NSE7_SDW Practice Exam 3 — 20 Questions

Question 1

Which TWO of the following can be used as a 'Source' in an SD-WAN rule?

Accepted Answer

Source IP address object.. In an SD-WAN rule, the Source field matches traffic by the origin of the flow, and a Source IP address object (Option A) is a valid match criterion because SD-WAN rules can select traffic based on source address objects defined in the firewall address book. A User group (Option E) is also valid as a Source, since FortiGate SD-WAN rules can match traffic by authenticated user or user group identity, allowing policy-based steering per user population. SLA target name (Option B) is not a source match; it is a performance SLA object referenced in the rule's outgoing interface/strategy configuration to measure link health. Interface MAC address (Option C) is not a supported Source match criterion in SD-WAN rules, and Firewall policy ID (Option D) is not a source selector either, as policy IDs identify firewall policies rather than traffic origin.

Answer

SLA target name.

Answer

Interface MAC address.

Answer

Firewall policy ID.

Question 2

What is the impact of checking the 'Interface Preference' box in an SD-WAN rule?

Accepted Answer

It overrides the SLA strategy selection.. In Fortinet SD-WAN, the 'Interface Preference' option in an SD-WAN rule forces traffic to use a specific preferred interface (or set of interfaces) regardless of what the SLA strategy would otherwise select. This effectively overrides the SLA-based path selection, ensuring the rule's traffic egresses through the chosen member(s) even if another member has better SLA scores. It is used when business policy requires a specific WAN link for certain applications.

Answer

It enables failover to the default gateway.

Answer

It enables load balancing across interfaces.

Answer

It increases the probe frequency.

Question 3

You are configuring a Performance SLA to monitor reachability to a SaaS application. Which parameter determines the threshold for an interface to be considered 'unhealthy' in the SD-WAN routing table?

Accepted Answer

Packet Loss Threshold. The Packet Loss Threshold is one of the SLA criteria (along with latency and jitter) that determines when a member is marked unhealthy in the SD-WAN routing table. When the measured packet loss exceeds the configured threshold, the Performance SLA marks that member as out-of-SLA, and SD-WAN rules that require SLA compliance will stop selecting it. This is the parameter that directly defines the 'unhealthy' boundary for loss-based SLA evaluation.

Answer

Probe Mode

Answer

Sequence Number

Answer

Update Interval

Question 4

When creating an SD-WAN template, what must be defined before you can add an SD-WAN interface to the template?

Accepted Answer

Individual SD-WAN member interfaces. Before you can add an SD-WAN interface to an SD-WAN template in FortiManager, you must first define the individual SD-WAN member interfaces (the physical or logical links that will participate in SD-WAN). The template's SD-WAN interface object is built on top of these member interfaces, so they are the prerequisite.

Answer

The SD-WAN health check probes

Answer

Global firewall policies

Answer

The virtual domain (VDOM) settings

Question 5

A company has an SD-WAN template in FortiManager that is assigned to 50 FortiGates. The template includes a health check object named 'HC1' that monitors a server at 10.0.0.1. The administrator modifies 'HC1' to monitor 10.0.0.2 instead. After the change, the administrator notices that some FortiGates still show the old server IP in their running configuration. What is the most likely reason for this discrepancy?

Accepted Answer

The FortiGates with the old IP have not had the updated template installed yet.. The most likely reason is that the FortiGates with the old IP have not had the updated template installed. Modifying a health check object in FortiManager updates the configuration in the database, but the changes are not automatically pushed to managed devices. An install operation is required to apply the changes. If some devices were offline or excluded from the last install, they would retain the old configuration.

Answer

The FortiGates are using a cached version of the health check and need to be rebooted.

Answer

The health check object is locked and cannot be modified.

Answer

The health check object is not referenced correctly in the SD-WAN template.

Question 6

Which interface can be used as an SD-WAN member in an SD-WAN template?

