NSE7_SDW Practice Test 1 — 10 Questions

Question 1

You are deploying a new SD-WAN interface. What is the mandatory step before you can add an interface to an SD-WAN zone?

Accepted Answer

Remove all firewall policy, static route, and DHCP references from the interface.. Before an interface can be added to an SD-WAN zone, it must be free of references from firewall policies, static routes, and DHCP server configurations. FortiOS enforces this because SD-WAN zones take over the routing and policy handling for member interfaces, and conflicting references would create ambiguous or broken behavior. Removing these references is therefore the mandatory prerequisite step.

Answer

Configure a performance SLA for that specific interface.

Answer

Assign a VLAN ID to the interface.

Answer

Enable SD-WAN on the global system settings.

Question 2

A Performance SLA bound to an SD-WAN zone is configured with a 200 ms latency threshold and a 5% packet-loss threshold. A member reports 180 ms latency but 8% packet loss. What is the member's SLA state, and how does it affect rule selection?

Accepted Answer

The member is considered out of SLA because packet loss exceeds the threshold, so rules exclude it from selection.. Performance SLA health requires every configured threshold to be met, so exceeding the packet-loss limit alone marks the member out of SLA even though latency is acceptable. Rules referencing that SLA then skip the member, steering traffic to healthier links. The member is not merely warned, and both thresholds do not need to fail together.

Answer

The member is considered in SLA because latency is within threshold, so it remains eligible for rules.

Answer

The member is in SLA but is flagged with a warning that only affects logging, not rule selection.

Answer

The member is out of SLA only if latency and packet loss both exceed their thresholds simultaneously.

Question 3

An administrator has created an SD-WAN template in FortiManager and applied it to a FortiGate. The administrator then modifies the template to add a new SD-WAN rule that directs traffic from a specific subnet to a new overlay interface. After installing the policy package, the administrator notices that the rule is not taking effect on the FortiGate. What is the most likely reason?

Accepted Answer

The new overlay interface is not included in the SD-WAN zone on the FortiGate.. The most likely reason an SD-WAN rule is not taking effect after a template update is that the new overlay interface referenced in the rule is not a member of the SD-WAN zone on the FortiGate. SD-WAN rules can only select interfaces that are part of the SD-WAN zone. The administrator should verify that the interface is correctly mapped and included in the zone after installation.

Answer

The FortiGate requires a reboot after installing a new SD-WAN rule.

Answer

The SD-WAN template was not saved before installation.

Answer

The SD-WAN rule priority is lower than the default route.

Question 4

In an ADVPN 2.0 deployment, a hub unit uses BGP to advertise routes to spokes. When a spoke learns a prefix via BGP from the hub, what mechanism allows the spoke to automatically initiate an ADVPN shortcut tunnel directly to another spoke when traffic flows between them?

Accepted Answer

The FortiGate kernel detects traffic matching a dynamic BGP route over the IPsec interface and initiates an IKE shortcut negotiation with the target spoke. In ADVPN, when a spoke receives a BGP route from the hub pointing to another spoke's subnet, the route's next-hop resolves over the IPsec tunnel. When the spoke's kernel sees traffic destined for that prefix, it triggers the ADVPN shortcut logic: the spoke initiates an IKE negotiation directly with the target spoke to build a dynamic shortcut tunnel, bypassing the hub for that traffic. This is the core ADVPN 'shortcut' behavior.

Answer

OSPF sends a special multicast hello packet across the hub to establish mesh point-to-point links

Answer

FortiManager pushes a dynamic static route to both spokes simultaneously

Answer

The Web Filtering profile intercepts the packet and redirects it via proxy to the destination spoke

Question 5

A network engineer is creating an SD-WAN template in FortiManager. They want to define a health check that monitors the quality of an internet link by sending HTTP requests to a specific URL. Which configuration element in the SD-WAN template should they use to accomplish this?

