View Full Fortinet FCSS_NST_SE-7.6 Exam Dumps and Practice Test Dumps

 

Q341. What is the primary purpose of BGP community attributes in large network environments?

1) To replace IP addressing
2) To group routes so common routing policies can be applied
3) To establish TCP connectivity
4) To encrypt routing updates

Correct Answer: 2)

Explanation:

BGP community attributes provide a flexible method for grouping routes according to common policy requirements. Instead of creating separate routing policies for every individual prefix, administrators can assign a community to multiple routes and then use that community when applying filtering or route-selection policies. This can simplify traffic engineering, route advertisement control, and administrative classification. Communities do not establish BGP sessions or encrypt routing information. On FortiGate, BGP communities can be used with routing policies to influence how routes are accepted, modified, or advertised. Proper community design can therefore make large BGP environments easier to manage and troubleshoot.

Q342. Which BGP community is commonly used to prevent a route from being advertised outside the local autonomous system?

1) NO_EXPORT
2) NO_ADVERTISE
3) INTERNET
4) NOPEER

Correct Answer: 1)

Explanation:

The NO_EXPORT community indicates that a route should not be advertised outside the local autonomous system or BGP confederation. This allows internal BGP routers to receive and use the route while limiting its propagation to external autonomous systems. It is useful when a route is intended for internal communication or controlled traffic engineering but should not become visible throughout the Internet. NO_ADVERTISE is more restrictive because it prevents the route from being advertised to any BGP peer. Understanding these community behaviors helps administrators control route propagation and prevent unnecessary or unintended routing information from reaching external networks.

Q343. Which BGP community provides the strongest restriction by preventing a route from being advertised to any BGP peer?

1) NO_EXPORT
2) INTERNET
3) NO_ADVERTISE
4) LOCAL_PREF

Correct Answer: 3)

Explanation:

The NO_ADVERTISE community tells a BGP speaker not to advertise the associated route to any BGP peer. This makes it more restrictive than NO_EXPORT, which allows the route to remain within the local autonomous system while preventing external advertisement. NO_ADVERTISE can be useful when a route should be retained for local processing but must not be propagated further. The community does not modify Local Preference or MED, and it does not establish or terminate BGP sessions. When troubleshooting unexpected route propagation, administrators should examine BGP communities and the policies that match those communities.

Q344. What is the purpose of a BGP community-list on a FortiGate?

1) To identify routes based on their community values
2) To assign IP addresses to interfaces
3) To establish IPsec tunnels
4) To calculate packet loss

Correct Answer: 1)

Explanation:

A BGP community-list is used to match routes according to their BGP community attributes. Once a route is identified through its community value, routing policies can take actions such as permitting, denying, modifying, or controlling its advertisement. This provides a scalable way to apply consistent policy decisions to groups of routes. For example, routes marked with a particular community could be given special handling or prevented from being advertised externally. Community-lists are therefore useful for organizing complex BGP policies. They do not assign interface addresses, establish VPN tunnels, or measure network performance.

Q345. Which BGP attribute is normally used to communicate a preferred inbound path to a neighboring autonomous system?

1) Weight
2) MED
3) Local Preference
4) Router ID

Correct Answer: 2)

Explanation:

MED, or Multi-Exit Discriminator, is commonly used to influence how a neighboring autonomous system selects an entry point into your network when multiple connections exist between the two autonomous systems. A lower MED is generally preferred when the relevant comparison conditions apply. This allows an organization to suggest which external link should receive incoming traffic. Local Preference is instead primarily used within an autonomous system to influence outbound path selection. Weight is generally local to a router, while Router ID identifies the BGP speaker. Understanding the scope of each attribute is essential for effective BGP traffic engineering.

Q346. Which BGP attribute is normally preferred when its value is higher, assuming the relevant path-selection stage is being compared?

1) MED
2) AS Path length
3) Local Preference
4) Origin type

Correct Answer: 3)

Explanation:

BGP generally prefers a higher Local Preference value when comparing otherwise eligible routes at the Local Preference stage. This attribute is used within an autonomous system to influence outbound traffic decisions. For example, an administrator can assign a higher Local Preference to routes learned through a preferred Internet connection, causing internal routers to favor that path. MED behaves differently because a lower value is generally preferred. AS Path is evaluated based on path length, while Origin has its own preference order. When troubleshooting unexpected outbound routing, checking Local Preference is therefore an important part of the BGP best-path analysis.

Q347. What is the main purpose of BGP AS Path prepending?

1) To make a route appear less attractive by artificially increasing its AS Path length
2) To reduce the number of BGP updates
3) To increase Local Preference automatically
4) To authenticate BGP neighbors

Correct Answer: 1)

Explanation:

BGP AS Path prepending is a traffic-engineering technique used primarily to influence inbound traffic. An administrator adds repeated instances of the local autonomous system number to an advertised route. This makes the path appear longer to external BGP networks. Because a shorter AS Path is generally preferred when other applicable attributes are equal, the prepended path may become less attractive than an alternative path. This can encourage external networks to send traffic through another connection. AS Path prepending does not provide authentication or directly modify Local Preference. It is primarily useful when controlling how external networks select among multiple available paths.