Accepted Answer

Physical ports, VLANs, and VPN tunnels. In an SD-WAN template on FortiManager, SD-WAN members can be physical ports, VLAN interfaces, and VPN tunnels (including IPsec and ADVPN tunnels). This flexibility allows branches to use whatever WAN transport is available — a physical DSL port, a VLAN-tagged fiber connection, or an IPsec tunnel over the internet — as an SD-WAN member. The template abstracts these into SD-WAN zones and members for centralized management.

Answer

Only WAN physical ports

Answer

Only VLANs

Answer

Only loopback interfaces

Question 7

You have an SD-WAN rule with 'Priority' strategy. What happens if the highest priority member fails its SLA?

Accepted Answer

Traffic fails over to the member with the next highest priority value.. In an SD-WAN rule using the Priority strategy, members are ranked by priority value (lower number = higher priority). If the highest-priority member fails its SLA, FortiOS fails over to the next highest-priority member that is still SLA-compliant, preserving service continuity.

Answer

Traffic is dropped.

Answer

The FortiGate enters an error state.

Answer

Traffic is load balanced across all remaining members.

Question 8

You are configuring an SD-WAN rule that uses the 'lowest-cost (SLA)' strategy. You have three members: wan1 (cost 10), wan2 (cost 20), and wan3 (cost 30). All have Performance SLAs configured. Currently, wan1 and wan2 meet their SLAs, but wan3 does not. Which member will be selected for traffic matching this rule?

Accepted Answer

wan1, because it has the lowest cost and meets the SLA.. With lowest-cost (SLA) strategy, the FortiGate selects the member with the lowest cost that also meets its Performance SLA. wan1 has the lowest cost and meets SLA, so it is chosen. wan2 meets SLA but has a higher cost, and wan3 fails SLA so it is excluded. The rule does not require all members to meet SLA; it only needs at least one eligible member.

Answer

wan3, because it has the highest cost and thus the highest priority.

Answer

No member, because wan3 fails its SLA and the rule requires all members to meet SLA.

Answer

wan2, because it has the next lowest cost after wan1.

Question 9

You are configuring SD-WAN templates in FortiManager. What is the primary purpose of using SD-WAN Central Management instead of configuring SD-WAN directly on individual FortiGates?

Accepted Answer

To enable SD-WAN template inheritance and synchronized policy updates across multiple managed devices. SD-WAN Central Management in FortiManager enables the use of SD-WAN templates that can be inherited by multiple FortiGates, ensuring consistent configuration and synchronized policy updates across the managed estate. This centralizes control, reduces configuration drift, and simplifies large-scale deployments. The primary purpose is to achieve scalable, template-driven management rather than per-device manual configuration.

Answer

To perform local traffic analysis on the FortiGate only

Answer

To allow FortiGates to manage their own SD-WAN interfaces independently

Answer

To bypass the need for ADOMs

Question 10

An enterprise deploys BGP over SD-WAN with multiple MPLS and broadband connections. A route-map is applied to incoming BGP updates on the FortiGate to set a specific weight for routes learned over the MPLS interface. Why is the 'weight' attribute particularly effective in this FortiOS SD-WAN and BGP integration scenario?

Accepted Answer

Weight is evaluated first in the BGP best-path selection algorithm on FortiOS, allowing local preference override without altering global AS path attributes. In FortiOS BGP, the weight attribute is evaluated first in the best-path selection algorithm, before local preference and other attributes. Setting a higher weight on routes learned from the MPLS interface makes those routes preferred locally without affecting other routers, since weight is local to the FortiGate and not propagated in BGP updates. This allows granular, per-device control in an SD-WAN environment.

Answer

Weight replaces the need for SD-WAN SLA rules by performing layer 7 packet inspection

Answer

Weight automatically adjusts the SD-WAN health check probe frequency based on route stability

Answer

Weight is propagated to all iBGP peers, ensuring cluster-wide path synchronization

Question 11

An administrator is creating an SD-WAN template in FortiManager to be applied to multiple FortiGate devices. The administrator wants to ensure that the template can be reused across devices with different WAN interface names. Which configuration element in the SD-WAN template allows the use of variables for interface names?

