View Full Fortinet FCSS_NST_SE-7.6 Exam Dumps and Practice Test Dumps

 

Q301. What is the primary purpose of a BGP community attribute?

1) To encrypt BGP updates
2) To identify and classify routes for applying routing policies
3) To establish the TCP connection between peers
4) To calculate interface bandwidth

Correct Answer: 2)

Explanation:

BGP community attributes provide a flexible way to group routes and apply routing policies consistently. Instead of creating individual policies for every prefix, an administrator can assign communities to routes and then match those communities in routing policies. This can be useful for controlling route advertisement, selecting preferred paths, or marking routes for special handling. Communities do not establish BGP sessions or encrypt routing updates. They are carried as optional BGP attributes and can simplify large-scale routing policy management. On FortiGate, communities can be used with BGP policy mechanisms to influence how routes are accepted, modified, or advertised to neighboring autonomous systems.

Q302. Which well-known BGP community prevents a route from being advertised outside the local autonomous system?

1) NO_EXPORT
2) NO_ADVERTISE
3) INTERNET
4) LOCAL_PREF

Correct Answer: 1)

Explanation:

The NO_EXPORT BGP community instructs a router not to advertise the associated route outside its local autonomous system or confederation. This is useful when a network wants internal BGP peers to know about a route while preventing that route from being propagated to external autonomous systems. NO_EXPORT is different from NO_ADVERTISE, which prevents the route from being advertised to any BGP peer. Administrators can attach these communities to selected routes and use them to control route propagation. This provides a practical method for limiting route visibility without requiring separate filtering rules for every individual network prefix.

Q303. What is the effect of the BGP NO_ADVERTISE community on a route?

1) It increases the route’s local preference
2) It causes the route to become a default route
3) It prevents the route from being advertised to BGP peers
4) It forces the route to use the shortest AS path

Correct Answer: 3)

Explanation:

The NO_ADVERTISE community tells a BGP router not to advertise the associated route to any BGP peer. This is stronger than NO_EXPORT, which generally restricts advertisement outside the local autonomous system. NO_ADVERTISE can therefore be useful when a route should remain known locally but should not be propagated through BGP. The community itself does not change the route’s local preference, AS path length, or default-route status. Administrators can use communities such as NO_ADVERTISE as part of a broader routing policy strategy to control route distribution and reduce unwanted route propagation between different network domains.

Q304. What is the purpose of using BGP community lists in routing policies?

1) To match routes based on their community attributes
2) To replace the BGP routing table
3) To establish BGP TCP sessions
4) To calculate packet latency

Correct Answer: 1)

Explanation:

BGP community lists allow administrators to match routes according to their assigned community attributes. Once routes are matched, a routing policy can permit, deny, modify, or otherwise process those routes according to the network’s requirements. This approach is particularly useful in environments with many prefixes because a single community can represent a group of routes that should receive the same treatment. Community lists do not replace the BGP routing table and are not responsible for session establishment or performance measurement. Using communities and community lists together provides a scalable way to organize and control BGP route advertisement and selection policies.

Q305. Which BGP community is commonly used to prevent a route from being advertised to any BGP peer?

1) NO_EXPORT
2) NO_ADVERTISE
3) LOCAL_PREF
4) MED

Correct Answer: 2)

Explanation:

The NO_ADVERTISE community is specifically designed to prevent a BGP route from being advertised to any BGP peer. When a router receives or assigns this community to a route, the route is treated as restricted from further BGP advertisement. This can be useful when a route is intended only for local use or controlled processing. NO_EXPORT has a different purpose because it permits propagation within the local autonomous system while preventing external advertisement. LOCAL_PREF and MED are routing attributes used for path selection rather than route-propagation restrictions. Understanding these distinctions is important when designing BGP policies and troubleshooting unexpected route advertisements.

Q306. When comparing BGP MED values from routes learned from the same neighboring autonomous system, which value is generally preferred?

