NSE7_SDW Practice Test 10 — 10 Questions

Question 1

Which THREE tasks are required to successfully deploy SD-WAN via FortiManager?

Accepted Answer

Installing the configuration to the devices. Option B is correct because FortiManager deploys SD-WAN through a centralized SD-WAN template (or SD-WAN overlay template) that defines the member interfaces, zones, and performance SLAs before it can be pushed to devices. Option E is correct because the template must be assigned to the target managed FortiGates, which binds the template to those devices so FortiManager knows which FortiGates should receive the SD-WAN configuration. Option A is correct because after the template is created and assigned, the configuration must be installed to the devices, which pushes the SD-WAN settings into the FortiGate running configuration. Option C is not required, since a hard factory reset is unnecessary and would only disrupt the existing management connection to FortiManager. Option D is also not required, because existing firewall policies do not need to be deleted for SD-WAN deployment; policies can be adjusted or referenced as needed.

Answer

Performing a hard factory reset on the FortiGate

Answer

Deleting all existing firewall policies

Question 2

A network administrator is troubleshooting an SD-WAN deployment managed by FortiManager. They notice that a specific SD-WAN rule is not being enforced on a FortiGate, even though the template was installed successfully. The rule uses a performance SLA to select the best path. What is the most likely cause?

Accepted Answer

The performance SLA health check is not properly configured or is failing.. The most likely cause is that the performance SLA health check is not properly configured or is failing. Without a valid health check, the SD-WAN rule cannot evaluate SLA compliance and thus may not enforce the rule as intended. Successful template installation does not guarantee that health checks are operational.

Answer

The SD-WAN rule is configured with a manual interface selection instead of using the SLA.

Answer

The SD-WAN template was applied to the wrong device group.

Answer

The FortiGate does not support SD-WAN performance SLAs.

Question 3

How do you apply an SD-WAN template to multiple managed FortiGates simultaneously?

Accepted Answer

By assigning the template in the Device Manager tab. In FortiManager, SD-WAN templates are applied to managed devices through the Device Manager tab, where you can assign a template to one or many FortiGates at once. This centralized push means the same SD-WAN configuration (members, zones, health checks, SLA rules) is deployed consistently across all selected devices without touching each unit individually. It is the standard workflow for provisioning SD-WAN at scale in a FortiManager-managed environment.

Answer

By manually editing each FortiGate config

Answer

Through individual CLI console sessions

Answer

By creating a global profile

Question 4

You are deploying a new FortiGate for an SD-WAN branch. The branch uses a single physical WAN link that is delivered as a VLAN-tagged subinterface on port1 (VLAN ID 100). You want to add this link to an SD-WAN zone named 'virtual-wan-link'. Which configuration step must be completed before the VLAN subinterface can be selected as an SD-WAN member?

Accepted Answer

The VLAN subinterface must be created and have an IP address assigned.. An SD-WAN member can only reference an interface that already exists and has an IP address configured. For a VLAN-based WAN link, that means creating the VLAN subinterface under the physical interface and assigning it an IP address before adding it to the SD-WAN zone. Role labels, Performance SLA objects, and VDOM placement are not prerequisites for membership.

Answer

The VLAN subinterface must be placed in a separate VDOM that is dedicated to SD-WAN.

Answer

The VLAN subinterface must be added to a Performance SLA before it can join the SD-WAN zone.

Answer

The VLAN subinterface must be assigned a role of WAN in its interface configuration.

Question 5

An administrator wants to view the active SD-WAN rule hit counts and verify which traffic is matching a specific SD-WAN rule in FortiOS. Which command should be used?

Accepted Answer

diagnose sys sdwan service. The command 'diagnose sys sdwan service' displays the SD-WAN service rules along with their hit counts and the sessions currently matching each rule, making it the correct tool to verify which traffic is hitting a specific rule. It is a diagnostic command run from the FortiGate CLI that exposes the internal SD-WAN service table. Other commands either show configuration, clear caches, or display firewall policy statistics that do not map to SD-WAN rule matching.

Answer

show system sdwan

Answer

execute router clear sdwan cache

Answer

get firewall policy statistics

Question 6

When using SD-WAN templates, how are SD-WAN rules ordered?

Accepted Answer

Top to bottom. SD-WAN rules in FortiGate templates are evaluated in a strict top-to-bottom order, exactly like firewall policies. The first rule whose matching criteria (source, destination, application, etc.) are satisfied is applied, and subsequent rules are not evaluated. This deterministic ordering lets administrators control which traffic takes which member link and ensures predictable path selection.

Answer

Based on the creation date

Answer

By the interface speed

Answer

Randomly

Question 7

When configuring an SD-WAN health check to monitor internet reachability using HTTP/HTTPS requests, which parameter defines the specific string the FortiGate expects to receive in the server response body to validate that the path is healthy?

Accepted Answer

http-match. The http-match parameter in an SD-WAN health check defines the specific string that the FortiGate expects to find in the HTTP/HTTPS response body to consider the path healthy. This allows the firewall to validate not just reachability but also that the correct application or service is responding. It is a key configuration for application-aware health checks.

Answer

probe-packet-size

Answer

sla-break-time

Answer

server-response-timeout

Question 8

If you modify a shared SD-WAN health check object that is referenced by ten different templates, what happens to the FortiGates?

Accepted Answer

All FortiGates using those templates will be affected after an install. When a shared SD-WAN health check object referenced by multiple templates is modified, the change is propagated to all FortiGates using those templates after a configuration install. FortiManager does not push changes in real time; an explicit install operation is required to apply the updated configuration to the managed devices. This ensures controlled rollout and consistency across the estate.

Answer

The FortiGates will automatically revert to the old settings

Answer

The health check will be disabled on all devices

Answer

Only the templates are updated, not the FortiGates

Question 9

A network administrator is using FortiManager to manage a large SD-WAN deployment. The administrator needs to create a new SD-WAN template that will be used by several FortiGates. The template must include a health check that uses HTTP to monitor a specific server. Which FortiManager object type should the administrator configure first to define the HTTP health check before adding it to the SD-WAN template?

Accepted Answer

SD-WAN Performance SLA. To define an HTTP health check, the administrator must create an SD-WAN Performance SLA object in FortiManager. This object specifies the protocol, server, and thresholds. Once created, it can be referenced in the SD-WAN template, allowing the health check to be applied to the appropriate members.

Answer

SD-WAN Zone

Answer

SD-WAN Member

Answer

SD-WAN Rule

Question 10

When setting up a Performance SLA, what is the 'Participant' setting?

Accepted Answer

The SD-WAN member that originates the probe.. The Participant setting in a Performance SLA defines which SD-WAN member (interface or link) originates the probe traffic. This determines the source of the health-check probes used to measure latency, jitter, and packet loss for that SLA.

Answer

The monitoring interval.

Answer

The user group assigned to the probe.

Answer

The destination IP address.