NSE7_SDW Practice Test 2 — 25 Questions

Question 1

You are configuring an SD-WAN rule to route business-critical traffic. You want to ensure that the rule uses the best available link based on performance SLAs, and that it can fail over to a secondary link if the primary link's SLA is violated. Which two configuration elements are required to achieve this? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the rule's strategy to 'SLA' and specify the SLA targets.. To route based on SLA and fail over when the SLA is violated, you must configure Performance SLAs on the members and use the 'SLA' strategy in the rule, specifying the SLA targets. This enables the rule to monitor link health and switch to a secondary link when the primary fails to meet the SLA.

Answer

Configure a static route with equal distance for both WAN links.

Answer

Set the rule's strategy to 'Lowest Cost' and assign costs to each member.

Answer

Enable 'Link Health Monitor' on the SD-WAN zone.

Question 2

Which THREE of the following are benefits of using SD-WAN?

Accepted Answer

Simplified WAN management through zones.. Option B is correct because SD-WAN controllers abstract WAN transport links into logical zones (e.g., VPN zones, service zones), letting administrators apply consistent policy and routing across many sites from a single management plane instead of configuring each device individually. Option C is correct because SD-WAN continuously monitors link health (via BFD, IP SLA, or similar probes) and automatically reroutes traffic to a backup WAN link—LTE, broadband, or MPLS—when the primary link degrades or fails, without manual intervention. Option E is correct because SD-WAN's application-aware routing engine classifies traffic by application and steers it over the path with the best measured performance (latency, jitter, packet loss), enforcing policies such as sending VoIP over the lowest-latency link. Option A does not belong because SD-WAN is a software overlay/control technology and does not provide or install physical layer cabling. Option D does not belong because automatic hardware replacement is a vendor support/logistics function, not a capability of the SD-WAN software itself.

Answer

Built-in physical layer cabling.

Answer

Automatic hardware replacement.

Question 3

An administrator configures an SD-WAN rule that steers Microsoft 365 traffic over the IPsec tunnel 'MPLS-VPN' and sets the rule's 'Priority' to 1. A second SD-WAN rule for the same traffic exists, but its 'Priority' is 10. Which statement accurately describes how FortiOS evaluates these rules?

Accepted Answer

The rule with Priority 1 is evaluated first; if its SLA health check fails, the rule with Priority 10 is evaluated next.. SD-WAN rules are processed in ascending priority order. The rule with the lowest priority number is evaluated first; if its SLA health check fails, FortiOS moves to the next rule. This design provides deterministic failover. The other options misstate the direction of priority or incorrectly describe parallel evaluation, which is not how FortiOS SD-WAN rule processing works.

Answer

Both rules are evaluated simultaneously, and traffic is load-balanced across the tunnels defined in each rule.

Answer

The rule with Priority 1 is applied only if the rule with Priority 10 is disabled or deleted.

Answer

The rule with Priority 10 is evaluated first because a higher numeric value indicates a higher precedence in FortiOS SD-WAN.

Question 4

Where are SD-WAN zones managed in the FortiGate GUI?

Accepted Answer

Network > SD-WAN > SD-WAN Zones.. In FortiGate's GUI, SD-WAN zones are configured under Network > SD-WAN > SD-WAN Zones. This is where administrators create and manage the logical zones that group SD-WAN member interfaces for policy and steering decisions. The SD-WAN Zones page is distinct from the general interface and zone configuration pages.

Answer

Interface > Physical Interfaces.

Answer

System > Network > Zones.

Answer

Firewall > Policy > Objects.

Question 5

An administrator is setting up a new SD-WAN deployment on a FortiGate. They have two interfaces, port1 and port2, that will be part of the SD-WAN. They want to group these interfaces into a single SD-WAN zone named 'virtual-wan-link' to simplify rule configuration. Which step is required before adding the interfaces to the SD-WAN zone?

