Fortinet · Free Practice Questions · Last reviewed May 2026
18 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
When using SD-WAN templates, how are SD-WAN rules ordered?
Top to bottom
SD-WAN rules are evaluated in a top-down sequence.
Based on the creation date
By the interface speed
Randomly
In SD-WAN central management, what is the 'SD-WAN Zone' used for?
To define the physical port speed
To limit bandwidth for specific users
To group multiple SD-WAN members for logical policy routing
An SD-WAN Zone groups interfaces and overlay members sharing identical routing and policy treatment, letting administrators apply one rule set across them. This satisfies central management's need to route traffic by logical segment rather than per-link, so FortiGate policies reference the zone and members inherit consistent steering without duplicated configuration.
To isolate the SD-WAN traffic from the WAN
You are troubleshooting a scenario where an SD-WAN template is not pushing to a FortiGate. Which log file on the FortiManager is most useful to identify the specific CLI command causing the failure?
fmg_event.log
fmg_debug.log
fmg_debug.log captures FortiManager daemon debugging, including the specific CLI commands pushed to the FortiGate and the exact command that fails. It satisfies the stem's requirement to identify the failing CLI command during SD-WAN template troubleshooting.
fmg_audit.log
fmg_system.log
When creating an SD-WAN template, what must be defined before you can add an SD-WAN interface to the template?
Individual SD-WAN member interfaces
SD-WAN member interfaces must exist before they can be referenced within a template. The template binds these individual interfaces into the SD-WAN zone and defines their participation, so the member interfaces are the prerequisite object that must be defined first.
The SD-WAN health check probes
Global firewall policies
The virtual domain (VDOM) settings
Which object must be created before assigning a health check to an SD-WAN service rule in an SD-WAN template?
An SD-WAN Health Check
An SD-WAN Health Check object defines the probe type, target, interval and failure thresholds used to judge link quality. It must exist in the template before a service rule can reference it, since the rule binds to that object's SLA criteria.
A routing protocol
A firewall address object
An SD-WAN Zone
You are configuring SD-WAN templates in FortiManager. What is the primary purpose of using SD-WAN Central Management instead of configuring SD-WAN directly on individual FortiGates?
To perform local traffic analysis on the FortiGate only
To allow FortiGates to manage their own SD-WAN interfaces independently
To bypass the need for ADOMs
To enable SD-WAN template inheritance and synchronized policy updates across multiple managed devices
Central management pushes one SD-WAN template to many FortiGates, so inheritance propagates configuration and policy changes consistently. This removes per-device drift and manual repetition, which is the scalability constraint the stem contrasts against local configuration.
Want more Central Management practice?
Practice this domainYou have an SD-WAN rule with 'Priority' strategy. What happens if the highest priority member fails its SLA?
Traffic is dropped.
The FortiGate enters an error state.
Traffic is load balanced across all remaining members.
Traffic fails over to the member with the next highest priority value.
Under the Priority strategy, members are ranked by priority value, and the highest-priority member is preferred while its SLA is met. When that member breaches its SLA, FortiGate immediately redirects traffic to the next-highest-priority member, satisfying the rule's requirement for deterministic ordered failover rather than load balancing.
You are configuring a Performance SLA to monitor reachability to a SaaS application. Which parameter determines the threshold for an interface to be considered 'unhealthy' in the SD-WAN routing table?
Probe Mode
Sequence Number
Packet Loss Threshold
The Performance SLA's packet loss threshold defines the percentage of lost probes above which the interface is marked unhealthy and removed from the SD-WAN routing table. Latency and jitter thresholds affect path preference, but packet loss is the reachability health determinant.
Update Interval
An SD-WAN rule is configured with 'Lowest Cost (SLA)' strategy. If all members in the SLA meet the requirements, how does the FortiGate select the outgoing interface?
The member with the lowest interface cost value defined in the SD-WAN member configuration.
With Lowest Cost (SLA), FortiGate first filters members meeting the SLA targets, then breaks ties by the configured interface cost value in the SD-WAN member settings. The lowest-cost member among those passing SLA becomes the selected outgoing interface.
Round Robin
The interface with the highest bandwidth.
The interface that was most recently added to the zone.
When using SD-WAN zones, what is the primary benefit of grouping multiple physical interfaces into a single zone?
It increases the throughput of individual physical links.
It prevents the need for performance SLAs.
It automatically enables load balancing between interfaces.
It allows you to apply a single firewall policy to the entire group.
Grouping physical interfaces into one SD-WAN zone lets a single firewall policy govern all member interfaces, since policy is applied per zone rather than per link. This satisfies the stem's aim of simplified, consistent policy enforcement across multiple WAN links.
When configuring an SD-WAN rule, what is the purpose of the 'Source' address field?
To define the gateway IP for the route.
To force traffic to a specific SD-WAN zone.
To determine which ISP the traffic exits through regardless of SLA.
To match traffic based on the source IP or user.
