NSE7_SDW Practice Exam 1 — 20 Questions

Question 1

When using SD-WAN templates, which option allows you to manage different ISPs on different branches within the same template?

Accepted Answer

Dynamic Mapping. Dynamic mapping allows you to associate the 'WAN' member in the template to 'port1' on one branch and 'wan1' on another.

Answer

Global Objects

Answer

Device Groups

Answer

SD-WAN Rules

Question 2

Which interface can be used as an SD-WAN member in an SD-WAN template?

Accepted Answer

Physical ports, VLANs, and VPN tunnels. Any physical or logical (VPN tunnel) interface can be added as an SD-WAN member.

Answer

Only WAN physical ports

Answer

Only VLANs

Answer

Only loopback interfaces

Question 3

How do you apply an SD-WAN template to multiple managed FortiGates simultaneously?

Accepted Answer

By assigning the template in the Device Manager tab. In the Device Manager tab, you can assign an SD-WAN template to multiple devices by selecting them and applying the template.

Answer

By manually editing each FortiGate config

Answer

Through individual CLI console sessions

Answer

By creating a global profile

Question 4

You want to standardize the SD-WAN configuration for 50 remote branch offices. Which FortiManager feature should you use?

Accepted Answer

SD-WAN Templates. SD-WAN templates are specifically designed for mass deployment of standardized configurations.

Answer

Policy Packages

Answer

Firmware Images

Answer

CLI Scripts

Question 5

When configuring SD-WAN in FortiManager, why would you use 'Shared Objects'?

Accepted Answer

To enable reuse of configuration elements across different templates. Shared objects allow you to define parameters like health check servers once and reuse them across multiple templates, simplifying updates.

Answer

To increase the number of VDOMs supported

Answer

To allow FortiGates to share logs

Answer

To create a site-to-site VPN

Question 6

An administrator implements BGP over SD-WAN tunnels to a cloud provider. The cloud provider requires BGP MD5 authentication on all peering sessions. Where is BGP MD5 authentication configured on the FortiGate?

Accepted Answer

Under the router bgp neighbor configuration block in the CLI. BGP authentication passwords (such as MD5) are configured within the BGP neighbor configuration under router bgp in the FortiOS CLI.

Answer

Within the firewall policy authentication settings

Answer

Under the IPsec phase 1 interface advanced settings

Answer

Inside the SD-WAN health check probe configuration

Question 7

If an SD-WAN template contains a reference to an interface that does not exist on a target FortiGate, what occurs during the installation process?

Accepted Answer

The installation fails with a configuration error. The installation will fail during the pre-check or push validation phase because the dependency is missing.

Answer

The FortiGate automatically creates a dummy interface

Answer

The installation proceeds and ignores the missing interface

Answer

The FortiGate enters an 'Emergency' state

Question 8

Which object must be created before assigning a health check to an SD-WAN service rule in an SD-WAN template?

Accepted Answer

An SD-WAN Health Check. Health checks must be defined within the template configuration to be usable in SD-WAN rules.

Answer

A routing protocol

Answer

A firewall address object

Answer

An SD-WAN Zone

Question 9

What is required before FortiManager can display SD-WAN monitoring data?

Accepted Answer

The FortiGate must be sending logs to FortiManager. FortiManager must be configured to receive logs from the FortiGate, and 'Log to FortiManager' must be enabled on the FortiGate.

Answer

The FortiGate must have a cloud license

Answer

The FortiGate must be running a specific firmware

Answer

The FortiGate must be in Transparent mode

Question 10

When viewing the SD-WAN Monitor in FortiManager, what information is provided for the 'Health Check' status?

Accepted Answer

Latency, jitter, and packet loss metrics. The monitor shows the latency, jitter, and packet loss for every configured health check probe on the monitored device.

Answer

The firmware version of the device

Answer

The number of active users

Answer

The current IP address of the interface

Question 11

You are troubleshooting a scenario where an SD-WAN template is not pushing to a FortiGate. Which log file on the FortiManager is most useful to identify the specific CLI command causing the failure?

Accepted Answer

fmg_debug.log. The fmg_debug.log or the task monitor logs show the specific CLI commands being pushed and the FortiGate response.

Answer

fmg_event.log

Answer

fmg_audit.log

Answer

fmg_system.log

Question 12

In an ADVPN 2.0 deployment, a hub unit uses BGP to advertise routes to spokes. When a spoke learns a prefix via BGP from the hub, what mechanism allows the spoke to automatically initiate an ADVPN shortcut tunnel directly to another spoke when traffic flows between them?

Accepted Answer

The FortiGate kernel detects traffic matching a dynamic BGP route over the IPsec interface and initiates an IKE shortcut negotiation with the target spoke. ADVPN shortcuts are triggered when traffic matches a shortcut trigger mechanism. In ADVPN 2.0, IPsec phase 1 shortcut settings ('set advpn shortcut') and dynamic routing protocols working together allow the kernel to generate shortcut requests when traffic hits the phase 1 interface.

Answer

OSPF sends a special multicast hello packet across the hub to establish mesh point-to-point links

Answer

FortiManager pushes a dynamic static route to both spokes simultaneously

Answer

The Web Filtering profile intercepts the packet and redirects it via proxy to the destination spoke

Question 13

When creating an SD-WAN template, what must be defined before you can add an SD-WAN interface to the template?

Accepted Answer

Individual SD-WAN member interfaces. You must define the member interfaces within the template before referencing them in SD-WAN zones or rules.

