NSE7_SDW Practice Exam 2 — 20 Questions

Question 1

A FortiGate is configured with two IPsec overlays in an SD-WAN zone. The administrator wants to ensure that return traffic from the remote subnet arrives on the same overlay that the original session used, but the remote gateway IP is the same on both overlays. Which SD-WAN member setting should be configured to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable 'preserve-session-route' under the IPsec phase1-interface.. When multiple IPsec overlays terminate on the same remote gateway IP, the FortiGate cannot differentiate them by gateway alone. Enabling preserve-session-route on the IPsec phase1-interface forces the return traffic of a session to use the same tunnel that initiated it, ensuring symmetry. This is essential in SD-WAN deployments where multiple overlays exist and traffic must not be load-balanced across them for established sessions. The other options do not provide this per-session stickiness at the tunnel level.

Answer

Enable 'preserve-session-route' under the SD-WAN member interface.

Answer

Configure 'route-overlap' to allow multiple default routes over the same gateway.

Answer

Enable 'auto-discovery-forwarder' on the SD-WAN zone.

Question 2

A FortiGate is configured with an SD-WAN rule that steers traffic to an IPsec overlay tunnel. A security administrator needs to inspect the traffic with an IPS sensor before it egresses the tunnel. Where must the IPS sensor be applied so that it inspects traffic matching the SD-WAN rule?

Accepted Answer

In the firewall policy that permits the traffic and references the SD-WAN zone as the outgoing interface.. The firewall policy that permits the session is where UTM profiles such as IPS are enforced. Because the SD-WAN rule only chooses the egress member after the policy is matched, the policy must reference the SD-WAN zone as its outgoing interface. This way, any member selected by the rule inherits the same IPS inspection, ensuring consistent protection regardless of which tunnel carries the traffic.

Answer

Inside the SD-WAN rule definition, by enabling the 'security-profile' option and selecting the IPS sensor.

Answer

In the IPsec Phase 2 selector, by attaching the IPS sensor to the tunnel's proxy ID.

Answer

In the SD-WAN health-check definition, by binding the IPS sensor to the SLA probe.

Question 3

A network engineer is adding a new WAN link to an existing SD-WAN deployment on a FortiGate. The physical interface 'wan3' has been configured with an IP address and is up, but it does not appear in the list of available interfaces when the engineer tries to add it to an SD-WAN zone. Which action should the engineer take to resolve this?

Accepted Answer

Set the interface role to 'WAN' in the interface configuration.. For a physical interface to be available as an SD-WAN member, it must have its role set to 'WAN' in the interface configuration. This is a mandatory prerequisite in FortiOS. Once the role is set, the interface becomes selectable when adding members to an SD-WAN zone.

Answer

Assign the interface to a virtual WAN link (vwan) before adding it to the SD-WAN zone.

Answer

Ensure the interface is not used by any firewall policy.

Answer

Enable 'sdwan' on the interface under Network > Interfaces.

Question 4

A network engineer is adding a new physical interface to an existing SD-WAN zone on a FortiGate. The interface is currently used for management access. Which prerequisite must be met before the interface can be added to the SD-WAN zone?

Accepted Answer

The interface must have an IP address and be administratively up.. Before an interface can be added to an SD-WAN zone, it must have an IP address and be administratively up. These are fundamental requirements for the interface to function as an SD-WAN member. Other options describe global settings or optional features that are not prerequisites for zone membership.

Answer

The interface must have a performance SLA bound to it.

Answer

The interface must be assigned to a VDOM in NAT mode.

Answer

The interface must be part of a redundant interface pair.

Question 5

What happens if you modify an SD-WAN template that is already applied to a FortiGate?

Accepted Answer

The configuration status shows 'Modified' and requires an installation task. When you modify an SD-WAN template already applied to a FortiGate, FortiManager marks the device's configuration status as 'Modified', indicating the device is out of sync with the template. The changes are not pushed automatically; an administrator must run an installation task (Install Wizard or Install Device) to push the updated configuration to the FortiGate. This staged workflow prevents unintended immediate changes to production devices.

