NSE7 Advanced Networking and SD-WAN Practice Question
What is the purpose of configuring BFD (Bidirectional Forwarding Detection) on a FortiGate?
⚠ Common exam trap
A common mix-up: candidates confuse BFD with routing protocol features like authentication or load balancing, but BFD is exclusively a fast failure detection mechanism that works alongside, not instead of, routing protocols.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To provide rapid failure detection between two forwarding engines.
BFD (Bidirectional Forwarding Detection) provides sub-second failure detection between two forwarding engines, such as FortiGate peers running OSPF or BGP. It operates independently of the routing protocol, using a lightweight hello mechanism to detect link or neighbor failures faster than protocol-native timers (e.g., OSPF dead interval of 40 seconds). This enables rapid convergence in SD-WAN and advanced networking scenarios.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
To provide rapid failure detection between two forwarding engines.
Why this is correct
BFD runs a lightweight, sub-second hello exchange directly between forwarding engines, independent of routing protocol timers. This satisfies the stem's requirement for rapid failure detection, letting OSPF or BGP tear down a dead neighbour far sooner than default dead intervals would allow.
- ✗
To load balance traffic across multiple links.
Why it's wrong here
BFD detects link or path failure rapidly by exchanging hello packets with a peer, so it informs routing convergence rather than distributing sessions across links. It is tempting because fast failure detection supports ECMP failover, but load balancing itself is performed by ECMP or SD-WAN rules, not BFD.
- ✗
To encrypt BGP updates between peers.
Why it's wrong here
BGP update confidentiality comes from TCP MD5 signatures or IPsec, which encrypt and authenticate the session itself. BFD packets are unencrypted and only signal liveness. It is tempting because BFD is often enabled on the same BGP peering interfaces, but encryption is the right choice when peers traverse untrusted networks.
- ✗
To authenticate OSPF neighbors.
Why it's wrong here
OSPF neighbour authentication uses key chains or MD5/SHA hashes in the OSPF interface configuration; BFD carries no authentication fields and only exchanges detection timers. It is tempting because both features are configured per interface alongside OSPF, but authentication is the correct choice when you must verify neighbour identity.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 718 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.