or other criteria, in addition to the destination IP alone?

A.Policy-Based Routing (PBR)
B.RIP
C.OSPF route redistribution
D.ECMP
AnswerA

PBR uses policies to route traffic based on various attributes.

Why this answer

Policy-Based Routing (PBR) allows a FortiGate to forward packets based on criteria beyond the destination IP address, such as source IP, destination port, protocol, or application. This is achieved by configuring policy routes that override the default routing table lookup, enabling granular traffic steering for advanced networking scenarios like SD-WAN.

Exam trap

The trap here is that candidates often confuse Policy-Based Routing with ECMP, assuming ECMP can also use source IP for path selection, but ECMP only balances traffic based on destination IP and does not support criteria like source IP or application without additional configuration like PBR or SD-WAN rules.

How to eliminate wrong answers

Option B (RIP) is wrong because RIP is a dynamic routing protocol that exchanges routes based solely on destination network prefixes, not on source IP or other packet attributes. Option C (OSPF route redistribution) is wrong because redistribution is a mechanism to import routes from one routing protocol into another, not a technique for forwarding packets based on multiple criteria. Option D (ECMP) is wrong because ECMP (Equal-Cost Multi-Path) distributes traffic across multiple paths with the same destination prefix cost, but it does not consider source IP or other packet-level criteria for forwarding decisions.

Practice this question →
54
Multi-Selectmedium

A FortiGate is configured with OSPF and BGP. The administrator wants to redistribute OSPF routes into BGP. Which TWO steps are required?

Select 2 answers
A.Configure a route map to filter the routes being redistributed
B.Set the BGP table version to 2
C.Use the 'redistribute ospf' command under the BGP configuration
D.Ensure the OSPF routes are present in the routing table
E.Disable OSPF on the interface
AnswersC, D

This enables redistribution of OSPF routes into BGP.

Why this answer

The 'redistribute ospf' command under BGP configuration is the explicit method to inject OSPF-learned routes into the BGP table. This command triggers the redistribution process, allowing OSPF routes to be advertised to BGP peers.

Exam trap

The trap here is that candidates often assume a route map is mandatory for redistribution, but the exam tests the knowledge that only the redistribution command and the presence of routes in the routing table are strictly required.

Practice this question →
55
MCQmedium

An administrator sees the following output from 'diagnose sys session list' for a particular session: proto=6 proto_state=01 duration=3600 expire=3599. What does this indicate about the session?

A.The session is an ICMP session
B.The session is a TCP session that is still open and will expire in 3599 seconds
C.The session is a TCP session in TIME_WAIT state
D.The session is for UDP traffic and has been up for 3600 seconds
AnswerB

proto=6 is TCP, duration=3600 seconds, expire=3599 seconds remaining.

Why this answer

The output shows proto=6, which is the protocol number for TCP. proto_state=01 indicates the TCP session is in the SYN_SENT state, meaning the session has been created but the TCP three-way handshake is not yet complete. The duration=3600 means the session has existed for 3600 seconds, and expire=3599 means it will expire in 3599 seconds if no further traffic is seen. Therefore, the session is a TCP session that is still open and will expire in 3599 seconds, making option B correct.

Exam trap

The trap is that candidates may mistake proto_state=01 for SYN_SENT, but it actually means the TCP session is ESTABLISHED. Also, the expire value does not indicate TIME_WAIT; TIME_WAIT would have a different state value.

How to eliminate wrong answers

Option A is wrong because ICMP uses protocol number 1, not 6, and would not show a TCP state field. Option C is wrong because a TCP TIME_WAIT state is represented by a different proto_state value (typically 0x1e or similar), not 01, and would have a much shorter expire time. Option D is wrong because UDP uses protocol number 17, not 6, and does not have a proto_state field for connection state tracking.

Practice this question →
56
MCQhard

A FortiGate is configured with two SD-WAN members (wan1, wan2) and a performance SLA for each. The SD-WAN rule uses 'Maximize Bandwidth' strategy with volume-based load balancing. The administrator notices that traffic is only using wan1, even though both links have capacity. The SLA status for wan2 shows 'alive'. What could be the problem?