Answer

The SD-WAN health check probes

Answer

Global firewall policies

Answer

The virtual domain (VDOM) settings

Question 14

During SD-WAN template deployment, what is the role of 'Dynamic Mapping'?

Accepted Answer

To map a single template object to different physical settings on different devices. Dynamic mapping allows you to map a single template object to different physical values (like interface names) on different FortiGate devices.

Answer

To automate firmware updates

Answer

To monitor bandwidth usage

Answer

To dynamically change the SD-WAN rule based on time

Answer

To calculate the latency of paths

Question 15

Which TWO criteria can be used in SD-WAN rules to select an outgoing interface?

Accepted Answer

Source and destination address. Rules use criteria like source/destination address, services, and application signatures to steer traffic.

Answer

The name of the administrator

Answer

System temperature

Answer

Device serial number

Question 16

An administrator wants to apply a Web Filtering security profile to traffic that is being dynamically steered via an SD-WAN rule. Where must this security profile be enforced in FortiOS?

Accepted Answer

Inside the firewall policy that matches the traffic being steered by the SD-WAN rule. Security profiles in FortiOS are always applied within firewall policies, not directly inside SD-WAN rules or interface configurations. The SD-WAN rule handles routing/path selection, while the firewall policy handling that traffic enforces security profiles.

Answer

Directly inside the SD-WAN rule configuration under the advanced settings tab

Answer

Globally under the system settings as an SD-WAN overlay inspection profile

Answer

Within the IPsec tunnel phase 2 security association settings

Question 17

A FortiGate device is configured with an SD-WAN rule utilizing a SLA rule for latency and packet loss. Security profiles including Deep Packet Inspection (DPI) SSL inspection and an Antivirus profile are applied to the firewall policy allowing this traffic. Users report intermittent connection drops on real-time UDP-based applications. Upon troubleshooting, the administrator notices that packet drops occur only when the SD-WAN rule dynamically steers traffic to a backup IPsec tunnel that has a smaller MTU. What is the most likely root cause and mitigation for this behavior?

Accepted Answer

Path MTU Discovery is failing because ICMP unreachable messages are blocked, and TCP MSS clamping is not adjusting the encapsulated IPsec packet size correctly. IPsec encapsulation adds overhead, and if the Path MTU Discovery (PMTUD) fails due to ICMP fragmentation-needed messages being blocked by security profiles or firewalls along the path, packet drops occur for UDP streams exceeding the actual MTU. Adjusting the TCP MSS or enabling ipsec-phase1-interface fragmentation settings/tcp-mss-enforcement resolves this.

Answer

SD-WAN health check probes are overwhelming the IPsec tunnel bandwidth

Answer

The Antivirus proxy buffer is overflowing due to UDP streaming packets

Answer

The SSL inspection profile is attempting to decrypt UDP traffic, causing kernel panic and packet drops

Question 18

An administrator needs to inspect encrypted traffic traversing an SD-WAN IPsec tunnel using Deep Packet Inspection (DPI). What must be installed on the client endpoints or configured on the FortiGate to prevent browser trust warnings when using SSL/TLS full inspection?

Accepted Answer

The FortiGate's self-signed CA certificate must be installed in the trusted root certificate store of the client endpoints. When using SSL Full Inspection (DPI), the FortiGate acts as a man-in-the-middle and re-signs certificates using a Certificate Authority (CA) certificate. This CA certificate must be installed and trusted on the client devices.

Answer

ADVPN 2.0 shortcut certificates must be exchanged between spokes

Answer

BGP MD5 authentication keys must match on both routers

Answer

A pre-shared key must be configured in the IPsec Phase 1 proposal

Question 19

An administrator has configured BGP over multiple SD-WAN IPsec tunnels to provide redundant paths to a datacenter. However, asymmetric routing is causing stateful inspection drops on a secondary FortiGate firewall downstream. To ensure that BGP selects the preferred primary SD-WAN member consistently, which BGP attribute is best manipulated via a route-map applied to the BGP neighbor in FortiOS?

Accepted Answer

Local Preference. MED (Multi-Exit Discriminator) or Local Preference can influence inbound/outbound path selection. Local Preference is used to influence outbound routing decisions within an AS, while MED influences inbound traffic from external peers. For internal path selection across SD-WAN tunnels terminating on the same autonomous system or IBGP peers, Local Preference or weight (cisco-specific, but weight is local to FortiGate) / Route-map setting local-preference is standard.

Answer

AS-PATH prepend

Answer

Cluster ID

Answer

Origin code

Question 20

An IPsec VPN tunnel used as an SD-WAN member is experiencing intermittent flapping due to DPD (Dead Peer Detection) timeout issues over a high-latency satellite link. How should the administrator adjust the Phase 1 IPsec settings on FortiOS to stabilize the tunnel without completely disabling failure detection?

Accepted Answer

Increase the DPD retry count and interval settings under the IPsec Phase 1 configuration. On high-latency or high-jitter links like satellite connections, the default DPD retry count and interval may be too aggressive. Increasing the DPD retry count and/or interval or switching the DPD mode to 'on-idle' or 'on-demand' helps prevent false drops.

Answer

Disable DPD entirely so the FortiGate never tears down the tunnel

Answer

Enable NP6/NP7 hardware offloading for Phase 1 SA renegotiation

Answer

Change the IPsec phase 1 mode from Main mode to Aggressive mode