NSE7_SDW Practice Test 2 — 10 Questions

Question 1

You are configuring SD-WAN on a FortiGate that will be managed by FortiManager. You want to ensure that the SD-WAN configuration is consistent across multiple devices and that changes can be deployed centrally. Which action must you take in FortiManager to support SD-WAN configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the SD-WAN template in FortiManager.. FortiManager's SD-WAN template is designed for centralized configuration of SD-WAN settings. It allows you to define members, zones, performance SLAs, and rules once and assign them to multiple FortiGates. This ensures consistency and simplifies deployment. Other options do not provide the centralized SD-WAN configuration capability required.

Answer

Enable 'Central Management' on each FortiGate under System > Settings.

Answer

Install a 'SD-WAN' license on the FortiGate.

Answer

Create a firewall policy on FortiManager that references SD-WAN zones.

Question 2

A network engineer is using FortiManager to manage SD-WAN templates for multiple FortiGates. They need to ensure that a specific SD-WAN rule is only applied to branch offices that have a specific tag. Which FortiManager feature should they use?

Accepted Answer

Dynamic mapping. Dynamic mapping in FortiManager enables the conditional assignment of configuration objects, including SD-WAN templates and rules, based on device metadata such as tags. This allows administrators to target specific devices without manually assigning templates to each one. By using dynamic mapping, the SD-WAN rule is applied only to branch offices that have the designated tag, ensuring precise configuration management.

Answer

Meta fields

Answer

Provisioning templates

Answer

Policy packages

Question 3

An administrator applies security profiles (Antivirus, Web Filtering, and IPS) to traffic steered by an SD-WAN rule. Performance issues arise. Which TWO methods can the administrator use to optimize inspection performance without completely disabling security? (Choose two)

Accepted Answer

Switch the inspection mode from proxy-based to flow-based where supported, allowing hardware offloading (NP6/NP7) to accelerate packet processing. Option A is correct because switching from proxy-based to flow-based inspection allows supported FortiGate models to use hardware acceleration (NP6/NP7 processors) for packet processing, which significantly reduces latency and improves throughput while still applying the security profiles. Option C is correct because configuring security profile exemptions or antivirus inspection overrides for trusted internal subnets or latency-sensitive VoIP traffic reduces the volume of traffic subjected to deep inspection, thereby optimizing performance without fully disabling security. Option B is incorrect because DES is a weak, deprecated encryption algorithm and would not meaningfully speed up IPsec decryption; it also degrades security rather than optimizing inspection. Option D is incorrect because disabling SSL inspection globally removes a critical security control entirely, which violates the requirement to avoid completely disabling security. Option E is incorrect because removing the SD-WAN virtual interface from all firewall zones would break the SD-WAN routing and security policy enforcement, not optimize inspection performance.

Answer

Set the IPsec Phase 1 encryption algorithm to DES to speed up decryptions

Answer

Disable all SSL inspection globally across the entire FortiGate device

Answer

Remove the SD-WAN virtual interface from all firewall zones

Question 4

An administrator configures an SD-WAN rule that uses the 'maximize bandwidth (SLA)' strategy across three IPsec overlays. A security profile group containing IPS and Application Control is applied to the firewall policy that references the SD-WAN zone. Users report that some sessions are being re-evaluated mid-stream and reset when a health check fails. Which FortiOS behavior explains the resets?

Accepted Answer

When an SLA member fails, FortiOS re-runs the SD-WAN rule and may steer existing sessions to a different member, causing the security profile to re-inspect and reset sessions that cannot be re-evaluated.. SD-WAN rules that monitor SLA can trigger re-evaluation of existing sessions when a member's SLA degrades or fails. If the rule permits re-evaluation, FortiOS may move flows to a different member. Stateful security profiles such as IPS and Application Control may not be able to maintain inspection state across members, leading to session resets. Administrators can control this by disabling re-evaluation for sensitive rules or by designing SLA thresholds that avoid frequent flapping, ensuring stable session steering.

Answer

IPS and Application Control cannot be applied to SD-WAN zones; the profiles are silently ignored, and the resets are caused by the missing inspection.

Answer

The 'maximize bandwidth (SLA)' strategy ignores SLA health checks and only uses link capacity, so when a member saturates, IPS drops packets and resets the session.

Answer

The security profile group is applied to the SD-WAN zone, but FortiOS requires profiles to be bound to each member interface individually; the zone-level binding causes mid-stream resets.

Question 5

How can you verify that an SD-WAN configuration change was successfully applied to a FortiGate via FortiManager?

