Reinforce NSE7_SDW concepts with active-recall study cards covering all 3 blueprint domains. Each card shows the question on the front and the correct answer with a full explanation on the back.
Flashcards work through active recall — the process of retrieving information from memory rather than passively re-reading it. Research consistently shows that active recall produces stronger, longer-lasting memory than re-reading study guides. For NSE7_SDW preparation, this means flashcards are one of the highest-return study tools available.
Attempt recall first
Read the NSE7_SDW question on each card, pause, and attempt to formulate the answer in your own words before revealing. This retrieval attempt — even if wrong — dramatically strengthens memory compared to immediately reading the answer.
Review wrong cards again
When you get a card wrong, note it and add it back to your review pile. Spaced repetition — seeing difficult cards more frequently — is the mechanism that makes flashcard study far more efficient than linear reading.
Study by domain
Group your NSE7_SDW flashcard sessions by domain for the first 3–4 weeks. Master one domain before moving to the next. In the final week, shuffle all cards together to test cross-domain recall — which is what the real NSE7_SDW exam requires.
Short sessions beat marathon reviews
20–30 flashcard cards per session, done daily, produces better retention than a single 200-card marathon session. Five short daily sessions per week over 4 weeks gives you over 400 total card reviews — enough to reliably pass NSE7_SDW.
Sample cards from the NSE7_SDW flashcard bank. Read the question, think of the answer, then read the explanation below.
When using SD-WAN templates, how are SD-WAN rules ordered?
Top to bottom
SD-WAN rules in FortiGate templates are evaluated in a strict top-to-bottom order, exactly like firewall policies. The first rule whose matching criteria (source, destination, application, etc.) are satisfied is applied, and subsequent rules are not evaluated. This deterministic ordering lets administrators control which traffic takes which member link and ensures predictable path selection.
You have an SD-WAN rule with 'Priority' strategy. What happens if the highest priority member fails its SLA?
Traffic fails over to the member with the next highest priority value.
In an SD-WAN rule using the Priority strategy, members are ranked by priority value (lower number = higher priority). If the highest-priority member fails its SLA, FortiOS fails over to the next highest-priority member that is still SLA-compliant, preserving service continuity.
An administrator wants to apply a Web Filtering security profile to traffic that is being dynamically steered via an SD-WAN rule. Where must this security profile be enforced in FortiOS?
Inside the firewall policy that matches the traffic being steered by the SD-WAN rule
In FortiOS, security profiles such as Web Filtering are enforced by the firewall policy that matches the traffic, not by the SD-WAN rule itself. SD-WAN rules only determine the outgoing interface or path; they do not apply security inspection. Therefore, the Web Filtering profile must be attached to the firewall policy that permits and steers the traffic via the SD-WAN rule.
You are deploying a new SD-WAN interface. What is the mandatory step before you can add an interface to an SD-WAN zone?
Remove all firewall policy, static route, and DHCP references from the interface.
Before an interface can be added to an SD-WAN zone, it must be free of references from firewall policies, static routes, and DHCP server configurations. FortiOS enforces this because SD-WAN zones take over the routing and policy handling for member interfaces, and conflicting references would create ambiguous or broken behavior. Removing these references is therefore the mandatory prerequisite step.
A Performance SLA bound to an SD-WAN zone is configured with a 200 ms latency threshold and a 5% packet-loss threshold. A member reports 180 ms latency but 8% packet loss. What is the member's SLA state, and how does it affect rule selection?
The member is considered out of SLA because packet loss exceeds the threshold, so rules exclude it from selection.
Performance SLA health requires every configured threshold to be met, so exceeding the packet-loss limit alone marks the member out of SLA even though latency is acceptable. Rules referencing that SLA then skip the member, steering traffic to healthier links. The member is not merely warned, and both thresholds do not need to fail together.