Accepted Answer

Dynamic interface mapping. Dynamic interface mapping in FortiManager SD-WAN templates uses metadata variables to represent interface names, which are resolved per device during installation. This allows a single template to be reused across FortiGates with different interface naming schemes. The other options involve static configuration that would not adapt automatically, making them unsuitable for this requirement.

Answer

Interface role assignment

Answer

Static interface selection

Answer

SD-WAN zone configuration

Question 12

A network administrator is troubleshooting an SD-WAN deployment managed by FortiManager. The administrator notices that after installing an SD-WAN template, some FortiGates are not using the expected health check server. The administrator verifies that the template is correctly configured with the health check server IP. What is the most likely cause for the discrepancy?

Accepted Answer

The health check server IP is overridden by a per-device setting or metadata variable.. Per-device overrides or metadata variables in FortiManager can supersede template settings, including health check server IPs. If a device has a specific value defined, it will use that instead of the template's value. This is the most likely reason for the observed discrepancy. The other options do not directly explain why a different server IP would be used while the template is correct.

Answer

The health check server IP is not reachable from the FortiGates.

Answer

The FortiGates are running an older FortiOS version that does not support the configured health check protocol.

Answer

The SD-WAN template was not installed on those FortiGates.

Question 13

When viewing the SD-WAN Monitor in FortiManager, what information is provided for the 'Health Check' status?

Accepted Answer

Latency, jitter, and packet loss metrics. The SD-WAN Monitor's Health Check status is built from the SLA probe results that FortiGates send for each member link. These probes measure latency, jitter, and packet loss, which are the exact metrics displayed for each health-check entry. This lets administrators see in real time whether a link meets the SLA thresholds defined in the SD-WAN rules.

Answer

The firmware version of the device

Answer

The number of active users

Answer

The current IP address of the interface

Question 14

You have a large SD-WAN deployment. Why would you use a 'Centralized Policy' in FortiManager instead of local policies?

Accepted Answer

To enforce global security and traffic routing policies consistently across multiple sites. Centralized policies in FortiManager let administrators define security and SD-WAN traffic routing rules once and push them consistently to many managed FortiGates, ensuring uniform enforcement across a large deployment. This is essential in SD-WAN environments where inconsistent per-device policies cause routing asymmetry, security gaps, and configuration drift. Centralized policy also supports provisioning templates and policy packages that scale to hundreds of sites.

Answer

To eliminate the need for logs

Answer

To reduce the CPU load on the FortiGate

Answer

To allow local admins to override global policies

Question 15

An administrator is configuring an SD-WAN template in FortiManager. The template includes multiple health checks that monitor the performance of different WAN links. The administrator wants to ensure that if a health check fails, the SD-WAN rule automatically redirects traffic to another member. Which component of the SD-WAN template is responsible for defining the action taken when a health check fails?

Accepted Answer

SD-WAN Rule. In an SD-WAN template, the SD-WAN rule is the component that specifies how traffic is handled, including the action to take when a health check fails. It references the Performance SLA to determine link status and then applies the configured strategy to redirect traffic to a healthy member, ensuring continuity.

Answer

Performance SLA

Answer

SD-WAN Zone

Answer

SD-WAN Member

Question 16

A network engineer is configuring an SD-WAN template in FortiManager. They want to define a performance SLA that monitors the quality of two WAN links using HTTP probes to a specific server. Which FortiManager object should they configure to define the HTTP probe parameters?

Accepted Answer

SD-WAN Health Check. To define HTTP probe parameters for a performance SLA, you configure an SD-WAN Health Check object in FortiManager. This object allows you to specify the protocol, target, interval, and other settings. It is then referenced in SD-WAN rules to make routing decisions based on link quality.

