NSE7_SDW Practice Test 4 — 25 Questions

Question 1

You are configuring an SD-WAN rule to steer traffic to a business-critical application. The rule uses the 'Lowest Cost (SLA)' strategy with two members: a low-cost broadband link and an expensive MPLS link. The broadband link meets the SLA most of the time but occasionally experiences high latency. You want traffic to prefer the broadband link but fail over to MPLS when broadband violates the SLA. Which additional configuration is required to ensure the rule behaves as intended?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a Performance SLA and associate it with the SD-WAN rule.. The 'Lowest Cost (SLA)' strategy chooses the lowest-cost member that satisfies the SLA defined in a Performance SLA. The Performance SLA must be created separately and then referenced by the SD-WAN rule. Without it, the rule has no way to evaluate link health, so it may not fail over when the broadband link degrades. Associating a Performance SLA with appropriate thresholds ensures the rule dynamically selects the MPLS link when broadband violates the SLA.

Answer

Enable 'SLA Target' on the rule and specify the required latency threshold.

Answer

Set the broadband member's priority to a lower value than the MPLS member.

Answer

Set the MPLS member's cost to a lower value than the broadband member.

Question 2

An engineer needs to configure an SD-WAN rule that sends traffic out the member with the lowest latency for a specific application, but also wants the rule to automatically fail over to the next-best member if the primary member's latency exceeds a threshold. Which SD-WAN strategy and configuration should be used?

Accepted Answer

Use the lowest-latency strategy and enable the performance SLA on the members.. The lowest-latency strategy is the only one that actively measures latency and selects the member with the best value. When combined with a performance SLA that defines a latency threshold, the member is marked out of SLA if the threshold is exceeded, triggering failover to the next-best member. This provides both optimal path selection and automatic failover.

Answer

Use the manual strategy and specify a preferred member order.

Answer

Use the priority strategy and assign priorities to members.

Answer

Use the volume-based strategy and set a maximum bandwidth threshold.

Question 3

A company has an SD-WAN deployment with three members: port1 (MPLS), port2 (Broadband), and port3 (LTE). The administrator wants to ensure that business-critical traffic uses port1 whenever it meets the SLA, but if port1 fails the SLA, traffic should use port2. If both port1 and port2 fail, traffic should use port3. Which SD-WAN rule strategy should be used to achieve this?

Accepted Answer

Priority. The 'Priority' strategy is designed for active/standby failover based on SLA status. The administrator assigns a priority value to each member; lower values indicate higher priority. The SD-WAN rule will select the highest-priority member that meets the referenced Performance SLA. If that member fails the SLA, the next priority member is chosen. This provides the exact behavior described: port1 preferred, then port2, then port3, all conditional on SLA compliance.

Answer

Lowest Cost

Answer

Best Quality

Answer

Maximize Bandwidth

Question 4

You are troubleshooting an SD-WAN deployment where a rule configured with the 'Best Quality' strategy is not selecting the expected member. The Performance SLA shows that member1 has lower latency and jitter than member2, yet traffic is using member2. Which factor should you verify first?

Accepted Answer

Check whether the SD-WAN rule is placed above a conflicting rule in the rule list.. SD-WAN rules are processed sequentially, and the first rule that matches the traffic is used. If an earlier rule matches the same traffic, it will dictate member selection, potentially overriding the intended 'Best Quality' rule. Therefore, checking rule order is the logical first step. Other factors like cost or SLA algorithm are not relevant to the 'Best Quality' strategy, which selects the member with the best measured performance.

Answer

Confirm that member1 has a lower cost than member2.

Answer

Ensure that the Performance SLA is configured with the 'Best Quality' algorithm.

Answer

Verify that the 'Best Quality' strategy is supported on the FortiGate model.

Question 5

An administrator is configuring SD-WAN on a FortiGate with two WAN interfaces: port1 and port2. They need to ensure that the SD-WAN can properly direct traffic based on application type and link performance. Which two configuration steps are required to enable application-based steering with SLA enforcement? (Choose two.)

Accepted Answer

Create an SD-WAN zone and add port1 and port2 as members.. To enable application-based steering with SLA enforcement, the administrator must first create an SD-WAN zone and add the WAN interfaces as members. Then, a Performance SLA must be configured and applied to the zone to monitor link health. These two steps provide the foundation for SD-WAN rules to match applications and steer traffic based on SLA status. Without the zone, members cannot be managed collectively; without the SLA, there is no performance data to enforce.

