NSE7_SDW Practice Exam 4 — 20 Questions

Question 1

An administrator configures an SD-WAN rule using the 'Volume' strategy across two IPsec tunnels with different bandwidth capacities (Tunnel A: 100 Mbps, Tunnel B: 50 Mbps). How does FortiOS distribute traffic across these members when using the Volume strategy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Traffic is distributed proportionally based on the configured weight or bandwidth ratio of each member interface. The Volume strategy in SD-WAN distributes traffic proportional to the configured volume/weight (bandwidth capacity) of each member interface.

Answer

Traffic is balanced equally (50/50) regardless of interface capacity

Answer

Traffic is sent exclusively over Tunnel A until it reaches 100% packet loss, then fails over to Tunnel B

Answer

Traffic is steered strictly based on real-time latency measured by health checks

Question 2

An administrator is configuring BGP over SD-WAN IPsec tunnels between a headquarters FortiGate and branch FortiGates. Which TWO configuration steps are required to ensure robust and stable dynamic routing over the SD-WAN IPsec tunnels? (Choose two)

Accepted Answer

Configure BGP neighbors using the loopback interface IP addresses or tunnel specific IP addresses rather than physical interface IPs. Robust BGP over SD-WAN requires configuring the BGP router ID, setting up appropriate timers or neighbor relationships, and ensuring that the underlying SD-WAN members and IPsec tunnels allow routing protocol traffic. Additionally, managing BGP timers or enabling graceful restart helps maintain stability during brief IPsec reconnections.

Answer

Set the BGP administrative distance to 255 to disable all routing updates

Answer

Configure static default routes on all BGP neighbors pointing to the null0 interface

Answer

Disable IPsec phase 2 encryption to allow BGP plaintext hello packets to pass through without encapsulation overhead

Question 3

A FortiGate SD-WAN deployment uses a firewall policy with an Intrusion Prevention System (IPS) profile applied. After turning on IPS, administrators notice that throughput over an IPsec SD-WAN tunnel drops significantly. What is the primary reason for this throughput reduction, and how can it be mitigated?

Accepted Answer

IPS inspection requires intensive CPU processing for packet payload analysis, which can be optimized by using flow-based inspection mode and ensuring hardware offloading is active where supported. IPS inspection performs deep packet inspection and signature matching, which is CPU-intensive. While NP6/NP7 hardware offloading accelerates IPsec encryption, full content inspection like IPS typically requires CPU processing unless offloaded or optimized. Using flow-based inspection or hardware offloading settings where supported helps mitigate performance impact.

Answer

IPS requires proxy-based inspection, which permanently disables IPsec hardware acceleration

Answer

IPS blocks all IPsec AH/ESP headers, forcing fallback to unencrypted GRE tunnels

Answer

The IPS database size exceeds the IPsec Phase 2 buffer limit

Question 4

An administrator troubleshoots an ADVPN 2.0 deployment where dynamic shortcut tunnels fail to establish between branch spokes. Which THREE diagnostic steps or log checks should the administrator perform on the FortiGate hub or spoke to isolate the issue? (Choose three)

Accepted Answer

Check 'diagnose vpn tunnel list' to verify if dynamic shortcut child security associations are being created. Troubleshooting ADVPN shortcut failures requires checking IPsec status, IKE exchanges, routing table entries, and network device creation. Valid diagnostic steps include checking IKE daemon output, verifying IPsec tunnel status, and inspecting routing table entries for shortcut triggers.

Answer

Check the firewall policy statistics to ensure SD-WAN rules have zero hit counts globally

Answer

Execute 'execute format disk' to reset the internal flash storage and clear corrupted ADVPN certificates

Question 5

Which TWO of the following can cause an SD-WAN member to be marked as 'down' in an SLA?

Accepted Answer

The probe times out.. An interface is marked down if the probe fails to receive a response or if the response exceeds configured thresholds.

Answer

The system clock is updated.

Answer

The firewall policy is disabled.

Answer

The interface IP address is changed.

Question 6

Which of the following is required to successfully implement SD-WAN?

Accepted Answer

At least two physical interfaces.. At least two interfaces are typically required to make SD-WAN selection meaningful, though one is technically possible.

Answer

A FortiManager instance.

Answer

A subscription to FortiGuard SD-WAN service.

Answer

An external load balancer.

Question 7

You are configuring a Performance SLA to monitor reachability to a SaaS application. Which parameter determines the threshold for an interface to be considered 'unhealthy' in the SD-WAN routing table?

Accepted Answer

Packet Loss Threshold. The 'threshold-alert' or the individual latency/jitter/packet loss thresholds within the Performance SLA configuration dictate when a member is marked failed.

Answer

Probe Mode

Answer

Sequence Number

Answer

Update Interval

Question 8

What is the purpose of the 'Gateway' override in an SD-WAN member configuration?

Accepted Answer

To specify a manual gateway for the SD-WAN member.. The gateway override allows the FortiGate to use a specific IP for the probe that is different from the interface's gateway, or to define a manual gateway where DHCP is used.