A.The link cost for wan2 is too high.
B.The SD-WAN rule has a 'set member' statement that lists only wan1.
C.The performance SLA for wan2 is not associated with the SD-WAN rule.
D.The bandwidth weight for wan2 is set to 0.
AnswerB

If the rule explicitly includes only wan1, traffic will not use wan2 even if the SLA is alive.

Why this answer

The 'Maximize Bandwidth' strategy with volume-based load balancing distributes traffic based on bandwidth weights, but the SD-WAN rule's 'set member' statement explicitly defines which interfaces are eligible for load balancing. If the rule lists only wan1, traffic will never be sent to wan2, regardless of SLA status or bandwidth weights. This is the most direct cause of the observed behavior.

Exam trap

The trap here is that candidates often assume a healthy SLA and correct bandwidth weights are sufficient for load balancing, overlooking that the SD-WAN rule's member list explicitly controls which interfaces are used, and a missing member will exclude that interface entirely.

How to eliminate wrong answers

Option A is wrong because link cost is used in 'Lowest Cost' (SLA) strategies, not in 'Maximize Bandwidth' with volume-based load balancing; a high cost does not prevent traffic from using wan2 in this strategy. Option C is wrong because the performance SLA for wan2 being associated with the rule is not required for the rule to use wan2; the SLA only affects the interface's health status, and since wan2 is 'alive', it is eligible. Option D is wrong because a bandwidth weight of 0 would still allow traffic to be sent to wan2 if the rule includes it, though it would receive no traffic under volume-based load balancing; however, the question states traffic is only using wan1, implying wan2 is not even considered, which is caused by the rule's member list, not the weight.

Practice this question →
57
Multi-Selectmedium

An administrator needs to configure a FortiGate to use two WAN links for internet traffic with failover and load balancing. Which TWO steps are required?

Select 2 answers
A.Configure a performance SLA for each SD-WAN member.
B.Set the SD-WAN zone to 'spillover' mode.
C.Enable NAT on the SD-WAN zone.
D.Define SD-WAN rules to match internet-bound traffic.
E.Add both WAN interfaces as SD-WAN members.
AnswersD, E

Rules determine how traffic is load-balanced.

Why this answer

For internet traffic failover and load balancing over two WAN links, the FortiGate must first add both WAN interfaces as SD-WAN members (option E) to form the SD-WAN zone. Then, SD-WAN rules (option D) are required to match internet-bound traffic and define how it is distributed among the members (e.g., by volume, session, or spillover) and which failover strategy to apply. Without these rules, the SD-WAN zone cannot enforce load balancing or failover policies for the traffic.

Exam trap

The trap here is that candidates assume adding interfaces as SD-WAN members alone enables load balancing and failover, but without SD-WAN rules, the FortiGate defaults to a single-route behavior, negating the SD-WAN benefits.

Practice this question →
58
MCQhard

An administrator configures a route map named RMAP_EXPORT that sets a community for routes redistributed into BGP. The route map is applied to the 'redistribute connected' statement under BGP. However, the connected routes are not being advertised to BGP peers. What is the most likely cause?

A.The BGP neighbor is not configured with 'route-map in'
B.Connected routes are not in the routing table
C.The route map does not have a 'match ip address' statement
D.The route map is missing a 'set community' action
AnswerC

Without a match, the route map may not permit any routes.

Why this answer

A route map used for redistribution into BGP must contain at least one 'match' statement to filter which routes are redistributed. Without a 'match ip address' statement, the route map does not explicitly permit any routes, causing all connected routes to be denied by default. BGP redistribution requires an explicit permit action via a match condition; otherwise, the implicit deny at the end of the route map blocks all routes.

Exam trap

The trap here is that candidates assume a route map with only a 'set' action will permit routes by default, but in reality, a route map without a 'match' statement denies all routes due to the implicit deny at the end of the route map.

How to eliminate wrong answers

Option A is wrong because 'route-map in' on a neighbor is used to filter incoming BGP updates, not to control redistribution of connected routes into BGP. Option B is wrong because the question states the administrator configured 'redistribute connected', which implies connected routes exist in the routing table; if they were absent, the redistribution command would have no effect, but the issue is specifically about the route map blocking advertisement. Option D is wrong because the route map does include a 'set community' action as stated in the question; the problem is the lack of a 'match' statement, not the absence of the set action.

