View Full Fortinet FCSS_NST_SE-7.6 Exam Dumps and Practice Test Dumps

 

Q381. What is the main purpose of advertising a default route through BGP?

1) To provide a path for destinations not covered by more specific routes
2) To disable route filtering
3) To replace the BGP Router ID
4) To increase the BGP hold timer

Correct Answer: 1)

Explanation:

A BGP default route provides a general path for destinations that do not have a more specific route in the routing table. It is commonly used when a FortiGate or another router acts as an upstream gateway for downstream networks. Instead of maintaining every possible destination route, the downstream device can forward unknown traffic toward the router advertising the default route. Administrators should carefully control default-route advertisements because an incorrect default can redirect substantial traffic through an unintended path. When troubleshooting default-route behavior, verify route generation, BGP policy, neighbor advertisements, and the receiving router’s routing table.

Q382. Which BGP attribute is commonly used to influence the preferred outbound path within an autonomous system?

1) MED
2) Local Preference
3) Origin
4) Community

Correct Answer: 2)

Explanation:

Local Preference is commonly used to influence outbound path selection within an autonomous system. A higher Local Preference value is generally preferred. Because Local Preference is propagated through iBGP, administrators can establish a consistent preference across multiple routers in the same AS. For example, an organization may assign a higher Local Preference to routes learned from a preferred Internet provider and a lower value to routes learned from a backup provider. This allows internal routers to select the desired exit path. When troubleshooting outbound BGP traffic, Local Preference should be checked along with other path-selection attributes.

Q383. Which BGP mechanism can make an external path less attractive by increasing the AS Path length?

1) Local Preference
2) MED
3) AS Path prepending
4) Route Refresh

Correct Answer: 3)

Explanation:

AS Path prepending adds additional instances of the local autonomous system number to the AS Path attribute of an advertised route. Because BGP generally prefers shorter AS Paths when comparing otherwise suitable routes, prepending can make a particular path less attractive to external networks. This technique is commonly used to influence inbound traffic by making one provider connection appear less preferred than another. AS Path prepending should be applied selectively because its effect depends on the routing policies of remote autonomous systems. It does not directly control internal outbound path selection in the same way that Local Preference does.

Q384. Why does BGP examine the AS Path when preventing routing loops?

1) It identifies whether a route has already passed through the local autonomous system
2) It determines the interface MTU
3) It identifies the DNS server
4) It calculates packet latency

Correct Answer: 1)

Explanation:

BGP uses the AS Path attribute as an important loop-prevention mechanism. When an autonomous system receives a BGP advertisement, it can inspect the AS Path to determine whether its own AS number is already present. If the local AS is found in the path, the route is normally rejected because accepting it could create a routing loop. This behavior is particularly important for eBGP because routes can travel through multiple autonomous systems before returning toward the original network. Administrators troubleshooting unexpected route rejection should therefore inspect the AS Path and verify whether the local AS appears in the advertised route.

Q385. What is the primary benefit of BGP Graceful Restart?

1) It eliminates the need for routing protocols
2) It allows temporary control-plane restarts while helping preserve forwarding during recovery
3) It changes the BGP AS number
4) It automatically summarizes all routes

Correct Answer: 2)

Explanation:

BGP Graceful Restart is designed to reduce routing disruption when a BGP-speaking device or routing process temporarily restarts. During an appropriate graceful restart scenario, forwarding can continue using previously learned routes while the control plane recovers and reestablishes BGP sessions. This can reduce unnecessary traffic interruption during software restarts or certain control-plane failures. Graceful Restart does not prevent all outages, and its effectiveness depends on support and compatible behavior between participating peers. Administrators should understand the platform’s implementation and recovery timers when deploying it, particularly in networks where rapid and predictable convergence is important.

Q386. Which BGP message is primarily responsible for advertising new routes or withdrawing previously advertised routes?

1) OPEN
2) KEEPALIVE
3) UPDATE
4) NOTIFICATION

Correct Answer: 3)

Explanation:

The BGP UPDATE message carries routing information between BGP peers. It can advertise reachable network prefixes and withdraw routes that are no longer valid. UPDATE messages also carry path attributes associated with advertised routes, allowing receiving routers to evaluate different paths according to BGP best-path rules. OPEN messages are used when establishing a BGP session, KEEPALIVE messages maintain the session, and NOTIFICATION messages indicate errors or terminate a session. When troubleshooting missing routes, administrators can inspect BGP neighbor information and routing updates to determine whether a route was actually advertised, filtered, rejected, or withdrawn.

Q387. Which BGP message is exchanged during the initial establishment of a BGP session?

1) UPDATE
2) OPEN
3) KEEPALIVE
4) NOTIFICATION

Correct Answer: 2)

Explanation:

The BGP OPEN message is exchanged after the underlying TCP connection has been established and is used to begin negotiating the BGP session. It includes important information such as the autonomous system number, BGP version, Hold Time, and Router ID, along with supported capabilities. If the peers successfully process the OPEN messages and agree on the session parameters, the BGP relationship can progress toward the Established state. If there is an incompatibility or other error, the session may fail and a NOTIFICATION message may be generated. Troubleshooting BGP establishment therefore often involves examining OPEN parameters and peer configuration.

