NSE7_SDW Practice Test 2 — 25 Questions

Question 1

A FortiGate device is running ADVPN 2.0 with OSPF. A spoke experiences transient routing loops when a shortcut tunnel tears down due to inactivity timeout. Which configuration adjustment on the FortiGate hub and spokes prevents these temporary routing blackholes or loops during shortcut teardown?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Adjust the administrative distance or use route redistribution filters with appropriate metrics so hub routes and shortcut routes do not conflict during teardown. When shortcuts time out, routes must cleanly transition back to the hub route without creating transient routing loops. Adjusting route redistribution metrics, using specific distance values, or configuring 'shortcut-routing' / route-map timers / asymmetric routing settings prevents loops. In FortiOS ADVPN, setting appropriate dead timers or using dynamic routing distance adjustments ensures the hub route has a predictable preference when the shortcut drops.

Answer

Disable OSPF on the spoke units and rely entirely on static default routes

Answer

Set the IPsec phase 1 lifetime to infinite to prevent shortcuts from timing out

Answer

Configure asymmetric routing bypass on all firewall policies

Question 2

An enterprise network implements BGP over ADVPN. Spoke units advertise their local subnets to the hub via BGP. To prevent spokes from learning each other's subnets directly through the hub via regular BGP route propagation before an ADVPN shortcut is established (forcing them to route through the hub unnecessarily), or conversely, to optimize route distribution, what BGP feature is typically configured on the hub?

Accepted Answer

BGP Route Reflection configured on the hub with spoke routers set as clients. In BGP over ADVPN, Route Reflection is typically enabled on the hub so that spoke-to-spoke routes are reflected correctly, or next-hop behavior is manipulated. Wait, if we want spokes not to learn routes or to handle them correctly without full mesh, BGP Route Reflection (with no-client-to-client reflection if desired, or standard route reflection) is used. Alternatively, disabling next-hop-self or using peer groups. Let's look at the options. BGP Route Reflection on the hub allows the hub to reflect routes between spoke iBGP peers without requiring a full mesh iBGP session between every spoke.

Answer

BGP Multipath relaxing with maximum-paths set to 32

Answer

Static default route redistribution with aggregate-address suppression

Answer

BGP Confederation with each spoke acting as a separate autonomous system

Question 3

An administrator configures an SD-WAN rule to route guest Wi-Fi traffic out of a secondary broadband internet connection. However, guest users are still able to access internal corporate subnets that are routed over the primary IPsec VPN tunnel. What configuration is missing or incorrect?

Accepted Answer

The firewall policy permitting traffic from the Guest Wi-Fi interface to the internal VPN interface lacks proper security profile enforcement or is missing a deny rule blocking inter-zone access. SD-WAN rules route internet or specific traffic based on criteria, but traffic between zones (like Guest Wi-Fi to Corporate LAN) is governed by firewall policies. If a firewall policy permits traffic from Guest Wi-Fi directly to Corporate LAN, it bypasses SD-WAN rules because SD-WAN rules only evaluate traffic matching egress SD-WAN zones/interfaces specified by the rule or routing table lookup. To prevent guest traffic from reaching internal subnets, the firewall policy must block or restrict that inter-zone traffic.

Answer

The SD-WAN health check probe is not monitoring the corporate subnet gateway

Answer

The IPsec Phase 2 security association selectors include the guest subnet range

Answer

The SD-WAN rule priority for the internal VPN interface is set higher than the broadband interface

Question 4

An administrator configures a static route where the gateway is an SD-WAN zone instead of a specific IP address. How does FortiOS process this SD-WAN static route?

Accepted Answer

The FortiOS SD-WAN engine intercepts the route lookup and applies SD-WAN rules to dynamically select the best member interface based on performance SLAs. When a static route points to an SD-WAN zone as its gateway, the FortiOS routing table delegates the packet forwarding decision to the SD-WAN engine, which then evaluates SD-WAN rules to select the best member interface.

