NSE7_SDW Practice Test 17 — 15 Questions

Question 1

A FortiGate is configured with an SD-WAN zone containing two members: 'wan1' (static IP, gateway 203.0.113.1) and 'wan2' (DHCP, learned gateway 198.51.100.1). You need to verify the current SD-WAN member health and the measured latency, jitter, and packet loss for each member from the CLI. Which command displays the live SD-WAN health-check results for all members?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

diagnose sys sdwan health-check. Live SD-WAN health data is exposed through the health-check diagnose command, which reports each Performance SLA's state and the per-member latency, jitter, and packet-loss values. Member and service commands show configuration and rule selection respectively, while 'get' shows only static configuration. To confirm measured SLA values, the health-check output is the correct source.

Answer

get system sdwan health-check

Answer

diagnose sys sdwan member

Answer

diagnose sys sdwan service

Question 2

A network administrator manages 30 FortiGate devices in FortiManager. The administrator wants to ensure that all devices use the same SD-WAN health check settings for a specific SLA target. Which FortiManager object should the administrator configure to achieve this?

Accepted Answer

SD-WAN health check template. SD-WAN health check templates are shared objects in FortiManager that define the parameters for performance monitoring, such as protocol, server, and thresholds. By referencing the same health check template in multiple SD-WAN templates, the administrator ensures that all managed FortiGates use identical health check settings. This centralizes management and reduces configuration drift, which is essential for consistent SLA enforcement across many devices.

Answer

SD-WAN zone

Answer

Virtual IP

Answer

Firewall address object

Question 3

An administrator is configuring an SD-WAN rule to route VoIP traffic over the MPLS link, which has lower latency. The administrator wants to ensure that if the MPLS link fails the SLA for latency, the traffic is automatically routed over the internet VPN. Which SD-WAN strategy should be used to achieve this?

Accepted Answer

Lowest Latency (SLA). Lowest Latency (SLA) is designed to select the member with the lowest latency that also meets the SLA. This ensures VoIP traffic uses the MPLS link when it meets the latency SLA, and if it fails, the rule automatically selects the next member (internet VPN) that meets the SLA. This strategy provides the desired automatic failover based on latency.

Answer

Lowest Cost (SLA)

Answer

Maximize Bandwidth (SLA)

Answer

Manual

Question 4

An administrator configures a static route where the gateway is an SD-WAN zone instead of a specific IP address. How does FortiOS process this SD-WAN static route?

Accepted Answer

The FortiOS SD-WAN engine intercepts the route lookup and applies SD-WAN rules to dynamically select the best member interface based on performance SLAs. FortiOS supports SD-WAN static routes where the gateway is an SD-WAN zone rather than a next-hop IP. When such a route matches, the SD-WAN engine takes over the route lookup and applies SD-WAN rules (SLA-based, priority-based, or load-balance) to select the best member interface dynamically based on measured performance against configured SLAs.

Answer

The FortiGate drops the packet because static routes require a valid IP address gateway

Answer

The packet is forwarded exclusively through the physical interface with the lowest index number

Answer

Traffic is load-balanced equally across all physical interfaces in the FortiGate chassis using round-robin

Question 5

A FortiGate is configured with an SD-WAN zone containing two members: 'wan1' (static IP, gateway 203.0.113.1) and 'wan2' (DHCP, learned gateway 198.51.100.1). You need to verify the current SD-WAN member health and the measured latency, jitter, and packet loss for each member from the CLI. Which command displays the live SD-WAN health-check results for all members?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The security profiles are applied to the wrong policy; the SD-WAN rule is referenced in a policy that does not have security profiles enabled.. Security profiles are applied to firewall policies, not directly to SD-WAN rules. When traffic matches an SD-WAN rule, it is processed by the firewall policy that contains that rule. If that policy lacks security profiles, no inspection occurs. Even if profiles are configured on the SD-WAN zone, they must also be enabled on the policy. Therefore, the most likely reason is that the policy referencing the SD-WAN rule does not have security profiles enabled.

Answer

The SD-WAN rule is using the 'volume' strategy, which disables security inspection.

Answer

The SD-WAN rule is configured with the 'pass-through' action, which bypasses security inspection.