An administrator has created an SD-WAN template in FortiManager and applied it to a FortiGate. The administrator then modifies the template to add a new SD-WAN rule that directs traffic from a specific subnet to a new overlay interface. After installing the policy package, the administrator notices that the rule is not taking effect on the FortiGate. What is the most likely reason?
The new overlay interface is not included in the SD-WAN zone on the FortiGate.
The most likely reason an SD-WAN rule is not taking effect after a template update is that the new overlay interface referenced in the rule is not a member of the SD-WAN zone on the FortiGate. SD-WAN rules can only select interfaces that are part of the SD-WAN zone. The administrator should verify that the interface is correctly mapped and included in the zone after installation.
In an ADVPN 2.0 deployment, a hub unit uses BGP to advertise routes to spokes. When a spoke learns a prefix via BGP from the hub, what mechanism allows the spoke to automatically initiate an ADVPN shortcut tunnel directly to another spoke when traffic flows between them?
The FortiGate kernel detects traffic matching a dynamic BGP route over the IPsec interface and initiates an IKE shortcut negotiation with the target spoke
In ADVPN, when a spoke receives a BGP route from the hub pointing to another spoke's subnet, the route's next-hop resolves over the IPsec tunnel. When the spoke's kernel sees traffic destined for that prefix, it triggers the ADVPN shortcut logic: the spoke initiates an IKE negotiation directly with the target spoke to build a dynamic shortcut tunnel, bypassing the hub for that traffic. This is the core ADVPN 'shortcut' behavior.
A network engineer is creating an SD-WAN template in FortiManager. They want to define a health check that monitors the quality of an internet link by sending HTTP requests to a specific URL. Which configuration element in the SD-WAN template should they use to accomplish this?
Performance SLA
Performance SLA is the SD-WAN template component designed for health checking. It supports HTTP as a protocol and allows specifying a URL to monitor. The SLA generates probes and evaluates link quality, which is essential for SD-WAN to make informed routing decisions based on real-time performance metrics.
What is the default behavior when all SD-WAN members in a rule fail their SLA?
The traffic uses all members.
By default, when all SD-WAN members in a rule fail their SLA, FortiOS falls back to using all members in the rule rather than dropping traffic. This 'best effort' behaviour ensures connectivity is maintained even when no member meets the SLA thresholds.
An administrator is configuring an IPsec VPN tunnel between two FortiGate devices for SD-WAN. The administrator wants to ensure that the tunnel interface can be used in SD-WAN rules and that the tunnel is established only when the underlying physical interface is up. Which IPsec Phase 1 configuration parameter is required to bind the tunnel to a specific outgoing interface?
interface
The 'interface' parameter in IPsec Phase 1 explicitly binds the tunnel to a specific outgoing interface. This ensures the tunnel uses only that interface and is established only when it is up, which is critical for SD-WAN member association and health checking. Other parameters like local-gw or remote-gw do not provide this binding.
A network administrator wants to ensure that IPsec traffic between two FortiGate SD-WAN members is encrypted with a specific set of algorithms. The administrator configures Phase 2 selectors on both peers. Which Phase 2 parameter must match on both ends for the tunnel to come up?
The Phase 2 proposal, including encryption and authentication algorithms.
For an IPsec Phase 2 SA to establish, the proposal—encryption and authentication algorithms—must match on both peers. Other parameters like key lifetime, selectors, and replay window are either locally significant or must be complementary rather than identical. In SD-WAN deployments, consistent Phase 2 proposals across all overlay members prevent negotiation failures and ensure stable tunnels. Administrators should verify proposals when troubleshooting tunnel establishment issues.
An administrator is configuring an SD-WAN template in FortiManager. The template includes a performance SLA that monitors two health checks: one for latency and one for jitter. The administrator wants the SD-WAN rule to select the member with the lowest latency. Which FortiManager configuration element must be used to achieve this?
SD-WAN rule with strategy set to 'lowest latency' and the latency SLA referenced.