Answer

Create a firewall policy that includes the SD-WAN zone as the outgoing interface and enable NAT.

Answer

Configure a static route for each WAN interface with the same distance.

Answer

Enable application control on the firewall policy that references the SD-WAN zone.

Question 6

You are configuring an SD-WAN rule for a branch office that must use the lowest-latency path for Microsoft 365 traffic. You have already created a Performance SLA named 'M365_SLA' that measures latency to several Microsoft 365 endpoints. You want the SD-WAN rule to select the member with the best latency among those that meet the SLA. Which SD-WAN rule strategy should you configure?

Accepted Answer

lowest-latency (SLA). For latency-sensitive applications such as Microsoft 365, the SD-WAN rule strategy must dynamically select the member with the lowest measured latency. The lowest-latency strategy uses the Performance SLA results to compare members and choose the one with the best latency, ensuring optimal user experience. Other strategies focus on cost, bandwidth, or static priority, which do not directly optimize for latency and may select a suboptimal path.

Answer

lowest-cost (SLA)

Answer

maximize-bandwidth (SLA)

Answer

priority (SLA)

Question 7

An administrator wants an SD-WAN rule to select the member with the best measured quality for Microsoft 365 traffic, and also to ensure that if the best member degrades, traffic moves to the next-best member without manual intervention. The rule must continuously evaluate all eligible members. Which strategy satisfies these requirements?

Accepted Answer

Best quality. Best quality evaluates every in-SLA member using the Performance SLA measurements and steers traffic to the member currently offering the best value for the monitored metric. Because the comparison repeats as new probe results arrive, a member that degrades is automatically bypassed in favor of the next-best healthy member. Strategies such as manual, lowest cost, and maximize bandwidth either ignore live quality or optimize for a different objective.

Answer

Manual

Answer

Lowest cost

Answer

Maximize bandwidth

Question 8

You have an SD-WAN zone named 'virtual-wan-link' with members 'wan1' and 'wan2'. You notice that a member interface is administratively up and has a valid IP address, but it is not appearing as a selectable member when you edit the SD-WAN member list. Which condition most likely explains why the interface cannot be added?

Accepted Answer

The interface is currently assigned to a different SD-WAN zone.. An interface can be a member of only one SD-WAN zone. If it already belongs to another zone, it will not be offered as a selectable member when editing a different zone. Administrative role, static routes pointing to the zone, and Performance SLA membership do not restrict member selectability, so zone exclusivity is the condition that explains the symptom.

Answer

The interface has not been added to a Performance SLA.

Answer

The interface is already referenced by a static route that points to the SD-WAN zone.

Answer

The interface is assigned an administrative role of LAN rather than WAN.

Question 9

An administrator is configuring an SD-WAN rule that must ensure business-critical traffic always uses the best path based on measured latency and jitter, while also allowing the rule to fail over to a secondary link if the primary link's SLA is violated. The rule includes three members: wan1, wan2, and wan3. Which two actions must be performed to achieve this? (Choose two.)

Accepted Answer

Configure the SD-WAN rule to use the 'Best Quality' strategy.. To dynamically select the best path based on latency and jitter, the SD-WAN rule must use the 'Best Quality' strategy, which relies on a Performance SLA that monitors those metrics. The Performance SLA must be created and associated with the members. Together, these two actions allow the rule to choose the member with the best measured quality and fail over if the SLA is violated.

Answer

Enable 'Gateway' override on all three members to ensure they are prioritized equally.

Answer

Set the SD-WAN rule strategy to 'Lowest Cost (SLA)' and assign costs based on link quality.

Answer

Assign the same cost value to all three members to allow the rule to choose based on quality.

Question 10

A network administrator is configuring an IPsec VPN tunnel between a FortiGate hub and a spoke. The administrator wants to ensure that the spoke can dynamically learn routes from the hub and also advertise its local subnets. Which routing protocol is most commonly used in Fortinet SD-WAN deployments to achieve this?

Accepted Answer

BGP. In Fortinet SD-WAN deployments, BGP is the de facto routing protocol for dynamic route exchange between hub and spoke over IPsec tunnels. It provides scalability, policy control, and seamless integration with ADVPN for on-demand tunnels. BGP enables spokes to advertise their local subnets and learn hub routes, which is essential for dynamic routing in SD-WAN. While OSPF and other protocols are supported, BGP is the most commonly used and recommended for this purpose.