Q388. What is the purpose of a BGP NOTIFICATION message?

1) To advertise a new network prefix
2) To maintain an idle BGP session
3) To report a BGP error and terminate the session
4) To increase Local Preference

Correct Answer: 3)

Explanation:

A BGP NOTIFICATION message is used to report an error condition and normally results in termination of the affected BGP session. It contains information identifying the category of the problem and may include additional error details. Common causes can include malformed messages, incorrect peer configuration, unsupported parameters, or administrative conditions. When a BGP session unexpectedly drops, reviewing logs and diagnostic information for NOTIFICATION-related errors can provide valuable clues. After identifying the cause, administrators should correct the underlying configuration or connectivity issue before attempting repeated session resets, because continuously resetting a misconfigured BGP relationship does not resolve the underlying problem.

Q389. Which transport protocol and port does BGP use for its sessions?

1) UDP 179
2) TCP 179
3) TCP 443
4) UDP 53

Correct Answer: 2)

Explanation:

BGP uses TCP as its transport protocol and normally establishes sessions using TCP port 179. Using TCP provides reliable, ordered delivery for BGP control-plane messages. When a BGP session cannot become Established, administrators should verify that routing exists between the peer addresses and that security policies or intermediate firewalls permit TCP port 179. Source-address configuration, eBGP multihop, authentication, and TTL-related settings may also affect session establishment. Remembering the TCP 179 requirement is particularly useful when troubleshooting a BGP neighbor that remains in Idle, Connect, or Active rather than reaching the Established state.

Q390. A BGP neighbor remains in the Active state. What should an administrator investigate first?

1) BGP route summarization only
2) TCP connectivity and reachability to the configured neighbor
3) DNS filtering categories
4) Web application signatures

Correct Answer: 2)

Explanation:

A BGP neighbor in the Active state generally indicates that the router is attempting to establish the TCP session but has not successfully completed the connection. Administrators should therefore begin by checking IP reachability between the configured peer addresses and verifying that TCP port 179 is permitted. If loopback addresses are used, routing to those addresses and the appropriate source configuration should be checked. For multihop eBGP sessions, hop-count and TTL-related settings should also be reviewed. Authentication mismatches, incorrect AS numbers, firewall policies, and interface failures can further prevent successful establishment.

Q391. What is the purpose of BGP route dampening?

1) To reduce the impact of repeatedly unstable routes
2) To advertise every available route
3) To increase interface bandwidth
4) To disable BGP authentication

Correct Answer: 1)

Explanation:

BGP route dampening is designed to reduce the impact of routes that repeatedly flap. Frequent route advertisements and withdrawals can create instability and consume routing resources. Dampening can temporarily suppress routes that exhibit excessive instability and allow them to become eligible again after their penalty decreases according to the configured mechanism. This can help limit the propagation of persistent routing changes. However, overly aggressive dampening may delay legitimate routing recovery, so administrators should configure it carefully and understand the operational requirements of the network. When troubleshooting route suppression, dampening statistics and policy configuration should be reviewed.

Q392. What is the primary purpose of a BGP prefix list?

1) To define prefixes that should be permitted or denied by routing policy
2) To establish TCP sessions
3) To calculate BGP hold timers
4) To replace the routing table

Correct Answer: 1)

Explanation:

A BGP prefix list provides a structured way to match network prefixes for routing policies. Administrators can use prefix lists to permit or deny specific networks based on their prefix length and address range. They are commonly applied through routing policies such as route maps to control inbound or outbound BGP advertisements. For example, an administrator can create an outbound prefix list that allows only approved organizational networks to be advertised to an external provider. Prefix lists are therefore an important tool for preventing accidental route advertisements and unwanted route acceptance while maintaining clear and manageable routing policy.

Q393. What is the purpose of a route map when implementing BGP policy?

1) To physically connect two routers
2) To apply conditional matching and attribute-based routing actions
3) To replace TCP port 179
4) To configure DNS forwarding

Correct Answer: 2)

Explanation:

A route map allows administrators to create more flexible routing policies by matching specific routing characteristics and applying actions to matching routes. In BGP environments, route maps can work with prefix lists and other matching criteria to control route acceptance or advertisement and modify supported BGP attributes. For example, a route map can match a selected group of prefixes and assign a different routing preference before the routes are installed or advertised. Route-map behavior depends on its sequence and matching logic, so administrators should carefully review both permitted and denied sequences when troubleshooting unexpected BGP policy behavior.

Q394. Which BGP feature helps reduce the requirement for a full iBGP mesh among internal routers?

