View Full Fortinet FCSS_NST_SE-7.6 Exam Dumps and Practice Test Dumps

 

Q321. What is the primary purpose of the BGP Local Preference attribute?

1) To influence the preferred outbound path within an autonomous system
2) To encrypt BGP routing updates
3) To determine the TCP port used by BGP
4) To identify the physical interface carrying traffic

Correct Answer: 1)

Explanation:

BGP Local Preference is used to influence which outbound path routers inside an autonomous system prefer when multiple BGP routes are available. A higher Local Preference value is generally preferred. Because the attribute is propagated through iBGP, it allows routers within the same autonomous system to apply a consistent exit-path policy. Local Preference is different from MED, which is commonly used to influence how another autonomous system selects an entry point. When troubleshooting outbound routing decisions, administrators should inspect Local Preference along with other BGP attributes such as weight, AS Path, origin, MED, and next-hop reachability.

Q322. Which BGP attribute is commonly used to influence how external networks choose an inbound path toward your organization?

1) Local Preference
2) MED
3) Weight
4) Router ID

Correct Answer: 2)

Explanation:

MED, or Multi-Exit Discriminator, can be used to influence how a neighboring autonomous system selects between multiple entry points into your network. A lower MED is generally preferred when the relevant comparison conditions are met. This makes MED useful when an organization has multiple links to the same external autonomous system and wants to communicate which link should normally receive incoming traffic. Local Preference primarily influences outbound path selection within an autonomous system, while weight is generally local to a router. MED should therefore be considered when troubleshooting or designing inbound traffic engineering across multiple external connections.

Q323. What is BGP AS Path prepending primarily used for?

1) Increasing the apparent AS path length to influence inbound route selection
2) Encrypting BGP packets
3) Reducing the number of BGP neighbors
4) Increasing Local Preference automatically

Correct Answer: 1)

Explanation:

BGP AS Path prepending involves intentionally adding one or more instances of the local autonomous system number to a route’s AS Path. This makes the path appear longer to external networks and can influence their BGP best-path selection. Because a shorter AS Path is generally preferred when other relevant attributes are equal, prepending can make one advertised path less attractive than another. It is commonly used for inbound traffic engineering when an organization has multiple Internet or external connections. AS Path prepending does not encrypt BGP traffic, reduce neighbor counts, or directly modify Local Preference.

Q324. Why does BGP use the AS Path attribute for loop prevention?

1) Routers reject routes containing their own AS number in the AS Path
2) Routers always prefer the longest AS Path
3) AS Path determines the physical cable used
4) AS Path encrypts routing information

Correct Answer: 1)

Explanation:

The BGP AS Path attribute helps prevent routing loops between autonomous systems. When a BGP route is advertised through an autonomous system, that AS number is added to the route’s AS Path. If a BGP router later receives a route advertisement containing its own autonomous system number, it can recognize that the route has already passed through the same AS and reject it. This prevents routes from circulating indefinitely between autonomous systems. AS Path is also an important path-selection attribute because, under applicable conditions, a shorter path is generally preferred over a longer one.

Q325. What is a key benefit of BGP graceful restart?

1) It can help preserve forwarding during certain temporary control-plane restarts
2) It permanently removes failed routes
3) It disables BGP authentication
4) It converts BGP into static routing

Correct Answer: 1)

Explanation:

BGP graceful restart is designed to reduce routing disruption when a BGP-speaking device or routing process experiences a temporary restart. Under supported conditions, forwarding can continue using previously learned routing information while the BGP session and routing information are being reestablished. This can reduce the impact of short control-plane interruptions. Graceful restart does not permanently remove routes or replace BGP with static routing. Its effectiveness depends on support and compatible configuration on the participating devices. Administrators should understand the graceful-restart timers and stale-route behavior because incorrect settings can potentially retain outdated routes longer than intended.

Q326. Which BGP message is primarily responsible for advertising new routes and withdrawing previously advertised routes?

1) OPEN
2) KEEPALIVE
3) UPDATE
4) NOTIFICATION

Correct Answer: 3)

Explanation:

The BGP UPDATE message carries routing information between BGP peers. It can advertise new network prefixes and associated path attributes, while also withdrawing routes that are no longer reachable or should no longer be advertised. OPEN messages establish the BGP session and negotiate capabilities, KEEPALIVE messages maintain the session, and NOTIFICATION messages report errors that can cause the session to close. Understanding the function of each BGP message is useful when troubleshooting neighbor relationships. If a session is established but expected prefixes are not being exchanged, examining routing policies and UPDATE-related information can help identify the problem.

Q327. Which BGP message is exchanged when two peers establish a BGP session and negotiate session parameters?

1) UPDATE
2) OPEN
3) KEEPALIVE
4) NOTIFICATION

Correct Answer: 2)

Explanation:

The BGP OPEN message is exchanged after the underlying TCP connection is established. It allows the peers to identify themselves and negotiate important session parameters, including the autonomous system information, BGP identifier, and hold-time-related information. If the OPEN message is rejected because of incompatible parameters or configuration problems, the BGP session may not progress to the Established state. UPDATE messages are used for route exchange after the session is established, while KEEPALIVE messages maintain the session. NOTIFICATION messages are used to report errors. Reviewing OPEN-related information can therefore help troubleshoot session-establishment failures.

