NSE7_SDW Practice Test 14 — 15 Questions

Question 1

A network administrator manages 80 FortiGate devices in FortiManager. The company wants to ensure that all devices use the same SD-WAN health check settings for a critical business application, but each device has a different WAN IP address. Which FortiManager feature should the administrator use to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SD-WAN template with dynamic mapping. Dynamic mapping in SD-WAN templates allows the use of variables that are resolved per device during installation, making it the ideal solution for standardizing health check settings across devices with different WAN IP addresses. The template remains consistent, while the variables ensure each device uses its own IP.

Answer

SD-WAN template with static interface mapping

Answer

Per-device SD-WAN configuration in FortiManager

Answer

SD-WAN template with a shared health check object

Question 2

An administrator is configuring an SD-WAN template in FortiManager for a hub-and-spoke topology. The administrator wants to ensure that the SD-WAN rules can dynamically select the best path based on performance. Which two components must be configured within the SD-WAN template to achieve this? (Choose two.)

Accepted Answer

SD-WAN rules with path selection criteria. To enable dynamic path selection based on performance, an SD-WAN template must include performance SLA definitions and SD-WAN rules that reference those SLAs. The performance SLAs measure link quality, and the rules use that data to select the best path. Other components like static routes, BGP, or bandwidth settings are not essential for this specific functionality.

Answer

Interface bandwidth settings

Answer

Static route priorities

Answer

BGP neighbor configurations

Question 3

You are configuring an SD-WAN rule that must use a specific member interface only when its measured latency is below 50 ms, and otherwise fall back to another member. Which configuration element directly defines the latency threshold that the FortiGate evaluates for that member?

Accepted Answer

The SLA target configured in the Performance SLA. The latency limit that determines whether a member is considered healthy is stored as an SLA target inside the Performance SLA object. The SD-WAN rule then references that SLA, so the FortiGate compares live probe measurements against the configured threshold and removes members that exceed it from consideration. Static attributes such as link cost, priority, and probe interval influence selection or detection speed but never define the numeric latency boundary.

Answer

The priority value assigned to the SD-WAN member

Answer

The link-cost value of the SD-WAN member

Answer

The health-check interval configured on the member interface

Question 4

What is the purpose of the 'Inbound' interface setting in an SD-WAN rule?

Accepted Answer

To restrict the rule to traffic originating from a specific interface.. The 'Inbound' interface setting in an SD-WAN rule restricts the rule to traffic that originates from (ingresses) a specific interface. It is used to scope the rule so that only traffic entering via that interface is matched, which is useful when the same destination is reachable from multiple ingress points. It does not define the egress interface or gateway — those are determined by the SD-WAN member selection.

Answer

To enable reverse path forwarding checks.

Answer

To define the WAN gateway.

Answer

To specify the egress interface.

Question 5

An administrator is configuring an SD-WAN template in FortiManager for a new branch deployment. The template will include multiple SD-WAN members and a performance SLA that monitors the health of these members. Which two statements about the relationship between SD-WAN templates and health check objects are true? (Choose two.)

Accepted Answer

If a health check object is modified, the change is reflected in all templates that reference it, but an install is needed to push to FortiGates.. Two statements are true: a health check object can be referenced by multiple SD-WAN templates, and modifying a health check object updates all referencing templates in FortiManager but requires an install to push changes to FortiGates. These reflect the centralized, reusable nature of health check objects and the need for an explicit install step to apply configuration changes to managed devices.

Answer

An SD-WAN template can reference only one health check object at a time.

Answer

Health check objects are defined within each SD-WAN template and cannot be shared.

Answer

Modifying a health check object automatically updates all FortiGates that use templates referencing it, without requiring an install.

Question 6

A network administrator is using FortiManager to manage SD-WAN templates for multiple FortiGates. They need to ensure that a specific health check, which monitors a critical cloud application, is used by all SD-WAN rules across all templates. What is the most efficient way to achieve this in FortiManager?

Accepted Answer

Create a shared health check object and reference it in each SD-WAN template.. Using shared health check objects in FortiManager allows multiple SD-WAN templates to reference the same health check. This centralizes management and ensures consistency across all templates. Any update to the shared object is reflected in all templates that use it, making it the most efficient solution.

Answer

Use a meta field to define the health check and apply it to all templates.

