View Full Fortinet FCSS_NST_SE-7.6 Exam Dumps and Practice Test Dumps

 

Q361. Which BGP attribute is preferred first when FortiGate compares routes learned from different BGP paths?

1) MED
2) Local Preference
3) Weight
4) Origin

Correct Answer: 3)

Explanation:

On FortiGate, BGP Weight is a locally significant attribute that can influence route selection before attributes such as Local Preference are considered. A higher Weight is preferred over a lower Weight. Unlike Local Preference, which can be propagated within an autonomous system through BGP, Weight is generally local to the FortiGate where it is configured. This makes Weight useful when an administrator needs one specific device to prefer a particular route without changing routing preferences across the entire AS. When troubleshooting BGP path selection, administrators should therefore check configured Weight values along with Local Preference, AS Path, Origin, MED, and other relevant attributes.

Q362. What is the main difference between BGP Weight and Local Preference?

1) Weight is local to a device, while Local Preference can influence routing throughout an AS
2) Weight is advertised externally, while Local Preference is never advertised
3) Weight is used only for IPv6, while Local Preference is used only for IPv4
4) Weight always has a lower priority than MED

Correct Answer: 1)

Explanation:

The primary difference is the scope in which the attributes operate. BGP Weight is a local preference mechanism and is applied on the FortiGate itself. It does not normally propagate to other BGP routers. Local Preference, however, is communicated within the autonomous system and is commonly used to influence which exit path internal routers select for outbound traffic. A higher value is generally preferred for both mechanisms. Understanding this distinction is important when designing routing policies because Weight can solve a device-specific requirement, while Local Preference is better suited to establishing a consistent outbound routing preference across multiple routers.

Q363. Which BGP Origin attribute value represents a route learned through a network or route advertisement process considered most preferable among the listed origin types?

1) Incomplete
2) EGP
3) IGP
4) Unknown

Correct Answer: 3)

Explanation:

BGP Origin indicates how a route entered BGP. The standard origin codes are IGP, EGP, and Incomplete. During BGP best-path selection, IGP is preferred over EGP, and EGP is preferred over Incomplete. IGP is commonly associated with routes introduced through a BGP network statement, depending on the platform and configuration. EGP is a historical origin code associated with the former Exterior Gateway Protocol, while Incomplete commonly indicates redistribution or other methods that do not provide an IGP origin. When troubleshooting route selection, checking the Origin attribute can help explain why one otherwise similar route is preferred.

Q364. What is the BGP origin preference order from most preferred to least preferred?

1) Incomplete, EGP, IGP
2) IGP, EGP, Incomplete
3) EGP, Incomplete, IGP
4) IGP, Incomplete, EGP

Correct Answer: 2)

Explanation:

BGP assigns an order of preference to the Origin attribute values. The preferred order is IGP first, EGP second, and Incomplete last. This means that when other important route-selection attributes are equal, a route with an IGP origin is preferred over one with an EGP origin, while EGP is preferred over Incomplete. The Incomplete value is frequently seen when routes enter BGP through redistribution or other mechanisms that do not identify an IGP origin. Administrators should remember that Origin is only one part of the overall BGP best-path process and is evaluated after several higher-priority attributes.

Q365. Which identifier is used to uniquely identify a BGP speaker within its BGP routing process?

1) Router ID
2) Interface MAC address
3) VLAN ID
4) Autonomous System Number

Correct Answer: 1)

Explanation:

The BGP Router ID uniquely identifies a BGP speaker within the BGP process. It is typically represented as a 32-bit value in IPv4 address format. The Router ID is important during BGP session establishment and route-selection processes. On many platforms, it can be manually configured, which is often preferable for predictable operation. If it is not explicitly configured, the device may select an address according to platform-specific rules. Administrators should avoid unnecessary Router ID changes because changing it can cause BGP sessions to reset and may temporarily interrupt routing convergence. Stable Router ID configuration is therefore an important operational practice.

Q366. Why is a stable loopback address often selected as the BGP Router ID?

1) It automatically disables BGP authentication
2) It prevents all routing loops
3) It eliminates the need for an AS number
4) It provides a stable logical address independent of a physical interface

Correct Answer: 4)

Explanation:

A loopback interface provides a logical address that does not depend on the operational state of a particular physical interface. Using a stable loopback address for BGP identification can make routing operations more predictable, especially in environments with multiple physical links or redundant paths. If a physical interface fails, the loopback can remain available as long as routing provides reachability to it. This is particularly useful for BGP sessions that use loopback addresses as their source. A stable Router ID also reduces unexpected BGP process changes and helps administrators maintain consistent identification across routing and troubleshooting operations.

Q367. Which BGP feature allows an eBGP session to be established across multiple IP hops?

1) Route reflector
2) eBGP multihop
3) Local Preference
4) Route dampening

Correct Answer: 2)

Explanation:

By default, eBGP peers are commonly expected to be directly connected, and the standard TTL behavior reflects that assumption. eBGP multihop allows a BGP session to be established when the peers are separated by multiple routed hops. This is particularly useful when routers establish BGP sessions using loopback addresses rather than directly connected physical interfaces. The configured hop limit must be sufficient for the actual path between peers. Administrators should also ensure that routing exists between the peer addresses and that firewalls or security policies permit the required BGP traffic. eBGP multihop is therefore a connectivity feature rather than a route-selection attribute.