Accepted Answer

By checking the Device Manager installation status. In FortiManager, after you install a configuration change to a managed FortiGate, the Device Manager provides a real-time installation status for each device. This status shows whether the installation succeeded, failed, or is pending, and includes details such as the specific policy package or configuration revision applied. Therefore, checking the Device Manager installation status is the direct and authoritative way to verify that an SD-WAN configuration change was successfully applied.

Answer

By checking the FortiAnalyzer logs

Answer

By restarting the FortiGate

Answer

By viewing the system dashboard of the FortiGate locally

Question 6

A network engineer is configuring an SD-WAN template in FortiManager for a new branch office. The branch has two internet links: one via DHCP and one via static IP. The engineer wants to ensure that the SD-WAN rule prefers the static link for business-critical traffic but can fail over to the DHCP link if the static link's performance degrades. Which SD-WAN template component should the engineer configure to define the performance thresholds that trigger failover?

Accepted Answer

Performance SLA. Performance SLA defines the acceptable thresholds for latency, jitter, and packet loss. When a link's health check measurements violate these thresholds, the link is marked as out of SLA, and SD-WAN rules can then select an alternative link. This enables dynamic failover based on link quality. Health checks provide the data, but the SLA sets the criteria. SD-WAN rules use the SLA status to make routing decisions, but they do not define the thresholds themselves.

Answer

Interface priority

Answer

SD-WAN rule

Answer

SD-WAN health check

Question 7

Where do you configure the 'Gateway' IP address for an SD-WAN member?

Accepted Answer

Under Network > SD-WAN > SD-WAN Members.. The Gateway IP address for an SD-WAN member is configured in the member's settings under Network > SD-WAN > SD-WAN Members. This gateway is the next-hop IP address used for health checks and for forwarding traffic over that member, and it is specific to the SD-WAN member configuration rather than the interface or static route table.

Answer

Under Firewall Policy.

Answer

Under Network > Static Routes.

Answer

Under System > Interfaces.

Question 8

An administrator is configuring an SD-WAN rule to route VoIP traffic over the MPLS link and all other traffic over the internet link. The administrator wants to ensure that VoIP traffic is prioritized and that the rule only selects the MPLS link if it meets specific latency and jitter thresholds. Which SD-WAN configuration should be used?

Accepted Answer

Create an SD-WAN rule with the 'SLA' strategy, referencing a health check that monitors latency and jitter on the MPLS link, and set the rule to match VoIP traffic.. The 'SLA' strategy is designed to route traffic based on health check metrics such as latency and jitter. By referencing a health check that monitors these metrics on the MPLS link, the SD-WAN rule can ensure that VoIP traffic is only sent over the MPLS link when it meets the specified thresholds. If the thresholds are not met, the rule can fail over to another link, maintaining call quality.

Answer

Create an SD-WAN rule with the 'volume' strategy, assigning a higher weight to the MPLS link for VoIP traffic.

Answer

Create an SD-WAN rule with the 'priority' strategy, setting the MPLS link as the highest priority for VoIP traffic.

Answer

Create an SD-WAN rule with the 'manual' strategy, explicitly selecting the MPLS link for VoIP traffic.

Question 9

An administrator needs to configure an SD-WAN rule that load-balances traffic across two WAN links based on the volume of traffic, ensuring that both links are utilized proportionally to their configured weights. Which SD-WAN rule strategy should be selected?

Accepted Answer

Weighted Load Balance. The 'Weighted Load Balance' strategy is designed to distribute traffic across SD-WAN members according to their configured weights. This is the only strategy that allows the administrator to specify a proportional split, such as 70% on one link and 30% on another. It ensures both links are utilized in proportion to their weights, which matches the scenario's requirement.

Answer

Maximize Bandwidth (SLA)

Answer

Priority

Answer

Lowest Cost (SLA)

Question 10

An SD-WAN rule uses the lowest-cost (SLA) strategy with two members, wan1 and wan2. wan1 has a lower configured cost than wan2, and both currently meet the SLA. A network engineer observes that all matching traffic egresses wan1. The engineer now wants traffic to prefer wan2 whenever wan2 meets the SLA, while still failing over to wan1 if wan2 degrades. What should the engineer change?

Accepted Answer

Set the rule strategy to priority and give wan2 a lower priority value than wan1. Preference between healthy members is expressed by the rule strategy. The lowest-cost strategy always favors the lower-cost member, so no cost or probe tuning produces a manual preference. Switching to the priority strategy and giving the desired member the lowest priority number makes it preferred while it passes the SLA, with automatic failover to the higher-numbered member.

Answer

Increase the cost value configured on wan2 above the cost on wan1

Answer

Add a Performance SLA probe on wan2 with a shorter probe interval than wan1

Answer

Lower the cost value configured on wan1 below the cost on wan2