Q328. What is the primary purpose of a BGP NOTIFICATION message?

1) To advertise a new network prefix
2) To maintain an idle session
3) To report a BGP error and terminate the session
4) To calculate the shortest AS Path

Correct Answer: 3)

Explanation:

A BGP NOTIFICATION message is used to report a protocol error or other serious condition. When a BGP speaker sends a NOTIFICATION, the BGP session is generally terminated. Error information can help administrators determine why a neighbor relationship failed, such as an incorrect message format, unsupported parameter, authentication problem, or other protocol violation. UPDATE messages handle route advertisements and withdrawals, while KEEPALIVE messages maintain an established session. When troubleshooting a BGP session that repeatedly disconnects, reviewing the reported notification error can provide an important clue about the underlying configuration or protocol problem.

Q329. Which transport protocol and port does BGP normally use for its neighbor sessions?

1) UDP port 179
2) TCP port 179
3) TCP port 443
4) UDP port 500

Correct Answer: 2)

Explanation:

BGP normally establishes its routing sessions using TCP port 179. TCP provides reliable, ordered delivery for BGP messages, allowing the protocol to exchange routing information without implementing its own transport reliability mechanism. UDP port 179 is not the standard transport for BGP. TCP 443 is commonly associated with HTTPS, while UDP 500 is commonly used for IKE in IPsec VPN negotiations. When troubleshooting BGP connectivity, administrators should verify that TCP port 179 is permitted between the configured peer addresses and that routing and interface reachability exist in both directions.

Q330. A BGP neighbor remains in the Active state. What should an administrator investigate first?

1) Whether TCP connectivity to the BGP peer can be established
2) Whether the web filter blocks a website
3) Whether DNS has an MX record
4) Whether an antivirus signature is current

Correct Answer: 1)

Explanation:

The BGP Active state often indicates that the router is attempting to establish a TCP connection with its configured neighbor but has not successfully completed the process. Administrators should therefore begin by checking basic IP connectivity between the peers and whether TCP port 179 is reachable. They should also verify the neighbor IP address, local and remote AS numbers, routing to the peer, firewall policies, and any authentication requirements. If the underlying TCP connection cannot be established, BGP cannot progress to the Established state. Troubleshooting the transport layer first can prevent unnecessary changes to higher-level BGP policies.

Q331. What is the purpose of BGP route dampening?

1) To reduce the impact of frequently flapping routes
2) To increase the number of route advertisements
3) To encrypt BGP updates
4) To force every route through one interface

Correct Answer: 1)

Explanation:

BGP route dampening is designed to reduce the impact of routes that repeatedly become reachable and unreachable, a behavior known as route flapping. Frequent changes can generate large numbers of BGP updates and cause instability throughout a network. Dampening assigns penalties to unstable routes and can temporarily suppress routes that exceed configured thresholds. After the route remains stable for an appropriate period, the penalty decreases and the route can become eligible again. Dampening should be configured carefully because overly aggressive settings can suppress legitimate routes for too long. Its purpose is stability, not encryption or permanent route removal.

Q332. What is the primary function of a BGP prefix list?

1) To match and filter specific IP prefixes
2) To establish the TCP connection
3) To calculate interface utilization
4) To synchronize firewall sessions

Correct Answer: 1)

Explanation:

A BGP prefix list is used to match specific network prefixes and control whether those prefixes are accepted or advertised. Administrators can define permitted networks, denied networks, and prefix-length conditions to create precise routing filters. Prefix lists are commonly applied to inbound or outbound BGP policies to prevent unwanted routes from entering or leaving the routing domain. They do not establish BGP sessions or calculate interface utilization. Proper prefix filtering is an important security and stability measure because it can help prevent accidental route advertisements, unauthorized prefixes, and routing-table pollution between neighboring autonomous systems.

Q333. What is a common purpose of a BGP route map?

1) To apply conditional routing policy actions to matched routes
2) To replace the routing table
3) To establish an IPsec tunnel
4) To provide DNS resolution

Correct Answer: 1)

Explanation:

A BGP route map provides a flexible mechanism for applying routing policy actions to routes that match specified conditions. A route map can match attributes such as prefixes, communities, or other routing information and then apply actions such as permitting, denying, modifying attributes, or controlling route advertisements. This makes route maps useful for sophisticated traffic-engineering and filtering requirements. Prefix lists can be used within route-map matching conditions to identify specific networks. Route maps do not replace the routing table or establish VPN tunnels. When designing BGP policies, administrators should ensure that route-map sequence order and permit or deny behavior are carefully reviewed.

Q334. What is the main advantage of using a BGP route reflector?

