NSE7_SDW Practice Test 13 — 15 Questions

Question 1

An administrator configures an SD-WAN health check with multiple probes (e.g., ping and HTTP) to monitor a set of IPsec VPN tunnels. Which THREE criteria or settings govern how FortiOS determines whether an SD-WAN member has met or failed the performance SLA? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The restoretime parameter, which specifies how many consecutive successful probes are required before restoring a failed member to healthy status. Option B is correct because the restoretime setting in an SD-WAN health check defines how many consecutive successful probes must occur before a previously failed member is returned to healthy status, preventing flapping. Option D is correct because the failtime parameter specifies the number of consecutive probe failures required before FortiOS marks the SD-WAN member as failed and removes it from SLA compliance. Option E is correct because the health check's configured thresholds for latency, jitter, and packet loss are the actual performance SLA criteria that each probe result is compared against to decide whether the member meets the SLA. Option A is incorrect because the BGP AS number is a routing attribute unrelated to SD-WAN health check SLA evaluation. Option C is incorrect because physical cable length is not a parameter FortiOS uses in SD-WAN performance SLA determination.

Answer

The BGP AS number assigned to the WAN interface gateway

Answer

The physical cable length calculated in meters between the FortiGate and the nearest ISP switch

Question 2

Which TWO criteria can be used in SD-WAN rules to select an outgoing interface?

Accepted Answer

Source and destination address. Option D (Source and destination address) is correct because SD-WAN rules commonly match traffic based on IP header fields such as source and destination IP addresses (and often ports), allowing the policy to steer specific flows out a chosen interface. Option E (Application or service type) is correct because SD-WAN solutions perform application-aware routing, identifying applications or services via signatures/DPI and using that classification to select the outgoing interface. Option A (administrator name) is not a traffic-matching criterion for interface selection, as it identifies a person, not a flow. Option B (system temperature) is a hardware health metric, not a routing rule criterion. Option C (device serial number) identifies the device itself, not the traffic to be steered, so it cannot be used to select an outgoing interface per flow.

Answer

The name of the administrator

Answer

System temperature

Answer

Device serial number

Question 3

You are deploying a new FortiGate SD-WAN solution with two WAN links: wan1 and wan2. You want SD-WAN rules to be able to select members based on performance SLAs, but you also need to ensure that the SD-WAN configuration is synchronized across a pair of FortiGates in an HA cluster. Which configuration step is required before you can create an SD-WAN rule that references wan1 and wan2?

Accepted Answer

Add wan1 and wan2 as SD-WAN members and assign them to an SD-WAN zone.. To use interfaces in SD-WAN rules, they must first be configured as SD-WAN members and placed into an SD-WAN zone. This membership is what allows the rule to select them and apply performance SLAs. Static routes, interface-level SD-WAN toggles, and SLAs do not replace this step.

Answer

Create a static route for each WAN interface and enable 'SD-WAN' in the route settings.

Answer

Configure a Performance SLA for each interface before adding them to SD-WAN.

Answer

Enable SD-WAN on each interface under Network > Interfaces.

Question 4

A network administrator at a large enterprise uses FortiManager to manage 120 FortiGates. The security team wants to enforce a consistent SD-WAN configuration across all branches, but the branches have different WAN link counts and interface names. The administrator wants to avoid manually editing each device's configuration. Which FortiManager feature should the administrator use to create a reusable SD-WAN configuration that can adapt to each device's interface names?

Accepted Answer

SD-WAN template with metadata variables. SD-WAN templates in FortiManager are designed to centralize and standardize SD-WAN configurations across many devices. By incorporating metadata variables, the template can reference device-specific values such as interface names, which are resolved during installation. This allows a single template to be applied to branches with different physical interface naming, ensuring consistency without manual per-device edits. Other options lack the SD-WAN specific constructs and dynamic mapping capability.

Answer

Provisioning template with static interface mapping

Answer

CLI template script with hardcoded interface names

Answer

Policy package with per-device installation targets

Question 5

An administrator has an SD-WAN template in FortiManager that is assigned to a managed FortiGate. The FortiGate is currently offline. The administrator modifies the template and installs the configuration. What happens to the FortiGate when it comes back online?

Accepted Answer

The FortiGate retains its previous configuration until the administrator manually installs the updated template.. FortiManager does not automatically push configuration changes to managed devices. When an SD-WAN template is modified, the changes are stored in FortiManager but must be explicitly installed to the FortiGate. If the FortiGate is offline during the modification, it will not receive the update until the administrator performs an install after the device is back online.

Answer

The FortiGate receives the update only if the template is set to auto-install.

Answer

The FortiGate downloads the updated template when it reconnects, but the changes are not applied until a reboot.

