View Full Fortinet FCSS_NST_SE-7.6 Exam Dumps and Practice Test Dumps

 

Q221. What is the primary purpose of BGP route dampening?

1) To reduce instability caused by frequently flapping routes
2) To increase available bandwidth
3) To encrypt BGP updates
4) To create additional BGP neighbors

Correct Answer: 1)

Explanation:
BGP route dampening is designed to reduce the impact of unstable routes that repeatedly go up and down. Frequent route changes can cause excessive routing updates and unnecessary convergence throughout a network. Dampening can temporarily suppress routes that exhibit repeated instability and allow them to become usable again after the network stabilizes. On FortiGate, understanding route stability is important when troubleshooting BGP environments with unreliable links. Administrators should use dampening carefully because aggressive suppression can delay legitimate route recovery and may hide underlying connectivity problems.

Q222. Which BGP attribute is normally preferred when its value is higher?

1) MED
2) AS Path length
3) Local Preference
4) Origin

Correct Answer: 3)

Explanation:
BGP Local Preference is generally preferred when it has a higher value. It is used within an autonomous system to influence the preferred exit point for outbound traffic. Because Local Preference can be propagated through iBGP, administrators can apply consistent outbound path-selection policies across internal BGP routers. A higher value indicates a more preferred route. On FortiGate, checking Local Preference is useful when multiple BGP paths exist and traffic unexpectedly leaves through a particular WAN or external connection. Other attributes still participate in the overall best-path process.

Q223. Which BGP attribute is generally preferred when its value is lower?

1) Local Preference
2) MED
3) Weight
4) Router ID

Correct Answer: 2)

Explanation:
The Multi-Exit Discriminator, or MED, is generally preferred when its value is lower, assuming the relevant BGP comparison conditions apply. MED can be used to suggest which connection an external autonomous system should use when multiple links exist between the same autonomous systems. This makes MED useful for influencing inbound traffic. On FortiGate, administrators should remember that MED is only one component of BGP path selection and may not always determine the final route. Troubleshooting should therefore include examining other BGP attributes and the overall neighbor configuration.

Q224. What is the purpose of BGP communities?

1) To group routes so that routing policies can be applied consistently
2) To replace IP addresses
3) To establish VPN encryption
4) To monitor interface temperature

Correct Answer: 1)

Explanation:
BGP communities are attributes that allow routes to be logically grouped and identified for routing-policy purposes. An administrator can assign a community to selected routes and then use routing policies to treat those routes differently. For example, certain routes can be tagged for preferred handling, filtering, or special advertisement behavior. Communities are especially useful in large routing environments because they reduce the need to match every network individually. On FortiGate, communities can support flexible BGP policy design when multiple routes require consistent treatment.

Q225. What does a BGP route reflector client relationship help simplify?

1) Large-scale iBGP deployments
2) Physical cabling
3) SSL inspection certificates
4) DNS forwarding

Correct Answer: 1)

Explanation:
Route reflector client relationships simplify large iBGP deployments by reducing the need for a complete mesh of direct iBGP sessions. Clients establish BGP sessions with route reflectors, which then distribute appropriate routing information among the participating routers. This can significantly reduce configuration complexity as the number of internal BGP speakers grows. On FortiGate, route-reflector designs can help organizations scale internal BGP routing while maintaining manageable neighbor relationships. Administrators should carefully plan reflector placement and client relationships to avoid unnecessary routing dependencies.

Q226. What is the purpose of BGP graceful restart?

1) To help preserve forwarding during certain temporary control-plane interruptions
2) To increase Internet bandwidth
3) To disable BGP timers
4) To prevent all route withdrawals permanently

Correct Answer: 1)

Explanation:
BGP graceful restart can help maintain forwarding during certain temporary control-plane interruptions by allowing routes to remain usable while the BGP process or routing control plane restarts. This can reduce the impact of brief control-plane disruptions and prevent unnecessary traffic interruption. The feature depends on cooperation and support between BGP peers. On FortiGate, graceful-restart behavior should be considered when designing highly available routing environments. It does not eliminate the need for proper failure detection, and it should not be treated as a substitute for reliable network connectivity.

Q227. Which BGP message is used to exchange routing information between peers?

1) UPDATE
2) OPEN
3) KEEPALIVE
4) NOTIFICATION

Correct Answer: 1)

Explanation:
The BGP UPDATE message is used to advertise new routes, withdraw routes, and communicate path attributes between BGP peers. OPEN messages establish the BGP session parameters, KEEPALIVE messages maintain the session, and NOTIFICATION messages report errors or terminate sessions. Understanding these message types helps administrators interpret BGP behavior during troubleshooting. On FortiGate, if routes are missing from a neighbor, administrators can investigate whether the peer is established and whether the expected prefixes are being exchanged through BGP updates.