1) It allows scalable iBGP route distribution without requiring a full mesh
2) It removes the need for routing protocols
3) It converts iBGP into static routing
4) It disables AS Path processing

Correct Answer: 1)

Explanation:

A BGP route reflector improves iBGP scalability by reducing the number of sessions required between internal BGP routers. In a traditional iBGP design, routers generally need a full mesh because routes learned from one iBGP peer are not normally advertised to another iBGP peer. A route reflector can receive routes from clients and reflect appropriate routes to other clients or peers. This significantly simplifies large deployments. Route reflectors do not eliminate routing protocols, disable AS Path processing, or convert BGP into static routing. Their primary value is improving scalability while maintaining controlled internal route distribution.

Q335. What information does the BGP NEXT_HOP attribute provide?

1) The IP address that should be used as the next-hop toward the advertised destination
2) The number of ASes in the route
3) The route’s encryption key
4) The BGP neighbor’s TCP port

Correct Answer: 1)

Explanation:

The BGP NEXT_HOP attribute identifies the IP address that should be used as the next hop when forwarding traffic toward the advertised destination. A route can be present in the BGP table but still fail to become usable if the next-hop address cannot be resolved through the local routing table. This is why next-hop reachability is an important part of BGP troubleshooting. In iBGP designs, next-hop-self may be configured when internal routers need to use the advertising router as the reachable next hop. NEXT_HOP is therefore essential to connecting BGP route information with actual packet-forwarding decisions.

Q336. What is the primary purpose of BGP route aggregation?

1) To combine multiple prefixes into a summarized route
2) To increase the number of individual routing entries
3) To encrypt routing updates
4) To disable route filtering

Correct Answer: 1)

Explanation:

BGP route aggregation combines multiple more-specific prefixes into a summarized or aggregated route. The main benefit is reducing the number of routing entries and advertisements that need to be exchanged between BGP peers. Smaller routing tables can improve scalability and reduce the amount of routing information propagated across the network. However, aggregation must be designed carefully because an overly broad summary can unintentionally attract traffic destined for networks that are not actually reachable. More-specific routes can also affect forwarding through longest-prefix matching. Administrators should therefore balance scalability benefits with accurate route reachability when implementing BGP summarization.

Q337. What is a potential problem with an overly broad BGP summary route?

1) It may attract traffic for destinations that are not actually reachable
2) It automatically encrypts all BGP traffic
3) It prevents TCP from functioning
4) It eliminates the need for route filtering

Correct Answer: 1)

Explanation:

An overly broad BGP summary can advertise reachability for destinations that are not actually available through the summarizing router. Because routers use longest-prefix matching, a summary may attract traffic for addresses that fall within the advertised range even when the specific destination network is unavailable. This can result in blackholing or incorrect traffic forwarding. Administrators should therefore carefully select summary boundaries and use more-specific routes, null routes, or other mechanisms where appropriate. Aggregation is valuable for reducing routing-table size, but it should never be implemented without considering the actual topology and reachability of the summarized address space.

Q338. A FortiGate SD-WAN member is marked unavailable even though its physical interface is up. What should be checked?

1) The SD-WAN performance SLA and health-check results
2) The administrator’s browser history
3) The DNS MX record only
4) The antivirus signature database only

Correct Answer: 1)

Explanation:

An SD-WAN member can have an operational physical interface while still being considered unavailable for SD-WAN path selection. This can happen when the member fails its configured performance SLA or health-check requirements. Administrators should examine the health-check destination, latency, jitter, packet loss, probe success, and configured thresholds. If the performance criteria are not satisfied, FortiGate may remove the member from eligible paths even though the interface itself reports an up state. This distinction is important during troubleshooting because checking only the physical interface status may not reveal why SD-WAN is avoiding the link.

Q339. What is a common reason FortiGate SD-WAN moves traffic from one WAN member to another?

1) The selected member no longer satisfies the configured SD-WAN performance criteria
2) The firewall automatically changes all routes every minute
3) The DNS server changes its hostname
4) The administrator opens a web browser

Correct Answer: 1)

Explanation:

FortiGate SD-WAN can move traffic to another WAN member when the currently preferred member fails the performance criteria defined by an SD-WAN rule or performance SLA. Metrics such as latency, jitter, and packet loss can be monitored to determine whether a link continues to meet application requirements. If the link falls outside the configured thresholds, another eligible member may be selected. This provides dynamic path selection based on actual network conditions rather than relying only on interface status. Administrators troubleshooting unexpected failover should review the SD-WAN rule, member priority, SLA results, and health-check history.

Q340. When troubleshooting unexpected SD-WAN path selection, which sequence is most useful?

1) Check the browser, DNS cache, and antivirus first
2) Check the SD-WAN rule, member eligibility, SLA status, and routing information
3) Reinstall FortiOS immediately
4) Disable all security policies

Correct Answer: 2)

Explanation:

A structured SD-WAN troubleshooting process should begin with the rule that determines which traffic is being evaluated. Next, verify which members are eligible, including their administrative status and SD-WAN performance SLA results. Then inspect routing information and confirm that the selected interface has a valid path toward the destination. Application identification, service rules, member priorities, latency, jitter, and packet-loss thresholds can all influence the final decision. This approach helps isolate whether the unexpected path is caused by policy matching, member availability, performance measurements, or underlying routing. It is generally more effective than making broad configuration changes without identifying the actual decision point.