NSE7_SDW Practice Test 16 — 15 Questions

Question 1

During SD-WAN template deployment, what is the role of 'Dynamic Mapping'?

Accepted Answer

To map a single template object to different physical settings on different devices. Dynamic Mapping in FortiManager SD-WAN templates allows a single template object (e.g., an interface or zone) to be mapped to different physical settings on different managed devices. This enables one template to be reused across devices with varying interface names or configurations, with FortiManager resolving the mapping at install time.

Answer

To automate firmware updates

Answer

To monitor bandwidth usage

Answer

To dynamically change the SD-WAN rule based on time

Answer

To calculate the latency of paths

Question 2

You are preparing a FortiGate for SD-WAN and need to verify that the underlying system settings will support SD-WAN rule processing and health monitoring. Which two configuration items must be present for SD-WAN to function? (Choose two.)

Accepted Answer

A Performance SLA if health-based steering is required. A functional SD-WAN configuration requires member interfaces organized into at least one SD-WAN zone, and it requires a Performance SLA whenever steering or failover depends on link health. Multi-VDOM mode, BGP peering, and IPsec overlays are design choices that add capabilities or segmentation but are not mandatory for SD-WAN rules and health monitoring to work on a FortiGate.

Answer

A VDOM operating in multi-VDOM mode

Answer

BGP configured between the FortiGate and each WAN provider

Answer

An IPsec tunnel to a remote hub for every member link

Question 3

Which TWO items must be configured within an SD-WAN template for SD-WAN traffic steering to work?

Accepted Answer

SD-WAN Members. Option B (SD-WAN Members) is correct because traffic steering requires the physical or logical WAN interfaces to be defined as SD-WAN members, which are the egress paths the SD-WAN engine can select among. Option C (SD-WAN Rules) is correct because these rules define the match criteria (source/destination, application, etc.) and the steering action (best quality, lowest cost, SLA-based) that tells the SD-WAN engine how to forward matched traffic. Together, SD-WAN Members provide the available links and SD-WAN Rules provide the selection logic, so both are mandatory for traffic steering to function. Option A (DHCP server settings) is not required, since DHCP only provides IP addressing and is unrelated to path selection. Option D (VLAN tagging) is not required, as VLANs are a Layer 2 segmentation mechanism and not a prerequisite for SD-WAN steering. Option E (Local users) is not required, because local user accounts are for administrative authentication and have no role in traffic steering.

Answer

DHCP server settings

Answer

VLAN tagging

Answer

Local users

Question 4

An administrator wants to ensure that an SD-WAN rule only selects a member if its measured latency is below 100 ms and packet loss is below 2%. Which SD-WAN feature should be configured to enforce these thresholds?

Accepted Answer

SLA health check with latency and packet loss thresholds.. SLA health checks are the SD-WAN feature designed to monitor performance metrics like latency, jitter, and packet loss. By configuring thresholds in an SLA health check and associating it with an SD-WAN rule, the rule will only select members that meet the criteria. Other features like priority, cost, or traffic shaping do not provide dynamic threshold enforcement.

Answer

Traffic shaping policy with guaranteed bandwidth.

Answer

SD-WAN rule priority with manual cost values.

Answer

IPsec phase 2 proposal with perfect forward secrecy.

Question 5

When configuring an SD-WAN rule, what is the purpose of the 'Source' address field?

Accepted Answer

To match traffic based on the source IP or user.. In an SD-WAN rule, the Source field is a match condition that identifies traffic by source IP address, source user (via FSSO or LDAP), or source address group. It does not control routing or egress; it simply narrows which traffic the rule applies to, alongside destination, application, and service matches.

Answer

To define the gateway IP for the route.

Answer

To force traffic to a specific SD-WAN zone.

Answer

To determine which ISP the traffic exits through regardless of SLA.

Question 6

An administrator is reviewing the SD-WAN configuration in FortiManager after applying a template to several FortiGates. They notice that one FortiGate has a different SD-WAN rule order than the others. What is the most likely reason for this discrepancy?

Accepted Answer

The SD-WAN template was not properly installed on that FortiGate, so it retained its previous configuration.. The most likely reason for the different SD-WAN rule order is that the template was not successfully installed on that FortiGate. Without a successful installation, the device retains its previous configuration, which may have a different rule order. This can occur if the device was offline or excluded from the installation.

Answer

The SD-WAN template includes a dynamic mapping that reorders rules based on metadata.

Answer

The FortiGate has a local SD-WAN configuration that overrides the template.