Answer

The FortiGate automatically retrieves the updated configuration from FortiManager.

Question 6

A company uses FortiManager to manage SD-WAN configurations for 50 branch offices. The administrator needs to update the SD-WAN rules across all branches to include a new application category for SaaS traffic. The update must be applied consistently and with minimal administrative effort. Which two actions should the administrator take to achieve this? (Choose two.)

Accepted Answer

Modify the SD-WAN template to include the new application category in the rules.. To update SD-WAN rules across all branches, the administrator should modify the SD-WAN template to include the new application category, then install the template to all managed FortiGates. This leverages FortiManager's centralized management to ensure consistency and efficiency. Other options either use the wrong object (policy package), involve manual per-device changes, or pull configurations instead of pushing them, none of which meet the requirement.

Answer

Create a new policy package with the updated rules and assign it to all devices.

Answer

Run a script on each FortiGate to add the application category to the local SD-WAN rules.

Answer

Synchronize the FortiManager ADOM to retrieve the latest SD-WAN rules from the devices.

Question 7

A company uses FortiManager to manage 100 FortiGates. They have an SD-WAN template applied to all devices. The administrator modifies a health check within the template to change the probe interval from 500ms to 1000ms. After saving the template, they want to push the change to all managed FortiGates. What must the administrator do to ensure the updated health check is applied to all devices?

Accepted Answer

Use the 'Install Wizard' to install the SD-WAN template to all devices.. After modifying an SD-WAN template in FortiManager, the administrator must use the Install Wizard to deploy the changes to the managed FortiGates. This centralized installation process ensures that all devices receive the updated health check configuration. Without an explicit install, the changes remain only in the FortiManager database.

Answer

The change is automatically synchronized to all FortiGates in real-time.

Answer

Reboot each FortiGate to apply the new health check settings.

Answer

Re-install the SD-WAN template on each FortiGate individually.

Question 8

A network administrator is configuring a static route on a FortiGate to direct traffic to a remote subnet through an IPsec VPN tunnel. The tunnel interface is named 'VPN_Tunnel'. Which of the following is the correct way to configure the static route?

Accepted Answer

Set the destination to the remote subnet, the gateway to 0.0.0.0, and the interface to 'VPN_Tunnel'.. For a route-based IPsec VPN, the static route must direct traffic to the remote subnet through the tunnel interface. The correct configuration uses the remote subnet as destination, 0.0.0.0 as gateway, and the tunnel interface as the outgoing interface. This ensures that traffic is encrypted and sent through the tunnel. Other configurations would either bypass the tunnel or send traffic unencrypted.

Answer

Set the destination to the remote subnet, the gateway to the remote public IP, and the interface to the WAN interface.

Answer

Set the destination to the remote subnet, the gateway to the local public IP, and the interface to the WAN interface.

Answer

Set the destination to the remote subnet, the gateway to the VPN tunnel's remote IP, and the interface to 'VPN_Tunnel'.

Question 9

A network administrator needs to apply a security profile to traffic that matches a specific SD-WAN rule. The SD-WAN rule steers traffic out of two IPsec tunnels based on application detection. Where should the administrator apply the security profile?

Accepted Answer

In the firewall policy that includes the SD-WAN zone as the outgoing interface.. Security profiles in FortiOS are applied within firewall policies. When using SD-WAN, the firewall policy that permits traffic must have the SD-WAN zone as the outgoing interface. The security profiles are then applied to the traffic as it exits through the zone. This is the standard and recommended method, as it ensures consistent security inspection regardless of which SD-WAN member is chosen.

Answer

In the SD-WAN rule configuration under the 'Security Profile' section.

Answer

On each individual IPsec tunnel interface that is a member of the SD-WAN zone.

Answer

On the SD-WAN zone interface in the firewall policy that permits the traffic.

Question 10

An administrator is configuring an IPsec VPN tunnel between two FortiGates for SD-WAN. The administrator wants to ensure that the tunnel interface is not used for routing until the IPsec tunnel is fully established and the health check passes. Which configuration step should be taken?

Accepted Answer

Configure the IPsec tunnel as a member of an SD-WAN zone and enable 'update-static-route' in the health check.. To ensure the IPsec tunnel is only used for routing when the health check passes, the tunnel should be part of an SD-WAN zone, and the health check must have update-static-route enabled. This causes FortiOS to install a static route only when the health check is successful, effectively gating routing on tunnel health.

Answer

Enable 'net-device' on the IPsec phase1-interface.

Answer

Enable 'auto-discovery-forwarder' on the IPsec phase1-interface.

Answer

Set the IPsec tunnel's 'distance' to a higher value than other routes.