Accepted Answer

Enable SD-WAN on the FortiGate under System > Feature Visibility.. In FortiOS, the SD-WAN feature is not enabled by default in the GUI. The administrator must first enable it under System > Feature Visibility. After that, they can create an SD-WAN zone and add member interfaces. This step is mandatory regardless of interface type or addressing. Without enabling the feature, the SD-WAN configuration options are unavailable, so the zone cannot be created.

Answer

Assign static IP addresses to both interfaces.

Answer

Create a firewall address object for each interface's subnet.

Answer

Configure each interface as a VLAN subinterface with a unique VLAN ID.

Question 6

If an SD-WAN template contains a reference to an interface that does not exist on a target FortiGate, what occurs during the installation process?

Accepted Answer

The installation fails with a configuration error. When an SD-WAN template references an interface that does not exist on the target FortiGate, the installation process fails with a configuration error. The template cannot be applied because the referenced interface is missing, and FortiManager reports the failure.

Answer

The FortiGate automatically creates a dummy interface

Answer

The installation proceeds and ignores the missing interface

Answer

The FortiGate enters an 'Emergency' state

Question 7

A network administrator is using FortiManager to manage an SD-WAN deployment. They want to create a new SD-WAN template that includes a health check for the 'MPLS' interface. Where in the FortiManager GUI should the administrator navigate to create this template?

Accepted Answer

Policy & Objects > SD-WAN Templates. SD-WAN templates in FortiManager are created under Policy & Objects > SD-WAN Templates. This section provides the interface to define templates that can include SD-WAN interfaces, Performance SLAs, and rules. Once created, these templates can be assigned to policy packages and installed on managed FortiGates, enabling centralized management of SD-WAN configurations across multiple devices.

Answer

FortiView > SD-WAN > Templates

Answer

System Settings > SD-WAN > Template Library

Answer

Device Manager > SD-WAN > Templates

Question 8

Which object must be created before assigning a health check to an SD-WAN service rule in an SD-WAN template?

Accepted Answer

An SD-WAN Health Check. Before assigning a health check to an SD-WAN service rule in an SD-WAN template, you must first create an SD-WAN Health Check object. The health check defines the probe parameters (protocol, interval, failure thresholds) that determine link quality and availability for the service rule.

Answer

A routing protocol

Answer

A firewall address object

Answer

An SD-WAN Zone

Question 9

An SD-WAN rule is configured with the Best Quality strategy and includes two members: WAN1 and WAN2. The Performance SLA for both members is set to monitor latency, jitter, and packet loss. The SLA thresholds are latency 100 ms, jitter 20 ms, and packet loss 1%. Currently, WAN1 has latency 80 ms, jitter 10 ms, and packet loss 0.5%; WAN2 has latency 90 ms, jitter 25 ms, and packet loss 0.2%. Both members are up. Which member will be selected by the Best Quality strategy?

Accepted Answer

WAN1, because it meets all SLA thresholds while WAN2 exceeds the jitter threshold.. The Best Quality strategy selects the member that meets all SLA thresholds and has the best overall quality. WAN1 satisfies latency, jitter, and packet loss thresholds, while WAN2 violates the jitter threshold. Therefore, WAN2 is excluded, and WAN1 is chosen as the only compliant member.

Answer

WAN2, because it has lower packet loss than WAN1, which is the most important metric.

Answer

WAN2, because it has the lowest latency among the members that meet the packet loss threshold.

Answer

Neither member will be selected because both must meet all SLA thresholds for any to be chosen.

Question 10

Which TWO methods can be used to update SD-WAN policies across all managed devices in FortiManager?

Accepted Answer

Using a CLI script to push updates. Option A is correct because FortiManager allows administrators to run CLI scripts (via Script > Scripts, executed with 'Run Script' or as part of a policy package install) that push configuration commands to all managed FortiGates, which can include SD-WAN policy changes. Option B is correct because SD-WAN templates in FortiManager (found under Policy & Objects > SD-WAN Templates or in the SD-WAN Manager) are centralized configuration templates; modifying the template and then installing the changes to the managed devices propagates the updated SD-WAN policies to all devices assigned to that template. Option C is not correct because editing an individual FortiGate policy only affects that single device, not all managed devices. Option D is not correct because creating a new ADOM is an administrative grouping action and does not update SD-WAN policies on existing managed devices. Option E is not correct because rebooting FortiManager does not push or update any SD-WAN policy configuration to managed devices.

