NSE7_SDW Practice Test 15 — 15 Questions

Question 1

An administrator is setting up an IPsec VPN tunnel between a FortiGate hub and a branch office FortiGate. The administrator wants to ensure that the branch office can access the internet through the hub's internet connection while also accessing resources at the headquarters. Which type of IPsec VPN configuration should the administrator use to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Site-to-site IPsec VPN with full tunneling and default route through the tunnel.. To route all traffic, including internet-bound traffic, from the branch through the hub, a site-to-site IPsec VPN with full tunneling and a default route through the tunnel is required. This ensures that the branch uses the hub's internet connection while still accessing headquarters resources. Other options either do not route internet traffic through the hub or are not suitable for site-to-site connectivity.

Answer

Dial-up IPsec VPN with dynamic routing.

Answer

Site-to-site IPsec VPN with split tunneling enabled.

Answer

Remote access IPsec VPN with full tunneling.

Question 2

An administrator is creating an SD-WAN template in FortiManager. The template will be used to provision multiple FortiGates. The administrator wants to define a health check that uses ICMP probes to monitor the primary WAN link. Which FortiManager object must be configured within the SD-WAN template to achieve this?

Accepted Answer

SD-WAN Health Check. To define ICMP probes for monitoring a WAN link, the administrator must configure an SD-WAN Health Check object within the template. This object specifies the probe type (ICMP), target, and thresholds for latency, jitter, and packet loss. The health check is then referenced by SD-WAN rules to make routing decisions based on link performance.

Answer

SD-WAN Rule

Answer

SD-WAN Zone

Answer

SD-WAN Member

Question 3

A network engineer is designing an SD-WAN rule that must steer real-time voice traffic to the member with the best measured quality rather than a fixed link. The rule will use Performance SLA results to make the decision. Which two Performance SLA configuration elements directly influence whether a member is considered healthy for this voice rule? (Choose two.)

Accepted Answer

The latency, jitter, and packet-loss thresholds defined in the SLA. A Performance SLA decides member health by probing designated targets and comparing results to configured thresholds. The targets determine what is measured, and the latency, jitter, and packet-loss limits determine whether the measurements pass. Together they directly govern whether the voice rule sees a member as healthy and eligible for selection.

Answer

The DSCP marking applied to the voice traffic by the firewall policy

Answer

The administrative distance of the default route on each member

Answer

The source interface selected for the SLA probes

Question 4

When configuring SD-WAN services in a template, what does the 'Performance SLA' setting determine?

Accepted Answer

The criteria for path selection based on link quality. The Performance SLA setting defines the health-check parameters — probe protocol, target, latency, jitter, and packet-loss thresholds — that FortiGate uses to decide whether an SD-WAN member is within acceptable quality. Those results feed the SD-WAN rule's path-selection logic, so the SLA effectively determines which links are considered 'alive' and eligible for traffic.

Answer

The physical port priority

Answer

The maximum bandwidth allowed

Answer

The number of tunnels created

Question 5

An administrator has configured an SD-WAN template in FortiManager and applied it to a FortiGate. Later, the administrator needs to add a new VLAN interface as an SD-WAN member. Where should this change be made to ensure it is reflected in the FortiManager-managed configuration?

Accepted Answer

Modify the SD-WAN template in FortiManager and reinstall the configuration on the FortiGate.. SD-WAN templates in FortiManager are the authoritative source for SD-WAN configuration on managed FortiGates. To add a new member, the administrator must edit the template to include the VLAN interface and then install the updated configuration. This maintains consistency and ensures the change is properly tracked. Direct device changes or per-device overrides are not appropriate for adding new members.

Answer

Create a new SD-WAN template with the VLAN interface and apply it to the FortiGate, replacing the existing template.

Answer

Use a per-device mapping in FortiManager to override the SD-WAN member list for that FortiGate.

Answer

Directly on the FortiGate CLI, add the VLAN to the SD-WAN configuration, then retrieve the configuration in FortiManager.

Question 6

A network administrator is configuring an SD-WAN template in FortiManager. The template includes multiple SD-WAN rules that reference different Performance SLAs. The administrator wants to ensure that if a link fails an SLA, traffic is automatically routed to another link that meets the SLA. Which SD-WAN rule strategy should be used to achieve this?