Practice this question →
59
Multi-Selecthard

A FortiGate is experiencing asymmetric routing due to route leaking between VRFs. The administrator wants to ensure that traffic using a specific VRF returns via the same path. Which THREE actions should be taken? (Choose three.)

Select 3 answers
A.Enable 'set pbr-enforce-symmetric' on the VRF interfaces
B.Configure policy-based routing with set-next-hop to force return traffic through the same interface
C.Use a route map to set the next-hop on routes leaked into the VRF
D.Disable route leaking between VRFs
E.Increase the administrative distance of the leaked routes
AnswersA, B, C

This feature forces symmetric routing for policy-based routes.

Why this answer

Enabling 'set pbr-enforce-symmetric' on VRF interfaces forces the FortiGate to use policy-based routing (PBR) rules bidirectionally, ensuring that return traffic for a session follows the same path as the forward traffic. This is critical in asymmetric routing scenarios caused by route leaking between VRFs, as it overrides the default per-packet forwarding behavior and enforces symmetry at the session level.

Exam trap

The trap here is that candidates often confuse route leaking with routing asymmetry and assume that disabling or deprioritizing leaked routes (options D or E) will fix the issue, when in fact the correct solution is to enforce symmetric forwarding at the policy level using PBR symmetry or explicit return-path PBR rules.

Practice this question →
60
MCQeasy

What is the purpose of a prefix list in FortiGate routing?

A.To match routes based on their network prefix and subnet mask.
B.To configure NAT rules.
C.To define SD-WAN members.
D.To assign IP addresses to interfaces.
AnswerA

Prefix lists are used to match specific routes for filtering or redistribution based on prefix length.

Why this answer

A prefix list in FortiGate is used to match routes based on their network prefix and subnet mask (prefix length). It is commonly applied in route maps or BGP configurations to filter or manipulate routing information, such as in redistribution or neighbor policy statements. Unlike access lists, prefix lists match the exact prefix and length, providing more granular control over route advertisement and acceptance.

Exam trap

The trap here is that candidates often confuse prefix lists with access lists or route maps, assuming they can be used for general packet filtering or interface configuration, but prefix lists are strictly for route prefix matching in routing policy contexts.

How to eliminate wrong answers

Option B is wrong because NAT rules are configured using firewall policies or central NAT tables, not prefix lists. Option C is wrong because SD-WAN members are defined in the SD-WAN configuration under the 'config system sdwan' context, where interfaces and their roles are specified, not via prefix lists. Option D is wrong because IP addresses are assigned to interfaces using the 'config system interface' command with the 'set ip' directive, not through prefix lists.

Practice this question →
61
MCQhard

A FortiGate is connected to a FortiExtender via USB. The administrator wants to use LTE as a backup WAN link in an SD-WAN setup. After configuring the FortiExtender, the LTE interface is not showing up as an SD-WAN member. What is the most likely reason?

A.The FortiExtender is not in managed mode
B.The FortiGate does not have a valid FortiExtender license
C.The LTE SIM card is not activated
D.The LTE interface must be configured as a WAN link in the FortiExtender first
AnswerB

A valid license is required for FortiExtender integration; without it, the interface may not be recognized as an SD-WAN member.

Why this answer

When a FortiGate connects to a FortiExtender via USB, the LTE interface will not appear as an SD-WAN member unless the FortiExtender is in managed mode and the FortiGate has a valid FortiExtender license. Without the license, the FortiGate cannot manage the FortiExtender or expose its LTE interface for SD-WAN membership, even if the physical connection and SIM are functional.

Exam trap

The trap here is that candidates assume the LTE interface will appear automatically once the FortiExtender is physically connected and configured, overlooking the mandatory FortiExtender license that governs the management plane between the FortiGate and the extender.

How to eliminate wrong answers

Option A is wrong because the FortiExtender must be in managed mode for the FortiGate to control it, but the question states the administrator configured the FortiExtender, implying managed mode is already set; the missing license is the blocking factor. Option C is wrong because an inactive SIM would prevent LTE connectivity, but the interface would still appear as an SD-WAN member (though down); the issue is that the interface is not showing up at all. Option D is wrong because the LTE interface does not need to be pre-configured as a WAN link on the FortiExtender; the FortiGate discovers and exposes it automatically when managed, provided the license is present.

Practice this question →
62
MCQhard

You run 'diagnose sys session filter dport 443' and see the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate about the session?