Answer

Security profiles cannot be applied to SD-WAN zones; they must be applied to the individual member interfaces.

Question 6

You are deploying an SD-WAN solution with two WAN links: port1 (primary) and port2 (secondary). You need to ensure that when port1 fails its Performance SLA, the FortiGate automatically removes it from the SD-WAN zone until it recovers. Which configuration step is required to achieve this behavior?

Accepted Answer

Configure a Performance SLA and reference it in the SD-WAN member settings. The correct approach is to configure a Performance SLA and assign it to the SD-WAN member. This allows the FortiGate to monitor the link's health and automatically remove the member from the SD-WAN zone if the SLA fails, ensuring traffic is not routed over a degraded link. Other options either misrepresent features or are not part of the SD-WAN configuration workflow.

Answer

Set the interface's priority to 0 to enable automatic failover

Answer

Enable 'SLA Target' on the SD-WAN interface

Answer

Enable 'Dynamic Zone Membership' globally under SD-WAN settings

Question 7

A network engineer is configuring an SD-WAN rule to route VoIP traffic. The requirement is to always use the member with the lowest jitter, even if other members have higher bandwidth. The engineer wants to avoid manual priority configuration. Which SD-WAN strategy should be selected for this rule?

Accepted Answer

Best Quality. The Best Quality strategy automatically selects the SD-WAN member that meets the SLA and has the best quality metrics, including the lowest jitter. This aligns with the requirement to always use the member with the lowest jitter for VoIP traffic without manual intervention. Other strategies focus on cost, bandwidth, or manual priority.

Answer

Maximize Bandwidth (SLA)

Answer

Priority

Answer

Lowest Cost (SLA)

Question 8

An administrator is using FortiManager to deploy an SD-WAN configuration to a new FortiGate. The administrator wants to ensure that the SD-WAN member interfaces are correctly associated with the physical interfaces on the device. Which FortiManager feature allows the administrator to define the mapping between logical SD-WAN interfaces and physical interfaces?

Accepted Answer

SD-WAN Template. The SD-WAN Template in FortiManager is the correct feature for defining SD-WAN configurations, including member interfaces and their mapping to physical interfaces. When the template is applied to a FortiGate, FortiManager uses the template's logical interface references and maps them to the device's physical interfaces, ensuring the SD-WAN setup is correctly instantiated.

Answer

Provisioning Template

Answer

Firewall Policy

Answer

Address Group

Question 9

A network administrator is deploying SD-WAN on a FortiGate and needs to ensure that the SD-WAN zone can be referenced in firewall policies. Which configuration step is mandatory before the zone can be used in a policy?

Accepted Answer

Enable SD-WAN in Feature Visibility under System > Feature Visibility.. Before SD-WAN zones can be created or used in firewall policies, the SD-WAN feature must be enabled in System > Feature Visibility. This is a global setting that reveals the SD-WAN configuration menu. Without it, the administrator cannot define zones, members, or rules, and the zone will not appear as an option in policy interfaces.

Answer

Assign an IP address to the SD-WAN zone interface.

Answer

Create a static route pointing to the SD-WAN zone.

Answer

Configure a Performance SLA and bind it to the zone.

Question 10

You are deploying an SD-WAN rule that must prioritize VoIP traffic over the best available link based on real-time performance. You have configured a Performance SLA with strict latency and jitter thresholds. Which SD-WAN rule strategy ensures that VoIP traffic uses the link with the lowest jitter that meets the SLA?

Accepted Answer

Best Quality. Best Quality is the only strategy that actively selects the member with the best measured quality, including jitter. It continuously evaluates the SLA metrics and chooses the optimal link for real-time traffic like VoIP. The other strategies either prioritize cost, load-balancing, or static priority, none of which guarantee the lowest jitter link. Therefore, Best Quality is correct.

Answer

Maximize Bandwidth (SLA)

Answer

Lowest Cost (SLA)

Answer

Priority

Question 11

An engineer is configuring an SD-WAN rule that must load-balance traffic across two members based on the volume of traffic, but also must ensure that if one member's health check fails, traffic is redistributed to the remaining healthy member. Which strategy should be selected in the SD-WAN rule?

