NSE7_SDW Practice Test 12 — 15 Questions

Question 1

Which THREE factors can affect the 'Performance SLA' logic in an SD-WAN template?

Accepted Answer

Packet loss threshold. The Performance SLA logic in an SD-WAN template is driven by the SLA criteria defined for each member, and those criteria are the three measured metrics: packet loss threshold (A), jitter threshold (C), and latency threshold (E). FortiGate continuously probes each SD-WAN member (e.g., via ping or HTTP) and compares the measured packet loss, jitter, and latency against these configured thresholds to determine whether the link is within SLA and to trigger SLA-based steering or failover. Option B is incorrect because the FortiGate firmware version is not an SLA metric; it may affect available features but does not feed the Performance SLA calculation. Option D is incorrect because the number of active VPN tunnels is a topology/state value, not a measured SLA parameter used by the Performance SLA logic.

Answer

The firmware version of the FortiGate

Answer

The number of active VPN tunnels

Question 2

Which TWO of the following are benefits of using SD-WAN templates in FortiManager?

Accepted Answer

Consistent SD-WAN policy application across devices. Option A is correct because SD-WAN templates in FortiManager let you define SD-WAN settings (members, zones, health checks, and rules) once and assign them to many managed FortiGates, ensuring the same SD-WAN policy is applied consistently across devices. Option E is correct because these templates enable simplified, scalable configuration deployment for large branch deployments by pushing a standardized SD-WAN configuration to many FortiGates at once instead of configuring each device individually. Option B is not correct because firmware upgrades are handled by FortiManager's firmware management features, not by SD-WAN templates. Option C is not correct because log analysis is performed by FortiAnalyzer, not by SD-WAN templates in FortiManager. Option D is not correct because direct CLI access is a separate administrative capability and is not a benefit provided by SD-WAN templates.

Answer

Automatic firmware upgrades

Answer

Automated log analysis

Answer

Direct access to the FortiGate CLI

Question 3

Which TWO configuration changes require a push from FortiManager to the FortiGate?

Accepted Answer

Changes to an SD-WAN template. Option B is correct because SD-WAN templates are FortiManager-managed objects: when you edit an SD-WAN template in FortiManager, the change is stored in the ADOM and must be installed/pushed to the managed FortiGate for it to take effect. Option C is correct because a firewall policy package is also a FortiManager-managed configuration object, so any modification must be installed to the target FortiGate device. Option A is incorrect because changes made directly in the FortiGate local GUI are local to the device and do not require a FortiManager push. Option D is incorrect because adding a local user directly on the FortiGate is a local device change, not a FortiManager-managed object requiring installation. Option E is incorrect because changing the FortiManager admin password affects only FortiManager itself and is not pushed to managed FortiGates.

Answer

Changes to the log settings on the FortiGate local GUI

Answer

Adding a new user to the FortiGate local database

Answer

Changing the FortiManager admin password

Question 4

An enterprise network uses ADVPN 2.0 with BGP running over IPsec tunnels. A spoke needs to initiate a shortcut tunnel to another spoke. Which FortiOS CLI command is used on the hub to verify the active shortcut tunnels and view the shortcut state information?

Accepted Answer

diagnose vpn tunnel list. The command 'diagnose vpn tunnel list' on the hub displays all active IPsec tunnels, including ADVPN shortcut tunnels established between spokes. It shows tunnel names, source/destination IPs, and state information, allowing the administrator to verify that shortcut tunnels are up and active. This is the standard FortiOS diagnostic command for inspecting IPsec tunnel status in ADVPN deployments.

Answer

execute router clear bgp all

Answer

get system sdwan neighbor

Answer

diagnose netlink interface list

Question 5

In SD-WAN central management, what is the 'SD-WAN Zone' used for?

Accepted Answer

To group multiple SD-WAN members for logical policy routing. In SD-WAN central management, an SD-WAN Zone is a logical grouping of multiple SD-WAN members (interfaces or tunnels) that share the same path selection and policy routing characteristics. It allows administrators to apply policies to a group of links rather than individual interfaces, simplifying configuration and enabling logical routing decisions based on zone-level metrics.

Answer

To define the physical port speed

Answer

To limit bandwidth for specific users

Answer

To isolate the SD-WAN traffic from the WAN

Question 6

An administrator is troubleshooting an SD-WAN deployment where traffic matching an SD-WAN rule with a destination service object (e.g., HTTPS) is not being steered according to the SLA priority. Instead, it is always taking the default static route member. Upon checking the firewall policies, what is the most common reason why an SD-WAN rule fails to process application or service-based traffic matching?