To select the SD-WAN member with the lowest latency, the SD-WAN rule must use the 'lowest latency' strategy and reference the latency SLA. This strategy evaluates all members that meet the SLA and picks the one with the lowest measured latency. Other strategies focus on cost, bandwidth, or load distribution, and do not guarantee the lowest latency member is selected.
Which command is used to verify the current status of SD-WAN members and their SLA health from the CLI?
diagnose sys sdwan health-check
On FortiGate SD-WAN, the health of each member link and its SLA probes is inspected with 'diagnose sys sdwan health-check', which shows per-SLA state (up/down), latency, jitter, and packet loss for each member. This is the canonical CLI command for verifying that SLA-based steering decisions are being made on accurate telemetry.
You are configuring SD-WAN on a FortiGate that will be managed by FortiManager. You want to ensure that the SD-WAN configuration is consistent across multiple devices and that changes can be deployed centrally. Which action must you take in FortiManager to support SD-WAN configuration?
Use the SD-WAN template in FortiManager.
FortiManager's SD-WAN template is designed for centralized configuration of SD-WAN settings. It allows you to define members, zones, performance SLAs, and rules once and assign them to multiple FortiGates. This ensures consistency and simplifies deployment. Other options do not provide the centralized SD-WAN configuration capability required.
A network engineer is using FortiManager to manage SD-WAN templates for multiple FortiGates. They need to ensure that a specific SD-WAN rule is only applied to branch offices that have a specific tag. Which FortiManager feature should they use?
Dynamic mapping
Dynamic mapping in FortiManager enables the conditional assignment of configuration objects, including SD-WAN templates and rules, based on device metadata such as tags. This allows administrators to target specific devices without manually assigning templates to each one. By using dynamic mapping, the SD-WAN rule is applied only to branch offices that have the designated tag, ensuring precise configuration management.
An administrator configures an SD-WAN rule that uses the 'maximize bandwidth (SLA)' strategy across three IPsec overlays. A security profile group containing IPS and Application Control is applied to the firewall policy that references the SD-WAN zone. Users report that some sessions are being re-evaluated mid-stream and reset when a health check fails. Which FortiOS behavior explains the resets?
When an SLA member fails, FortiOS re-runs the SD-WAN rule and may steer existing sessions to a different member, causing the security profile to re-inspect and reset sessions that cannot be re-evaluated.
SD-WAN rules that monitor SLA can trigger re-evaluation of existing sessions when a member's SLA degrades or fails. If the rule permits re-evaluation, FortiOS may move flows to a different member. Stateful security profiles such as IPS and Application Control may not be able to maintain inspection state across members, leading to session resets. Administrators can control this by disabling re-evaluation for sensitive rules or by designing SLA thresholds that avoid frequent flapping, ensuring stable session steering.
How can you verify that an SD-WAN configuration change was successfully applied to a FortiGate via FortiManager?
By checking the Device Manager installation status
In FortiManager, after you install a configuration change to a managed FortiGate, the Device Manager provides a real-time installation status for each device. This status shows whether the installation succeeded, failed, or is pending, and includes details such as the specific policy package or configuration revision applied. Therefore, checking the Device Manager installation status is the direct and authoritative way to verify that an SD-WAN configuration change was successfully applied.
A network engineer is configuring an SD-WAN template in FortiManager for a new branch office. The branch has two internet links: one via DHCP and one via static IP. The engineer wants to ensure that the SD-WAN rule prefers the static link for business-critical traffic but can fail over to the DHCP link if the static link's performance degrades. Which SD-WAN template component should the engineer configure to define the performance thresholds that trigger failover?
Performance SLA
Performance SLA defines the acceptable thresholds for latency, jitter, and packet loss. When a link's health check measurements violate these thresholds, the link is marked as out of SLA, and SD-WAN rules can then select an alternative link. This enables dynamic failover based on link quality. Health checks provide the data, but the SLA sets the criteria. SD-WAN rules use the SLA status to make routing decisions, but they do not define the thresholds themselves.
