View Full Fortinet FCSS_NST_SE-7.6 Exam Dumps and Practice Test Dumps

 

Q261. Which BGP attribute is commonly used to influence the preferred outbound path within an autonomous system?

1) MED
2) AS Path
3) Local Preference
4) Origin

Correct Answer: 3)

Explanation:

Local Preference is a BGP attribute used within an autonomous system to influence which exit path is preferred for outbound traffic. A higher Local Preference value is generally preferred over a lower value. Because the attribute is distributed through iBGP, it can help maintain consistent outbound path selection across routers in the same autonomous system. Administrators commonly use Local Preference when multiple Internet or external connections are available and one connection should be preferred. It differs from MED, which is primarily used to influence inbound path selection from neighboring autonomous systems.

Q262. Which BGP attribute can be used to influence how an external autonomous system selects an inbound path toward your network?

1) MED
2) Local Preference
3) Weight
4) Originator ID

Correct Answer: 1)

Explanation:

The Multi-Exit Discriminator, or MED, can be used to communicate a preferred entry point into an autonomous system when multiple connections exist between the same neighboring autonomous systems. A lower MED is generally preferred when comparing otherwise suitable routes from the same neighboring AS. MED is therefore useful for influencing inbound traffic decisions made by another autonomous system. It is important to distinguish MED from Local Preference. Local Preference is normally used internally to influence outbound traffic, while MED can provide information to an external neighbor about the preferred inbound path.

Q263. What is the primary purpose of BGP AS Path prepending?

1) Increase available bandwidth
2) Make a route appear less preferred to external BGP neighbors
3) Encrypt routing updates
4) Reduce the number of BGP neighbors

Correct Answer: 2)

Explanation:

BGP AS Path prepending intentionally adds additional copies of the local autonomous system number to the AS Path of an advertised route. Because BGP generally prefers shorter AS Paths, prepending can make a particular route appear less attractive to external networks. This technique is commonly used to influence inbound traffic when an organization has multiple external connections. It does not guarantee a particular traffic path because other BGP attributes and routing policies may take precedence. AS Path prepending should therefore be used carefully and verified by examining the routes received by external neighbors.

Q264. Which BGP mechanism helps prevent a route from being accepted if its own autonomous system number appears in the AS Path?

1) Route reflection
2) AS Path loop prevention
3) BFD
4) Graceful restart

Correct Answer: 2)

Explanation:

BGP uses the AS Path attribute as one mechanism for preventing routing loops between autonomous systems. When a BGP router receives an advertisement, it can examine the AS Path to determine whether its own autonomous system number is already present. If the local AS is found in the path, the route is normally rejected because accepting it could create a routing loop. This behavior is especially important in eBGP environments where routes can travel through multiple autonomous systems. AS Path loop prevention is fundamental to maintaining stable inter-domain routing and does not depend on BFD or graceful restart.

Q265. What is the main purpose of BGP graceful restart?

1) Reduce route table size
2) Allow forwarding to continue during certain control-plane restarts
3) Replace TCP
4) Automatically summarize routes

Correct Answer: 2)

Explanation:

BGP graceful restart is designed to reduce traffic disruption when a BGP-speaking router experiences certain control-plane restarts. During a restart, forwarding can potentially continue using previously learned routes while the BGP session and routing information are re-established. This can help reduce unnecessary route withdrawals and traffic interruption. The effectiveness of graceful restart depends on support and configuration across participating devices. It does not replace TCP, reduce the number of routes through summarization, or provide encryption. Administrators should understand the restart behavior of neighboring devices when deploying graceful restart in resilient routing environments.

Q266. Which BGP message is primarily used to exchange routing information after a BGP session has been established?

1) OPEN
2) NOTIFICATION
3) UPDATE
4) KEEPALIVE

Correct Answer: 3)

Explanation:

The BGP UPDATE message carries routing information between BGP neighbors. It can advertise new network prefixes and withdraw routes that are no longer available. The UPDATE message can also contain path attributes used during route selection, such as AS Path, Next Hop, Local Preference, and MED. The OPEN message establishes the BGP session parameters, while KEEPALIVE messages maintain the session. NOTIFICATION messages report errors and can terminate a session. Understanding the purpose of each BGP message type is important when troubleshooting neighbor establishment, route advertisement, withdrawals, and session failures.

Q267. What is the primary purpose of a BGP OPEN message?

1) Establish BGP session parameters with a neighbor
2) Advertise every routing prefix
3) Monitor interface bandwidth
4) Perform NAT translation

Correct Answer: 1)

Explanation:

The BGP OPEN message is exchanged after the initial TCP connection is established and is used to establish the BGP session between two peers. It communicates important session information such as the autonomous system number, BGP identifier, and hold-time-related parameters. After successful OPEN message processing, the peers can proceed to exchange routing information using UPDATE messages. KEEPALIVE messages are subsequently used to maintain the session. If an error occurs during negotiation, a NOTIFICATION message may be generated. Understanding the BGP message sequence helps administrators diagnose problems with neighbor establishment and session negotiation.

