NSE7_SDW Practice Test 3 — 25 Questions

Question 1

Which THREE pieces of information are displayed in the SD-WAN Monitor in FortiManager?

Accepted Answer

Status of SD-WAN members. The SD-WAN monitor provides visibility into the health of probes, the interface bandwidth, and the overall performance of the SD-WAN links.

Answer

System temperature of the FortiGate

Answer

The current username of the logged-in admin

Question 2

Which TWO methods can be used to update SD-WAN policies across all managed devices in FortiManager?

Accepted Answer

Using a CLI script to push updates. Updates are performed by modifying the template and then pushing the updated configuration to the devices.

Answer

Editing the individual FortiGate policy

Answer

Creating a new ADOM

Answer

Rebooting the FortiManager

Question 3

An administrator is configuring SD-WAN rules with performance SLAs. Which TWO strategies are available in FortiOS when configuring an SD-WAN rule based on SLA metrics? (Choose two)

Accepted Answer

Lowest Cost (SLA). FortiOS SD-WAN rule strategies include Lowest Cost (SLA), Max Bandwidth, Service-ID, Volume, and Priority. Among these, Priority and Lowest Cost (SLA) are standard strategy options utilizing SLA performance metrics.

Answer

Round-Robin DNS Load Balancing

Answer

Dynamic BGP AS-Prepending

Answer

Static Flow-Hashing

Question 4

When using SD-WAN zones, what is the primary benefit of grouping multiple physical interfaces into a single zone?

Accepted Answer

It allows you to apply a single firewall policy to the entire group.. Zones allow you to reference a group of interfaces in a single firewall policy, simplifying the configuration.

Answer

It increases the throughput of individual physical links.

Answer

It prevents the need for performance SLAs.

Answer

It automatically enables load balancing between interfaces.

Question 5

An enterprise deploys BGP over SD-WAN with multiple MPLS and broadband connections. A route-map is applied to incoming BGP updates on the FortiGate to set a specific weight for routes learned over the MPLS interface. Why is the 'weight' attribute particularly effective in this FortiOS SD-WAN and BGP integration scenario?

Accepted Answer

Weight is evaluated first in the BGP best-path selection algorithm on FortiOS, allowing local preference override without altering global AS path attributes. Weight is a Cisco/FortiOS-specific BGP attribute that is local to the router on which it is configured. It is evaluated first in the BGP best-path selection algorithm, allowing administrators to deterministically force traffic out of a specific SD-WAN/BGP member without affecting other routers in the AS.

Answer

Weight replaces the need for SD-WAN SLA rules by performing layer 7 packet inspection

Answer

Weight automatically adjusts the SD-WAN health check probe frequency based on route stability

Answer

Weight is propagated to all iBGP peers, ensuring cluster-wide path synchronization

Question 6

An administrator configures an ADVPN 2.0 deployment between a FortiGate hub and multiple spokes using OSPF as the dynamic routing protocol. The spoke units need to establish direct shortcut tunnels dynamically. Which configuration step is mandatory on the hub to ensure that BGP or OSPF next-hop resolution works correctly for ADVPN shortcut creation?

Accepted Answer

Disable next-hop-self on the hub's BGP neighbor configuration or adjust OSPF interface settings so the advertising router is not forced as the next hop. In ADVPN environments running dynamic routing protocols like OSPF or BGP, network-object settings or interface settings such as setting the route-map or disabling next-hop-self on the hub allow spokes to properly resolve shortcut routes. Specifically, modifying the BGP next-hop or OSPF next-hop behavior ensures traffic is steered directly to the requesting spoke's IP rather than looping back through the hub.

Answer

Enable split-horizon globally within the OSPF routing process

Answer

Enable exchange-interface in the hub's OSPF interface configuration

Answer

Configure a static blackhole route for all spoke subnets on the hub

Question 7

An administrator wants to view the active SD-WAN rule hit counts and verify which traffic is matching a specific SD-WAN rule in FortiOS. Which command should be used?

Accepted Answer

diagnose sys sdwan service. To view runtime statistics and hit counts for SD-WAN rules, the command 'diagnose sys sdwan service' is used.

Answer

show system sdwan

Answer

execute router clear sdwan cache

Answer

get firewall policy statistics

Question 8

Which SD-WAN rule strategy should you choose if you want to distribute traffic across multiple interfaces based on their bandwidth weights?

Accepted Answer

Maximize Bandwidth (SLA). The 'Maximize Bandwidth' strategy allows traffic distribution based on the configured bandwidth weight for each interface.

Answer

Manual

Answer

Lowest Cost (SLA)

Answer

SLA Target

Question 9

What is the maximum number of members allowed in a single SD-WAN zone?

Accepted Answer

Depends on the model, but generally limited by system resources.. FortiOS supports a large number of members per zone, typically limited only by the hardware model's scale, not a low fixed number.

Answer

8

Answer

2

Answer

4

Question 10

When configuring an SD-WAN health check to monitor internet reachability using HTTP/HTTPS requests, which parameter defines the specific string the FortiGate expects to receive in the server response body to validate that the path is healthy?

Accepted Answer

http-match. In SD-WAN health check (ping, tcp-echo, http, dns), when HTTP is selected as the server-type, administrators can configure a 'security-string' or 'http-match' / 'expect' string to validate the HTTP response body.

Answer

probe-packet-size

Answer

sla-break-time

Answer

server-response-timeout

Question 11

An administrator configures an SD-WAN rule using the 'Volume' strategy across two IPsec tunnels with different bandwidth capacities (Tunnel A: 100 Mbps, Tunnel B: 50 Mbps). How does FortiOS distribute traffic across these members when using the Volume strategy?