A.The session is a UDP session with a short timeout.
B.The session is a UDP session that has been active for 1 hour.
C.The session is a TCP session in established state that has been active for 1 hour and will expire in about 1 hour.
D.The session is a TCP session that has timed out and is being removed.
AnswerC

The output matches a TCP established session with durations.

Why this answer

The output shows 'proto=6', which is the protocol number for TCP, and 'proto_state=01', which indicates the TCP session is in an established state (TCP_ESTABLISHED). The 'duration=3600' means the session has been active for 3600 seconds (1 hour), and 'expire=3599' means the session will expire in 3599 seconds (approximately 1 hour), consistent with the default TCP session timeout of 3600 seconds in FortiGate.

Exam trap

The trap here is that candidates confuse 'proto=6' with UDP or misinterpret 'proto_state=01' as a timeout indicator, when in fact it specifically denotes an established TCP session with a standard 1-hour idle timeout.

How to eliminate wrong answers

Option A is wrong because 'proto=6' indicates TCP, not UDP (UDP uses protocol 17), and the session has a long timeout (3600 seconds), not a short one. Option B is wrong because 'proto=6' is TCP, not UDP, and while the duration is 1 hour, the protocol is misidentified. Option D is wrong because the session has not timed out; 'expire=3599' shows it is still active with nearly a full hour remaining, and 'proto_state=01' indicates an established state, not a timed-out or being-removed state.

Practice this question →
63
MCQhard

An administrator wants to load-balance traffic across two WAN links using ECMP. The routes have equal distances and metrics. However, traffic is only using one of the links. What could be the cause?

A.The routes are learned via different routing protocols with different administrative distances.
B.ECMP is not enabled globally under config system settings.
C.The firewall policy is configured to use a specific egress interface.
D.The traffic is session-based and ECMP uses per-packet load balancing.
AnswerA

ECMP requires equal distances; if one route has a lower distance, it will be preferred.

Why this answer

ECMP (Equal-Cost Multi-Path) requires routes to have identical administrative distances (AD) to be considered equal-cost. If routes are learned via different routing protocols (e.g., OSPF with AD 110 and static with AD 1), the FortiGate will prefer the route with the lower AD, even if metrics are equal. This causes traffic to use only the preferred link, as the other route is not installed in the routing table for ECMP selection.

Exam trap

The trap here is that candidates assume equal metrics are sufficient for ECMP, overlooking that administrative distance (AD) is the primary tiebreaker in route selection, and different routing protocols inherently assign different ADs unless manually overridden.

How to eliminate wrong answers

Option B is wrong because ECMP is enabled by default on FortiGate and does not require a global toggle under config system settings; the key requirement is equal-cost routes. Option C is wrong because a firewall policy configured with a specific egress interface overrides routing decisions, but the question states the administrator wants to load-balance traffic, implying no such policy is in place; if it were, it would force all matching traffic out one interface, breaking ECMP. Option D is wrong because FortiGate ECMP uses per-session (not per-packet) load balancing by default, which is session-based; per-packet balancing would cause out-of-order packets and is not the default behavior.

Practice this question →
64
MCQmedium

An administrator configures BFD on a FortiGate to improve convergence time for OSPF. What is the primary purpose of BFD in this context?

A.To reduce the number of OSPF neighbors
B.To encrypt OSPF packets
C.To detect link failures faster than OSPF hello timers
D.To load balance OSPF traffic across multiple links
AnswerC

BFD provides rapid failure detection, often sub-second, improving convergence.

Why this answer

BFD (Bidirectional Forwarding Detection) provides sub-second link failure detection, typically in the range of 50-300 milliseconds, which is significantly faster than OSPF's default hello/dead intervals (e.g., 10/40 seconds for broadcast networks). By integrating BFD with OSPF, the FortiGate can trigger OSPF neighbor state changes and route convergence almost immediately upon a link failure, without waiting for OSPF's own hello timer expiration.

Exam trap

The trap here is that candidates may confuse BFD's fast detection with OSPF's own hello mechanism, thinking BFD replaces or modifies OSPF timers, when in fact BFD works in parallel and triggers OSPF state changes only after a failure is detected.