Answer

Editing the individual FortiGate policy

Answer

Creating a new ADOM

Answer

Rebooting the FortiManager

Question 11

An administrator is troubleshooting an IPsec VPN tunnel that is part of an SD-WAN zone. The tunnel is up, but SD-WAN health checks are failing, causing the tunnel to be marked as down. The administrator verifies that the Phase 2 selectors include the health check server's IP address. What is the next most likely cause to investigate?

Accepted Answer

The health check server is not reachable via the tunnel due to missing route.. After verifying Phase 2 selectors, the next most likely cause for SD-WAN health check failure on an up tunnel is a missing route to the health check server. Without a route, the probes cannot reach the server, and the health check fails. The other options are either contradicted by the scenario (tunnel up) or less likely given the context. Ensuring proper routing is essential for health checks to traverse the tunnel.

Answer

The tunnel interface is not added to the SD-WAN zone.

Answer

The SD-WAN health check is configured with the wrong protocol (e.g., HTTP instead of ping).

Answer

The IPsec tunnel's Phase 1 proposal does not match the remote gateway.

Question 12

You are building a new SD-WAN template in FortiManager to push to 40 branch FortiGates. The template must define two SD-WAN zones, the member interfaces, and the Performance SLA health checks, but the branch WAN IP addresses differ per site and must not be part of the template. Which FortiManager object type should you use to package the shared SD-WAN configuration?

Accepted Answer

An SD-WAN template in the FortiManager device manager. The SD-WAN template is the FortiManager object designed to normalize SD-WAN zones, member mappings, Performance SLA checks, and rules across many FortiGates. Keeping per-site WAN addressing out of the template is exactly what the normalized object model enables, since interface references resolve on each managed device. A CLI script or an address group cannot provide that reusable, metadata-aware structure.

Answer

A firewall address group object bound to the ADOM

Answer

A normalized interface template with SD-WAN member mappings

Answer

A CLI script template assigned through a policy package

Question 13

An administrator implements BGP over SD-WAN tunnels to a cloud provider. The cloud provider requires BGP MD5 authentication on all peering sessions. Where is BGP MD5 authentication configured on the FortiGate?

Accepted Answer

Under the router bgp neighbor configuration block in the CLI. BGP MD5 authentication is configured per neighbor under the 'config router bgp' → 'config neighbor' block using the 'set password' command. This applies TCP MD5 signature authentication to the BGP peering session, which the cloud provider requires for all peering sessions.

Answer

Within the firewall policy authentication settings

Answer

Under the IPsec phase 1 interface advanced settings

Answer

Inside the SD-WAN health check probe configuration

Question 14

A company uses FortiManager to manage 200 FortiGates with SD-WAN enabled. The administrator needs to update the SD-WAN health check settings for all branches to use a new server IP. The health check is referenced by a single SD-WAN template that is assigned to all branches. After modifying the health check object in FortiManager, what must the administrator do to apply the changes to all FortiGates?

Accepted Answer

Use the 'Install Wizard' to push the updated template to all managed FortiGates.. The correct action is to use the Install Wizard to push the updated template to all managed FortiGates. FortiManager's Install Wizard allows bulk installation of configuration changes, including SD-WAN templates and referenced objects like health checks. After modifying the shared health check, the administrator can select all affected devices and install the changes in a single operation, ensuring all branches receive the update efficiently.

Answer

Install the SD-WAN template on each FortiGate individually.

Answer

Manually edit the SD-WAN configuration on each FortiGate via CLI.

Answer

Reboot each FortiGate to apply the new health check settings.

Question 15

An administrator is creating an SD-WAN template in FortiManager and needs to define the member interfaces. Which FortiManager object is used to group these interfaces for the SD-WAN configuration?