Accepted Answer

Traffic is distributed proportionally based on the configured weight or bandwidth ratio of each member interface. The Volume strategy in SD-WAN distributes traffic proportional to the configured volume/weight (bandwidth capacity) of each member interface.

Answer

Traffic is balanced equally (50/50) regardless of interface capacity

Answer

Traffic is sent exclusively over Tunnel A until it reaches 100% packet loss, then fails over to Tunnel B

Answer

Traffic is steered strictly based on real-time latency measured by health checks

Question 12

An administrator is configuring BGP over SD-WAN IPsec tunnels between a headquarters FortiGate and branch FortiGates. Which TWO configuration steps are required to ensure robust and stable dynamic routing over the SD-WAN IPsec tunnels? (Choose two)

Accepted Answer

Configure BGP neighbors using the loopback interface IP addresses or tunnel specific IP addresses rather than physical interface IPs. Robust BGP over SD-WAN requires configuring the BGP router ID, setting up appropriate timers or neighbor relationships, and ensuring that the underlying SD-WAN members and IPsec tunnels allow routing protocol traffic. Additionally, managing BGP timers or enabling graceful restart helps maintain stability during brief IPsec reconnections.

Answer

Set the BGP administrative distance to 255 to disable all routing updates

Answer

Configure static default routes on all BGP neighbors pointing to the null0 interface

Answer

Disable IPsec phase 2 encryption to allow BGP plaintext hello packets to pass through without encapsulation overhead

Question 13

A FortiGate SD-WAN deployment uses a firewall policy with an Intrusion Prevention System (IPS) profile applied. After turning on IPS, administrators notice that throughput over an IPsec SD-WAN tunnel drops significantly. What is the primary reason for this throughput reduction, and how can it be mitigated?

Accepted Answer

IPS inspection requires intensive CPU processing for packet payload analysis, which can be optimized by using flow-based inspection mode and ensuring hardware offloading is active where supported. IPS inspection performs deep packet inspection and signature matching, which is CPU-intensive. While NP6/NP7 hardware offloading accelerates IPsec encryption, full content inspection like IPS typically requires CPU processing unless offloaded or optimized. Using flow-based inspection or hardware offloading settings where supported helps mitigate performance impact.

Answer

IPS requires proxy-based inspection, which permanently disables IPsec hardware acceleration

Answer

IPS blocks all IPsec AH/ESP headers, forcing fallback to unencrypted GRE tunnels

Answer

The IPS database size exceeds the IPsec Phase 2 buffer limit

Question 14

An administrator troubleshoots an ADVPN 2.0 deployment where dynamic shortcut tunnels fail to establish between branch spokes. Which THREE diagnostic steps or log checks should the administrator perform on the FortiGate hub or spoke to isolate the issue? (Choose three)

Accepted Answer

Check 'diagnose vpn tunnel list' to verify if dynamic shortcut child security associations are being created. Troubleshooting ADVPN shortcut failures requires checking IPsec status, IKE exchanges, routing table entries, and network device creation. Valid diagnostic steps include checking IKE daemon output, verifying IPsec tunnel status, and inspecting routing table entries for shortcut triggers.

Answer

Check the firewall policy statistics to ensure SD-WAN rules have zero hit counts globally

Answer

Execute 'execute format disk' to reset the internal flash storage and clear corrupted ADVPN certificates

Question 15

Which TWO of the following can cause an SD-WAN member to be marked as 'down' in an SLA?

Accepted Answer

The probe times out.. An interface is marked down if the probe fails to receive a response or if the response exceeds configured thresholds.

Answer

The system clock is updated.

Answer

The firewall policy is disabled.

Answer

The interface IP address is changed.

Question 16

Which of the following is required to successfully implement SD-WAN?

Accepted Answer

At least two physical interfaces.. At least two interfaces are typically required to make SD-WAN selection meaningful, though one is technically possible.

Answer

A FortiManager instance.

Answer

A subscription to FortiGuard SD-WAN service.

Answer

An external load balancer.

Question 17

You are configuring a Performance SLA to monitor reachability to a SaaS application. Which parameter determines the threshold for an interface to be considered 'unhealthy' in the SD-WAN routing table?

Accepted Answer

Packet Loss Threshold. The 'threshold-alert' or the individual latency/jitter/packet loss thresholds within the Performance SLA configuration dictate when a member is marked failed.

Answer

Probe Mode

Answer

Sequence Number

Answer

Update Interval

Question 18

What is the purpose of the 'Gateway' override in an SD-WAN member configuration?

Accepted Answer

To specify a manual gateway for the SD-WAN member.. The gateway override allows the FortiGate to use a specific IP for the probe that is different from the interface's gateway, or to define a manual gateway where DHCP is used.

Answer

To force the use of a secondary ISP.

Answer

To bypass the firewall policy.

Answer

To enable load balancing.

Question 19

An SD-WAN rule is configured with 'Lowest Cost (SLA)' strategy. If all members in the SLA meet the requirements, how does the FortiGate select the outgoing interface?

Accepted Answer

The member with the lowest interface cost value defined in the SD-WAN member configuration.. In 'Lowest Cost (SLA)' mode, the FortiGate selects the member with the lowest configured cost that meets the SLA requirements.

Answer

Round Robin

Answer

The interface with the highest bandwidth.

Answer

The interface that was most recently added to the zone.

Question 20

Which TWO of the following steps are required to correctly configure a Performance SLA?

Accepted Answer

Select the probe protocol.. To configure an SLA, you must define the destination IP (or server) and the probe protocol.

Answer

Configure a firewall address object for the probe.

Answer

Enable BGP on the interface.

Answer

Assign the probe to a VPN tunnel.