How to eliminate wrong answers

Option A is wrong because BFD does not reduce the number of OSPF neighbors; it operates independently on each established OSPF adjacency to monitor link continuity. Option B is wrong because BFD provides no encryption or security functions; it is a lightweight, unauthenticated (or optionally authenticated) hello-based protocol for fast failure detection. Option D is wrong because BFD does not perform load balancing; it is solely a detection mechanism and does not influence traffic distribution across multiple links.

Practice this question →
65
Multi-Selecthard

A FortiGate running FortiOS 7.2 has multiple WAN interfaces. The administrator is configuring SD-WAN load balancing with the 'volume' algorithm. The requirement is that each interface carries a percentage of total traffic based on its bandwidth capacity. The administrator sets the 'weight' of each interface accordingly. However, traffic distribution is not as expected. Which TWO factors could cause this discrepancy?

Select 2 answers
A.The interface bandwidth settings (speed) do not reflect actual link capacity
B.The weight values are not in the range 1-100
C.The traffic is dominated by a few large-volume sessions, causing imbalance
D.The load balancing algorithm is set to 'per-packet' instead of 'volume'
E.The performance SLA is set to 'disable' on some interfaces, causing them to be excluded
AnswersA, C

Why this answer

The 'volume' algorithm in FortiOS SD-WAN distributes traffic proportionally based on the configured interface weights, but these weights are derived from the interface bandwidth settings (speed). If the configured bandwidth does not match the actual link capacity, the weight ratios will be incorrect, leading to unexpected traffic distribution. The administrator must ensure that the 'speed' setting under each interface accurately reflects the real bandwidth to achieve the desired load balancing.

Exam trap

The trap here is that candidates often assume the 'volume' algorithm distributes traffic based on real-time link utilization or throughput, when in fact it relies solely on static weight values derived from configured bandwidth settings, not actual link capacity.

Practice this question →
66
MCQhard

A FortiGate is running OSPF with multiple areas. The administrator notices that routes from area 1 are not being redistributed into area 0. The ABR has the following configuration: 'config router ospf config area edit 0.0.0.0 set type nssa end config area edit 0.0.0.1 set type standard end end'. What is the issue?

A.The ABR must have 'set type standard' for area 0.
B.Area 0 is configured as NSSA, which does not accept type 3 LSAs from other areas.
C.The ABR is missing a 'redistribute connected' command.
D.Area 1 is not configured as NSSA, so routes cannot be redistributed.
AnswerB

NSSA areas do not allow type 3 summary LSAs. Routes from other areas are not injected into an NSSA area unless special options are used.

Why this answer

Area 0 is configured as an NSSA (Not-So-Stubby Area), which by default does not accept Type 3 summary LSAs from other areas. Since routes from area 1 (a standard area) are injected into the ABR as Type 3 LSAs, they are blocked by the NSSA area 0 boundary. This prevents inter-area route redistribution into area 0.

Exam trap

The trap here is that candidates assume area 0 must always be a standard area, but FortiGate allows area 0 to be NSSA, and the real issue is the NSSA's default behavior of blocking Type 3 LSAs from other areas.

How to eliminate wrong answers

Option A is wrong because area 0 can be configured as NSSA, but the issue is that NSSA areas block Type 3 LSAs, not that area 0 must be standard. Option C is wrong because the problem is not about redistributing connected routes; the administrator is trying to redistribute OSPF inter-area routes, not external routes. Option D is wrong because area 1 being standard is correct; the misconfiguration is on area 0, not area 1.

Practice this question →
67
Multi-Selectmedium

A FortiGate is configured with multiple VRFs to segregate traffic from different departments. The administrator needs to allow the Finance VRF to access a shared printer in the default VRF. Which TWO steps are required to enable inter-VRF communication?

Select 2 answers
A.Configure OSPF to redistribute routes between VRFs
B.Place both the Finance and default VRF interfaces into the same zone
C.Configure a leak route from the Finance VRF to the default VRF for the printer's subnet
D.Create a firewall policy between the VRF interfaces that permits the required traffic
E.Assign the printer's IP address to an interface in the Finance VRF
AnswersC, D

Why this answer

Route leaking is required to make the printer's subnet reachable from the Finance VRF. Without a leak route, the Finance VRF has no route to the printer in the default VRF, so traffic cannot be forwarded even if a firewall policy permits it.

Exam trap

The trap here is that candidates often assume a firewall policy alone is sufficient for inter-VRF traffic, forgetting that the source VRF must have a route to the destination subnet, which requires explicit route leaking.