Question 11

A FortiGate is configured with an SD-WAN rule that uses an SLA target and includes two IPsec tunnels. The administrator wants to ensure that security profiles are applied to traffic steered by this rule. Which two statements are correct regarding the enforcement of security profiles for SD-WAN traffic? (Choose two.)

Accepted Answer

Security profiles must be configured in the firewall policy that permits the traffic and references the SD-WAN zone as the outgoing interface.. Security profiles for SD-WAN traffic are enforced in the firewall policy that permits the session. That policy must reference the SD-WAN zone as its outgoing interface, so the profiles apply uniformly to all member tunnels selected by the rule. SD-WAN rules themselves do not carry security profiles, and interfaces do not automatically apply profiles. This design ensures consistent inspection regardless of which member is chosen.

Answer

The SD-WAN rule itself can directly reference a security profile, which is then applied to all member tunnels.

Answer

When the SD-WAN rule selects a member, the security profile configured on that member's interface is automatically applied.

Answer

Security profiles are applied only after the SD-WAN rule selects the egress member, so the policy must reference the specific member interface.

Question 12

You are setting up an SD-WAN zone and need to add two interfaces, port1 and port2. However, the FortiGate GUI does not allow you to add them to the zone. What is the most likely cause?

Accepted Answer

The interfaces are already assigned to another SD-WAN zone.. The most likely cause is that the interfaces are already members of another SD-WAN zone. FortiGate enforces that an interface can only belong to one SD-WAN zone at a time. To resolve this, you must remove the interfaces from the existing zone before adding them to the new one. Other options are either supported configurations or unrelated to zone membership.

Answer

The interfaces are configured with dynamic IP addresses.

Answer

The interfaces are not physical interfaces.

Answer

The interfaces have administrative distance set to 0.

Question 13

A FortiGate has two SD-WAN members, wan1 and wan2, both in the same zone. The administrator wants sessions that already use wan1 to remain on wan1 even if wan2 becomes the preferred member due to better SLA results, while new sessions should follow the preferred member. Which setting controls this behavior?

Accepted Answer

The 'Preserve session' or sticky session option in the SD-WAN rule. Session preservation, commonly configured as a sticky-session option within the SD-WAN rule, keeps established flows bound to their current member while allowing new sessions to be placed on the currently preferred member. The rule's strategy, member link cost, and probe interval all influence which member is preferred or how quickly changes are detected, but none of them controls whether existing sessions are migrated.

Answer

The member's link cost value

Answer

The SD-WAN rule's strategy

Answer

The Performance SLA probe interval

Question 14

An IPsec VPN tunnel used as an SD-WAN member is experiencing intermittent flapping due to DPD (Dead Peer Detection) timeout issues over a high-latency satellite link. How should the administrator adjust the Phase 1 IPsec settings on FortiOS to stabilize the tunnel without completely disabling failure detection?

Accepted Answer

Increase the DPD retry count and interval settings under the IPsec Phase 1 configuration. DPD (Dead Peer Detection) uses periodic hello/ack probes to verify the remote peer is alive; if probes go unanswered within the configured retry count and interval, FortiOS tears down the Phase 1 SA. On a high-latency satellite link, the default interval (often 20s) and retry count (3) are too aggressive, so legitimate replies arrive after the timeout and the tunnel flaps. Increasing both the DPD interval and retry count under Phase 1 gives the peer more time to respond before the tunnel is declared dead, stabilizing the tunnel while keeping failure detection active.

Answer

Disable DPD entirely so the FortiGate never tears down the tunnel

Answer

Enable NP6/NP7 hardware offloading for Phase 1 SA renegotiation

Answer

Change the IPsec phase 1 mode from Main mode to Aggressive mode

Question 15

An administrator has configured an SD-WAN template in FortiManager and applied it to a FortiGate. Later, the administrator modifies the template by adding a new SD-WAN zone and a new performance SLA. What happens when the administrator installs the modified template to the FortiGate?

Accepted Answer

The FortiGate will receive the new zone and SLA, but the new zone will be empty until interfaces are assigned to it.. Modifying an SD-WAN template to add a new zone and SLA results in those objects being created on the managed FortiGate upon installation. However, the new zone will have no member interfaces until they are explicitly assigned, either via the template or manually. Existing rules are not automatically updated to use the new zone. This behavior ensures that the administrator retains control over which interfaces belong to which zone.

Answer

The FortiGate will receive the new zone and SLA, but existing SD-WAN rules referencing the old zone will be automatically updated to include the new zone.

Answer

The FortiGate will receive the new SLA, but the new zone will not be created because zones must be defined in a separate provisioning template.

Answer

The FortiGate will reject the installation because the new zone conflicts with existing zones, requiring a reboot.