1) The highest MED
2) The lowest MED
3) The newest MED
4) The value closest to zero only when the AS path is longest

Correct Answer: 2)

Explanation:

BGP MED, or Multi-Exit Discriminator, is commonly used to influence which entry point another autonomous system should prefer when multiple links exist between the same autonomous systems. In typical BGP best-path processing, a lower MED is preferred when the relevant comparison conditions are satisfied. MED is therefore useful when an organization wants to communicate a preferred inbound path to a neighboring autonomous system. MED should not be confused with Local Preference, which is primarily used inside an autonomous system to influence outbound path selection. Proper MED configuration can help optimize traffic entering a network through multiple external connections.

Q307. On FortiGate, which BGP attribute can be used as a locally significant preference when selecting among routes?

1) Weight
2) MED
3) AS Path
4) Origin

Correct Answer: 1)

Explanation:

The weight attribute can be used as a local preference mechanism on platforms that support it, including FortiGate configurations where it is available for BGP route selection. A higher weight can be preferred locally, allowing an administrator to favor one route over another without advertising that preference to neighboring autonomous systems. Weight is therefore different from Local Preference, which is an actual BGP attribute propagated within an autonomous system. MED and AS Path have different purposes and comparison behavior. When configuring BGP, administrators should understand which attributes are local to the device and which attributes can influence routing decisions across the broader autonomous system.

Q308. What is the purpose of the BGP next-hop-self configuration on an iBGP router?

1) To disable route advertisements
2) To change the BGP AS number
3) To make the advertising router the next-hop for routes it advertises
4) To encrypt BGP traffic

Correct Answer: 3)

Explanation:

The next-hop-self function changes the BGP next-hop attribute of advertised routes so that the advertising router becomes the next-hop. This is especially useful in iBGP environments where a route learned from an external BGP peer may retain an external next-hop address that internal routers cannot reach. Configuring next-hop-self on the appropriate iBGP router ensures that internal peers can resolve the next hop through the internal network. Without proper next-hop reachability, a BGP route may appear in the BGP table but fail to become usable in the routing table. This makes next-hop-self an important tool for reliable internal route distribution.

Q309. Why does iBGP normally require a full mesh between routers when route reflectors are not used?

1) iBGP uses UDP instead of TCP
2) iBGP does not normally advertise routes learned from one iBGP peer to another iBGP peer
3) iBGP automatically encrypts all routing information
4) iBGP requires every router to use the same interface address

Correct Answer: 2)

Explanation:

A fundamental iBGP rule is that an iBGP speaker does not normally advertise routes learned from one iBGP peer to another iBGP peer. This behavior helps prevent routing loops but creates a scalability problem because every iBGP router must establish sessions with other iBGP routers in a traditional design. As the number of routers increases, the number of required sessions can become difficult to manage. Route reflectors provide a solution by allowing selected routers to reflect routes between iBGP clients. This reduces the need for a complete full mesh while preserving BGP’s loop-prevention mechanisms and simplifying large internal BGP deployments.

Q310. What problem does a BGP route reflector primarily solve?

1) It eliminates the need for IP routing
2) It replaces all firewall policies
3) It removes the requirement for a full iBGP mesh
4) It converts BGP into OSPF

Correct Answer: 3)

Explanation:

A BGP route reflector solves the scalability problem created by the traditional iBGP full-mesh requirement. Instead of every iBGP router establishing a session with every other iBGP router, selected routers can act as route reflectors and distribute routes between their configured clients. This significantly reduces the number of BGP sessions required in large networks. Route reflectors do not replace the IP routing process, firewall policies, or BGP itself. They provide a structured mechanism for propagating iBGP routes while maintaining loop-prevention behavior through mechanisms such as Originator ID and Cluster List attributes.

Q311. After the major BGP path attributes have been evaluated, what does the router generally use to continue the best-path selection process?