Accepted Answer

Best Quality. The Best Quality strategy is designed to select the link with the best performance metrics as defined by the SLA. If a link fails to meet the SLA, the rule automatically switches to another link that does meet the SLA, ensuring continuous compliance. Other strategies like Lowest Cost or Maximize Bandwidth prioritize cost or bandwidth, which may not align with the goal of maintaining SLA compliance.

Answer

Maximize Bandwidth (SLA)

Answer

Manual

Answer

Lowest Cost (SLA)

Question 7

An administrator is configuring an SD-WAN template in FortiManager. The template includes a performance SLA that monitors two health checks: one for latency and one for packet loss. Which FortiManager object must be referenced in the SD-WAN template to define these health checks?

Accepted Answer

SD-WAN health check. SD-WAN health check objects in FortiManager are used to define the parameters for monitoring SLA targets, including latency and packet loss. These objects are referenced within SD-WAN templates to specify which health checks to use. The template then applies these settings to the managed FortiGates. Other objects like zones or services do not contain health check definitions.

Answer

SD-WAN zone

Answer

SD-WAN member

Answer

SD-WAN service

Question 8

An administrator needs to inspect encrypted traffic traversing an SD-WAN IPsec tunnel using Deep Packet Inspection (DPI). What must be installed on the client endpoints or configured on the FortiGate to prevent browser trust warnings when using SSL/TLS full inspection?

Accepted Answer

The FortiGate's self-signed CA certificate must be installed in the trusted root certificate store of the client endpoints. To prevent browser trust warnings during SSL/TLS full inspection, the FortiGate's self-signed CA certificate must be installed in the trusted root certificate store of the client endpoints. When full inspection is enabled, the FortiGate acts as a man-in-the-middle, presenting its own certificate to the client. If the client does not trust the FortiGate's CA, the browser will display a warning.

Answer

ADVPN 2.0 shortcut certificates must be exchanged between spokes

Answer

BGP MD5 authentication keys must match on both routers

Answer

A pre-shared key must be configured in the IPsec Phase 1 proposal

Question 9

An administrator is troubleshooting an SD-WAN setup where traffic is not being routed through the preferred IPsec tunnel despite the tunnel being up and passing health checks. The administrator reviews the SD-WAN rule and notices that the rule is configured with the 'maximize-bandwidth (SLA)' strategy and includes two tunnels with different bandwidths. The administrator expects traffic to use the tunnel with higher bandwidth, but it is using the lower bandwidth tunnel. What could be the reason for this behavior?

Accepted Answer

The higher bandwidth tunnel is not meeting the SLA criteria, so SD-WAN selects the lower bandwidth tunnel that meets SLA.. The 'maximize-bandwidth (SLA)' strategy selects the tunnel with the highest bandwidth that also meets the SLA criteria. If the higher bandwidth tunnel fails to meet SLA, it is excluded, and the next best tunnel that meets SLA is chosen. Therefore, the observed behavior is likely because the higher bandwidth tunnel is not meeting SLA. The administrator should verify the SLA status and health check results for that tunnel.

Answer

The health check probes are not configured on the higher bandwidth tunnel, so it is not considered.

Answer

The SD-WAN rule is misconfigured; the 'maximize-bandwidth (SLA)' strategy always uses the tunnel with the lowest cost.

Answer

The SD-WAN rule is using the 'maximize-bandwidth (SLA)' strategy, but the higher bandwidth tunnel is in a different SD-WAN zone.

Question 10

A FortiGate is configured with an IPsec VPN tunnel to a remote peer. The administrator wants to apply an IPS sensor to traffic traversing the tunnel. However, the IPS sensor must inspect traffic after decryption but before it is routed to the internal network. Where should the IPS sensor be applied?

Accepted Answer

On the IPsec tunnel interface as an incoming interface in a firewall policy.. To inspect decrypted traffic from an IPsec tunnel, the IPS sensor must be applied to a firewall policy where the tunnel interface is the incoming interface. This ensures inspection occurs after decryption and before routing to the internal network. Applying it on the physical interface would inspect encrypted packets, and other placements are either inefficient or impossible.

Answer

On the internal LAN interface as an outgoing interface in a firewall policy.

Answer

In the IPsec phase 2 configuration as a proposal parameter.

Answer

On the physical WAN interface that carries the IPsec tunnel traffic.

