NSE7_SDW Practice Exam 2 — 20 Questions

Question 1

An enterprise network uses ADVPN 2.0 with BGP running over IPsec tunnels. A spoke needs to initiate a shortcut tunnel to another spoke. Which FortiOS CLI command is used on the hub to verify the active shortcut tunnels and view the shortcut state information?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

diagnose vpn tunnel list. The command 'get system session info' or specific VPN commands such as 'getvpn status' or 'diagnose vpn tunnel list' are used, but for ADVPN shortcuts specifically, 'diagnose sys ipsec tunnel list' or 'get vpn ipsec status' displays the dynamic child SAs. More precisely, 'get vpn advpn status' or querying the routing table with 'get router info routing-table database' shows shortcuts. Wait, the exact diagnostic command for checking ADVPN shortcuts in FortiOS is 'diagnose vpn swift list' or checking the IPsec tunnels via 'diagnose vpn tunnel list'. Let's look at the options to find the correct diagnostic command.

Answer

execute router clear bgp all

Answer

get system sdwan neighbor

Answer

diagnose netlink interface list

Question 2

When troubleshooting SD-WAN performance SLA packet loss, an administrator wants to view real-time latency, jitter, and packet loss statistics for individual health check members. Which CLI command should be executed?

Accepted Answer

diagnose sys sdwan health-check. FortiOS provides diagnostic commands to check SD-WAN health check status and SLA metrics. The correct command is 'diagnose sys sdwan health-check'.

Answer

get system interface physical

Answer

execute ping-server status

Answer

show system sdwan

Question 3

When configuring advanced IPsec VPN tunnels to act as members of an SD-WAN zone, which TWO configuration parameters on the FortiGate are critical for ensuring proper IPsec tunnel operation and traffic steering? (Choose two)

Accepted Answer

Ensure the IPsec interface is added to an SD-WAN zone and assigned a valid virtual IP/interface configuration. When configuring IPsec tunnels for SD-WAN, setting the interface as a member of an SD-WAN zone and ensuring correct Phase 2 selectors or mode-cfg / routing settings are essential. Specifically, setting the interface to allow traffic, defining appropriate Phase 2 selectors or using 0.0.0.0/0 with route-based VPNs, and assigning it to an SD-WAN zone are critical.

Answer

Disable NAT traversal (NAT-T) globally on all IPsec phase 1 tunnels

Answer

Configure the IPsec tunnel mode as dialup server on all participating branch spokes

Answer

Set the IPsec phase 1 authentication method strictly to RSA certificates only, disabling pre-shared keys

Question 4

An enterprise FortiGate is running SD-WAN with multiple internet breakouts. The administrator applies an Application Control security profile to the firewall policy. Some custom business applications are being incorrectly classified or blocked by the Application Control profile. To ensure SD-WAN can reliably steer this traffic using application signatures while preventing false positives, what is the recommended procedure?

Accepted Answer

Create a custom application signature override in the Application Control profile to correctly identify the traffic by port, IP, or pattern. When custom or specific applications are misidentified, administrators can create a Custom Application override or custom signature, or adjust the Application Control profile overrides to change the action (e.g., allow or assign to a specific app category) without disabling security entirely.

Answer

Disable all security profiles on the SD-WAN interface zone

Answer

Configure static routes for the application servers and bypass SD-WAN rules completely

Answer

Switch the inspection mode from flow-based to proxy-based for all firewall policies

Question 5

An administrator is troubleshooting an SD-WAN deployment where traffic matching an SD-WAN rule with a destination service object (e.g., HTTPS) is not being steered according to the SLA priority. Instead, it is always taking the default static route member. Upon checking the firewall policies, what is the most common reason why an SD-WAN rule fails to process application or service-based traffic matching?

Accepted Answer

The SD-WAN rules are evaluated sequentially from top to bottom; an earlier broad SD-WAN rule with matching source/destination IP addresses is intercepting the traffic before the service-specific rule is reached. For SD-WAN rules based on applications or destination services to take effect, the matching firewall policy must have application control or appropriate inspection enabled, or the SD-WAN rule position/criteria order must match correctly. Furthermore, explicit proxy or policy routing interactions can interfere if implicit firewall rules intercept the traffic first.

Answer

IPsec VPN phase 2 selectors must be set to 0.0.0.0/0 for service-based rules to evaluate

Answer

The firewall policy containing the traffic has SSL inspection disabled, preventing service-based identification

Answer

The FortiGate kernel requires hardware acceleration (NP7) to be disabled for service-based SD-WAN rules to function

Question 6

A FortiGate device is running ADVPN 2.0 with OSPF. A spoke experiences transient routing loops when a shortcut tunnel tears down due to inactivity timeout. Which configuration adjustment on the FortiGate hub and spokes prevents these temporary routing blackholes or loops during shortcut teardown?