Q228. Which BGP message is responsible for establishing session parameters between two peers?

1) UPDATE
2) KEEPALIVE
3) OPEN
4) NOTIFICATION

Correct Answer: 3)

Explanation:
The BGP OPEN message is exchanged after the underlying TCP connection is established. It communicates important session parameters, including the autonomous system number, BGP identifier, hold time, and supported capabilities. If the peers cannot agree on required parameters, the BGP session may fail during establishment. On FortiGate, incorrect autonomous system numbers, neighbor addresses, authentication settings, or incompatible configuration can prevent successful session formation. Reviewing BGP neighbor status and configuration helps determine whether the problem occurs during initial negotiation or later during route exchange.

Q229. What is the primary purpose of a BGP NOTIFICATION message?

1) To report an error condition and potentially terminate the BGP session
2) To advertise a new network prefix
3) To maintain an idle session
4) To calculate WAN latency

Correct Answer: 1)

Explanation:
A BGP NOTIFICATION message informs a peer that an error condition has occurred. Depending on the error, the BGP session may be terminated after the notification is sent. Common categories include message-header errors, OPEN-message errors, update-message errors, and hold-time-related problems. On FortiGate, repeated BGP session resets can sometimes be investigated by examining routing logs and peer status for error information. Understanding NOTIFICATION messages can help administrators distinguish protocol errors from basic network connectivity failures.

Q230. What does the BGP Idle state generally indicate?

1) The BGP process is not currently establishing an active peer session
2) The BGP session is fully established
3) Routes are actively being exchanged
4) The peer is sending continuous updates

Correct Answer: 1)

Explanation:
The Idle state is an initial or inactive BGP state in which the router is not currently maintaining an established session with its configured peer. Several conditions can cause a BGP neighbor to remain or return to Idle, including configuration problems, administrative actions, or failures during session establishment. On FortiGate, administrators should verify the neighbor IP address, local and remote autonomous system numbers, routing reachability, TCP port 179 access, and interface status. Checking these fundamentals helps identify why the peer cannot progress toward an Established state.

Q231. What is the purpose of the BGP Active state?

1) It indicates that BGP is attempting to establish or re-establish connectivity with a peer
2) It confirms that routes are fully synchronized
3) It means the peer has been permanently disabled
4) It indicates that no TCP connection is required

Correct Answer: 1)

Explanation:
The BGP Active state indicates that the router is attempting to establish or re-establish a connection with its configured BGP peer. It does not mean that the BGP session is successfully exchanging routes. Persistent Active-state behavior should prompt administrators to investigate network reachability, TCP port 179 access, neighbor configuration, autonomous system settings, and possible firewall restrictions. On FortiGate, checking the interface and routing path between peers is important because BGP cannot establish a session if the underlying IP connectivity is unavailable.

Q232. Which protocol transport does BGP use for its peer sessions?

1) UDP 53
2) TCP 179
3) UDP 500
4) TCP 443

Correct Answer: 2)

Explanation:
BGP uses TCP port 179 to establish reliable peer sessions. TCP provides reliable, ordered delivery of BGP messages and avoids requiring BGP itself to implement packet-retransmission mechanisms. When troubleshooting BGP connectivity, administrators should therefore verify that TCP port 179 is reachable between the configured peers. On FortiGate, firewall policies, local-in policies, routing, interface access, and security controls may affect BGP connectivity. A blocked TCP 179 connection can prevent a correctly configured BGP neighbor from progressing beyond the initial connection stages.

Q233. Why might a BGP route be received from a neighbor but not installed in the routing table?

1) The route may lose the best-path comparison or fail next-hop resolution
2) The firewall always rejects BGP routes
3) BGP routes never enter routing tables
4) The route must always use a static gateway

Correct Answer: 1)

Explanation:
Receiving a BGP route does not automatically mean that the route will become the active route in the routing table. The route may lose the BGP best-path comparison to another candidate, or its next hop may not be reachable. Filtering and routing policies can also affect route installation. On FortiGate, administrators should inspect received BGP routes, their attributes, next-hop information, route filters, and the current routing table. This provides a more complete picture than simply checking whether the BGP neighbor has advertised the prefix.

Q234. What is the purpose of BGP next-hop information?