Answer

Create a separate health check in each SD-WAN template with identical settings.

Answer

Configure the health check in the global ADOM and assign it to all templates.

Question 7

Which THREE of the following are valid strategies for SD-WAN rules?

Accepted Answer

Priority. In FortiGate SD-WAN, the strategy field of an SD-WAN rule determines how traffic is distributed across the selected members, and the valid strategies include Priority, Maximize Bandwidth (formerly Maximize Bandwidth (SLA)), and SLA Target. Option A (Priority) is correct because it sends traffic through the highest-priority member that is up and meets any configured SLA, falling back to lower-priority members only when the preferred one fails. Option B (Maximize Bandwidth) is correct because it distributes sessions across all eligible members to aggregate their available bandwidth rather than using a single link. Option D (SLA Target) is correct because it selects the member that best satisfies the configured SLA targets (such as latency, jitter, and packet loss) measured by performance SLAs. Option C (Load Balance) is not a valid SD-WAN rule strategy in FortiOS, and Option E (Round Robin) is likewise not an available strategy, since session-based distribution is handled by Maximize Bandwidth instead.

Answer

Load Balance

Answer

Round Robin

Question 8

A FortiGate is deployed in an SD-WAN environment with two WAN links: port1 (static, 100 Mbps) and port2 (DHCP, 50 Mbps). The administrator wants SD-WAN rules to automatically prefer port1 for all traffic unless its measured latency exceeds 150 ms, in which case traffic should fail over to port2. Which configuration element must be defined and referenced by the SD-WAN rule to achieve this behavior?

Accepted Answer

A Performance SLA named 'WAN_MONITOR' with a latency threshold of 150 ms, applied to the SD-WAN zone members.. The Performance SLA is the SD-WAN feature that actively probes members and measures metrics like latency, jitter, and packet loss. When an SD-WAN rule references this SLA, the rule dynamically selects a member that meets the SLA targets. The administrator must configure the SLA with the 150 ms latency threshold and apply it to the SD-WAN zone so that port1 is used while it meets the threshold, and port2 takes over when it does not.

Answer

A static route with a distance of 10 for port1 and a distance of 20 for port2, combined with a route map that monitors latency.

Answer

A link health monitor configured under the SD-WAN interface settings with a latency threshold of 150 ms.

Answer

An SD-WAN rule with the 'lowest cost' strategy and a manual priority set on port1.

Question 9

You are configuring an SD-WAN member for an IPsec tunnel that terminates on a remote FortiGate. The tunnel interface is named 'vpn_to_dc'. You want the SD-WAN member to be usable and to be monitored by a Performance SLA. Which two configuration elements must be present for this member to function correctly in the SD-WAN zone? (Choose two.)

Accepted Answer

The IPsec tunnel interface must be up and have an IP address assigned.. An SD-WAN member requires an existing, addressed interface, so the IPsec tunnel must be up with an IP address. To be monitored, the Performance SLA must include that member so probes are sent across the tunnel. Cost, priority, routing via the zone, and unique zone naming are design choices or optional attributes, not prerequisites for the member to function and be health-checked.

Answer

The member must be assigned a cost value and a priority value in its SD-WAN member configuration.

Answer

The tunnel must be configured with a unique SD-WAN zone name that differs from the physical WAN zone.

Answer

A static route to the remote subnet must point to the SD-WAN zone rather than the tunnel interface directly.

Question 10

A network engineer is configuring an SD-WAN template in FortiManager for a group of branch FortiGates. The engineer needs to define health checks that monitor the performance of WAN links. Which two health check protocols are supported in FortiManager SD-WAN templates? (Choose two.)

Accepted Answer

Ping. FortiManager SD-WAN templates support health check protocols such as Ping and HTTP. Ping uses ICMP to measure basic network performance, while HTTP performs application-layer checks. These protocols are essential for monitoring link quality and triggering SD-WAN rule actions. Other protocols like SNMP, DNS, and TCP echo are not available for this purpose in FortiManager.

Answer

SNMP

Answer

TCP echo

Answer

DNS

Question 11

You are deploying a new SD-WAN topology and must ensure that SD-WAN rules can distinguish business-critical traffic from bulk traffic. Which two rule match conditions can you configure to classify traffic for this purpose? (Choose two.)