Q368. Why might an administrator configure a BGP neighbor to use a loopback address as the update source?

1) To disable TCP communication
2) To prevent all route advertisements
3) To provide a stable source address for the BGP session
4) To replace the autonomous system number

Correct Answer: 3)

Explanation:

Configuring the BGP update source to a loopback interface allows the BGP session to use a stable logical address rather than relying on a particular physical interface. This can be valuable in redundant network designs because multiple physical paths may provide reachability to the loopback. If one physical path fails, routing can potentially use another path while maintaining the same BGP source and destination addresses. When loopbacks are used for eBGP peering, appropriate multihop configuration may also be required. The design must additionally ensure that routing provides reachability to both loopback addresses and that security policies allow the BGP connection.

Q369. What is the relationship between eBGP multihop and the TTL used for an eBGP session?

1) eBGP multihop can increase the permitted hop count for the BGP session
2) eBGP multihop disables TTL processing completely
3) eBGP multihop changes the BGP AS number
4) eBGP multihop is used only for route filtering

Correct Answer: 1)

Explanation:

eBGP multihop modifies the normal TTL behavior so that an eBGP peer can be reached across multiple routed hops. A directly connected eBGP session typically operates with a low TTL expectation, while multihop allows administrators to configure a higher permitted hop count. This is especially relevant when BGP peers are configured using loopback interfaces or when intermediate routers exist between the peers. The configuration must be consistent with the actual network topology. If the TTL or hop count is insufficient, the BGP TCP connection may fail even when basic IP routing appears to be working correctly.

Q370. What is the primary purpose of BFD when it is used with BGP?

1) To exchange complete BGP routing tables
2) To provide faster detection of a failed neighbor or path
3) To replace BGP route policies
4) To perform DNS resolution

Correct Answer: 2)

Explanation:

Bidirectional Forwarding Detection, or BFD, provides rapid detection of forwarding-path failures. When integrated with BGP, BFD can detect a failure much faster than relying solely on normal BGP timers. Once BFD determines that the forwarding path is unavailable, the routing process can react by bringing the associated BGP session down and selecting an alternative path if one exists. This can improve convergence in networks where rapid recovery is important. However, BFD timers should be selected carefully because extremely aggressive settings may create unnecessary session flapping when the network experiences temporary congestion or packet loss.

Q371. What is a key benefit of using BFD with BGP instead of relying only on standard BGP timers?

1) BFD provides faster failure detection
2) BFD eliminates the need for IP routing
3) BFD automatically summarizes all BGP routes
4) BFD changes the BGP autonomous system number

Correct Answer: 1)

Explanation:

BFD is designed specifically for rapid detection of forwarding failures. Standard BGP keepalive and hold timers can detect a failed peer, but their intervals may be too long for environments requiring fast convergence. BFD can operate with much shorter detection intervals and notify the routing process when the forwarding path becomes unavailable. This allows BGP to withdraw routes and select alternative paths sooner. BFD does not replace BGP or determine which routes are best; instead, it complements BGP by improving failure detection. Administrators should verify that both ends support compatible BFD behavior and that the configured timers are appropriate for network conditions.

Q372. What does the BGP Connect state generally indicate?

1) The BGP session has successfully exchanged all routes
2) The router is attempting to establish the underlying TCP connection
3) The router has permanently disabled the neighbor
4) The BGP neighbor has entered graceful restart

Correct Answer: 2)

Explanation:

The BGP Connect state indicates that BGP is attempting to establish the underlying TCP connection with its configured neighbor. BGP uses TCP port 179 for communication, so connectivity problems at the IP or TCP level can prevent the session from progressing to the Established state. When troubleshooting a neighbor stuck in Connect, administrators should verify reachability between peer addresses, routing, interface status, firewall policies, TCP port 179, source-address configuration, and multihop requirements when applicable. Authentication mismatches and incorrect neighbor parameters can also prevent successful session establishment. The Connect state therefore points primarily toward session-establishment troubleshooting.

Q373. What is the primary purpose of the BGP Hold Timer?

1) To determine how long routing entries remain in a static table
2) To limit the number of prefixes a neighbor can advertise
3) To determine how long BGP can go without receiving an expected message before considering the session failed
4) To select the preferred MED value

Correct Answer: 3)

Explanation:

The BGP Hold Timer defines the maximum period during which a BGP speaker can go without receiving a valid BGP message from its neighbor before considering the session unavailable. If the timer expires, the BGP session is typically reset and learned routes are withdrawn. BGP Keepalive messages are normally exchanged periodically to prevent the Hold Timer from expiring when there are no other BGP messages. When troubleshooting unexpected BGP resets, administrators should compare Hold Timer and Keepalive values on both peers and review logs for connectivity failures, packet loss, or configuration mismatches that could cause messages to stop arriving.

Q374. Which mechanism allows a BGP router to request routing updates without completely resetting the BGP session?