Q268. What happens when a BGP router sends a NOTIFICATION message to a neighbor?

1) It permanently disables all routing
2) It reports a BGP error and typically terminates the session
3) It advertises all local routes
4) It increases the hold timer

Correct Answer: 2)

Explanation:

A BGP NOTIFICATION message is used to report an error condition to a BGP neighbor. In many cases, sending a NOTIFICATION results in termination of the BGP session because the detected error prevents normal operation. The message includes information that can help identify the category of failure, such as malformed messages, configuration problems, or unacceptable session parameters. Administrators should examine BGP logs and diagnostic output when NOTIFICATION messages appear repeatedly. The message is not used for normal route advertisement or keepalive operation. It is primarily an error-reporting mechanism that helps identify serious BGP session problems.

Q269. Which TCP port does BGP normally use for its sessions?

1) 22
2) 53
3) 179
4) 443

Correct Answer: 3)

Explanation:

BGP normally establishes its transport sessions using TCP port 179. Using TCP provides reliable delivery of BGP protocol messages between neighbors. When troubleshooting a BGP session, administrators should verify that the required IP connectivity exists and that security policies or access controls are not blocking TCP port 179. If the peers cannot establish the TCP connection, BGP will not progress through the normal session states. Port 22 is commonly associated with SSH, port 53 with DNS, and port 443 with HTTPS. Therefore, checking TCP 179 connectivity is an important step in BGP troubleshooting.

Q270. A BGP neighbor remains in the Active state. What should an administrator investigate first?

1) TCP connectivity and reachability to the neighbor
2) DNS web-filter categories
3) Antivirus signatures
4) User password complexity

Correct Answer: 1)

Explanation:

A BGP neighbor in the Active state generally indicates that the router is attempting to establish the BGP session but has not successfully completed the required connection process. Administrators should first verify IP reachability and TCP connectivity to the configured neighbor address. They should also check whether a firewall policy or access control is blocking TCP port 179. Additional checks include the neighbor IP, local and remote AS numbers, update-source settings, and multihop requirements. Investigating basic connectivity before changing routing policies helps identify whether the problem is a transport-level failure or a BGP configuration issue.

Q271. What is the purpose of BGP route dampening?

1) Suppress unstable routes that repeatedly flap
2) Increase the number of BGP updates
3) Encrypt routing information
4) Force all routes to use one neighbor

Correct Answer: 1)

Explanation:

BGP route dampening is designed to reduce the impact of unstable routes that repeatedly appear and disappear from the routing system. Repeated route changes can generate excessive BGP updates and cause unnecessary routing-table recalculations. Dampening assigns penalties to routes that flap and can temporarily suppress routes that become sufficiently unstable. After the route becomes stable and the penalty decays, it can become eligible again. Administrators should configure dampening carefully because aggressive settings may suppress routes that are actually important. The mechanism is intended to improve routing stability rather than increase update frequency or provide security.

Q272. What does a BGP prefix-list primarily control?

1) Which network prefixes are permitted or denied
2) Which users can authenticate
3) Which applications are inspected
4) Which VPN encryption algorithm is selected

Correct Answer: 1)

Explanation:

A BGP prefix-list provides a structured method for permitting or denying specific network prefixes. It can be applied to routing policies to control which routes are accepted from or advertised to BGP neighbors. Prefix-lists can match prefixes using network addresses and prefix lengths, allowing administrators to create precise routing filters. They are commonly combined with route maps or other routing-policy mechanisms to control route advertisements and attributes. Proper prefix filtering is important for preventing unintended route propagation, limiting routing-table exposure, and maintaining predictable routing behavior between autonomous systems.

Q273. What is the main function of a route map in BGP policy configuration?

1) Apply conditional matching and actions to routes
2) Replace the BGP routing table
3) Establish TCP connections
4) Create physical WAN interfaces

Correct Answer: 1)

Explanation:

A route map provides flexible policy control over routing information. It can match characteristics such as prefixes, communities, or other route attributes and then apply actions such as permitting or denying a route or modifying selected attributes. Route maps are frequently used with BGP to implement routing policies that are more sophisticated than simple prefix filtering. For example, an administrator can match selected prefixes and modify their Local Preference or MED. Because route-map behavior can depend on sequence order and matching conditions, careful configuration and testing are important to avoid unintentionally changing route advertisements.

Q274. What is the primary advantage of using a BGP route reflector?