Accepted Answer

Maximize Bandwidth (SLA). The Maximize Bandwidth (SLA) strategy is designed to load-balance traffic across all SD-WAN members that meet the SLA, using their available bandwidth as the weight. It also automatically reroutes traffic if a member fails its health check. This satisfies both the load-balancing and resilience requirements described in the scenario.

Answer

SLA

Answer

Best Quality

Answer

Priority

Question 12

A network administrator has deployed SD-WAN with two IPsec overlays and one internet breakout on a FortiGate. The administrator wants to ensure that traffic from a specific source subnet uses the VPN overlay for a business-critical application, while all other traffic follows the default route. The SD-WAN rule must also verify that the overlay meets an SLA for jitter. Which SD-WAN configuration object should the administrator use to define the source subnet and application criteria?

Accepted Answer

SD-WAN service rule with match criteria specifying source address and application, and an SLA target. The SD-WAN service rule is the correct construct because it supports matching on source address, application, and other criteria, and can reference an SLA target that uses health-check results to select the best member. This allows the administrator to steer the business-critical application over the overlay only when it meets the jitter SLA, while other traffic follows the default route.

Answer

Policy route with destination and service objects, and an outgoing interface of the SD-WAN zone

Answer

SD-WAN zone with a preferred member and a priority-based selection

Answer

Static route with a gateway pointing to the SD-WAN zone and a priority value

Question 13

A network administrator is deploying SD-WAN with IPsec tunnels and wants to ensure that if a tunnel goes down, traffic is automatically redirected to another member. The administrator has configured two IPsec tunnels in the same SD-WAN zone and a health check for each. Which SD-WAN rule configuration ensures that traffic uses the tunnel with the lowest latency and fails over when the primary tunnel fails the health check?

Accepted Answer

Set the strategy to 'Best Quality' and reference a health check with latency SLA.. Best Quality strategy evaluates the health check SLA and selects the member with the best quality metric, typically latency, among those that meet the SLA. If the primary tunnel fails the health check, it becomes ineligible, and the rule automatically fails over to the next best member. This provides both lowest-latency selection and automatic failover, unlike Manual, Lowest Cost, or Maximize Bandwidth strategies.

Answer

Set the strategy to 'Maximize Bandwidth' and enable load balancing across both tunnels.

Answer

Set the strategy to 'Manual' and assign priority values to each member.

Answer

Set the strategy to 'Lowest Cost' and configure cost values on each member.

Question 14

Which THREE of the following are parameters that can be monitored in a Performance SLA?

Accepted Answer

Packet Loss. In a Performance SLA (as used by SD-WAN/performance-monitoring features such as Fortinet's Performance SLA), the monitored parameters are the network-quality metrics measured by probes: Packet Loss (A), Jitter (C), and Latency (E). Packet Loss (A) is correct because the SLA tracks the percentage of probe packets that never arrive, which directly reflects link reliability. Jitter (C) is correct because it measures the variation in delay between probe packets, a key indicator of voice/video quality. Latency (E) is correct because it measures the round-trip or one-way delay of the probe traffic, the primary SLA threshold metric. CPU load (B) and Disk usage (D) are not part of a Performance SLA; they are system-resource metrics monitored by device health/SNMP or resource-usage tools, not by the SLA probe mechanism.

Answer

CPU load

Answer

Disk usage

Question 15

A network engineer is adding two WAN links to a new SD-WAN deployment on a FortiGate. The interfaces are already configured with IP addresses and default gateways. What must be done before these interfaces can participate in SD-WAN rules?

Accepted Answer

Assign each interface to an SD-WAN zone. Before an interface can be used by SD-WAN rules, it must be a member of an SD-WAN zone. Creating the zone and adding the physical or logical interfaces is what registers them with the SD-WAN feature set. Other settings such as asymmetric routing, VLAN tagging, or static routes affect forwarding behavior but do not perform the membership step that makes the interface selectable in rules.

Answer

Convert each interface to a VLAN subinterface

Answer

Enable asymmetric routing on each interface

Answer

Configure a static route for each interface in the SD-WAN routing table