Accepted Answer

Performance SLA. Performance SLA is the SD-WAN template component designed for health checking. It supports HTTP as a protocol and allows specifying a URL to monitor. The SLA generates probes and evaluates link quality, which is essential for SD-WAN to make informed routing decisions based on real-time performance metrics.

Answer

SD-WAN rule

Answer

SD-WAN zone

Answer

Static route

Question 6

What is the default behavior when all SD-WAN members in a rule fail their SLA?

Accepted Answer

The traffic uses all members.. By default, when all SD-WAN members in a rule fail their SLA, FortiOS falls back to using all members in the rule rather than dropping traffic. This 'best effort' behaviour ensures connectivity is maintained even when no member meets the SLA thresholds.

Answer

The traffic is routed to the management interface.

Answer

The rule becomes inactive.

Answer

The traffic is dropped.

Question 7

An administrator is configuring an IPsec VPN tunnel between two FortiGate devices for SD-WAN. The administrator wants to ensure that the tunnel interface can be used in SD-WAN rules and that the tunnel is established only when the underlying physical interface is up. Which IPsec Phase 1 configuration parameter is required to bind the tunnel to a specific outgoing interface?

Accepted Answer

interface. The 'interface' parameter in IPsec Phase 1 explicitly binds the tunnel to a specific outgoing interface. This ensures the tunnel uses only that interface and is established only when it is up, which is critical for SD-WAN member association and health checking. Other parameters like local-gw or remote-gw do not provide this binding.

Answer

psksecret

Answer

remote-gw

Answer

local-gw

Question 8

A network administrator wants to ensure that IPsec traffic between two FortiGate SD-WAN members is encrypted with a specific set of algorithms. The administrator configures Phase 2 selectors on both peers. Which Phase 2 parameter must match on both ends for the tunnel to come up?

Accepted Answer

The Phase 2 proposal, including encryption and authentication algorithms.. For an IPsec Phase 2 SA to establish, the proposal—encryption and authentication algorithms—must match on both peers. Other parameters like key lifetime, selectors, and replay window are either locally significant or must be complementary rather than identical. In SD-WAN deployments, consistent Phase 2 proposals across all overlay members prevent negotiation failures and ensure stable tunnels. Administrators should verify proposals when troubleshooting tunnel establishment issues.

Answer

The Phase 2 replay window size, which must be set to the same value on both peers.

Answer

The Phase 2 key lifetime, which must be identical in seconds on both peers.

Answer

The Phase 2 local and remote subnets, which must be mirrored exactly on both peers.

Question 9

An administrator is configuring an SD-WAN template in FortiManager. The template includes a performance SLA that monitors two health checks: one for latency and one for jitter. The administrator wants the SD-WAN rule to select the member with the lowest latency. Which FortiManager configuration element must be used to achieve this?

Accepted Answer

SD-WAN rule with strategy set to 'lowest latency' and the latency SLA referenced.. To select the SD-WAN member with the lowest latency, the SD-WAN rule must use the 'lowest latency' strategy and reference the latency SLA. This strategy evaluates all members that meet the SLA and picks the one with the lowest measured latency. Other strategies focus on cost, bandwidth, or load distribution, and do not guarantee the lowest latency member is selected.

Answer

SD-WAN rule with strategy set to 'lowest cost (SLA)' and the latency SLA referenced.

Answer

SD-WAN rule with strategy set to 'maximize bandwidth (SLA)' and the latency SLA referenced.

Answer

SD-WAN rule with strategy set to 'load balance' and the latency SLA referenced.

Question 10

Which command is used to verify the current status of SD-WAN members and their SLA health from the CLI?

Accepted Answer

diagnose sys sdwan health-check. On FortiGate SD-WAN, the health of each member link and its SLA probes is inspected with 'diagnose sys sdwan health-check', which shows per-SLA state (up/down), latency, jitter, and packet loss for each member. This is the canonical CLI command for verifying that SLA-based steering decisions are being made on accurate telemetry.

Answer

show router info bgp

Answer

get system interface

Answer

get system sdwan member