1) Route refresh
2) TCP reset
3) Hard reboot
4) AS Path prepending

Correct Answer: 1)

Explanation:

BGP Route Refresh allows a router to request that a peer resend routing information without tearing down the established BGP session. This is useful after changing inbound routing policies, such as prefix lists or route maps. Instead of performing a disruptive hard reset, the administrator can request refreshed route information and allow the new policy to be evaluated. Route Refresh can therefore reduce service disruption during routing-policy changes. It is especially useful in production environments where maintaining established BGP sessions is important. Administrators should confirm that the participating BGP peers support the Route Refresh capability.

Q375. What is a potential drawback of using inbound soft reconfiguration for BGP?

1) It prevents all route advertisements
2) It can require additional memory because unmodified received routes may be retained
3) It disables BGP authentication
4) It changes the peer’s autonomous system number

Correct Answer: 2)

Explanation:

Inbound soft reconfiguration can allow a router to retain a copy of routes received from a BGP neighbor before inbound policy modifications are applied. This can make it possible to reevaluate routes without requesting them again from the neighbor. However, retaining additional routing information can consume significant memory, particularly when a peer advertises a large routing table. Modern BGP implementations often support Route Refresh, which can reduce the need to retain an unmodified copy of all received routes. Administrators should therefore consider memory usage and platform capabilities when deciding whether inbound soft reconfiguration is necessary.

Q376. A FortiGate administrator changes a BGP policy intended to influence routes received from a neighbor. In which direction should the policy generally be applied?

1) Outbound toward the neighbor
2) Only to local static routes
3) Inbound from the neighbor
4) Only to management traffic

Correct Answer: 3)

Explanation:

A BGP policy that controls routes received from a neighbor is generally applied in the inbound direction. Inbound policies can filter, modify, or influence routes before they are accepted into the local routing process. For example, a prefix list can restrict which prefixes are accepted, while a route map can modify attributes such as Local Preference or other supported values. Outbound policies instead control what the local router advertises to its neighbor. Correctly identifying policy direction is essential when troubleshooting BGP because a perfectly configured route map will not have the expected effect if it is applied in the wrong direction.

Q377. Why is inbound BGP route filtering important at an external network boundary?

1) It prevents unwanted or unauthorized prefixes from entering the routing table
2) It automatically increases bandwidth
3) It disables all BGP timers
4) It converts eBGP into iBGP

Correct Answer: 1)

Explanation:

Inbound BGP filtering protects a network by controlling which prefixes it accepts from external peers. Without appropriate filtering, a peer could accidentally or intentionally advertise unexpected routes, potentially causing routing instability, traffic interception, or excessive resource consumption. Prefix lists and route maps are commonly used to define acceptable prefixes and apply additional routing policy. Administrators should establish clear expectations for each BGP neighbor and reject routes that fall outside those requirements. Inbound filtering is therefore an important routing-security measure and should be reviewed whenever external connectivity, advertised networks, or upstream routing relationships change.

Q378. What is the primary purpose of outbound BGP route filtering?

1) To increase the BGP hold timer
2) To prevent unintended routes from being advertised to a neighbor
3) To disable route selection
4) To change the physical interface speed

Correct Answer: 2)

Explanation:

Outbound BGP filtering controls which local routes are advertised to a particular neighbor. This is important for preventing accidental route leaks, such as advertising internal networks to an external provider or customer when those routes were not intended to be shared. Prefix lists and route maps can be used to define the permitted advertisements. A carefully designed outbound policy helps ensure that each BGP relationship receives only the routes it is supposed to learn. Administrators should review outbound policies whenever network prefixes are added, removed, or restructured, because unintended advertisements can affect both security and routing stability.

Q379. Which BGP configuration can be used to advertise a default route to a BGP neighbor?

1) BGP default-originate functionality
2) BFD authentication
3) Route dampening
4) TCP keepalive

Correct Answer: 1)

Explanation:

BGP default-originate functionality can be used to advertise a default route, typically represented as 0.0.0.0/0, to a BGP neighbor. This is useful when a FortiGate should tell another router that it can provide a path toward destinations not otherwise known by that router. The exact behavior depends on the configuration and platform implementation, including whether the default route must exist locally or can be conditionally generated. Administrators should verify the intended policy before advertising a default route because an incorrect default advertisement can cause large amounts of traffic to use an unintended path.

Q380. A BGP neighbor is established, but the expected default route is not being advertised. What should the administrator check first?

1) The switch VLAN name only
2) The FortiGate hostname
3) The default-route advertisement configuration and applicable outbound policy
4) The DNS server address

Correct Answer: 3)

Explanation:

When a BGP session is Established but a default route is not being advertised, the administrator should first verify the configuration responsible for generating or advertising the default route. The next step is to inspect outbound BGP policies, including prefix lists and route maps, because they may unintentionally deny the default prefix. The local routing table should also be checked if the configured default-originate behavior requires an existing default route. Reviewing BGP neighbor advertisements can confirm what the FortiGate is actually sending. This structured approach helps distinguish between route-generation problems and outbound policy-filtering problems.