Answer

The changes take effect immediately without a push

Answer

The FortiGate automatically pulls the new config

Answer

The FortiGate configuration is reverted

Question 6

You are configuring an SD-WAN rule to route business-critical traffic. You want to ensure that the rule uses the best available link based on performance SLAs, and that it can fail over to a secondary link if the primary link's SLA is violated. Which two configuration elements are required to achieve this? (Choose two.)

Accepted Answer

Set the rule's strategy to 'SLA' and specify the SLA targets.. To route based on SLA and fail over when the SLA is violated, you must configure Performance SLAs on the members and use the 'SLA' strategy in the rule, specifying the SLA targets. This enables the rule to monitor link health and switch to a secondary link when the primary fails to meet the SLA.

Answer

Configure a static route with equal distance for both WAN links.

Answer

Set the rule's strategy to 'Lowest Cost' and assign costs to each member.

Answer

Enable 'Link Health Monitor' on the SD-WAN zone.

Question 7

Which THREE of the following are benefits of using SD-WAN?

Accepted Answer

Simplified WAN management through zones.. Option B is correct because SD-WAN controllers abstract WAN transport links into logical zones (e.g., VPN zones, service zones), letting administrators apply consistent policy and routing across many sites from a single management plane instead of configuring each device individually. Option C is correct because SD-WAN continuously monitors link health (via BFD, IP SLA, or similar probes) and automatically reroutes traffic to a backup WAN link—LTE, broadband, or MPLS—when the primary link degrades or fails, without manual intervention. Option E is correct because SD-WAN's application-aware routing engine classifies traffic by application and steers it over the path with the best measured performance (latency, jitter, packet loss), enforcing policies such as sending VoIP over the lowest-latency link. Option A does not belong because SD-WAN is a software overlay/control technology and does not provide or install physical layer cabling. Option D does not belong because automatic hardware replacement is a vendor support/logistics function, not a capability of the SD-WAN software itself.

Answer

Built-in physical layer cabling.

Answer

Automatic hardware replacement.

Question 8

An administrator configures an SD-WAN rule that steers Microsoft 365 traffic over the IPsec tunnel 'MPLS-VPN' and sets the rule's 'Priority' to 1. A second SD-WAN rule for the same traffic exists, but its 'Priority' is 10. Which statement accurately describes how FortiOS evaluates these rules?

Accepted Answer

The rule with Priority 1 is evaluated first; if its SLA health check fails, the rule with Priority 10 is evaluated next.. SD-WAN rules are processed in ascending priority order. The rule with the lowest priority number is evaluated first; if its SLA health check fails, FortiOS moves to the next rule. This design provides deterministic failover. The other options misstate the direction of priority or incorrectly describe parallel evaluation, which is not how FortiOS SD-WAN rule processing works.

Answer

Both rules are evaluated simultaneously, and traffic is load-balanced across the tunnels defined in each rule.

Answer

The rule with Priority 1 is applied only if the rule with Priority 10 is disabled or deleted.

Answer

The rule with Priority 10 is evaluated first because a higher numeric value indicates a higher precedence in FortiOS SD-WAN.

Question 9

Where are SD-WAN zones managed in the FortiGate GUI?

Accepted Answer

Network > SD-WAN > SD-WAN Zones.. In FortiGate's GUI, SD-WAN zones are configured under Network > SD-WAN > SD-WAN Zones. This is where administrators create and manage the logical zones that group SD-WAN member interfaces for policy and steering decisions. The SD-WAN Zones page is distinct from the general interface and zone configuration pages.

Answer

Interface > Physical Interfaces.

Answer

System > Network > Zones.

Answer

Firewall > Policy > Objects.

Question 10

An administrator is setting up a new SD-WAN deployment on a FortiGate. They have two interfaces, port1 and port2, that will be part of the SD-WAN. They want to group these interfaces into a single SD-WAN zone named 'virtual-wan-link' to simplify rule configuration. Which step is required before adding the interfaces to the SD-WAN zone?

Accepted Answer

Enable SD-WAN on the FortiGate under System > Feature Visibility.. In FortiOS, the SD-WAN feature is not enabled by default in the GUI. The administrator must first enable it under System > Feature Visibility. After that, they can create an SD-WAN zone and add member interfaces. This step is mandatory regardless of interface type or addressing. Without enabling the feature, the SD-WAN configuration options are unavailable, so the zone cannot be created.

