NSE7_SDW Practice Exam 3 — 20 Questions

Question 1

How can you verify that an SD-WAN configuration change was successfully applied to a FortiGate via FortiManager?

Accepted Answer

By checking the Device Manager installation status. The 'Installation' task status in the Task Monitor will show 'Success', and the device configuration history will show the synchronized state.

Answer

By checking the FortiAnalyzer logs

Answer

By restarting the FortiGate

Answer

By viewing the system dashboard of the FortiGate locally

Question 2

What happens if you modify an SD-WAN template that is already applied to a FortiGate?

Accepted Answer

The configuration status shows 'Modified' and requires an installation task. The change creates a configuration difference, which must be pushed to the device to take effect.

Answer

The changes take effect immediately without a push

Answer

The FortiGate automatically pulls the new config

Answer

The FortiGate configuration is reverted

Question 3

Which TWO of these are valid SD-WAN health check protocols?

Accepted Answer

HTTP. FortiGate SD-WAN supports multiple probes, including HTTP, Ping, and DNS, to verify link health.

Answer

SSH

Answer

FTP

Answer

SNMP

Question 4

In SD-WAN central management, what is the 'SD-WAN Zone' used for?

Accepted Answer

To group multiple SD-WAN members for logical policy routing. SD-WAN zones allow you to group multiple physical interfaces into a logical container for easier policy management.

Answer

To define the physical port speed

Answer

To limit bandwidth for specific users

Answer

To isolate the SD-WAN traffic from the WAN

Question 5

You have a large SD-WAN deployment. Why would you use a 'Centralized Policy' in FortiManager instead of local policies?

Accepted Answer

To enforce global security and traffic routing policies consistently across multiple sites. Centralized policy packages allow you to enforce security and SD-WAN routing rules consistently across the entire organization from one location.

Answer

To eliminate the need for logs

Answer

To reduce the CPU load on the FortiGate

Answer

To allow local admins to override global policies

Question 6

You are configuring SD-WAN templates in FortiManager. What is the primary purpose of using SD-WAN Central Management instead of configuring SD-WAN directly on individual FortiGates?

Accepted Answer

To enable SD-WAN template inheritance and synchronized policy updates across multiple managed devices. Central management enables consistent SD-WAN policy deployment, simplified configuration management across large-scale deployments, and centralized monitoring.

Answer

To perform local traffic analysis on the FortiGate only

Answer

To allow FortiGates to manage their own SD-WAN interfaces independently

Answer

To bypass the need for ADOMs

Question 7

If you modify a shared SD-WAN health check object that is referenced by ten different templates, what happens to the FortiGates?

Accepted Answer

All FortiGates using those templates will be affected after an install. The change affects all templates referencing that object; once pushed, the changes update the health check settings on all associated FortiGates.

Answer

The FortiGates will automatically revert to the old settings

Answer

The health check will be disabled on all devices

Answer

Only the templates are updated, not the FortiGates

Question 8

Which TWO of the following are benefits of using SD-WAN templates in FortiManager?

Accepted Answer

Consistent SD-WAN policy application across devices. Templates provide standardized configurations and reduce the administrative burden by avoiding per-device manual settings.

Answer

Automatic firmware upgrades

Answer

Automated log analysis

Answer

Direct access to the FortiGate CLI

Question 9

Which THREE tasks are required to successfully deploy SD-WAN via FortiManager?

Accepted Answer

Installing the configuration to the devices. Deployment requires defining the template, assigning it to devices, and installing the configuration.

Answer

Performing a hard factory reset on the FortiGate

Answer

Deleting all existing firewall policies

Question 10

Which TWO items must be configured within an SD-WAN template for SD-WAN traffic steering to work?

Accepted Answer

SD-WAN Members. You must define the members (interfaces) and the rules (policies) that dictate how traffic is steered.

Answer

DHCP server settings

Answer

VLAN tagging

Answer

Local users

Question 11

Which THREE pieces of information are displayed in the SD-WAN Monitor in FortiManager?

Accepted Answer

Status of SD-WAN members. The SD-WAN monitor provides visibility into the health of probes, the interface bandwidth, and the overall performance of the SD-WAN links.

Answer

System temperature of the FortiGate

Answer

The current username of the logged-in admin

Question 12

Which TWO methods can be used to update SD-WAN policies across all managed devices in FortiManager?

Accepted Answer

Using a CLI script to push updates. Updates are performed by modifying the template and then pushing the updated configuration to the devices.