Q348. Which BGP mechanism helps prevent a route from being accepted if its AS Path already contains the receiving router’s own AS number?

1) MED
2) AS Path loop detection
3) Local Preference
4) BGP community tagging

Correct Answer: 2)

Explanation:

BGP uses the AS Path for loop prevention. When a route is received, the router examines the AS Path to determine whether its own autonomous system number is already present. If it is, the router recognizes that the route has previously passed through the same autonomous system and normally rejects it. This prevents routing loops between autonomous systems. AS Path can also influence path selection because shorter paths are generally preferred. Community values, Local Preference, and MED have different purposes. When troubleshooting a route that is unexpectedly rejected, checking whether the local AS appears in the received AS Path can reveal a loop-prevention decision.

Q349. What is the main benefit of BGP graceful restart?

1) It can help maintain forwarding during certain temporary control-plane interruptions
2) It permanently disables failed BGP peers
3) It removes all stale routes immediately
4) It changes the BGP autonomous system number

Correct Answer: 1)

Explanation:

BGP graceful restart can reduce routing disruption during certain temporary control-plane restarts. Under appropriate conditions, a router can continue forwarding using previously learned routes while the BGP process is restarted and routing information is reestablished. This can help maintain traffic flow during short interruptions. Graceful restart does not permanently disable peers or change the autonomous system number. Its behavior depends on the capabilities and timers supported by the participating devices. Administrators should understand how stale routes are retained and when they are removed because inappropriate timer settings can allow outdated routing information to remain active longer than intended.

Q350. Which BGP message carries route advertisements and route withdrawals?

1) OPEN
2) KEEPALIVE
3) UPDATE
4) NOTIFICATION

Correct Answer: 3)

Explanation:

The BGP UPDATE message is responsible for exchanging routing information between BGP peers. It can advertise reachable network prefixes along with their associated path attributes and can also withdraw previously advertised routes that are no longer valid. OPEN messages are used during session establishment, KEEPALIVE messages maintain established sessions, and NOTIFICATION messages report protocol errors. If a BGP session is established but a particular route is missing, administrators should investigate whether the route is being included in UPDATE messages and whether inbound or outbound policies are filtering it. Understanding UPDATE processing is essential when troubleshooting BGP route propagation.

Q351. Which BGP message is used during initial session establishment to exchange capabilities and basic peer information?

1) OPEN
2) UPDATE
3) KEEPALIVE
4) NOTIFICATION

Correct Answer: 1)

Explanation:

The OPEN message is exchanged after the underlying TCP connection has been established between BGP peers. It provides important information needed to establish the BGP relationship, including the autonomous system number, BGP identifier, hold time, and supported capabilities. If the OPEN exchange fails because of incompatible configuration or other errors, the session cannot progress to the Established state. UPDATE messages are exchanged after the session is established to carry routes, while KEEPALIVE messages maintain the session. NOTIFICATION messages report errors. Checking OPEN-related parameters is therefore useful when a BGP neighbor fails to establish successfully.

Q352. What is the primary function of a BGP KEEPALIVE message?

1) To advertise a new network
2) To maintain an established BGP session
3) To withdraw all routes
4) To modify the AS Path

Correct Answer: 2)

Explanation:

BGP KEEPALIVE messages are used to maintain an established BGP session and confirm that the peer remains reachable and responsive. If a router does not receive expected BGP messages within the negotiated hold time, it can consider the session unavailable. KEEPALIVE messages are therefore an important part of BGP session monitoring. They do not advertise new routes or modify path attributes. UPDATE messages handle route advertisements and withdrawals, while OPEN messages establish the session. When troubleshooting a neighbor that repeatedly drops, administrators should examine hold timers, connectivity, CPU conditions, and whether KEEPALIVE or other BGP messages are being exchanged normally.

Q353. What is the primary purpose of BGP maximum-prefix protection?

1) To protect a router from receiving an unexpectedly large number of prefixes
2) To increase the BGP table without limits
3) To force all traffic through one interface
4) To disable route filtering

Correct Answer: 1)

Explanation:

BGP maximum-prefix protection limits the number of routes a router is willing to accept from a particular BGP neighbor. This provides an important safeguard against routing leaks, accidental full-table advertisements, or other configuration mistakes that could unexpectedly fill the routing table. Depending on configuration, reaching the threshold can generate warnings or cause protective actions against the BGP session. Maximum-prefix protection should be combined with proper route filtering because it is not a replacement for prefix lists or route maps. Administrators should set thresholds carefully based on the expected number of legitimate routes received from each neighbor.

Q354. What can occur if a BGP peer suddenly advertises far more prefixes than expected and the maximum-prefix limit is reached?