1) Route reflector
2) MED
3) BFD
4) AS Path prepending

Correct Answer: 1)

Explanation:

A BGP route reflector reduces the need for every iBGP router to maintain a direct session with every other iBGP router. Without route reflection, traditional iBGP requires a full-mesh relationship within the autonomous system, which becomes difficult to manage as the number of routers grows. A route reflector can receive routes from clients and reflect eligible routes to other clients or non-client peers according to its configuration. This simplifies BGP topology and reduces the number of required sessions. Administrators should still understand route-reflector behavior and attributes such as Originator ID and Cluster List when troubleshooting reflected routes.

Q395. What does the BGP NEXT_HOP attribute identify?

1) The next-hop address that should be used to reach the advertised destination
2) The BGP password
3) The neighbor’s DNS server
4) The route’s VLAN identifier

Correct Answer: 1)

Explanation:

The BGP NEXT_HOP attribute identifies the address that a router should use as the next hop when forwarding traffic toward the advertised network. The receiving router must have a valid route to that next-hop address before the BGP route can normally become usable in the routing table. An unreachable next hop can therefore cause a route to remain present in the BGP table while not being installed into the main routing table. When troubleshooting this situation, administrators should inspect the advertised NEXT_HOP value and verify recursive reachability to it. The next-hop-self feature can also be relevant in certain iBGP designs.

Q396. What is the main purpose of BGP route aggregation?

1) To increase the number of individual routes advertised
2) To combine multiple more-specific networks into a summarized route
3) To disable route filtering
4) To establish a BGP TCP connection

Correct Answer: 2)

Explanation:

BGP route aggregation combines multiple more-specific networks into a summarized prefix. This can reduce the number of routes advertised between BGP peers and simplify routing information. Smaller routing tables can reduce resource consumption and make routing policies easier to manage. However, aggregation must be designed carefully because an overly broad summary can attract traffic for destinations that are not actually reachable through the advertising router. Administrators may use appropriate supporting routes or policies to prevent blackholing. When troubleshooting aggregation, compare the summary with the underlying specific routes and verify that the resulting advertisement represents the intended reachable address space.

Q397. What is a potential problem with an overly broad BGP summary route?

1) It may attract traffic for destinations that are not actually reachable
2) It always disables BGP
3) It prevents TCP from functioning
4) It automatically increases route convergence speed

Correct Answer: 1)

Explanation:

An overly broad BGP summary can advertise reachability for addresses that are not actually available behind the advertising router. Because routers use the advertised prefix as a forwarding indication, traffic destined for an uncovered address may be sent toward the summarizing device. If no appropriate internal route exists, the traffic may be discarded, creating a blackhole. Careful aggregation design is therefore important. Administrators should verify the address space represented by a summary and understand how more-specific routes, default routes, and blackhole or discard routes interact with it. Troubleshooting should include both BGP advertisements and the local routing table.

Q398. A FortiGate SD-WAN member is physically up but is marked unavailable by its performance SLA. What is the most likely reason?

1) The interface name is too long
2) The member is failing configured SLA measurements
3) The BGP Router ID changed
4) The firewall hostname is incorrect

Correct Answer: 2)

Explanation:

An SD-WAN member can have an operational interface while still being considered unsuitable for forwarding if it fails the configured performance SLA. Performance monitoring may evaluate metrics such as latency, jitter, packet loss, or reachability to a defined health-check destination. If the measured values exceed the configured thresholds, the SD-WAN system can mark the member as unavailable for rules that require acceptable performance. This distinction is important because checking only the physical interface status may suggest that the link is healthy. Administrators should inspect SLA measurements, thresholds, health-check destinations, and SD-WAN rule requirements when investigating this condition.

Q399. What should happen when an SD-WAN rule determines that the preferred member no longer meets its required SLA?

1) Traffic should automatically stop permanently
2) The FortiGate should ignore all SD-WAN rules
3) Traffic can be moved to another eligible member according to the configured rule
4) BGP must always be disabled

Correct Answer: 3)

Explanation:

SD-WAN rules can select forwarding members according to configured criteria such as performance SLA, priority, application requirements, or other supported conditions. If the preferred member fails the required SLA, the FortiGate can select another eligible member according to the rule and configured failover behavior. This allows applications to continue using a path that meets the defined performance requirements. The exact outcome depends on rule configuration and available members. When troubleshooting failover, administrators should check member status, SLA measurements, rule order, member priorities, and whether another member satisfies the rule’s requirements.

Q400. When troubleshooting an unexpected FortiGate SD-WAN path, which sequence provides the most useful approach?

1) Check only the physical cable
2) Check the SD-WAN rule, member eligibility, SLA status, routing, and final forwarding decision
3) Change the firewall hostname
4) Disable all security policies

Correct Answer: 2)

Explanation:

SD-WAN path selection can depend on several layers, so troubleshooting should follow the actual forwarding decision. First, verify which SD-WAN rule matches the traffic and whether its conditions are satisfied. Next, check member eligibility and performance SLA results to determine which paths are available. Then review routing information and any policy-based routing or firewall policy interactions that could affect forwarding. Finally, verify the selected outgoing interface and next hop. This structured approach is more effective than changing random settings because it identifies the exact stage where the expected path differs from the actual forwarding decision.