Answer

Firewall Address

Answer

SD-WAN Zone

Answer

SD-WAN Rule

Question 17

A network administrator is using FortiManager to manage a large SD-WAN deployment. They need to create a new SD-WAN template that will be applied to multiple FortiGates. The administrator wants to ensure that the template can be easily modified in the future without having to manually update each device. Which FortiManager object should they use to define the SD-WAN template?

Accepted Answer

SD-WAN Template. The SD-WAN Template object in FortiManager is the correct choice because it is specifically designed for centralized SD-WAN configuration management. It allows the administrator to define SD-WAN settings once and apply them to multiple FortiGates, ensuring consistency and simplifying future modifications. Other objects like Policy Packages or Provisioning Templates serve different purposes and cannot manage SD-WAN templates directly.

Answer

Policy Package

Answer

Provisioning Template

Answer

Device Group

Question 18

An administrator is using FortiManager 7.2 to manage SD-WAN templates across 150 FortiGates. They need to ensure that when a template is updated, the changes are propagated efficiently and that the FortiGates maintain high availability. The administrator wants to use the 'Install Wizard' to push the updated template. Which two statements are true about installing an SD-WAN template with the Install Wizard in this scenario? (Choose two.)

Accepted Answer

The Install Wizard automatically creates a revision history entry for each FortiGate after a successful template installation, allowing rollback if needed.. The Install Wizard in FortiManager supports phased rollouts by allowing selection of specific FortiGates within an ADOM, and it automatically records revision history for each device after a successful installation. These features enable efficient, controlled updates across large SD-WAN deployments while providing rollback capabilities. The wizard does not operate across ADOMs in a single operation, nor does it require devices to be offline, and it can install individual templates rather than only full policy packages.

Answer

The Install Wizard can only install the entire policy package, not just the SD-WAN template, when multiple FortiGates are selected.

Answer

The Install Wizard can push the updated SD-WAN template to all managed FortiGates simultaneously, regardless of their ADOM membership.

Answer

The Install Wizard requires that all FortiGates be offline before installing an SD-WAN template to prevent configuration conflicts.

Question 19

An administrator is using FortiManager to manage an SD-WAN deployment with 80 FortiGates. The SD-WAN template includes a health check that pings the destination '8.8.8.8' every 500ms. The administrator notices that some branches have high latency to that destination, causing unnecessary failovers. The administrator wants to change the health check destination to a regional server with lower latency for each branch. However, the branches are in different geographic regions. What is the most efficient way to customize the health check destination per region without creating multiple templates?

Accepted Answer

Use metadata variables in the SD-WAN template to define the health check destination per device.. Metadata variables in SD-WAN templates enable per-device customization without creating multiple templates. By defining a variable for the health check destination and assigning values based on region, the administrator can maintain a single template that adapts to each branch. This approach is efficient, scalable, and consistent with FortiManager best practices. Other methods like multiple templates, local modifications, or CLI scripts introduce complexity, drift, or administrative overhead.

Answer

Use a CLI script to change the health check destination on all devices at once.

Answer

Create a separate SD-WAN template for each region and assign devices accordingly.

Answer

Modify the health check on each FortiGate locally after template installation.

Question 20

An administrator needs to deploy an SD-WAN template to a FortiGate that has two WAN interfaces: wan1 and wan2. The template includes an SD-WAN rule that load-balances traffic across both interfaces. During installation, the administrator receives an error that the interface mapping is incomplete. What is the most likely cause?

Accepted Answer

The administrator did not map the template's SD-WAN member interfaces to the FortiGate's physical interfaces.. The error indicates that the template's interface mapping is incomplete. In FortiManager, SD-WAN templates require that each abstract interface in the template be mapped to a physical interface on the target FortiGate. If the administrator fails to perform this mapping, the installation cannot proceed.

Answer

The FortiGate does not have the required firmware version to support SD-WAN templates.

Answer

The SD-WAN template does not include a health check for both interfaces.

Answer

The SD-WAN rule is configured to use dynamic mapping instead of static mapping.