Practice this question →
68
MCQmedium

A FortiGate is configured with two SD-WAN members (port1 and port2). The administrator sets an SD-WAN rule with 'set load-balance-mode source-dst-ip' for all internal traffic. The source IP is 10.0.0.1 and destination IP is 172.16.0.1. Which factor determines the outgoing interface for this traffic?

A.The destination IP only
B.The combination of source IP and destination IP hashed to select an interface
C.The source IP only
D.The interface with the lowest current utilization
AnswerB

source-dst-ip mode uses a hash of both source and destination IPs to consistently select the same interface for the same flow.

Why this answer

With 'set load-balance-mode source-dst-ip', the FortiGate performs a hash of both the source IP and destination IP to deterministically select an outgoing SD-WAN member. This ensures that all packets belonging to the same source-destination pair are consistently forwarded over the same interface, preserving flow symmetry without relying on per-packet metrics.

Exam trap

The trap here is that candidates confuse 'source-dst-ip' with 'source-ip' or 'destination-ip' modes, or incorrectly assume that SD-WAN load balancing always considers real-time link utilization, which is only true for 'spillover' or 'lowest-cost' strategies, not hash-based modes.

How to eliminate wrong answers

Option A is wrong because the destination IP alone is used only in 'load-balance-mode destination-ip', not in 'source-dst-ip' mode. Option C is wrong because the source IP alone is used only in 'load-balance-mode source-ip', not in 'source-dst-ip' mode. Option D is wrong because 'load-balance-mode source-dst-ip' uses a static hash of the IP pair, not dynamic interface utilization; the FortiGate does not consider current utilization in this mode.

Practice this question →
69
MCQhard

An administrator runs 'get router info bgp summary' and sees that the BGP session to a neighbor is in the 'Idle' state. The neighbor IP is reachable via ping. The BGP configuration uses loopback interfaces with 'update-source loopback1'. What is the MOST likely reason for the Idle state?

A.There is no route on the neighbor back to the FortiGate's loopback IP
B.The loopback interface is down or has no IP address assigned
C.The BGP neighbor's remote-as is misconfigured
D.The BGP timer values (keepalive/hold) are mismatched
AnswerA

BGP uses TCP; if the neighbor cannot reach the update-source IP, the TCP handshake fails, keeping the session in Idle.

Why this answer

The 'Idle' state in BGP indicates that the session cannot start, often due to a missing route to the neighbor's update-source IP. Since the neighbor IP is reachable via ping but the session uses loopback interfaces with 'update-source loopback1', the FortiGate's BGP packets will source from its loopback1 IP. If the neighbor does not have a route back to that loopback IP, it cannot respond to the TCP handshake, leaving the session stuck in Idle.

This is a classic BGP loopback peering issue where reachability of the source IP is required, not just the physical interface IP.

Exam trap

The trap here is that candidates assume ping reachability to the neighbor IP guarantees BGP session establishment, but they overlook that BGP packets are sourced from the loopback interface, requiring the neighbor to have a return route to that specific source IP.

How to eliminate wrong answers

Option B is wrong because if the loopback interface were down or had no IP, the 'update-source loopback1' command would fail to source packets, but the question states the neighbor IP is reachable via ping, implying the loopback is operational. Option C is wrong because a misconfigured remote-as would typically cause the session to transition to 'Active' or 'Connect' states, not remain in 'Idle', as BGP first attempts a TCP connection before checking AS numbers. Option D is wrong because mismatched keepalive/hold timers do not prevent the session from leaving Idle; they are negotiated during the Open message exchange after the TCP connection is established, so the session would reach 'Active' or 'Connect' first.

Practice this question →
70
MCQeasy

What is the function of a VRF (Virtual Routing and Forwarding) on a FortiGate?

A.To provide redundancy for routing protocols
B.To aggregate multiple physical interfaces into one logical interface
C.To create multiple independent routing tables
D.To encrypt traffic between different virtual domains
AnswerC

VRF maintains separate routing tables, providing path isolation.

Why this answer

VRF (Virtual Routing and Forwarding) on a FortiGate allows the creation of multiple independent routing tables within a single physical device. This enables network segmentation and traffic isolation at Layer 3, where each VRF maintains its own routing table, forwarding decisions, and interface associations, preventing routes from leaking between VRFs unless explicitly configured with route leaking.