Answer

The FortiGate is using a different firmware version that changes the default rule order.

Question 7

You are troubleshooting an SD-WAN deployment where a rule configured for VoIP traffic is not being matched. The rule uses a Performance SLA named 'VoIP_SLA' and is set to use the lowest-latency strategy. You have verified that the traffic matches the source and destination criteria, and that the SLA is up on both members. However, the traffic is still using the default route instead of the SD-WAN rule. What is the most likely cause?

Accepted Answer

The SD-WAN rule is missing a matching firewall policy that allows the traffic to use the SD-WAN zone.. The most common reason an SD-WAN rule appears to be ignored is that the firewall policy does not use the SD-WAN zone as the outgoing interface. The SD-WAN rule only selects among members within the zone; it does not override the firewall policy's interface selection. If the policy points to a physical interface or the default route, the SD-WAN rule is never consulted. Ensuring the policy references the SD-WAN zone is essential for the rule to take effect.

Answer

The SD-WAN rule is configured with a higher sequence number than the default route.

Answer

The SD-WAN members are not configured with a gateway, so the SLA cannot determine the next hop.

Answer

The Performance SLA probes are using the wrong protocol for VoIP traffic.

Question 8

A network engineer is deploying a new SD-WAN on a FortiGate. The design requires a single overlay tunnel that carries multiple VLANs between the branch and the hub, and each VLAN must be mapped to its own SD-WAN zone so that different SD-WAN rules can steer traffic per VLAN. Which configuration element must the engineer create on the overlay interface to support this design?

Accepted Answer

A VLAN sub-interface on the IPsec tunnel interface, assigned to a dedicated SD-WAN zone.. The requirement is one overlay carrying multiple VLANs, each in a separate SD-WAN zone. The only option that directly produces per-VLAN SD-WAN zones on the tunnel is creating VLAN sub-interfaces on the IPsec tunnel interface and assigning each to its own zone. Other options either create separate tunnels or fail to provide VLAN-level zone separation.

Answer

A second IPsec phase 1 with the same remote gateway but a different preshared key.

Answer

An SD-WAN zone that contains the physical WAN interfaces and the tunnel interface together.

Answer

A VXLAN interface bound to the IPsec tunnel interface, with one VNI per VLAN.

Question 9

An administrator has an SD-WAN template applied to 30 FortiGates via FortiManager. The template includes a performance SLA named 'Critical_SLA' that monitors two WAN links. The administrator needs to change the SLA's probe interval from 500ms to 1000ms without affecting other settings. After modifying the template, what must the administrator do to propagate the change to all managed FortiGates?

Accepted Answer

Install the SD-WAN template to the managed FortiGates.. Modifying an SD-WAN template in FortiManager does not automatically update managed FortiGates. The administrator must explicitly install the template to the devices to push the changes. This ensures the new probe interval is applied consistently. Other actions like synchronization, reboot, or CLI scripts do not properly propagate template changes and can lead to inconsistencies or extra downtime.

Answer

Run a CLI script on each FortiGate to modify the SLA settings.

Answer

Reboot each FortiGate to apply the updated template.

Answer

Synchronize the FortiManager ADOM with the FortiGates.

Question 10

An administrator is configuring an SD-WAN template in FortiManager. The template will be used to deploy SD-WAN to multiple branch FortiGates. Which two statements about SD-WAN templates in FortiManager are true? (Choose two.)

Accepted Answer

SD-WAN templates support the use of metadata variables to customize settings per device.. SD-WAN templates are reusable across multiple FortiGates, and they support metadata variables for per-device customization. These features enable efficient and scalable SD-WAN deployments. The other statements are false: templates can be applied to many devices, they do not create firewall policies, and they do not require identical firmware.

Answer

SD-WAN templates can only be applied to a single FortiGate at a time.

Answer

SD-WAN templates automatically create firewall policies for the SD-WAN rules.

Answer

SD-WAN templates require that all FortiGates use the same firmware version.

Question 11

An administrator configures an SD-WAN rule with an SLA target that includes latency, jitter, and packet loss. The rule uses the 'lowest cost (SLA)' strategy. Both tunnels meet the SLA, but one tunnel has a lower configured cost. How does FortiOS select the egress interface for a new session?

Accepted Answer

It selects the tunnel with the lowest cost among those that meet the SLA.. The 'lowest cost (SLA)' strategy evaluates members against the SLA criteria first. Members that meet all thresholds are eligible. Among those, FortiOS selects the member with the lowest configured cost. If multiple members share the same cost, further tie-breaking may occur, but cost is the primary differentiator. This ensures that quality requirements are met while optimizing for cost.