Accepted Answer

Internet service database entry, such as a specific cloud service.. Application category and internet service database entries are both supported match conditions that identify traffic by what it is, enabling rules to treat business-critical flows differently from bulk flows. Physical link attributes, route administrative distance, and probe interval describe infrastructure or health-check behaviour and cannot classify traffic. Only the two traffic-identification conditions satisfy the requirement.

Answer

The administrative distance of the static route covering the destination.

Answer

The Performance SLA probe interval configured on the member.

Answer

Interface duplex and speed settings of the egress member.

Question 12

An enterprise network uses OSPF over SD-WAN IPsec tunnels. The administrator notices that OSPF adjacency is constantly dropping over a specific backup SD-WAN member link due to intermittent packet loss. Which THREE configuration adjustments can improve OSPF stability over unstable SD-WAN IPsec links? (Choose three)

Accepted Answer

Configure OSPF network type as point-to-point on the IPsec tunnel interfaces to eliminate unnecessary DR/BDR elections. Option A is correct because setting the OSPF network type to point-to-point on IPsec tunnel interfaces removes DR/BDR election overhead and reduces the number of OSPF protocol packets needed, which is ideal for a single neighbor across an SD-WAN tunnel and minimizes the impact of intermittent loss. Option B is correct because OSPF graceful restart (and helper mode on the neighbors) allows the router to restart or fail over its OSPF process without tearing down adjacencies and re-converging, which preserves stability when the backup link is flapping. Option D is correct because increasing the hello and dead intervals on the affected IPsec tunnel interfaces makes OSPF more tolerant of temporary packet loss, preventing the dead timer from expiring and dropping the adjacency during brief outages. Option C is not valid because a router ID of 0.0.0.0 is not a usable OSPF router ID and would prevent OSPF from forming adjacencies. Option E is not valid because disabling OSPF hellos breaks neighbor detection and adjacency maintenance, and relying on static default routes does not provide the dynamic OSPF stability being sought.

Answer

Set the OSPF router ID to 0.0.0.0 on all branch spokes

Answer

Disable OSPF hello packets entirely and rely on static default routes

Question 13

An administrator is configuring an SD-WAN member on a FortiGate. The member's interface has a default gateway of 192.168.1.1, but the ISP requires that all traffic from this member be sent to a next-hop of 192.168.1.254 instead. Which SD-WAN member setting should the administrator configure to meet this requirement?

Accepted Answer

Gateway. The 'Gateway' setting in an SD-WAN member configuration is specifically designed to override the next-hop IP address. When the ISP requires traffic to be sent to a different next-hop than the interface's default gateway, the administrator sets the 'Gateway' field to the desired IP. This ensures that all traffic egressing through that member uses the specified next-hop.

Answer

Priority

Answer

Cost

Answer

Weight

Question 14

You need to ensure that VoIP traffic stays on the interface with the lowest jitter. Which strategy should you use?

Accepted Answer

SLA Target. The SLA Target strategy in an SD-WAN rule selects the member link that best meets the configured SLA target for the specified metric — in this case, lowest jitter. By defining a Performance SLA with a jitter threshold and using SLA Target as the strategy, the FortiGate steers VoIP traffic to the interface with the lowest jitter that satisfies the SLA. This is the correct approach for latency/jitter-sensitive applications like VoIP.

Answer

Load Balance

Answer

Lowest Cost (SLA)

Answer

Manual

Question 15

An administrator configures an SD-WAN rule that matches traffic to a specific destination subnet and sets the strategy to 'Lowest Cost (SLA)'. The rule includes two members: 'Tunnel-1' with cost 10 and 'Tunnel-2' with cost 20. Both tunnels pass their SLA health checks. Which tunnel will be selected for the traffic?

Accepted Answer

Tunnel-1, because it has the lower cost and both meet SLA.. The 'Lowest Cost (SLA)' strategy chooses the member with the lowest cost that also passes its SLA health check. Since both tunnels meet SLA, the one with cost 10 is selected. This strategy does not load-balance or require a cost difference threshold. It is commonly used to prefer a cheaper link while maintaining performance guarantees.

Answer

Traffic is load-balanced across both tunnels because both meet SLA.

Answer

Tunnel-1 is selected only if its cost is lower than the other member's cost by at least 50%.

Answer

Tunnel-2, because a higher cost indicates a higher priority in the 'Lowest Cost (SLA)' strategy.