Exam trap

The trap here is that candidates confuse VRF with VDOM (Virtual Domain), but VRF is a Layer 3 routing isolation mechanism within a single VDOM, whereas VDOM provides full administrative and security separation at the device level.

How to eliminate wrong answers

Option A is wrong because VRF does not provide redundancy for routing protocols; redundancy is achieved through protocols like VRRP, FGCP (FortiGate Cluster Protocol), or routing protocol features like BGP multipath. Option B is wrong because aggregating multiple physical interfaces into one logical interface is the function of link aggregation (LAG) or interface bonding, not VRF. Option D is wrong because encrypting traffic between different virtual domains is the role of IPsec VPNs or VDOM inter-VDOM links with encryption, not VRF; VRF focuses on routing table separation, not encryption.

Practice this question →
71
MCQmedium

An administrator connects a FortiExtender to the FortiGate's USB port. The FortiGate detects the FortiExtender and creates a virtual interface 'wwan1'. However, the link status shows 'down'. The SIM card is inserted and the cellular plan is active. What should the administrator check?

A.The APN settings are not configured under the FortiExtender interface
B.The FortiGate needs a security policy allowing traffic from wwan1
C.The FortiExtender firmware is not compatible with the FortiGate
D.The FortiExtender is not powered on
AnswerA

APN is required for cellular connectivity; without it, the link stays down.

Why this answer

The link status of the wwan1 interface remains 'down' because the FortiExtender requires the Access Point Name (APN) to be configured to establish a cellular data connection. Without the correct APN, the modem cannot attach to the mobile network, even with an active SIM card and power. The APN is configured under the FortiExtender interface settings on the FortiGate, not on the FortiExtender itself.

Exam trap

The trap here is that candidates often assume a detected device with an active SIM and power should automatically show a link-up status, overlooking the mandatory APN configuration required for cellular network attachment.

How to eliminate wrong answers

Option B is wrong because a security policy is only required for traffic forwarding, not for bringing the wwan1 link up; the link status is independent of firewall rules. Option C is wrong because firmware incompatibility would typically prevent detection or cause errors, but the FortiGate has already detected the FortiExtender and created the wwan1 interface, indicating basic compatibility. Option D is wrong because the FortiExtender is powered via the USB port from the FortiGate, and if it were not powered on, the FortiGate would not detect it or create the wwan1 interface.

Practice this question →
72
MCQmedium

An administrator is configuring SD-WAN on a FortiGate. They want traffic from the internal network to a specific SaaS application to use the MPLS link unless the latency exceeds 50 ms, in which case traffic should failover to the broadband link. Which configuration elements are required?

A.Configure policy-based routing to direct SaaS traffic to the MPLS link and rely on default routing for failover.
B.Add a static route for the SaaS IP with the MPLS interface as the gateway and a higher distance than the default route via broadband.
C.Create an SD-WAN member for each link, configure a performance SLA with jitter threshold 50 ms, and add an SD-WAN rule matching the SaaS traffic using the 'best-quality' strategy with the MPLS member.
D.Create an SD-WAN member for each link, configure a performance SLA with latency threshold 50 ms, and add an SD-WAN rule matching the SaaS traffic with the MPLS member as preferred and enable 'set failover enable'.
AnswerD

This correctly defines members, an SLA to measure latency, and a rule that uses the MPLS link with failover to the broadband when the SLA is not met.

Why this answer

It uses SD-WAN members for each link, a performance SLA with a latency threshold of 50 ms to monitor link quality, and an SD-WAN rule that matches SaaS traffic with the MPLS member as preferred and failover enabled. This configuration ensures that traffic uses the MPLS link as long as latency stays below 50 ms, and automatically fails over to the broadband link when the SLA is violated.

Exam trap

The trap here is that candidates often confuse jitter and latency thresholds or think that a static route with a higher distance can provide dynamic failover, but FortiGate SD-WAN requires explicit SLA monitoring and failover enablement to react to latency degradation.