Matching on source IP or user lets the rule identify which traffic the SD-WAN policy governs, so only flows originating from the specified address or identity are steered. This satisfies the requirement to define the traffic source before applying path selection and SLA actions.
Which SD-WAN rule strategy should you choose if you want to distribute traffic across multiple interfaces based on their bandwidth weights?
Manual
Maximize Bandwidth (SLA)
Maximize Bandwidth (SLA) distributes traffic proportionally across member interfaces according to their configured bandwidth weights, provided SLA targets are met. This directly satisfies the stem's requirement to spread traffic based on bandwidth weights rather than latency or link priority.
Lowest Cost (SLA)
SLA Target
Want more System Configuration And Setup practice?
Practice this domainAn administrator wants to apply a Web Filtering security profile to traffic that is being dynamically steered via an SD-WAN rule. Where must this security profile be enforced in FortiOS?
Inside the firewall policy that matches the traffic being steered by the SD-WAN rule
SD-WAN rules only steer traffic; they cannot apply security profiles. The profile must sit in the firewall policy that matches the steered traffic, because that policy performs the UTM inspection after the SD-WAN rule selects the egress member.
Directly inside the SD-WAN rule configuration under the advanced settings tab
Globally under the system settings as an SD-WAN overlay inspection profile
Within the IPsec tunnel phase 2 security association settings
An IPsec VPN tunnel used as an SD-WAN member is experiencing intermittent flapping due to DPD (Dead Peer Detection) timeout issues over a high-latency satellite link. How should the administrator adjust the Phase 1 IPsec settings on FortiOS to stabilize the tunnel without completely disabling failure detection?
Disable DPD entirely so the FortiGate never tears down the tunnel
Enable NP6/NP7 hardware offloading for Phase 1 SA renegotiation
Change the IPsec phase 1 mode from Main mode to Aggressive mode
Increase the DPD retry count and interval settings under the IPsec Phase 1 configuration
Raising the DPD retry count and interval lengthens the tolerance window before a peer is declared dead, absorbing satellite latency spikes so the tunnel stops flapping while failure detection remains active, unlike disabling DPD entirely.
An enterprise network uses ADVPN 2.0 with BGP running over IPsec tunnels. A spoke needs to initiate a shortcut tunnel to another spoke. Which FortiOS CLI command is used on the hub to verify the active shortcut tunnels and view the shortcut state information?
execute router clear bgp all
get system sdwan neighbor
diagnose vpn tunnel list
`diagnose vpn tunnel list` enumerates all IPsec tunnels on the hub, including ADVPN shortcut tunnels, showing their names, source and destination addresses, and state. This directly satisfies the stem's requirement to verify active shortcuts and view shortcut state information, whereas other commands lack this per-tunnel IPsec visibility.
diagnose netlink interface list
When troubleshooting SD-WAN performance SLA packet loss, an administrator wants to view real-time latency, jitter, and packet loss statistics for individual health check members. Which CLI command should be executed?
diagnose sys sdwan health-check
The diagnose sys sdwan health-check command displays per-member SLA statistics, including latency, jitter and packet loss, for each configured health check. It directly satisfies the requirement to inspect real-time performance of individual health check members.
get system interface physical
execute ping-server status
show system sdwan
When configuring an SD-WAN health check to monitor internet reachability using HTTP/HTTPS requests, which parameter defines the specific string the FortiGate expects to receive in the server response body to validate that the path is healthy?
probe-packet-size
sla-break-time
http-match
The http-match parameter specifies the exact string the FortiGate searches for in the HTTP or HTTPS response body; a match confirms the path is healthy. This satisfies the stem's requirement for validating internet reachability via response content.
server-response-timeout
An administrator is troubleshooting an SD-WAN deployment where traffic matching an SD-WAN rule with a destination service object (e.g., HTTPS) is not being steered according to the SLA priority. Instead, it is always taking the default static route member. Upon checking the firewall policies, what is the most common reason why an SD-WAN rule fails to process application or service-based traffic matching?
IPsec VPN phase 2 selectors must be set to 0.0.0.0/0 for service-based rules to evaluate
The SD-WAN rules are evaluated sequentially from top to bottom; an earlier broad SD-WAN rule with matching source/destination IP addresses is intercepting the traffic before the service-specific rule is reached
SD-WAN rules are evaluated top-down, and the first matching rule wins. A broader earlier rule matching the same source and destination IP addresses captures the traffic before the service-specific HTTPS rule is evaluated, so steering falls back to the default static route member.
The firewall policy containing the traffic has SSL inspection disabled, preventing service-based identification
The FortiGate kernel requires hardware acceleration (NP7) to be disabled for service-based SD-WAN rules to function
Want more Security Profiles Routing And IPsec practice?
Practice this domainThe vendor does not publish an exact question count for the NSE7_SDW. Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 3 domains: Central Management, System Configuration And Setup, Security Profiles Routing And IPsec. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Fortinet NSE7_SDW exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.