Question 11

A FortiGate is running SD-WAN with two IPsec tunnels to different data centers. The administrator wants to apply a Web Filtering profile only to HTTP/HTTPS traffic that is steered by a specific SD-WAN rule, while other traffic on the same tunnels remains unfiltered. Where should the Web Filtering profile be applied?

Accepted Answer

In the firewall policy that references the SD-WAN zone and matches the desired traffic, by enabling the Web Filtering profile in that policy.. Security profiles in FortiOS are enforced by firewall policies, not by SD-WAN rules or tunnel interfaces. To filter only the traffic handled by a specific SD-WAN rule, the administrator must ensure that traffic matches a firewall policy that references the SD-WAN zone and has the Web Filtering profile enabled. The SD-WAN rule then selects the outgoing member based on its criteria, while the firewall policy applies the security inspection.

Answer

On the IPsec Phase 1 configuration for each tunnel, by enabling 'set web-filter-profile'.

Answer

On the SD-WAN zone member interfaces in the firewall policy that matches the SD-WAN rule.

Answer

In the SD-WAN rule itself, by selecting the Web Filtering profile from the 'Security Profile' drop-down.

Question 12

An administrator wants to route traffic from a specific source subnet through an SD-WAN zone that contains two member interfaces: a dedicated internet link and an MPLS link. The administrator needs to ensure that traffic from that subnet always uses the MPLS link when it is available, but falls back to the internet link if the MPLS link fails. Which SD-WAN rule configuration should be used?

Accepted Answer

Create an SD-WAN rule with the source subnet as the match criteria, set the strategy to 'Manual', and order the MPLS interface first, then the internet interface.. The 'Manual' strategy in an SD-WAN rule allows explicit ordering of member interfaces. By listing the MPLS interface first, traffic will use it when it is available, and fall back to the internet interface if the MPLS link fails health checks. This meets the requirement of always using MPLS when available.

Answer

Create an SD-WAN rule with the source subnet as the match criteria, set the strategy to 'Lowest Cost', and assign a lower cost to the MPLS link.

Answer

Create an SD-WAN rule with the source subnet as the match criteria, set the strategy to 'Best Quality', and enable 'SLA target' for the MPLS link only.

Answer

Create an SD-WAN rule with the source subnet as the match criteria, set the strategy to 'Maximize Bandwidth', and enable 'SLA target' for both links.

Question 13

You are troubleshooting a scenario where an SD-WAN template is not pushing to a FortiGate. Which log file on the FortiManager is most useful to identify the specific CLI command causing the failure?

Accepted Answer

fmg_debug.log. The fmg_debug.log on FortiManager captures detailed debug output, including the CLI commands that FortiManager generates and attempts to push to managed FortiGates during template installation. When a template push fails, this log reveals the exact command that was rejected or errored, making it the most useful file for pinpointing the failing CLI line.

Answer

fmg_event.log

Answer

fmg_audit.log

Answer

fmg_system.log

Question 14

A network administrator is managing an SD-WAN deployment with multiple FortiGates using FortiManager. The administrator needs to ensure that all SD-WAN health checks are consistent across all devices and that any changes to the health check parameters are automatically propagated. Which FortiManager object should the administrator use to achieve this?

Accepted Answer

SD-WAN Health Check Template. An SD-WAN Health Check Template is a reusable object in FortiManager that centralizes health check parameters. When referenced by multiple SD-WAN templates, any update to the health check template is automatically reflected in all associated SD-WAN configurations. This ensures uniform health check behavior across all managed FortiGates and simplifies administration by eliminating the need to update each device individually.

Answer

Virtual IP

Answer

SD-WAN Rule

Answer

Firewall Address Object

Question 15

An administrator is troubleshooting an SD-WAN template deployment in FortiManager. The template fails to install on a managed FortiGate. Which two actions should the administrator take to identify the cause? (Choose two.)

Accepted Answer

Review the installation preview to see the generated CLI commands.. When an SD-WAN template fails to install, the administrator should first review the installation preview to see the generated CLI commands and check the task monitor for error messages. These steps provide direct insight into what went wrong, such as invalid references or syntax errors. Other actions like restarting the device or recreating the template do not address the underlying cause.

Answer

Use the FortiGate CLI to manually apply the configuration.

Answer

Restart the FortiGate to clear any temporary issues.

Answer

Delete and recreate the SD-WAN template from scratch.