Answer

IS-IS

Answer

OSPF

Answer

RIP

Question 11

An administrator is configuring a new SD-WAN rule to steer traffic based on application signatures. The administrator wants to ensure that the rule only matches traffic for Microsoft Teams and prioritizes it over other traffic. Which SD-WAN rule configuration should be used?

Accepted Answer

Use an application-based SD-WAN rule and select the Microsoft Teams application signature.. To steer traffic based on application, the SD-WAN rule must use the application-based matching capability. FortiOS includes an application database with signatures for thousands of applications, including Microsoft Teams. By creating an SD-WAN rule that specifies the Microsoft Teams application, the FortiGate can identify and steer that traffic accordingly. The rule can be prioritized by ordering it before other rules or by using the priority setting. This method is accurate and dynamic, unlike static IP or ISDB approaches.

Answer

Create a rule with 'internet-service' set to Microsoft Teams and enable 'sla'.

Answer

Set the rule's 'dst' to the Microsoft Teams IP addresses and enable 'priority'.

Answer

Configure a rule with 'src' as the internal subnet and 'dst' as 'all', then apply a web filter profile.

Question 12

A network engineer is using FortiManager to manage a FortiGate that already has a local SD-WAN configuration. The engineer wants to transition to centralized management by assigning an SD-WAN template to the device. After the template is assigned and installed, what is the effect on the existing local SD-WAN settings?

Accepted Answer

The local SD-WAN settings are overwritten by the template configuration when the policy package is installed.. When an SD-WAN template is assigned to a FortiGate in FortiManager and the policy package is installed, the template configuration overwrites the device's local SD-WAN settings. This is by design to enforce centralized management and consistency. The engineer must ensure the template includes all necessary SD-WAN members, health checks, and rules before installation.

Answer

The local SD-WAN settings are merged with the template, with template values taking precedence for any conflicting parameters.

Answer

The local SD-WAN settings remain active until the FortiGate is rebooted, after which the template takes effect.

Answer

The local SD-WAN settings are preserved, and the template is applied only to interfaces not already configured for SD-WAN.

Question 13

When configuring SD-WAN in FortiManager, why would you use 'Shared Objects'?

Accepted Answer

To enable reuse of configuration elements across different templates. Shared Objects in FortiManager SD-WAN configuration allow you to define configuration elements (such as health checks, SLA targets, or SD-WAN rules) once and reuse them across multiple SD-WAN templates. This promotes consistency and reduces duplication when managing many templates or devices. It is the mechanism for reusing configuration elements across different templates.

Answer

To increase the number of VDOMs supported

Answer

To allow FortiGates to share logs

Answer

To create a site-to-site VPN

Question 14

You are configuring a Performance SLA on a FortiGate to monitor the quality of two WAN links. You need to ensure that the SLA probe uses HTTP to check a specific URL and that it considers the link healthy only if the round-trip time is below 100 ms and packet loss is below 2%. Which two parameters must you configure in the Performance SLA? (Choose two.)

Accepted Answer

Configure the latency threshold to 100 ms and packet loss threshold to 2%.. To use HTTP for the SLA probe, you must set the protocol to HTTP and specify the URL. To enforce the health criteria, you must configure the latency threshold to 100 ms and the packet loss threshold to 2%. These two settings are directly required. Other options like update-static-route, probe interval, or jitter are not necessary to meet the stated monitoring conditions.

Answer

Enable 'update-static-route' to automatically adjust routing based on SLA.

Answer

Configure the SLA to use 'jitter' as the primary metric.

Answer

Set the probe interval to 100 ms to match the latency threshold.

Question 15

An engineer is troubleshooting an SD-WAN rule that is not steering traffic as expected. The rule is configured with the 'Lowest Cost (SLA)' strategy and includes two members: member1 (cost 10) and member2 (cost 20). Both members are passing their SLA health checks. However, all traffic is going out member1, and member2 is not used. What is the most likely explanation?

Accepted Answer

The 'Lowest Cost (SLA)' strategy always selects the member with the lowest cost and does not load-balance, so member2 is only used if member1 fails its SLA.. The Lowest Cost (SLA) strategy selects the healthy member with the lowest cost. It does not load-balance; it is designed to prefer the cheapest path that meets the SLA. Since member1 has a lower cost and is healthy, it is always chosen. Member2 remains idle unless member1 fails its SLA. This is the intended behavior, not a misconfiguration.

