Fortinet · Free Practice Questions · Last reviewed May 2026
18real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
When using SD-WAN templates, how are SD-WAN rules ordered?
Top to bottom
SD-WAN rules are evaluated in a top-down sequence.
Based on the creation date
By the interface speed
Randomly
In SD-WAN central management, what is the 'SD-WAN Zone' used for?
To define the physical port speed
To limit bandwidth for specific users
To group multiple SD-WAN members for logical policy routing
Zones simplify routing by aggregating interfaces.
To isolate the SD-WAN traffic from the WAN
You are troubleshooting a scenario where an SD-WAN template is not pushing to a FortiGate. Which log file on the FortiManager is most useful to identify the specific CLI command causing the failure?
fmg_event.log
fmg_debug.log
This log contains detailed task execution and CLI command push history.
fmg_audit.log
fmg_system.log
When creating an SD-WAN template, what must be defined before you can add an SD-WAN interface to the template?
Individual SD-WAN member interfaces
Members must be defined to form the SD-WAN construct.
The SD-WAN health check probes
Global firewall policies
The virtual domain (VDOM) settings
Which object must be created before assigning a health check to an SD-WAN service rule in an SD-WAN template?
An SD-WAN Health Check
Health checks are explicitly defined as objects in the template.
A routing protocol
A firewall address object
An SD-WAN Zone
You are configuring SD-WAN templates in FortiManager. What is the primary purpose of using SD-WAN Central Management instead of configuring SD-WAN directly on individual FortiGates?
To perform local traffic analysis on the FortiGate only
To allow FortiGates to manage their own SD-WAN interfaces independently
To bypass the need for ADOMs
To enable SD-WAN template inheritance and synchronized policy updates across multiple managed devices
SD-WAN templates allow for standardized configurations across managed FortiGates.
Want more Central Management practice?
Practice this domainAn administrator has configured BGP over multiple SD-WAN IPsec tunnels to provide redundant paths to a datacenter. However, asymmetric routing is causing stateful inspection drops on a secondary FortiGate firewall downstream. To ensure that BGP selects the preferred primary SD-WAN member consistently, which BGP attribute is best manipulated via a route-map applied to the BGP neighbor in FortiOS?
AS-PATH prepend
Cluster ID
Origin code
Local Preference
Correct. Local Preference is used within IBGP to dictate the preferred exit path (and thus the preferred SD-WAN IPsec tunnel) out of the local AS.
An administrator wants to apply a Web Filtering security profile to traffic that is being dynamically steered via an SD-WAN rule. Where must this security profile be enforced in FortiOS?
Inside the firewall policy that matches the traffic being steered by the SD-WAN rule
Correct. Traffic steered by SD-WAN rules must still match a firewall policy where security profiles (like Web Filtering, Antivirus, IPS) are attached.
Directly inside the SD-WAN rule configuration under the advanced settings tab
Globally under the system settings as an SD-WAN overlay inspection profile
Within the IPsec tunnel phase 2 security association settings
A FortiGate device is configured with an SD-WAN rule utilizing a SLA rule for latency and packet loss. Security profiles including Deep Packet Inspection (DPI) SSL inspection and an Antivirus profile are applied to the firewall policy allowing this traffic. Users report intermittent connection drops on real-time UDP-based applications. Upon troubleshooting, the administrator notices that packet drops occur only when the SD-WAN rule dynamically steers traffic to a backup IPsec tunnel that has a smaller MTU. What is the most likely root cause and mitigation for this behavior?
Path MTU Discovery is failing because ICMP unreachable messages are blocked, and TCP MSS clamping is not adjusting the encapsulated IPsec packet size correctly
Correct. When SD-WAN steers traffic over a tunnel with a smaller MTU, lack of fragmentation or MSS adjustment leads to drops of packets larger than the egress interface MTU.
