What is the purpose of failover testing in a redundant VPN configuration?

To reduce the number of tunnels needed

To increase the encryption strength of the VPN

To verify that traffic can automatically switch to the backup tunnel when the primary fails

Two FortiGates are connected by two IPsec tunnels. The administrator wants to use BGP over both tunnels to provide failover and load balancing. They have configured BGP on both devices and established peers over both tunnels. What additional configuration is required to ensure that BGP routes are withdrawn when a tunnel fails?

Use the 'network' command to advertise the remote subnet over both tunnels and let BGP's ECMP handle load balancing.

Configure BGP to use the tunnel interfaces as the source interface and enable fast external failover.

Enable Bidirectional Forwarding Detection (BFD) on the BGP peers and configure it to monitor the tunnel interfaces.

Configure a route map to prefer the primary tunnel's BGP routes and rely on BGP's keepalive timer for failover.

Which routing method can be used to support failover across redundant VPN tunnels?

Assigning the same metric to all routes

Using the same default gateway for all tunnels

Static routes with different administrative distances

What is the primary purpose of Dead Peer Detection (DPD) in an IPsec VPN?

To compress data before transmission

To authenticate users before establishing the tunnel

To detect when the remote VPN peer becomes unreachable

To encrypt data with a stronger algorithm

FortinetNSE 4 - FortiOS 7.6 Administrator

Domain 5Objective 3

Redundant VPN Between Two FortiGate Devices NSE4-FORTIOS-ADMINISTRATOR Practice Questions (Page 3)

Part of the VPNs domain, which accounts for 10-15% of the NSE4-FORTIOS-ADMINISTRATOR exam. Fortinet does not publish an official question count, but from its 90-minute exam (~35–60 total, ~4–9 in this domain), expect 1–2 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

7concepts

10-15%of the exam

Questions 11–15

11foundation · easy
What is the purpose of failover testing in a redundant VPN configuration?
Select an answer first
12expert · hard
Two FortiGates are connected by two IPsec tunnels. The administrator wants to use BGP over both tunnels to provide failover and load balancing. They have configured BGP on both devices and established peers over both tunnels. What additional configuration is required to ensure that BGP routes are withdrawn when a tunnel fails?
Select an answer first
13foundation · easy
When configuring multiple IPsec tunnels between two FortiGate devices for redundancy, what must be unique for each tunnel?
Select an answer first
14foundation · easy
Which routing method can be used to support failover across redundant VPN tunnels?
Select an answer first
15foundation · easy
What is the primary purpose of Dead Peer Detection (DPD) in an IPsec VPN?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE4-FORTIOS-ADMINISTRATOR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE4-FORTIOS-ADMINISTRATOR” is a trademark of its owner, used for identification only.

Redundant VPN Between Two FortiGate Devices NSE4-FORTIOS-ADMINISTRATOR Practice Questions (Page 3)

Questions 11–15

What is the purpose of failover testing in a redundant VPN configuration?

When configuring multiple IPsec tunnels between two FortiGate devices for redundancy, what must be unique for each tunnel?

Which routing method can be used to support failover across redundant VPN tunnels?

What is the primary purpose of Dead Peer Detection (DPD) in an IPsec VPN?

Keep studying — VPNs