Where do you configure the 'Gateway' IP address for an SD-WAN member?
Under Network > SD-WAN > SD-WAN Members.
The Gateway IP address for an SD-WAN member is configured in the member's settings under Network > SD-WAN > SD-WAN Members. This gateway is the next-hop IP address used for health checks and for forwarding traffic over that member, and it is specific to the SD-WAN member configuration rather than the interface or static route table.
An administrator is configuring an SD-WAN rule to route VoIP traffic over the MPLS link and all other traffic over the internet link. The administrator wants to ensure that VoIP traffic is prioritized and that the rule only selects the MPLS link if it meets specific latency and jitter thresholds. Which SD-WAN configuration should be used?
Create an SD-WAN rule with the 'SLA' strategy, referencing a health check that monitors latency and jitter on the MPLS link, and set the rule to match VoIP traffic.
The 'SLA' strategy is designed to route traffic based on health check metrics such as latency and jitter. By referencing a health check that monitors these metrics on the MPLS link, the SD-WAN rule can ensure that VoIP traffic is only sent over the MPLS link when it meets the specified thresholds. If the thresholds are not met, the rule can fail over to another link, maintaining call quality.
An administrator needs to configure an SD-WAN rule that load-balances traffic across two WAN links based on the volume of traffic, ensuring that both links are utilized proportionally to their configured weights. Which SD-WAN rule strategy should be selected?
Weighted Load Balance
The 'Weighted Load Balance' strategy is designed to distribute traffic across SD-WAN members according to their configured weights. This is the only strategy that allows the administrator to specify a proportional split, such as 70% on one link and 30% on another. It ensures both links are utilized in proportion to their weights, which matches the scenario's requirement.
The NSE7_SDW flashcard bank covers all 3 official blueprint domains published by Fortinet. Cards are distributed proportionally, so domains with higher exam weight have more cards.
Domain Coverage
Central Management
System Configuration And Setup
Security Profiles Routing And IPsec
Both flashcards and practice questions are evidence-based study tools. The difference is in what they train:
Flashcards — concept retention
Best for memorising definitions, acronyms, protocol behaviours, command syntax, and conceptual distinctions. Use flashcards to build the foundational vocabulary that NSE7_SDW questions assume you know.
Best in: weeks 1–3
Practice tests — application
Best for applying concepts to realistic scenarios, eliminating distractors, and building exam stamina.NSE7_SDW questions test scenario reasoning — not just recall — so practice tests are essential.
Best in: weeks 3–6
The most effective NSE7_SDW study plan combines both: use flashcards for the first 2–3 weeks to build conceptual foundations, then shift to practice tests and mock exams in the final 2–3 weeks to apply and benchmark that knowledge. Most candidates who pass on their first attempt use both tools.
Yes. Courseiva provides free NSE7_SDW flashcards across all official exam domains. Every card includes the correct answer and a full explanation of why it is right and why the distractors are wrong. The platform also includes topic-based practice, mock exams, and readiness tracking — no account required.
Courseiva has 216+ original NSE7_SDW flashcards across all 3 exam blueprint domains. New cards are added regularly as the question bank grows. All cards are checked against the official Fortinet exam objectives, with editorial oversight from an experienced network and security engineer.
Courseiva flashcards are purpose-built for IT certification exams. Unlike generic flashcard platforms where content quality varies, every Courseiva card is mapped to the official NSE7_SDW exam blueprint, written by engineers who hold the certification, and includes a full explanation of the correct answer and why the distractors are wrong. This explanation quality is what separates genuine learning from rote memorisation.
Courseiva is a web platform — an internet connection is required. For offline study, we recommend creating free Courseiva account, using the platform in your browser, and using your device's offline capabilities if your browser supports offline web apps.
Save your results, see which domains need more work, and get spaced repetition recommendations — all free.
Sign Up FreeFree forever · Every certification included