Answer

The FortiGate drops the packet because static routes require a valid IP address gateway

Answer

The packet is forwarded exclusively through the physical interface with the lowest index number

Answer

Traffic is load-balanced equally across all physical interfaces in the FortiGate chassis using round-robin

Question 5

An administrator applies security profiles (Antivirus, Web Filtering, and IPS) to traffic steered by an SD-WAN rule. Performance issues arise. Which TWO methods can the administrator use to optimize inspection performance without completely disabling security? (Choose two)

Accepted Answer

Switch the inspection mode from proxy-based to flow-based where supported, allowing hardware offloading (NP6/NP7) to accelerate packet processing. Optimizing security profile performance while maintaining inspection includes switching inspection mode to flow-based where appropriate, tuning antivirus/IPS settings to bypass heavy file types or exempt trusted IPs, and leveraging hardware acceleration.

Answer

Set the IPsec Phase 1 encryption algorithm to DES to speed up decryptions

Answer

Disable all SSL inspection globally across the entire FortiGate device

Answer

Remove the SD-WAN virtual interface from all firewall zones

Question 6

You are troubleshooting an issue where traffic is not using an SD-WAN rule despite meeting criteria. What is the most likely cause?

Accepted Answer

A higher-priority SD-WAN rule is matching the traffic first.. SD-WAN rules are evaluated top-down. If a higher-priority rule matches the traffic, the lower-priority rule will never be reached.

Answer

The SD-WAN rule is disabled.

Answer

The Performance SLA has timed out.

Answer

The interface is not in an SD-WAN zone.

Question 7

An enterprise network uses OSPF over SD-WAN IPsec tunnels. The administrator notices that OSPF adjacency is constantly dropping over a specific backup SD-WAN member link due to intermittent packet loss. Which THREE configuration adjustments can improve OSPF stability over unstable SD-WAN IPsec links? (Choose three)

Accepted Answer

Configure OSPF network type as point-to-point on the IPsec tunnel interfaces to eliminate unnecessary DR/BDR elections. To stabilize OSPF over unstable WAN links, adjusting OSPF hello and dead intervals, configuring OSPF dead-drop or fast-hello settings carefully, or utilizing passive interfaces/MD5 authentication correctly helps. Furthermore, ensuring that OSPF timers match and are relaxed prevents unnecessary adjacency drops.

Answer

Set the OSPF router ID to 0.0.0.0 on all branch spokes

Answer

Disable OSPF hello packets entirely and rely on static default routes

Question 8

An administrator troubleshoots a scenario where traffic matching an application-based SD-WAN rule is bypassing the preferred high-speed MPLS tunnel and taking the backup broadband tunnel instead. Which THREE factors should the administrator check to resolve this routing discrepancy? (Choose three)

Accepted Answer

Inspect the member priorities and weights configured within the specific SD-WAN rule. When an SD-WAN rule bypasses preferred paths, potential causes include SLA health check failure (the preferred link fails the SLA threshold), incorrect rule evaluation order (an earlier rule matches first), or interface priority/weight settings within the rule. Checking these three areas is standard practice.

Answer

Verify the FortiGate factory default administrator password is changed

Answer

Check the physical layer OSI Model cable category connected to the FortiGate port

Question 9

An enterprise deploys ADVPN 2.0 with BGP and security profiles applied to traffic traversing the VPN overlay. Which THREE statements are correct regarding how security profiles and ADVPN 2.0 interact in FortiOS? (Choose three)

Accepted Answer

SSL inspection (DPI) applied on spoke firewall policies inspects decrypted traffic traversing the ADVPN shortcut tunnel. In ADVPN 2.0, when spokes establish direct shortcut tunnels, data flows directly between spokes without passing through the hub. Therefore, firewall policies and security profiles enforcing inspection must exist on the spoke FortiGates, not just the hub. Additionally, shortcut tunnels permit direct inspection on the spoke interfaces.