Answer

Editing the individual FortiGate policy

Answer

Creating a new ADOM

Answer

Rebooting the FortiManager

Question 13

An administrator is configuring SD-WAN rules with performance SLAs. Which TWO strategies are available in FortiOS when configuring an SD-WAN rule based on SLA metrics? (Choose two)

Accepted Answer

Lowest Cost (SLA). FortiOS SD-WAN rule strategies include Lowest Cost (SLA), Max Bandwidth, Service-ID, Volume, and Priority. Among these, Priority and Lowest Cost (SLA) are standard strategy options utilizing SLA performance metrics.

Answer

Round-Robin DNS Load Balancing

Answer

Dynamic BGP AS-Prepending

Answer

Static Flow-Hashing

Question 14

When using SD-WAN zones, what is the primary benefit of grouping multiple physical interfaces into a single zone?

Accepted Answer

It allows you to apply a single firewall policy to the entire group.. Zones allow you to reference a group of interfaces in a single firewall policy, simplifying the configuration.

Answer

It increases the throughput of individual physical links.

Answer

It prevents the need for performance SLAs.

Answer

It automatically enables load balancing between interfaces.

Question 15

An enterprise deploys BGP over SD-WAN with multiple MPLS and broadband connections. A route-map is applied to incoming BGP updates on the FortiGate to set a specific weight for routes learned over the MPLS interface. Why is the 'weight' attribute particularly effective in this FortiOS SD-WAN and BGP integration scenario?

Accepted Answer

Weight is evaluated first in the BGP best-path selection algorithm on FortiOS, allowing local preference override without altering global AS path attributes. Weight is a Cisco/FortiOS-specific BGP attribute that is local to the router on which it is configured. It is evaluated first in the BGP best-path selection algorithm, allowing administrators to deterministically force traffic out of a specific SD-WAN/BGP member without affecting other routers in the AS.

Answer

Weight replaces the need for SD-WAN SLA rules by performing layer 7 packet inspection

Answer

Weight automatically adjusts the SD-WAN health check probe frequency based on route stability

Answer

Weight is propagated to all iBGP peers, ensuring cluster-wide path synchronization

Question 16

An administrator configures an ADVPN 2.0 deployment between a FortiGate hub and multiple spokes using OSPF as the dynamic routing protocol. The spoke units need to establish direct shortcut tunnels dynamically. Which configuration step is mandatory on the hub to ensure that BGP or OSPF next-hop resolution works correctly for ADVPN shortcut creation?

Accepted Answer

Disable next-hop-self on the hub's BGP neighbor configuration or adjust OSPF interface settings so the advertising router is not forced as the next hop. In ADVPN environments running dynamic routing protocols like OSPF or BGP, network-object settings or interface settings such as setting the route-map or disabling next-hop-self on the hub allow spokes to properly resolve shortcut routes. Specifically, modifying the BGP next-hop or OSPF next-hop behavior ensures traffic is steered directly to the requesting spoke's IP rather than looping back through the hub.

Answer

Enable split-horizon globally within the OSPF routing process

Answer

Enable exchange-interface in the hub's OSPF interface configuration

Answer

Configure a static blackhole route for all spoke subnets on the hub

Question 17

An administrator wants to view the active SD-WAN rule hit counts and verify which traffic is matching a specific SD-WAN rule in FortiOS. Which command should be used?

Accepted Answer

diagnose sys sdwan service. To view runtime statistics and hit counts for SD-WAN rules, the command 'diagnose sys sdwan service' is used.

Answer

show system sdwan

Answer

execute router clear sdwan cache

Answer

get firewall policy statistics

Question 18

Which SD-WAN rule strategy should you choose if you want to distribute traffic across multiple interfaces based on their bandwidth weights?

Accepted Answer

Maximize Bandwidth (SLA). The 'Maximize Bandwidth' strategy allows traffic distribution based on the configured bandwidth weight for each interface.

Answer

Manual

Answer

Lowest Cost (SLA)

Answer

SLA Target

Question 19

What is the maximum number of members allowed in a single SD-WAN zone?

Accepted Answer

Depends on the model, but generally limited by system resources.. FortiOS supports a large number of members per zone, typically limited only by the hardware model's scale, not a low fixed number.

Answer

8

Answer

2

Answer

4

Question 20

When configuring an SD-WAN health check to monitor internet reachability using HTTP/HTTPS requests, which parameter defines the specific string the FortiGate expects to receive in the server response body to validate that the path is healthy?

Accepted Answer

http-match. In SD-WAN health check (ping, tcp-echo, http, dns), when HTTP is selected as the server-type, administrators can configure a 'security-string' or 'http-match' / 'expect' string to validate the HTTP response body.

Answer

probe-packet-size

Answer

sla-break-time

Answer

server-response-timeout