Answer

Assign static IP addresses to both interfaces.

Answer

Create a firewall address object for each interface's subnet.

Answer

Configure each interface as a VLAN subinterface with a unique VLAN ID.

Question 11

If an SD-WAN template contains a reference to an interface that does not exist on a target FortiGate, what occurs during the installation process?

Accepted Answer

The installation fails with a configuration error. When an SD-WAN template references an interface that does not exist on the target FortiGate, the installation process fails with a configuration error. The template cannot be applied because the referenced interface is missing, and FortiManager reports the failure.

Answer

The FortiGate automatically creates a dummy interface

Answer

The installation proceeds and ignores the missing interface

Answer

The FortiGate enters an 'Emergency' state

Question 12

A network administrator is using FortiManager to manage an SD-WAN deployment. They want to create a new SD-WAN template that includes a health check for the 'MPLS' interface. Where in the FortiManager GUI should the administrator navigate to create this template?

Accepted Answer

Policy & Objects > SD-WAN Templates. SD-WAN templates in FortiManager are created under Policy & Objects > SD-WAN Templates. This section provides the interface to define templates that can include SD-WAN interfaces, Performance SLAs, and rules. Once created, these templates can be assigned to policy packages and installed on managed FortiGates, enabling centralized management of SD-WAN configurations across multiple devices.

Answer

FortiView > SD-WAN > Templates

Answer

System Settings > SD-WAN > Template Library

Answer

Device Manager > SD-WAN > Templates

Question 13

Which object must be created before assigning a health check to an SD-WAN service rule in an SD-WAN template?

Accepted Answer

An SD-WAN Health Check. Before assigning a health check to an SD-WAN service rule in an SD-WAN template, you must first create an SD-WAN Health Check object. The health check defines the probe parameters (protocol, interval, failure thresholds) that determine link quality and availability for the service rule.

Answer

A routing protocol

Answer

A firewall address object

Answer

An SD-WAN Zone

Question 14

An SD-WAN rule is configured with the Best Quality strategy and includes two members: WAN1 and WAN2. The Performance SLA for both members is set to monitor latency, jitter, and packet loss. The SLA thresholds are latency 100 ms, jitter 20 ms, and packet loss 1%. Currently, WAN1 has latency 80 ms, jitter 10 ms, and packet loss 0.5%; WAN2 has latency 90 ms, jitter 25 ms, and packet loss 0.2%. Both members are up. Which member will be selected by the Best Quality strategy?

Accepted Answer

WAN1, because it meets all SLA thresholds while WAN2 exceeds the jitter threshold.. The Best Quality strategy selects the member that meets all SLA thresholds and has the best overall quality. WAN1 satisfies latency, jitter, and packet loss thresholds, while WAN2 violates the jitter threshold. Therefore, WAN2 is excluded, and WAN1 is chosen as the only compliant member.

Answer

WAN2, because it has lower packet loss than WAN1, which is the most important metric.

Answer

WAN2, because it has the lowest latency among the members that meet the packet loss threshold.

Answer

Neither member will be selected because both must meet all SLA thresholds for any to be chosen.

Question 15

Which TWO methods can be used to update SD-WAN policies across all managed devices in FortiManager?

Accepted Answer

Using a CLI script to push updates. Option A is correct because FortiManager allows administrators to run CLI scripts (via Script > Scripts, executed with 'Run Script' or as part of a policy package install) that push configuration commands to all managed FortiGates, which can include SD-WAN policy changes. Option B is correct because SD-WAN templates in FortiManager (found under Policy & Objects > SD-WAN Templates or in the SD-WAN Manager) are centralized configuration templates; modifying the template and then installing the changes to the managed devices propagates the updated SD-WAN policies to all devices assigned to that template. Option C is not correct because editing an individual FortiGate policy only affects that single device, not all managed devices. Option D is not correct because creating a new ADOM is an administrative grouping action and does not update SD-WAN policies on existing managed devices. Option E is not correct because rebooting FortiManager does not push or update any SD-WAN policy configuration to managed devices.