Answer

To force the use of a secondary ISP.

Answer

To bypass the firewall policy.

Answer

To enable load balancing.

Question 9

An SD-WAN rule is configured with 'Lowest Cost (SLA)' strategy. If all members in the SLA meet the requirements, how does the FortiGate select the outgoing interface?

Accepted Answer

The member with the lowest interface cost value defined in the SD-WAN member configuration.. In 'Lowest Cost (SLA)' mode, the FortiGate selects the member with the lowest configured cost that meets the SLA requirements.

Answer

Round Robin

Answer

The interface with the highest bandwidth.

Answer

The interface that was most recently added to the zone.

Question 10

Which TWO of the following steps are required to correctly configure a Performance SLA?

Accepted Answer

Select the probe protocol.. To configure an SLA, you must define the destination IP (or server) and the probe protocol.

Answer

Configure a firewall address object for the probe.

Answer

Enable BGP on the interface.

Answer

Assign the probe to a VPN tunnel.

Question 11

Which TWO of the following are necessary to enable SD-WAN on a FortiGate?

Accepted Answer

Creating at least one SD-WAN rule.. SD-WAN is enabled by adding members to an SD-WAN zone and configuring rules.

Answer

Enabling SD-WAN in the Feature Visibility menu.

Answer

Updating the FortiGuard database.

Answer

Configuring a BGP peer.

Question 12

An administrator configures an SD-WAN health check with multiple probes (e.g., ping and HTTP) to monitor a set of IPsec VPN tunnels. Which THREE criteria or settings govern how FortiOS determines whether an SD-WAN member has met or failed the performance SLA? (Choose three)

Accepted Answer

The restoretime parameter, which specifies how many consecutive successful probes are required before restoring a failed member to healthy status. FortiOS SD-WAN health check SLA criteria evaluate packet loss, jitter, latency, and threshold failures. When multiple criteria or probes are used, settings such as latency-threshold, packet-loss-threshold, jitter-threshold, and failtime/restoretime determine state transitions.

Answer

The BGP AS number assigned to the WAN interface gateway

Answer

The physical cable length calculated in meters between the FortiGate and the nearest ISP switch

Question 13

When configuring an SD-WAN rule, what is the purpose of the 'Source' address field?

Accepted Answer

To match traffic based on the source IP or user.. The 'Source' field allows you to selectively apply SD-WAN rules based on specific traffic origins, such as a subnet or user group.

Answer

To define the gateway IP for the route.

Answer

To force traffic to a specific SD-WAN zone.

Answer

To determine which ISP the traffic exits through regardless of SLA.

Question 14

Which THREE of the following are benefits of using SD-WAN?

Accepted Answer

Simplified WAN management through zones.. SD-WAN provides link aggregation, intelligent path selection, and simplified WAN management.

Answer

Built-in physical layer cabling.

Answer

Automatic hardware replacement.

Question 15

You have an SD-WAN rule with 'Priority' strategy. What happens if the highest priority member fails its SLA?

Accepted Answer

Traffic fails over to the member with the next highest priority value.. In 'Priority' strategy, if the highest priority member becomes unhealthy (SLA failure), the traffic automatically fails over to the next highest priority member.

Answer

Traffic is dropped.

Answer

The FortiGate enters an error state.

Answer

Traffic is load balanced across all remaining members.

Question 16

What is the default behavior when all SD-WAN members in a rule fail their SLA?

Accepted Answer

The traffic uses all members.. If all members fail the SLA, the default behavior is that the rule will use all members as if the SLA was met, unless configured otherwise.

Answer

The traffic is routed to the management interface.

Answer

The rule becomes inactive.

Answer

The traffic is dropped.

Question 17

When configuring an SD-WAN rule for a specific application, how does the FortiGate identify the traffic?

Accepted Answer

By using the Application Control database.. The FortiGate uses the Application Control engine or specific destination IP/port objects to classify traffic for SD-WAN rules.

Answer

By analyzing the packet payload size.

Answer

By looking at the source MAC address.

Answer

By forcing traffic through a specific VLAN.

Question 18

Which THREE of the following are parameters that can be monitored in a Performance SLA?

Accepted Answer

Packet Loss. Performance SLAs monitor latency, jitter, and packet loss.

Answer

CPU load

Answer

Disk usage

Question 19

You are deploying a new SD-WAN interface. What is the mandatory step before you can add an interface to an SD-WAN zone?

Accepted Answer

Remove all firewall policy, static route, and DHCP references from the interface.. Before an interface can be added to an SD-WAN zone, it must not have any existing references, such as being used in a firewall policy, static route, or DHCP server configuration.

Answer

Configure a performance SLA for that specific interface.

Answer

Assign a VLAN ID to the interface.

Answer

Enable SD-WAN on the global system settings.

Question 20

Which protocol is NOT a valid option for Performance SLA probes?

Accepted Answer

UDP Broadcast. FortiGate supports ping (ICMP), TCP echo, HTTP, and Two-Way Active Measurement Protocol (TWAMP).

Answer

TCP Echo

Answer

HTTP

Answer

ICMP