Accepted Answer

The SD-WAN rules are evaluated sequentially from top to bottom; an earlier broad SD-WAN rule with matching source/destination IP addresses is intercepting the traffic before the service-specific rule is reached. SD-WAN rules are evaluated in order from top to bottom, and the first matching rule is applied. If a broad rule (e.g., matching any source/destination or all services) appears above a more specific service-based rule, it will intercept the traffic and prevent the service-specific rule from being evaluated. This is the most common misconfiguration causing service-based SD-WAN rules to be bypassed.

Answer

IPsec VPN phase 2 selectors must be set to 0.0.0.0/0 for service-based rules to evaluate

Answer

The firewall policy containing the traffic has SSL inspection disabled, preventing service-based identification

Answer

The FortiGate kernel requires hardware acceleration (NP7) to be disabled for service-based SD-WAN rules to function

Question 7

When troubleshooting SD-WAN performance SLA packet loss, an administrator wants to view real-time latency, jitter, and packet loss statistics for individual health check members. Which CLI command should be executed?

Accepted Answer

diagnose sys sdwan health-check. The command 'diagnose sys sdwan health-check' displays real-time performance SLA statistics for SD-WAN health check members, including latency, jitter, and packet loss. It is the correct tool to troubleshoot SLA violations and monitor link quality. This command provides per-member details essential for diagnosing SD-WAN performance issues.

Answer

get system interface physical

Answer

execute ping-server status

Answer

show system sdwan

Question 8

An SD-WAN rule is configured with 'Lowest Cost (SLA)' strategy. If all members in the SLA meet the requirements, how does the FortiGate select the outgoing interface?

Accepted Answer

The member with the lowest interface cost value defined in the SD-WAN member configuration.. With the 'Lowest Cost (SLA)' strategy, FortiGate first filters members that meet the SLA targets, then among those selects the member with the lowest configured cost value in the SD-WAN member configuration. Cost is a numeric value (default 0) that admins set per member to express preference — lower cost means preferred. So if all members meet SLA, the one with the lowest cost wins.

Answer

Round Robin

Answer

The interface with the highest bandwidth.

Answer

The interface that was most recently added to the zone.

Question 9

You are troubleshooting an issue where traffic is not using an SD-WAN rule despite meeting criteria. What is the most likely cause?

Accepted Answer

A higher-priority SD-WAN rule is matching the traffic first.. SD-WAN rules are evaluated top-down in the rule list, and the first rule whose match criteria (source, destination, application, user, etc.) are satisfied wins. If a higher-priority rule matches the same traffic, the intended rule is never reached, so the traffic is steered by the earlier rule instead. This is the most common cause of 'rule not being used' symptoms in production.

Answer

The SD-WAN rule is disabled.

Answer

The Performance SLA has timed out.

Answer

The interface is not in an SD-WAN zone.

Question 10

Which TWO of the following can cause an SD-WAN member to be marked as 'down' in an SLA?

Accepted Answer

The probe times out.. Option A is correct because an SD-WAN SLA probe (such as a bidirectional forwarding detection or performance-monitoring probe) that times out means the member stops receiving replies, so the health check fails and the member is marked down. Option C is correct because SLA criteria include packet-loss thresholds; when measured loss on the member exceeds the configured threshold, the SLA is violated and the member is marked down. Option B is not correct because a system clock update affects timestamps and logging but does not itself fail an SLA probe. Option D is not correct because disabling a firewall policy changes traffic handling, not the SLA health-check result for the member. Option E is not correct because changing an interface IP address is a configuration change that may disrupt connectivity, but it is not the SLA condition that directly marks the member down.

Answer

The system clock is updated.

Answer

The firewall policy is disabled.

Answer

The interface IP address is changed.

Question 11

An administrator is troubleshooting BGP route propagation over SD-WAN IPsec tunnels where a branch office is not receiving specific routes from the datacenter hub. Which TWO CLI commands on the FortiGate are most useful for diagnosing BGP peering and advertised route issues? (Choose two)

Accepted Answer

get router info bgp neighbors advertised-routes. Option D, 'get router info bgp neighbors advertised-routes', is correct because it shows exactly which prefixes the local FortiGate is advertising to a specific BGP neighbor, directly revealing whether the missing branch routes are being sent out the IPsec-over-SD-WAN peering. Option E, 'get router info bgp summary', is correct because it verifies the BGP session state (Established vs. Active/Idle), uptime, and prefix counters per neighbor, confirming whether the peering across the SD-WAN IPsec tunnel is actually up before investigating route contents. Option A, 'execute ipsec tunnel list', only lists IPsec tunnel status and does not expose BGP peering or route advertisement details. Option B, 'diagnose sys sdwan member', reports SD-WAN member health and SLA metrics, not BGP neighbor or prefix information. Option C, 'get system interface physical', merely displays physical interface configuration/status and is unrelated to BGP route propagation.