Answer

Editing the individual FortiGate policy

Answer

Creating a new ADOM

Answer

Rebooting the FortiManager

Question 16

An administrator is troubleshooting an IPsec VPN tunnel that is part of an SD-WAN zone. The tunnel is up, but SD-WAN health checks are failing, causing the tunnel to be marked as down. The administrator verifies that the Phase 2 selectors include the health check server's IP address. What is the next most likely cause to investigate?

Accepted Answer

The health check server is not reachable via the tunnel due to missing route.. After verifying Phase 2 selectors, the next most likely cause for SD-WAN health check failure on an up tunnel is a missing route to the health check server. Without a route, the probes cannot reach the server, and the health check fails. The other options are either contradicted by the scenario (tunnel up) or less likely given the context. Ensuring proper routing is essential for health checks to traverse the tunnel.

Answer

The tunnel interface is not added to the SD-WAN zone.

Answer

The SD-WAN health check is configured with the wrong protocol (e.g., HTTP instead of ping).

Answer

The IPsec tunnel's Phase 1 proposal does not match the remote gateway.

Question 17

You are building a new SD-WAN template in FortiManager to push to 40 branch FortiGates. The template must define two SD-WAN zones, the member interfaces, and the Performance SLA health checks, but the branch WAN IP addresses differ per site and must not be part of the template. Which FortiManager object type should you use to package the shared SD-WAN configuration?

Accepted Answer

An SD-WAN template in the FortiManager device manager. The SD-WAN template is the FortiManager object designed to normalize SD-WAN zones, member mappings, Performance SLA checks, and rules across many FortiGates. Keeping per-site WAN addressing out of the template is exactly what the normalized object model enables, since interface references resolve on each managed device. A CLI script or an address group cannot provide that reusable, metadata-aware structure.

Answer

A firewall address group object bound to the ADOM

Answer

A normalized interface template with SD-WAN member mappings

Answer

A CLI script template assigned through a policy package

Question 18

An administrator implements BGP over SD-WAN tunnels to a cloud provider. The cloud provider requires BGP MD5 authentication on all peering sessions. Where is BGP MD5 authentication configured on the FortiGate?

Accepted Answer

Under the router bgp neighbor configuration block in the CLI. BGP MD5 authentication is configured per neighbor under the 'config router bgp' → 'config neighbor' block using the 'set password' command. This applies TCP MD5 signature authentication to the BGP peering session, which the cloud provider requires for all peering sessions.

Answer

Within the firewall policy authentication settings

Answer

Under the IPsec phase 1 interface advanced settings

Answer

Inside the SD-WAN health check probe configuration

Question 19

A company uses FortiManager to manage 200 FortiGates with SD-WAN enabled. The administrator needs to update the SD-WAN health check settings for all branches to use a new server IP. The health check is referenced by a single SD-WAN template that is assigned to all branches. After modifying the health check object in FortiManager, what must the administrator do to apply the changes to all FortiGates?

Accepted Answer

Use the 'Install Wizard' to push the updated template to all managed FortiGates.. The correct action is to use the Install Wizard to push the updated template to all managed FortiGates. FortiManager's Install Wizard allows bulk installation of configuration changes, including SD-WAN templates and referenced objects like health checks. After modifying the shared health check, the administrator can select all affected devices and install the changes in a single operation, ensuring all branches receive the update efficiently.

Answer

Install the SD-WAN template on each FortiGate individually.

Answer

Manually edit the SD-WAN configuration on each FortiGate via CLI.

Answer

Reboot each FortiGate to apply the new health check settings.

Question 20

An administrator is creating an SD-WAN template in FortiManager and needs to define the member interfaces. Which FortiManager object is used to group these interfaces for the SD-WAN configuration?

Accepted Answer

SD-WAN zone. In FortiManager, SD-WAN zones are used to group member interfaces within an SD-WAN template. Zones allow policies and rules to reference a logical group rather than individual interfaces, simplifying configuration. The administrator defines zones and assigns interfaces to them. Other objects like address groups or interface groups serve different purposes and are not used for SD-WAN member grouping.

Answer

Virtual WAN link

Answer

Interface group

Answer

Firewall address group