1) Additional BGP tie-breaking rules and router-specific criteria
2) Random path selection
3) DNS resolution
4) Packet payload contents

Correct Answer: 1)

Explanation:

BGP uses a defined sequence of path-selection criteria to choose the best route. If important attributes such as weight, Local Preference, locally originated status, AS Path, Origin, and MED do not produce a unique winner, additional tie-breaking criteria are evaluated. These can include factors such as whether the route is internal or external, IGP metric to the next hop, router ID, and other platform-specific rules. The exact sequence can vary somewhat by implementation and configuration. Administrators troubleshooting BGP should therefore examine the complete best-path decision process rather than assuming that AS Path length alone determines the selected route.

Q312. What is the primary purpose of BGP neighbor authentication using a password?

1) To encrypt all application traffic
2) To verify that a BGP peer is an authorized neighbor
3) To increase the BGP hold timer
4) To change the autonomous system number

Correct Answer: 2)

Explanation:

BGP neighbor authentication helps ensure that a routing session is established only with an authorized peer. A shared password can be configured between two BGP neighbors so that each side can authenticate the session. This reduces the risk of unauthorized devices establishing BGP relationships and injecting incorrect routing information. Authentication does not encrypt the actual application traffic carried through the network, nor does it modify the autonomous system number or hold timer. When deploying BGP across trusted or untrusted network boundaries, neighbor authentication should be considered alongside other controls such as filtering, maximum-prefix limits, TTL protection, and careful route policies.

Q313. What is the purpose of TTL security for BGP sessions?

1) To protect BGP sessions from packets arriving with an unexpected TTL or excessive hop distance
2) To increase interface bandwidth
3) To modify the BGP Local Preference
4) To advertise default routes automatically

Correct Answer: 1)

Explanation:

TTL security, commonly associated with BGP’s Generalized TTL Security Mechanism, helps protect a BGP session from packets that are not expected to originate close to the configured peer. The mechanism uses the IP TTL value to make it harder for an attacker located several network hops away to send convincing BGP packets toward the session. This can provide an additional layer of protection against certain spoofing or remote attack scenarios. TTL security does not affect BGP route attributes such as Local Preference or MED and does not automatically advertise routes. It is best used together with authentication and appropriate routing policies.

Q314. What is the purpose of configuring a maximum-prefix limit on a BGP neighbor?

1) To increase the number of routes accepted without restriction
2) To limit the number of prefixes accepted from the neighbor
3) To disable route filtering
4) To force all routes to use the default gateway

Correct Answer: 2)

Explanation:

A maximum-prefix limit protects a router from receiving an unexpectedly large number of BGP routes from a neighbor. An administrator can configure a threshold representing the maximum number of prefixes that should normally be accepted. If the received route count approaches or exceeds the configured limit, the router can generate warnings or take protective action depending on the configuration. This can help reduce the impact of routing leaks, accidental advertisements, or misconfigured peers. Maximum-prefix protection does not replace route filtering, because legitimate prefixes should still be controlled using prefix lists, route maps, communities, or other policy mechanisms.

Q315. What can happen when a BGP neighbor exceeds its configured maximum-prefix threshold?

1) The firewall automatically disables all interfaces
2) The BGP process changes the autonomous system number
3) The router can take protective action against the session according to its configuration
4) All routes become static routes

Correct Answer: 3)

Explanation:

When the number of prefixes received from a BGP neighbor exceeds the configured maximum-prefix threshold, the router can take protective action according to its configuration. Depending on the implementation and settings, this may include generating a warning, temporarily disabling the session, or otherwise preventing additional route processing. This mechanism is valuable for limiting the impact of route leaks and accidental full-table advertisements. The exact response should be verified against the FortiOS configuration and version being used. Maximum-prefix protection should complement, rather than replace, carefully designed inbound route filters and explicit routing policies.

Q316. What is the advantage of performing a BGP soft reset or route refresh instead of clearing the entire BGP session?