Answer

execute ipsec tunnel list

Answer

diagnose sys sdwan member

Answer

get system interface physical

Question 12

Which THREE pieces of information are displayed in the SD-WAN Monitor in FortiManager?

Accepted Answer

Status of SD-WAN members. Option A is correct because the SD-WAN Monitor in FortiManager displays the operational status of each SD-WAN member interface, showing whether members are up, down, or degraded. Option B is correct because the monitor presents the health metrics collected by the SD-WAN performance SLA probes, specifically latency, jitter, and packet loss for each member. Option C is correct because the SD-WAN Monitor also shows interface bandwidth usage, allowing administrators to see throughput per SD-WAN member. Option D is not part of the SD-WAN Monitor, as system temperature is a hardware sensor value found in device dashboards or sensor views, not SD-WAN monitoring. Option E is also not displayed there, since the logged-in admin username is a session/administrative detail unrelated to SD-WAN member monitoring.

Answer

System temperature of the FortiGate

Answer

The current username of the logged-in admin

Question 13

Which THREE of the following criteria are used for SD-WAN rule traffic matching?

Accepted Answer

Destination address. In FortiGate SD-WAN rules, traffic is matched using criteria such as destination address (B), application/service (D), and source address (E), which are all standard SD-WAN rule match fields used to steer traffic to the appropriate member link. Destination address (B) is correct because SD-WAN rules can match on the destination IP/subnet to route specific traffic. Application/Service (D) is correct because SD-WAN rules commonly match on application signatures or service objects to steer application traffic. Source address (E) is correct because SD-WAN rules can match on the source IP/subnet to differentiate traffic from specific hosts or networks. Interface speed (A) is not a match criterion; it is a link attribute used for SLA/load-balancing decisions, not traffic matching. VLAN priority (C) is not a standard SD-WAN rule match criterion; QoS/priority handling is separate from SD-WAN traffic matching.

Answer

Interface speed

Answer

VLAN priority

Question 14

An administrator is configuring BGP over SD-WAN IPsec tunnels between a headquarters FortiGate and branch FortiGates. Which TWO configuration steps are required to ensure robust and stable dynamic routing over the SD-WAN IPsec tunnels? (Choose two)

Accepted Answer

Configure BGP neighbors using the loopback interface IP addresses or tunnel specific IP addresses rather than physical interface IPs. Option B is correct because peering BGP over loopback or tunnel-specific IP addresses (rather than physical WAN interface IPs) ties the session to the SD-WAN overlay, so the BGP session survives physical link changes and failover events since the tunnel/loopback address remains reachable regardless of which underlying WAN link carries the IPsec traffic. Option C is correct because WAN links and IPsec tunnels can experience latency spikes and reconvergence delays during failover; enabling BGP graceful restart or tuning keepalive/holddown timers prevents the session from flapping and dropping routes unnecessarily during those transient conditions. Option A is wrong because setting administrative distance to 255 makes the BGP routes unusable (never installed in the routing table), which disables dynamic routing rather than stabilizing it. Option D is wrong because static default routes pointing to null0 would black-hole traffic and are not a BGP-over-SD-WAN requirement. Option E is wrong because disabling IPsec Phase 2 encryption breaks the secure tunnel and is not needed for BGP, which is encapsulated inside the tunnel anyway.

Answer

Set the BGP administrative distance to 255 to disable all routing updates

Answer

Configure static default routes on all BGP neighbors pointing to the null0 interface

Answer

Disable IPsec phase 2 encryption to allow BGP plaintext hello packets to pass through without encapsulation overhead

Question 15

Which TWO of the following steps are required to correctly configure a Performance SLA?

Accepted Answer

Select the probe protocol.. Option C is correct because a Performance SLA health check must specify the probe protocol (e.g., Ping, HTTP, TCP-echo, or UDP-echo) so FortiGate knows how to generate and evaluate the probe traffic. Option D is correct because the SLA requires a destination IP address (the server or target being monitored) to which the probes are sent and against which latency, jitter, and packet loss are measured. Option A is not required, since the probe destination is defined directly in the SLA configuration rather than through a firewall address object. Option B is not required, as BGP is unrelated to Performance SLA probing and is only needed for dynamic routing. Option E is not required, because an SLA probe is bound to a specific outgoing interface or link, not to a VPN tunnel.

Answer

Configure a firewall address object for the probe.

Answer

Enable BGP on the interface.

Answer

Assign the probe to a VPN tunnel.