1) The router may take protective action against the BGP session
2) The router automatically increases its memory
3) The AS number changes
4) All firewall policies are deleted

Correct Answer: 1)

Explanation:

When a BGP peer exceeds a configured maximum-prefix threshold, the receiving router can take protective action according to its configuration. This helps prevent an unexpected routing-table expansion from consuming excessive resources or introducing potentially harmful routes. Depending on the implementation, the router may issue warnings, stop accepting additional routes, or terminate the affected BGP session. The exact behavior should be verified in the FortiOS configuration and version. Maximum-prefix limits are especially valuable on external BGP connections because accidental route leaks can expose thousands of unexpected prefixes. Administrators should combine this protection with carefully designed inbound filtering policies.

Q355. What is the main advantage of using a BGP route refresh instead of performing a hard reset?

1) It can request updated routing information without unnecessarily terminating the BGP session
2) It changes the neighbor’s AS number
3) It disables all route policies
4) It removes TCP from BGP

Correct Answer: 1)

Explanation:

BGP route refresh allows a router to request routing information from a peer again so that updated policies can be applied without necessarily tearing down the established BGP session. This is especially useful after changing inbound routing policies because the administrator can reprocess received routes while minimizing disruption. A hard reset terminates the BGP session and causes the peers to establish it again, which can temporarily withdraw routes and affect traffic. Route refresh therefore provides a more graceful operational method when supported by the peers. Administrators should still verify the exact FortiOS behavior and supported capabilities before making production changes.

Q356. What is a major difference between a BGP hard reset and a soft policy refresh?

1) A hard reset terminates the BGP session, while a soft refresh can reprocess routes with less disruption
2) A hard reset only affects DNS
3) A soft refresh changes the router’s IP address
4) There is no operational difference

Correct Answer: 1)

Explanation:

A BGP hard reset tears down the neighbor session and requires the peers to establish a new session. During this process, routes can be withdrawn and relearned, potentially causing temporary traffic disruption. A soft refresh or route refresh is intended to reprocess routing information while avoiding an unnecessary session teardown. This makes soft methods preferable for many policy changes when the platform and peer support the required capability. Administrators should understand that soft refresh does not solve every BGP problem. If the underlying neighbor relationship itself is broken, a hard reset or deeper troubleshooting may still be necessary.

Q357. What is the purpose of a BGP route reflector’s Originator ID attribute?

1) To help identify the router that originally advertised a reflected route
2) To calculate interface bandwidth
3) To encrypt route advertisements
4) To replace the AS Path

Correct Answer: 1)

Explanation:

The BGP Originator ID is used by route reflection to identify the original iBGP router that advertised a route into the route-reflector environment. This information helps prevent routing loops when routes are reflected between clients and route reflectors. It is particularly important in larger iBGP designs where routes may pass through multiple route-reflector relationships. Originator ID does not replace the AS Path and is not used for encryption or bandwidth calculations. Along with the Cluster List attribute, it contributes to route-reflector loop prevention and helps maintain stable route propagation in scalable internal BGP architectures.

Q358. What is the purpose of the BGP Cluster List attribute?

1) To help prevent routing loops between route reflectors
2) To identify the physical WAN interface
3) To determine the TCP port number
4) To increase Local Preference automatically

Correct Answer: 1)

Explanation:

The BGP Cluster List attribute is associated with route reflection and helps prevent loops involving route reflectors. When a route reflector reflects a route, it can add its cluster ID to the Cluster List. If a route reflector later receives a route containing its own cluster ID, it can reject the route because the route has already passed through that reflector cluster. This mechanism complements the Originator ID attribute. Cluster List does not determine interface selection, TCP ports, or Local Preference. Understanding these route-reflector attributes is important when troubleshooting unexpected route reflection behavior in large iBGP environments.

Q359. What is the purpose of configuring BGP next-hop-self on an internal BGP router?

1) To make the internal router reachable as the next hop for selected advertised routes
2) To disable BGP route advertisements
3) To increase the AS Path length
4) To change the remote AS number

Correct Answer: 1)

Explanation:

BGP next-hop-self is useful when an internal BGP peer needs to reach routes through the router advertising them. Routes learned from an external BGP peer can retain an external next-hop address. If internal routers do not have a route to that address, they may receive the BGP route but fail to install it as a usable route. Configuring next-hop-self changes the next-hop attribute so that the internal router becomes the next hop for the advertised route. This simplifies next-hop reachability and is commonly used in iBGP designs involving external connectivity and internal route distribution.

Q360. A BGP route appears in the BGP table but is not installed in the routing table. What should be investigated first?

1) Next-hop reachability and competing routes
2) Browser cache settings
3) Email filtering
4) Web authentication

Correct Answer: 1)

Explanation:

A BGP route can appear in the BGP table without becoming active in the main routing table. One important reason is that the BGP next-hop address is not reachable through the existing routing table. Administrators should also check whether another route has a more preferred administrative distance or whether another path is already selected for the same destination. Additional checks may include route validity, policy effects, recursive next-hop resolution, and interface status. Troubleshooting should therefore begin with the route lookup and next-hop reachability rather than assuming that the presence of the route in the BGP table guarantees forwarding.