Answer

Member2 is not being used because its health check is failing, even though it appears to be passing in the GUI.

Answer

Member2 is not being used because it is not included in the SD-WAN rule, even though it is in the zone.

Answer

Member2 is not being used because its cost is higher than member1's, and the strategy requires equal costs for load balancing.

Question 16

Which THREE tasks are required to successfully deploy SD-WAN via FortiManager?

Accepted Answer

Installing the configuration to the devices. Option B is correct because FortiManager deploys SD-WAN through a centralized SD-WAN template (or SD-WAN overlay template) that defines the member interfaces, zones, and performance SLAs before it can be pushed to devices. Option E is correct because the template must be assigned to the target managed FortiGates, which binds the template to those devices so FortiManager knows which FortiGates should receive the SD-WAN configuration. Option A is correct because after the template is created and assigned, the configuration must be installed to the devices, which pushes the SD-WAN settings into the FortiGate running configuration. Option C is not required, since a hard factory reset is unnecessary and would only disrupt the existing management connection to FortiManager. Option D is also not required, because existing firewall policies do not need to be deleted for SD-WAN deployment; policies can be adjusted or referenced as needed.

Answer

Performing a hard factory reset on the FortiGate

Answer

Deleting all existing firewall policies

Question 17

A network administrator is troubleshooting an SD-WAN deployment managed by FortiManager. They notice that a specific SD-WAN rule is not being enforced on a FortiGate, even though the template was installed successfully. The rule uses a performance SLA to select the best path. What is the most likely cause?

Accepted Answer

The performance SLA health check is not properly configured or is failing.. The most likely cause is that the performance SLA health check is not properly configured or is failing. Without a valid health check, the SD-WAN rule cannot evaluate SLA compliance and thus may not enforce the rule as intended. Successful template installation does not guarantee that health checks are operational.

Answer

The SD-WAN rule is configured with a manual interface selection instead of using the SLA.

Answer

The SD-WAN template was applied to the wrong device group.

Answer

The FortiGate does not support SD-WAN performance SLAs.

Question 18

How do you apply an SD-WAN template to multiple managed FortiGates simultaneously?

Accepted Answer

By assigning the template in the Device Manager tab. In FortiManager, SD-WAN templates are applied to managed devices through the Device Manager tab, where you can assign a template to one or many FortiGates at once. This centralized push means the same SD-WAN configuration (members, zones, health checks, SLA rules) is deployed consistently across all selected devices without touching each unit individually. It is the standard workflow for provisioning SD-WAN at scale in a FortiManager-managed environment.

Answer

By manually editing each FortiGate config

Answer

Through individual CLI console sessions

Answer

By creating a global profile

Question 19

You are deploying a new FortiGate for an SD-WAN branch. The branch uses a single physical WAN link that is delivered as a VLAN-tagged subinterface on port1 (VLAN ID 100). You want to add this link to an SD-WAN zone named 'virtual-wan-link'. Which configuration step must be completed before the VLAN subinterface can be selected as an SD-WAN member?

Accepted Answer

The VLAN subinterface must be created and have an IP address assigned.. An SD-WAN member can only reference an interface that already exists and has an IP address configured. For a VLAN-based WAN link, that means creating the VLAN subinterface under the physical interface and assigning it an IP address before adding it to the SD-WAN zone. Role labels, Performance SLA objects, and VDOM placement are not prerequisites for membership.

Answer

The VLAN subinterface must be placed in a separate VDOM that is dedicated to SD-WAN.

Answer

The VLAN subinterface must be added to a Performance SLA before it can join the SD-WAN zone.

Answer

The VLAN subinterface must be assigned a role of WAN in its interface configuration.

Question 20

An administrator wants to view the active SD-WAN rule hit counts and verify which traffic is matching a specific SD-WAN rule in FortiOS. Which command should be used?

Accepted Answer

diagnose sys sdwan service. The command 'diagnose sys sdwan service' displays the SD-WAN service rules along with their hit counts and the sessions currently matching each rule, making it the correct tool to verify which traffic is hitting a specific rule. It is a diagnostic command run from the FortiGate CLI that exposes the internal SD-WAN service table. Other commands either show configuration, clear caches, or display firewall policy statistics that do not map to SD-WAN rule matching.

Answer

show system sdwan

Answer

execute router clear sdwan cache

Answer

get firewall policy statistics