Accepted Answer

Adjust the administrative distance or use route redistribution filters with appropriate metrics so hub routes and shortcut routes do not conflict during teardown. When shortcuts time out, routes must cleanly transition back to the hub route without creating transient routing loops. Adjusting route redistribution metrics, using specific distance values, or configuring 'shortcut-routing' / route-map timers / asymmetric routing settings prevents loops. In FortiOS ADVPN, setting appropriate dead timers or using dynamic routing distance adjustments ensures the hub route has a predictable preference when the shortcut drops.

Answer

Disable OSPF on the spoke units and rely entirely on static default routes

Answer

Set the IPsec phase 1 lifetime to infinite to prevent shortcuts from timing out

Answer

Configure asymmetric routing bypass on all firewall policies

Question 7

An enterprise network implements BGP over ADVPN. Spoke units advertise their local subnets to the hub via BGP. To prevent spokes from learning each other's subnets directly through the hub via regular BGP route propagation before an ADVPN shortcut is established (forcing them to route through the hub unnecessarily), or conversely, to optimize route distribution, what BGP feature is typically configured on the hub?

Accepted Answer

BGP Route Reflection configured on the hub with spoke routers set as clients. In BGP over ADVPN, Route Reflection is typically enabled on the hub so that spoke-to-spoke routes are reflected correctly, or next-hop behavior is manipulated. Wait, if we want spokes not to learn routes or to handle them correctly without full mesh, BGP Route Reflection (with no-client-to-client reflection if desired, or standard route reflection) is used. Alternatively, disabling next-hop-self or using peer groups. Let's look at the options. BGP Route Reflection on the hub allows the hub to reflect routes between spoke iBGP peers without requiring a full mesh iBGP session between every spoke.

Answer

BGP Multipath relaxing with maximum-paths set to 32

Answer

Static default route redistribution with aggregate-address suppression

Answer

BGP Confederation with each spoke acting as a separate autonomous system

Question 8

An administrator configures an SD-WAN rule to route guest Wi-Fi traffic out of a secondary broadband internet connection. However, guest users are still able to access internal corporate subnets that are routed over the primary IPsec VPN tunnel. What configuration is missing or incorrect?

Accepted Answer

The firewall policy permitting traffic from the Guest Wi-Fi interface to the internal VPN interface lacks proper security profile enforcement or is missing a deny rule blocking inter-zone access. SD-WAN rules route internet or specific traffic based on criteria, but traffic between zones (like Guest Wi-Fi to Corporate LAN) is governed by firewall policies. If a firewall policy permits traffic from Guest Wi-Fi directly to Corporate LAN, it bypasses SD-WAN rules because SD-WAN rules only evaluate traffic matching egress SD-WAN zones/interfaces specified by the rule or routing table lookup. To prevent guest traffic from reaching internal subnets, the firewall policy must block or restrict that inter-zone traffic.

Answer

The SD-WAN health check probe is not monitoring the corporate subnet gateway

Answer

The IPsec Phase 2 security association selectors include the guest subnet range

Answer

The SD-WAN rule priority for the internal VPN interface is set higher than the broadband interface

Question 9

An administrator configures a static route where the gateway is an SD-WAN zone instead of a specific IP address. How does FortiOS process this SD-WAN static route?

Accepted Answer

The FortiOS SD-WAN engine intercepts the route lookup and applies SD-WAN rules to dynamically select the best member interface based on performance SLAs. When a static route points to an SD-WAN zone as its gateway, the FortiOS routing table delegates the packet forwarding decision to the SD-WAN engine, which then evaluates SD-WAN rules to select the best member interface.

Answer

The FortiGate drops the packet because static routes require a valid IP address gateway

Answer

The packet is forwarded exclusively through the physical interface with the lowest index number

Answer

Traffic is load-balanced equally across all physical interfaces in the FortiGate chassis using round-robin

Question 10

An administrator applies security profiles (Antivirus, Web Filtering, and IPS) to traffic steered by an SD-WAN rule. Performance issues arise. Which TWO methods can the administrator use to optimize inspection performance without completely disabling security? (Choose two)

Accepted Answer

Switch the inspection mode from proxy-based to flow-based where supported, allowing hardware offloading (NP6/NP7) to accelerate packet processing. Optimizing security profile performance while maintaining inspection includes switching inspection mode to flow-based where appropriate, tuning antivirus/IPS settings to bypass heavy file types or exempt trusted IPs, and leveraging hardware acceleration.

Answer

Set the IPsec Phase 1 encryption algorithm to DES to speed up decryptions

Answer

Disable all SSL inspection globally across the entire FortiGate device

Answer

Remove the SD-WAN virtual interface from all firewall zones

Question 11

You are troubleshooting an issue where traffic is not using an SD-WAN rule despite meeting criteria. What is the most likely cause?

Accepted Answer

A higher-priority SD-WAN rule is matching the traffic first.. SD-WAN rules are evaluated top-down. If a higher-priority rule matches the traffic, the lower-priority rule will never be reached.

Answer

The SD-WAN rule is disabled.