How to eliminate wrong answers

Option A is wrong because policy-based routing does not support dynamic failover based on real-time latency; it is static and cannot react to SLA violations. Option B is wrong because using a static route with a higher distance for the MPLS link would make the broadband link the primary path (lower distance), contradicting the requirement to prefer MPLS; also, static routes cannot trigger failover based on latency thresholds. Option C is wrong because it specifies a jitter threshold of 50 ms, but the requirement is to failover based on latency exceeding 50 ms, not jitter; the 'best-quality' strategy selects the best link based on multiple metrics but does not enforce a preferred link with failover behavior.

Practice this question →
73
MCQmedium

A company with a hub-and-spoke SD-WAN topology uses FortiGates at each site. The hub has two WAN links: MPLS (10 Mbps) and broadband (100 Mbps). The spokes connect only via MPLS. The company deploys a new real-time application that requires low latency and low jitter. The network administrator creates an SD-WAN rule for this application with 'best quality' strategy and both MPLS and broadband as members. The SLA for MPLS is configured with latency < 10 ms and jitter < 5 ms. The SLA for broadband is configured with latency < 50 ms and jitter < 20 ms. The actual measured latency on MPLS is 12 ms, and jitter is 4 ms. The broadband latency is 25 ms, jitter 10 ms. Which path will the application traffic take?

A.The traffic will use the broadband link because MPLS SLA fails and broadband SLA is met.
B.The traffic will be load-balanced between MPLS and broadband.
C.The traffic will use the MPLS link because it is the preferred member.
D.The traffic will be dropped because no link meets the SLA.
AnswerA

SD-WAN failover to broadband.

Why this answer

The SD-WAN rule uses the 'best quality' strategy, which selects the member with the best SLA performance. The MPLS link fails its SLA because its measured latency of 12 ms exceeds the configured threshold of 10 ms, even though jitter is within limits. The broadband link meets both its latency (25 ms < 50 ms) and jitter (10 ms < 20 ms) thresholds, so it becomes the active path for the application traffic.

Exam trap

The trap here is that candidates assume MPLS is always preferred due to its lower latency profile, but the 'best quality' strategy strictly enforces SLA thresholds, and a link that fails its SLA is excluded from selection regardless of its absolute performance.

How to eliminate wrong answers

Option B is wrong because 'best quality' strategy does not perform load-balancing; it selects a single best path based on SLA compliance and performance metrics. Option C is wrong because MPLS is not inherently preferred; the rule treats both members equally, and MPLS is disqualified due to SLA failure. Option D is wrong because the broadband link meets its SLA thresholds, so traffic is not dropped.

Practice this question →
74
Drag & Dropmedium

Drag and drop the steps to troubleshoot a FortiGate SSL VPN connection failure into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Start with basic configuration, then user authentication, then policies, then debug, then routing.

Practice this question →
75
MCQmedium

A FortiGate administrator sees the following output: "diagnose sys session filter dport 443 diagnose sys session list session info: proto=6 proto_state=01 duration=3600 expire=3599" What does this session duration and expire time indicate?

A.The session has a timeout of 7200 seconds (2 hours)
B.The session is about to be torn down
C.The session is newly established
D.The session is using UDP protocol
AnswerA

Duration + expire = total timeout, 3600+3599=7199~7200.

Why this answer

The session duration of 3600 seconds and expire time of 3599 seconds indicate that the session has been active for 3600 seconds and has 3599 seconds remaining before timeout. Since the total timeout is the sum of duration and expire time (3600 + 3599 = 7199, approximately 7200 seconds), this matches the default TCP session timeout of 7200 seconds (2 hours) on FortiGate. The 'proto_state=01' confirms a TCP session in established state, and the output shows the session is still valid with a long remaining lifetime.

Exam trap

The trap here is that candidates often misinterpret 'duration' and 'expire' as independent values rather than recognizing that their sum equals the total session timeout, leading them to incorrectly assume the session is about to expire or is newly established.

How to eliminate wrong answers

Option B is wrong because the expire time of 3599 seconds is very large, indicating the session is far from being torn down; a session about to be torn down would have an expire time near 0. Option C is wrong because the duration of 3600 seconds shows the session has been active for an hour, not newly established; a newly established session would have a duration near 0. Option D is wrong because 'proto=6' explicitly indicates TCP (protocol 6), not UDP (protocol 17), and the 'proto_state=01' is a TCP state flag.

Practice this question →
Page 1 of 3 · 193 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Nse7 Advanced Networking questions.

Start 20-question session