SD-WAN health check probes are overwhelming the IPsec tunnel bandwidth
The Antivirus proxy buffer is overflowing due to UDP streaming packets
The SSL inspection profile is attempting to decrypt UDP traffic, causing kernel panic and packet drops
An IPsec VPN tunnel used as an SD-WAN member is experiencing intermittent flapping due to DPD (Dead Peer Detection) timeout issues over a high-latency satellite link. How should the administrator adjust the Phase 1 IPsec settings on FortiOS to stabilize the tunnel without completely disabling failure detection?
Disable DPD entirely so the FortiGate never tears down the tunnel
Enable NP6/NP7 hardware offloading for Phase 1 SA renegotiation
Change the IPsec phase 1 mode from Main mode to Aggressive mode
Increase the DPD retry count and interval settings under the IPsec Phase 1 configuration
Correct. Increasing the DPD interval and retry count gives the satellite link more time to respond to liveness probes, preventing unnecessary flapping.
An enterprise network uses ADVPN 2.0 with BGP running over IPsec tunnels. A spoke needs to initiate a shortcut tunnel to another spoke. Which FortiOS CLI command is used on the hub to verify the active shortcut tunnels and view the shortcut state information?
execute router clear bgp all
get system sdwan neighbor
diagnose vpn tunnel list
Correct. 'diagnose vpn tunnel list' displays active IPsec tunnels, including dynamically created ADVPN shortcut tunnels.
diagnose netlink interface list
When troubleshooting SD-WAN performance SLA packet loss, an administrator wants to view real-time latency, jitter, and packet loss statistics for individual health check members. Which CLI command should be executed?
diagnose sys sdwan health-check
Correct. This command displays the current status, latency, jitter, and packet loss for configured SD-WAN health checks.
get system interface physical
execute ping-server status
show system sdwan
Want more Security Profiles Routing And IPsec practice?
Practice this domainYou have an SD-WAN rule with 'Priority' strategy. What happens if the highest priority member fails its SLA?
Traffic is dropped.
The FortiGate enters an error state.
Traffic is load balanced across all remaining members.
Traffic fails over to the member with the next highest priority value.
The system moves down the list of priorities.
You are configuring a Performance SLA to monitor reachability to a SaaS application. Which parameter determines the threshold for an interface to be considered 'unhealthy' in the SD-WAN routing table?
Probe Mode
Sequence Number
Packet Loss Threshold
If packet loss exceeds this percentage, the member is removed from the SD-WAN route table.
Update Interval
An SD-WAN rule is configured with 'Lowest Cost (SLA)' strategy. If all members in the SLA meet the requirements, how does the FortiGate select the outgoing interface?
The member with the lowest interface cost value defined in the SD-WAN member configuration.
Lowest cost strategy specifically uses the manual cost value.
Round Robin
The interface with the highest bandwidth.
The interface that was most recently added to the zone.
When using SD-WAN zones, what is the primary benefit of grouping multiple physical interfaces into a single zone?
It increases the throughput of individual physical links.
It prevents the need for performance SLAs.
It automatically enables load balancing between interfaces.
It allows you to apply a single firewall policy to the entire group.
This is the main administrative benefit of zones.
When configuring an SD-WAN rule, what is the purpose of the 'Source' address field?
To define the gateway IP for the route.
To force traffic to a specific SD-WAN zone.
To determine which ISP the traffic exits through regardless of SLA.
To match traffic based on the source IP or user.
This provides granular traffic steering.
Which SD-WAN rule strategy should you choose if you want to distribute traffic across multiple interfaces based on their bandwidth weights?
Manual
Maximize Bandwidth (SLA)
Distributes traffic based on weighted bandwidth settings.
Lowest Cost (SLA)
SLA Target
Want more System Configuration And Setup practice?
Practice this domainThe NSE7_SDW exam has 200 questions and must be completed in 90 minutes. The passing score is 700/1000.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 3 domains: Central Management, Security Profiles Routing And IPsec, System Configuration And Setup. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Fortinet NSE7_SDW exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.