Answer

The Performance SLA has timed out.

Answer

The interface is not in an SD-WAN zone.

Question 12

An enterprise network uses OSPF over SD-WAN IPsec tunnels. The administrator notices that OSPF adjacency is constantly dropping over a specific backup SD-WAN member link due to intermittent packet loss. Which THREE configuration adjustments can improve OSPF stability over unstable SD-WAN IPsec links? (Choose three)

Accepted Answer

Configure OSPF network type as point-to-point on the IPsec tunnel interfaces to eliminate unnecessary DR/BDR elections. To stabilize OSPF over unstable WAN links, adjusting OSPF hello and dead intervals, configuring OSPF dead-drop or fast-hello settings carefully, or utilizing passive interfaces/MD5 authentication correctly helps. Furthermore, ensuring that OSPF timers match and are relaxed prevents unnecessary adjacency drops.

Answer

Set the OSPF router ID to 0.0.0.0 on all branch spokes

Answer

Disable OSPF hello packets entirely and rely on static default routes

Question 13

An administrator troubleshoots a scenario where traffic matching an application-based SD-WAN rule is bypassing the preferred high-speed MPLS tunnel and taking the backup broadband tunnel instead. Which THREE factors should the administrator check to resolve this routing discrepancy? (Choose three)

Accepted Answer

Inspect the member priorities and weights configured within the specific SD-WAN rule. When an SD-WAN rule bypasses preferred paths, potential causes include SLA health check failure (the preferred link fails the SLA threshold), incorrect rule evaluation order (an earlier rule matches first), or interface priority/weight settings within the rule. Checking these three areas is standard practice.

Answer

Verify the FortiGate factory default administrator password is changed

Answer

Check the physical layer OSI Model cable category connected to the FortiGate port

Question 14

An enterprise deploys ADVPN 2.0 with BGP and security profiles applied to traffic traversing the VPN overlay. Which THREE statements are correct regarding how security profiles and ADVPN 2.0 interact in FortiOS? (Choose three)

Accepted Answer

SSL inspection (DPI) applied on spoke firewall policies inspects decrypted traffic traversing the ADVPN shortcut tunnel. In ADVPN 2.0, when spokes establish direct shortcut tunnels, data flows directly between spokes without passing through the hub. Therefore, firewall policies and security profiles enforcing inspection must exist on the spoke FortiGates, not just the hub. Additionally, shortcut tunnels permit direct inspection on the spoke interfaces.

Answer

ADVPN 2.0 automatically disables all firewall inspection profiles on shortcut interfaces to maximize throughput

Answer

The hub FortiGate inspects all data packets exchanged between spokes even after a direct shortcut tunnel is established

Question 15

An administrator is troubleshooting BGP route propagation over SD-WAN IPsec tunnels where a branch office is not receiving specific routes from the datacenter hub. Which TWO CLI commands on the FortiGate are most useful for diagnosing BGP peering and advertised route issues? (Choose two)

Accepted Answer

get router info bgp neighbors advertised-routes. To troubleshoot BGP routing issues on FortiOS, commands examining the BGP summary, advertised routes, and received routes are essential. These include 'get router info bgp summary' and 'get router info bgp neighbors <ip> advertised-routes'.

Answer

execute ipsec tunnel list

Answer

diagnose sys sdwan member

Answer

get system interface physical

Question 16

Which command is used to verify the current status of SD-WAN members and their SLA health from the CLI?

Accepted Answer

diagnose sys sdwan health-check. The command 'diagnose sys sdwan health-check' shows the status of configured health checks and member reachability.

Answer

show router info bgp

Answer

get system interface

Answer

get system sdwan member

Question 17

When using SD-WAN templates, how are SD-WAN rules ordered?

Accepted Answer

Top to bottom. SD-WAN rules are evaluated from top to bottom, similar to standard firewall policies.

Answer

Based on the creation date

Answer

By the interface speed

Answer

Randomly

Question 18

When configuring SD-WAN services in a template, what does the 'Performance SLA' setting determine?

Accepted Answer

The criteria for path selection based on link quality. The Performance SLA defines the criteria (latency, jitter, loss) that must be met for a path to be considered 'healthy' for traffic.

Answer

The physical port priority

Answer

The maximum bandwidth allowed

Answer

The number of tunnels created

Question 19

Which THREE factors can affect the 'Performance SLA' logic in an SD-WAN template?

Accepted Answer

Packet loss threshold. Performance SLA evaluates paths based on measured latency, jitter, and packet loss compared to defined thresholds.

Answer

The firmware version of the FortiGate

Answer

The number of active VPN tunnels

Question 20

Which TWO configuration changes require a push from FortiManager to the FortiGate?

Accepted Answer

Changes to an SD-WAN template. Any change made in the FortiManager policy or template objects requires a push to keep the device config synchronized.

Answer

Changes to the log settings on the FortiGate local GUI

Answer

Adding a new user to the FortiGate local database

Answer

Changing the FortiManager admin password