Accepted Answer

SD-WAN zone. In FortiManager, SD-WAN zones are used to group member interfaces within an SD-WAN template. Zones allow policies and rules to reference a logical group rather than individual interfaces, simplifying configuration. The administrator defines zones and assigns interfaces to them. Other objects like address groups or interface groups serve different purposes and are not used for SD-WAN member grouping.

Answer

Virtual WAN link

Answer

Interface group

Answer

Firewall address group

Question 16

Which TWO of the following can be used as a 'Source' in an SD-WAN rule?

Accepted Answer

Source IP address object.. In an SD-WAN rule, the Source field matches traffic by the origin of the flow, and a Source IP address object (Option A) is a valid match criterion because SD-WAN rules can select traffic based on source address objects defined in the firewall address book. A User group (Option E) is also valid as a Source, since FortiGate SD-WAN rules can match traffic by authenticated user or user group identity, allowing policy-based steering per user population. SLA target name (Option B) is not a source match; it is a performance SLA object referenced in the rule's outgoing interface/strategy configuration to measure link health. Interface MAC address (Option C) is not a supported Source match criterion in SD-WAN rules, and Firewall policy ID (Option D) is not a source selector either, as policy IDs identify firewall policies rather than traffic origin.

Answer

SLA target name.

Answer

Interface MAC address.

Answer

Firewall policy ID.

Question 17

What is the impact of checking the 'Interface Preference' box in an SD-WAN rule?

Accepted Answer

It overrides the SLA strategy selection.. In Fortinet SD-WAN, the 'Interface Preference' option in an SD-WAN rule forces traffic to use a specific preferred interface (or set of interfaces) regardless of what the SLA strategy would otherwise select. This effectively overrides the SLA-based path selection, ensuring the rule's traffic egresses through the chosen member(s) even if another member has better SLA scores. It is used when business policy requires a specific WAN link for certain applications.

Answer

It enables failover to the default gateway.

Answer

It enables load balancing across interfaces.

Answer

It increases the probe frequency.

Question 18

You are configuring a Performance SLA to monitor reachability to a SaaS application. Which parameter determines the threshold for an interface to be considered 'unhealthy' in the SD-WAN routing table?

Accepted Answer

Packet Loss Threshold. The Packet Loss Threshold is one of the SLA criteria (along with latency and jitter) that determines when a member is marked unhealthy in the SD-WAN routing table. When the measured packet loss exceeds the configured threshold, the Performance SLA marks that member as out-of-SLA, and SD-WAN rules that require SLA compliance will stop selecting it. This is the parameter that directly defines the 'unhealthy' boundary for loss-based SLA evaluation.

Answer

Probe Mode

Answer

Sequence Number

Answer

Update Interval

Question 19

When creating an SD-WAN template, what must be defined before you can add an SD-WAN interface to the template?

Accepted Answer

Individual SD-WAN member interfaces. Before you can add an SD-WAN interface to an SD-WAN template in FortiManager, you must first define the individual SD-WAN member interfaces (the physical or logical links that will participate in SD-WAN). The template's SD-WAN interface object is built on top of these member interfaces, so they are the prerequisite.

Answer

The SD-WAN health check probes

Answer

Global firewall policies

Answer

The virtual domain (VDOM) settings

Question 20

A company has an SD-WAN template in FortiManager that is assigned to 50 FortiGates. The template includes a health check object named 'HC1' that monitors a server at 10.0.0.1. The administrator modifies 'HC1' to monitor 10.0.0.2 instead. After the change, the administrator notices that some FortiGates still show the old server IP in their running configuration. What is the most likely reason for this discrepancy?

Accepted Answer

The FortiGates with the old IP have not had the updated template installed yet.. The most likely reason is that the FortiGates with the old IP have not had the updated template installed. Modifying a health check object in FortiManager updates the configuration in the database, but the changes are not automatically pushed to managed devices. An install operation is required to apply the changes. If some devices were offline or excluded from the last install, they would retain the old configuration.

Answer

The FortiGates are using a cached version of the health check and need to be rebooted.

Answer

The health check object is locked and cannot be modified.

Answer

The health check object is not referenced correctly in the SD-WAN template.