1) It can reapply routing policies without unnecessarily tearing down the established session
2) It changes the peer’s IP address
3) It removes all routes permanently
4) It disables BGP authentication

Correct Answer: 1)

Explanation:

A BGP soft reset or route refresh can allow routing policies to be reapplied without unnecessarily terminating the BGP session. This is useful after changing inbound or outbound policies because administrators may want the new policy to affect existing routes without causing a full session restart. A hard reset tears down the BGP relationship and requires the session to be established again, potentially causing temporary routing disruption. The exact available commands and behavior depend on the FortiOS version and BGP configuration. Soft reprocessing is generally preferable when policy changes can be safely applied without interrupting the neighbor relationship.

Q317. What is the main difference between a BGP hard reset and a soft reset?

1) A hard reset changes the AS number while a soft reset changes the router ID
2) A hard reset terminates and reestablishes the BGP session, while a soft reset attempts to reprocess routes without fully tearing down the session
3) A hard reset only affects DNS while a soft reset affects HTTP
4) There is no difference

Correct Answer: 2)

Explanation:

A hard BGP reset terminates the BGP session and causes the peers to establish the session again. During this process, routes may be withdrawn and relearned, which can temporarily affect traffic forwarding. A soft reset is designed to reprocess routing information or policies while minimizing disruption to the established session. Route refresh capabilities can make this particularly useful when inbound policy changes are required. Administrators should use the least disruptive method that achieves the desired result. Before performing any reset in production, it is important to understand the potential routing impact and confirm whether a soft policy refresh is sufficient.

Q318. What is the purpose of BGP conditional advertisement?

1) To advertise selected routes only when specified routing conditions are satisfied
2) To disable all BGP neighbors permanently
3) To convert BGP routes into firewall policies
4) To increase TCP packet size

Correct Answer: 1)

Explanation:

BGP conditional advertisement allows selected routes to be advertised only when defined routing conditions are met. This can be useful in designs where route announcements should depend on the presence or absence of another route or network condition. For example, an organization may advertise a backup path only when a preferred path is unavailable. Conditional advertisement can therefore support more dynamic routing behavior without relying solely on static configuration changes. Its exact implementation and supported syntax depend on the platform and software version. Administrators should carefully test conditions to ensure that routes are withdrawn or advertised as intended during failures and recoveries.

Q319. What must generally be true for a BGP network statement to advertise a specific prefix?

1) The prefix must normally be present in the local routing table
2) The prefix must be learned only through OSPF
3) The prefix must have a higher MED than every other route
4) The prefix must be configured as a firewall address object only

Correct Answer: 1)

Explanation:

A BGP network statement generally requires the specified prefix to exist in the local routing table before BGP can originate and advertise it. The presence of the route provides the underlying reachability that BGP uses when originating the network. If the route is missing or does not match the required prefix and mask conditions, the network statement may not result in an advertisement. The route does not necessarily have to come from a particular IGP; it can originate through an appropriate local routing mechanism. Troubleshooting should therefore begin by checking the routing table and confirming that the exact prefix is installed.

Q320. A FortiGate is configured to advertise a local network through BGP, but the neighbor does not receive it. What should be checked first?

1) The browser cache
2) The local route, BGP network configuration, outbound routing policy, and neighbor state
3) The DNS server’s MX record
4) The web filter category

Correct Answer: 2)

Explanation:

When a locally intended BGP route is not received by a neighbor, troubleshooting should follow the route’s complete advertisement path. First verify that the local prefix actually exists in the routing table and matches the BGP network configuration. Next, confirm that the BGP neighbor session is established and that no outbound prefix list, route map, or policy is blocking the advertisement. Finally, inspect the BGP advertised-routes information and the remote neighbor’s received routes. This structured approach helps identify whether the problem originates from local route availability, BGP configuration, routing policy, or the neighbor relationship itself.