1) It identifies the address that should be used to reach the advertised destination
2) It identifies the administrator who created the route
3) It specifies the firewall’s serial number
4) It determines antivirus scan priority

Correct Answer: 1)

Explanation:
The BGP next-hop attribute identifies the address that a router should use to reach the advertised destination. The receiving router must be able to resolve that next hop through its routing information before it can use the route for forwarding. Incorrect or unreachable next-hop information can therefore prevent an otherwise valid BGP route from becoming usable. On FortiGate, administrators troubleshooting BGP should verify next-hop reachability whenever routes appear to be received but are not installed or used.

Q235. What is route aggregation intended to accomplish?

1) Represent multiple more-specific routes with a broader summary prefix
2) Increase the number of routing entries
3) Disable dynamic routing
4) Encrypt routing protocols

Correct Answer: 1)

Explanation:
Route aggregation, also called route summarization, combines multiple more-specific networks into a broader summary prefix. This can reduce the number of routing entries exchanged between routing domains and simplify routing tables. Smaller routing tables can also reduce the amount of routing information that must be processed. On FortiGate, administrators should ensure that summarized prefixes accurately represent reachable networks and understand how summary routes interact with more-specific routes. Poorly planned summarization can cause traffic to be sent toward destinations that are not actually reachable.

Q236. What is a potential disadvantage of overly broad route summarization?

1) It can cause traffic to be directed toward a summary even when a specific destination is unavailable
2) It automatically encrypts traffic
3) It prevents all routing convergence
4) It disables interface monitoring

Correct Answer: 1)

Explanation:
Overly broad route summarization can hide important differences between individual networks. A summary may remain advertised even when one or more specific destinations inside that summary are unavailable. As a result, traffic can be directed toward a device that does not actually have a usable path to the intended destination. On FortiGate, administrators should carefully design summary boundaries and consider how specific routes are withdrawn during failures. Combining appropriate summarization with accurate failover and routing policies helps maintain predictable traffic forwarding.

Q237. What is the purpose of an IP SLA or performance-based health check in an SD-WAN design?

1) To measure WAN path performance and determine whether a link meets defined requirements
2) To create BGP autonomous systems
3) To replace firewall policies
4) To assign user passwords

Correct Answer: 1)

Explanation:
Performance-based health checks allow SD-WAN to evaluate characteristics of WAN paths such as latency, jitter, packet loss, or availability. These measurements can then be compared against configured service-level thresholds. If a path no longer meets the required performance, SD-WAN policies can select another suitable path. On FortiGate, this capability helps applications use WAN connections that satisfy their performance requirements rather than simply choosing an interface based on availability. Proper health-check targets and thresholds are essential for accurate path decisions.

Q238. What can happen when an SD-WAN member consistently fails its configured performance SLA?

1) The member may become ineligible for rules requiring that SLA
2) The member automatically receives higher priority
3) All firewall policies are deleted
4) BGP is permanently disabled

Correct Answer: 1)

Explanation:
When an SD-WAN member consistently fails the performance requirements defined by an SLA, SD-WAN rules can stop selecting that member for traffic that requires the failed performance criteria. This allows applications to move toward another path that better satisfies their requirements. The exact behavior depends on the configured SD-WAN rule and available members. On FortiGate, administrators should review health-check results, SLA thresholds, rule order, and member status when traffic unexpectedly moves between WAN links.

Q239. Why should SD-WAN rules be ordered carefully?

1) Earlier matching rules can determine how traffic is steered before later rules are evaluated
2) Rule order affects only interface naming
3) Later rules always override earlier rules
4) Rule order has no impact on traffic selection

Correct Answer: 1)

Explanation:
SD-WAN rules are evaluated according to their configured order and matching conditions. If a broad rule is placed before a more specific application or destination rule, the broad rule may capture traffic before the intended specific rule can apply. This can produce unexpected WAN path selection. On FortiGate, administrators should place more specific policies appropriately and verify source, destination, application, service, and SLA criteria. Reviewing rule order is an important troubleshooting step when SD-WAN traffic does not follow the expected path.

Q240. Which combination provides the strongest basis for troubleshooting unexpected SD-WAN path selection?

1) SD-WAN rules, member status, SLA results, routing information, and application matching
2) Only the firewall hostname
3) Only the administrator password
4) Only the device serial number

Correct Answer: 1)

Explanation:
Unexpected SD-WAN path selection can result from several interacting components. Administrators should review the matching SD-WAN rule, member availability, performance SLA results, routing information, and application identification. A path may be available but excluded because it fails an SLA, or traffic may match a different rule than expected. On FortiGate, examining these elements together provides a more accurate troubleshooting picture than checking interface status alone. A systematic review helps identify whether the issue originates from routing, application classification, SD-WAN policy matching, or WAN performance.