1) Reduce the requirement for a full iBGP mesh
2) Encrypt all routing traffic
3) Replace external BGP
4) Eliminate the need for route filtering

Correct Answer: 1)

Explanation:

A BGP route reflector reduces the requirement for every iBGP router in an autonomous system to maintain a direct session with every other iBGP router. Instead, selected routers act as route reflectors and distribute routes to their clients. This significantly simplifies the design of large iBGP networks and reduces the number of required sessions. Route reflectors also use mechanisms such as Originator ID and Cluster List to help prevent routing loops. They do not provide encryption or eliminate the need for routing policies. Proper route-reflector placement and redundancy are important considerations in large network deployments.

Q275. What does the BGP NEXT_HOP attribute identify?

1) The next-hop address that should be used to reach the advertised destination
2) The administrator’s login address
3) The DNS server address
4) The VPN encryption key

Correct Answer: 1)

Explanation:

The BGP NEXT_HOP attribute identifies the IP address that should be used as the next hop when forwarding traffic toward the advertised network. Correct next-hop reachability is essential because a route may be received through BGP but still fail to become usable if its next hop cannot be resolved. During troubleshooting, administrators should inspect both the BGP route and the underlying routing table to confirm that the next-hop address is reachable. Problems with next-hop handling can lead to routes being rejected, marked unusable, or not installed in the forwarding table.

Q276. What is the main benefit of BGP route aggregation?

1) Reduce the number of individual prefixes advertised
2) Increase the number of routing updates
3) Disable route filtering
4) Replace all security policies

Correct Answer: 1)

Explanation:

BGP route aggregation combines multiple more-specific networks into a summarized prefix when appropriate. This can reduce the number of individual routes advertised between routers and help decrease routing-table size and update overhead. Aggregation can also hide internal topology details and improve routing stability because changes to individual more-specific networks may not always need to be propagated externally. However, administrators must design summaries carefully because an overly broad summary can attract traffic for destinations that are not actually reachable. Proper aggregation should therefore balance route-table efficiency with accurate reachability information.

Q277. What is a potential problem with overly broad BGP route summarization?

1) It can attract traffic for destinations that are not actually reachable
2) It always improves routing accuracy
3) It prevents all BGP sessions
4) It automatically increases bandwidth

Correct Answer: 1)

Explanation:

Overly broad route summarization can cause traffic to be directed toward a network even when the specific destination is unavailable. If a summary route remains active while one or more underlying networks are no longer reachable, other routers may continue sending traffic toward the summarizing device. This can create blackholing or inefficient forwarding. Administrators should therefore ensure that summary routes accurately represent reachable destinations and consider appropriate discard or blackhole routes where required. Route aggregation is useful for reducing routing complexity, but it must be designed carefully to avoid creating misleading reachability information.

Q278. What should an administrator check when an SD-WAN member repeatedly fails its configured SLA?

1) Latency, jitter, packet loss, and health-check destination
2) Only the administrator username
3) The firewall hostname only
4) The number of local user accounts

Correct Answer: 1)

Explanation:

When an SD-WAN member repeatedly fails its SLA, administrators should investigate the measured performance values and verify the health-check destination. High latency, excessive jitter, or packet loss can cause the member to fail the configured thresholds even when the physical interface remains operational. The administrator should also verify whether the monitored destination itself is stable and reachable through the intended path. Reviewing logs, SLA measurements, interface statistics, and routing information can help determine whether the problem is caused by the WAN connection, the monitoring target, or incorrect threshold configuration.

Q279. Which SD-WAN behavior can occur when a preferred WAN member no longer satisfies the required performance SLA?

1) Traffic can be moved to another eligible member
2) All firewall policies are deleted
3) BGP is permanently disabled
4) The device automatically removes its IP address

Correct Answer: 1)

Explanation:

SD-WAN can select another eligible WAN member when the preferred path no longer satisfies the configured performance requirements. For example, if a link exceeds the allowed latency or packet-loss threshold, an SD-WAN rule may choose another member that provides acceptable performance. This dynamic behavior allows traffic to respond to changing WAN conditions rather than relying only on static interface status. The exact result depends on the SD-WAN rule, member configuration, SLA status, and available paths. Administrators should therefore review all these components when troubleshooting unexpected failover or path selection.

Q280. Which sequence provides the most useful approach when troubleshooting an unexpected SD-WAN forwarding decision?

1) Reboot the FortiGate and ignore routing information
2) Check only the interface speed
3) Review matching policy, routing table, SD-WAN rule, SLA status, and selected member
4) Disable all WAN links

Correct Answer: 3)

Explanation:

Troubleshooting an unexpected SD-WAN forwarding decision should follow the actual forwarding process. First, verify that the traffic matches the intended firewall policy. Next, inspect the routing table to confirm the available destination routes. Then review the SD-WAN rule and determine which conditions matched the traffic. Finally, check member availability and performance SLA results to understand why a specific WAN path was selected. This approach helps distinguish between policy problems, routing problems, and SD-WAN steering decisions. Reviewing the entire decision chain is more reliable than changing configuration without first identifying the component responsible for the unexpected behavior.