Answer

It selects the tunnel with the lowest jitter because jitter is the most important SLA metric.

Answer

It selects the tunnel with the best measured latency, regardless of configured cost.

Answer

It load-balances sessions across both tunnels because both meet the SLA.

Question 12

An administrator configures an IPsec VPN tunnel between two FortiGates for SD-WAN use. The tunnel is up, but traffic from the local subnet 10.10.10.0/24 to the remote subnet 10.20.20.0/24 is not passing. The administrator verifies that the Phase 2 selectors are configured with the correct local and remote subnets. What is the most likely cause?

Accepted Answer

There is no firewall policy allowing traffic from the local subnet to the remote subnet over the IPsec tunnel.. For traffic to traverse an IPsec tunnel in FortiOS, a firewall policy must explicitly allow it, referencing the tunnel interface as the outbound interface. Even with correct Phase 2 selectors and an established tunnel, without a policy, packets are dropped. This is a frequent misconfiguration in SD-WAN deployments.

Answer

The Phase 2 proposal encryption and authentication algorithms do not match between peers.

Answer

The SD-WAN rule is not configured to use the IPsec tunnel as a member.

Answer

The remote gateway's Phase 1 configuration is missing the local subnet in the interesting traffic selector.

Question 13

When configuring advanced IPsec VPN tunnels to act as members of an SD-WAN zone, which TWO configuration parameters on the FortiGate are critical for ensuring proper IPsec tunnel operation and traffic steering? (Choose two)

Accepted Answer

Ensure the IPsec interface is added to an SD-WAN zone and assigned a valid virtual IP/interface configuration. Option A is correct because an IPsec interface must be a member of the SD-WAN zone to participate in SD-WAN path selection and traffic steering; the interface also needs a valid IP/virtual interface configuration so the zone can reference it as a member and apply SD-WAN rules to it. Option E is correct because Phase 2 selectors define the traffic that the IPsec SA protects: matching the exact source/destination subnets ensures only intended traffic is encrypted, while 0.0.0.0/0 selectors are commonly used for route-based VPNs so routing and SD-WAN rules, rather than narrow proxy IDs, determine which traffic enters the tunnel. Option B is wrong because NAT-T (UDP encapsulation on port 4500) is often required for IPsec to traverse NAT devices and should not be globally disabled. Option C is wrong because not all participating spokes should be dialup servers; typically the hub is the dialup server and spokes are dialup clients, or all are static peers. Option D is wrong because restricting Phase 1 authentication to RSA certificates only is not required for SD-WAN membership and would unnecessarily break pre-shared-key deployments.

Answer

Disable NAT traversal (NAT-T) globally on all IPsec phase 1 tunnels

Answer

Configure the IPsec tunnel mode as dialup server on all participating branch spokes

Answer

Set the IPsec phase 1 authentication method strictly to RSA certificates only, disabling pre-shared keys

Question 14

An administrator is using FortiManager to manage an SD-WAN deployment. The administrator needs to add a new SD-WAN member to an existing template that is already assigned to 20 FortiGates. After modifying the template, what must the administrator do to apply the change to all managed devices?

Accepted Answer

Install the policy package to all managed FortiGates that use the template.. After modifying an SD-WAN template in FortiManager, the administrator must install the policy package to the managed FortiGates that use the template. This pushes the updated configuration, including the new SD-WAN member, to all selected devices. Batch installation is supported, allowing efficient updates across multiple FortiGates.

Answer

Run a 'Retrieve' operation on each FortiGate to pull the updated template.

Answer

Reboot each FortiGate to trigger a configuration sync from FortiManager.

Answer

Install the policy package on each FortiGate individually.

Question 15

An administrator has created an SD-WAN template in FortiManager and applied it to a group of FortiGates. Later, they need to modify the template to add a new health check. What is the most efficient way to update all managed devices with this change?

Accepted Answer

Modify the SD-WAN template in FortiManager and re-apply it to the devices.. The most efficient way to update all managed devices with a change to an SD-WAN template is to modify the template in FortiManager and re-apply it. FortiManager will automatically push the updated configuration to all devices using that template, ensuring consistency and saving time. Manual edits or scripts are less efficient and more error-prone.

Answer

Create a new SD-WAN template and apply it to the devices, replacing the old one.

Answer

Manually edit the SD-WAN configuration on each FortiGate.

Answer

Use a script to push the configuration change to each device.