Answer

ADVPN 2.0 automatically disables all firewall inspection profiles on shortcut interfaces to maximize throughput

Answer

The hub FortiGate inspects all data packets exchanged between spokes even after a direct shortcut tunnel is established

Question 10

An administrator is troubleshooting BGP route propagation over SD-WAN IPsec tunnels where a branch office is not receiving specific routes from the datacenter hub. Which TWO CLI commands on the FortiGate are most useful for diagnosing BGP peering and advertised route issues? (Choose two)

Accepted Answer

get router info bgp neighbors advertised-routes. To troubleshoot BGP routing issues on FortiOS, commands examining the BGP summary, advertised routes, and received routes are essential. These include 'get router info bgp summary' and 'get router info bgp neighbors <ip> advertised-routes'.

Answer

execute ipsec tunnel list

Answer

diagnose sys sdwan member

Answer

get system interface physical

Question 11

Which command is used to verify the current status of SD-WAN members and their SLA health from the CLI?

Accepted Answer

diagnose sys sdwan health-check. The command 'diagnose sys sdwan health-check' shows the status of configured health checks and member reachability.

Answer

show router info bgp

Answer

get system interface

Answer

get system sdwan member

Question 12

When using SD-WAN templates, how are SD-WAN rules ordered?

Accepted Answer

Top to bottom. SD-WAN rules are evaluated from top to bottom, similar to standard firewall policies.

Answer

Based on the creation date

Answer

By the interface speed

Answer

Randomly

Question 13

When configuring SD-WAN services in a template, what does the 'Performance SLA' setting determine?

Accepted Answer

The criteria for path selection based on link quality. The Performance SLA defines the criteria (latency, jitter, loss) that must be met for a path to be considered 'healthy' for traffic.

Answer

The physical port priority

Answer

The maximum bandwidth allowed

Answer

The number of tunnels created

Question 14

Which THREE factors can affect the 'Performance SLA' logic in an SD-WAN template?

Accepted Answer

Packet loss threshold. Performance SLA evaluates paths based on measured latency, jitter, and packet loss compared to defined thresholds.

Answer

The firmware version of the FortiGate

Answer

The number of active VPN tunnels

Question 15

Which TWO configuration changes require a push from FortiManager to the FortiGate?

Accepted Answer

Changes to an SD-WAN template. Any change made in the FortiManager policy or template objects requires a push to keep the device config synchronized.

Answer

Changes to the log settings on the FortiGate local GUI

Answer

Adding a new user to the FortiGate local database

Answer

Changing the FortiManager admin password

Question 16

How can you verify that an SD-WAN configuration change was successfully applied to a FortiGate via FortiManager?

Accepted Answer

By checking the Device Manager installation status. The 'Installation' task status in the Task Monitor will show 'Success', and the device configuration history will show the synchronized state.

Answer

By checking the FortiAnalyzer logs

Answer

By restarting the FortiGate

Answer

By viewing the system dashboard of the FortiGate locally

Question 17

What happens if you modify an SD-WAN template that is already applied to a FortiGate?

Accepted Answer

The configuration status shows 'Modified' and requires an installation task. The change creates a configuration difference, which must be pushed to the device to take effect.

Answer

The changes take effect immediately without a push

Answer

The FortiGate automatically pulls the new config

Answer

The FortiGate configuration is reverted

Question 18

Which TWO of these are valid SD-WAN health check protocols?

Accepted Answer

HTTP. FortiGate SD-WAN supports multiple probes, including HTTP, Ping, and DNS, to verify link health.

Answer

SSH

Answer

FTP

Answer

SNMP

Question 19

In SD-WAN central management, what is the 'SD-WAN Zone' used for?

Accepted Answer

To group multiple SD-WAN members for logical policy routing. SD-WAN zones allow you to group multiple physical interfaces into a logical container for easier policy management.

Answer

To define the physical port speed

Answer

To limit bandwidth for specific users

Answer

To isolate the SD-WAN traffic from the WAN

Question 20

You have a large SD-WAN deployment. Why would you use a 'Centralized Policy' in FortiManager instead of local policies?

Accepted Answer

To enforce global security and traffic routing policies consistently across multiple sites. Centralized policy packages allow you to enforce security and SD-WAN routing rules consistently across the entire organization from one location.

Answer

To eliminate the need for logs

Answer

To reduce the CPU load on the FortiGate

Answer

To allow local admins to override global policies