NSE7_SDW Practice Test 5 — 25 Questions

Question 1

A network engineer is creating a new SD-WAN template in FortiManager. The template will be used to configure SD-WAN on several FortiGate devices. The engineer wants to define a health check that monitors the latency to a specific server using ICMP. Which configuration object should the engineer create first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SD-WAN health check. The engineer should create an SD-WAN health check object first. This object contains the parameters for monitoring the health of SD-WAN members, such as the protocol (ICMP), server address, and thresholds. Once created, it can be referenced in the SD-WAN template when configuring members or rules, enabling the template to enforce performance SLAs.

Answer

SD-WAN member

Answer

Firewall policy

Answer

SD-WAN rule

Question 2

A network administrator is setting up an SD-WAN rule to steer traffic to a SaaS application. The rule uses a performance SLA that monitors the SaaS application's IP address. The administrator wants the SD-WAN rule to prefer the member with the lowest latency. Which SD-WAN rule strategy should be selected?

Accepted Answer

Lowest Latency (SLA). The Lowest Latency (SLA) strategy is designed to pick the member with the lowest latency that also meets the SLA. It directly aligns with the goal of preferring the lowest latency path for the SaaS application. Other strategies consider cost, bandwidth, or a composite quality score, which do not guarantee the lowest latency.

Answer

Best Quality (SLA)

Answer

Maximize Bandwidth (SLA)

Answer

Lowest Cost (SLA)

Question 3

What is the effect of changing the 'Hold-down' timer in a Performance SLA?

Accepted Answer

It prevents route flapping by delaying the transition back to an 'up' state.. The Hold-down timer in a Performance SLA defines how long the SLA must remain in a healthy state before FortiOS marks it as 'up' again after a failure. This delay prevents rapid up/down flapping of the SLA state, which would otherwise cause routes to oscillate between members.

Answer

It changes the frequency of the probes.

Answer

It sets the maximum number of failed probes allowed.

Answer

It determines the timeout duration for a single probe.

Question 4

When using SD-WAN zones, what is the primary benefit of grouping multiple physical interfaces into a single zone?

Accepted Answer

It allows you to apply a single firewall policy to the entire group.. SD-WAN zones allow multiple physical interfaces to be grouped and referenced as a single logical interface in firewall policies and SD-WAN rules. The primary benefit is that a single firewall policy can be applied to the entire group, simplifying configuration and ensuring consistent security and routing treatment across all member links. This reduces policy sprawl and administrative overhead.

Answer

It increases the throughput of individual physical links.

Answer

It prevents the need for performance SLAs.

Answer

It automatically enables load balancing between interfaces.

Question 5

You are adding a new physical interface to an existing SD-WAN deployment. Which step must be completed before the interface can be referenced by an SD-WAN rule?

Accepted Answer

Assign the interface to an SD-WAN zone.. SD-WAN rules match on zones, so an interface must first be assigned to an SD-WAN zone before it can be selected by any rule. Static routes, management designation, and virtual wire pairing do not confer rule eligibility. Zone membership is the mandatory prerequisite in the configuration workflow.

Answer

Enable the interface as a dedicated management port.

Answer

Create a static route that points to the interface.

Answer

Bind the interface to a virtual wire pair.

Question 6

An administrator is using FortiManager to manage SD-WAN configurations for multiple FortiGates. They need to update the SD-WAN template to change the health check target for all devices. After modifying the template, they want to ensure the changes are pushed to all managed FortiGates efficiently. Which action should they take in FortiManager?

Accepted Answer

Use the 'Install Wizard' to install the template on all managed FortiGates.. The Install Wizard in FortiManager is designed to deploy configuration changes, including SD-WAN template updates, to multiple managed FortiGates in one operation. This method is efficient, reduces manual effort, and ensures that all devices receive the updated configuration consistently, which is essential for large-scale SD-WAN deployments.

Answer

Export the template and import it on each FortiGate via CLI.

Answer

Install the template on each FortiGate individually.

Answer

Modify the template and wait for automatic synchronization.

Question 7

A network administrator is using FortiManager to manage SD-WAN configurations for multiple FortiGates. The administrator wants to define a health check that will be used across several SD-WAN templates and needs to ensure that any changes to this health check are automatically propagated to all templates that reference it. Which FortiManager object should the administrator create?

Accepted Answer

SD-WAN health check. The correct answer is an SD-WAN health check object. FortiManager allows you to create reusable health check definitions that can be referenced by multiple SD-WAN templates. This ensures that when the health check parameters are updated, all templates using it reflect the changes automatically, maintaining consistency and reducing administrative overhead across managed devices.

Answer

SD-WAN template

Answer

Virtual IP

Answer

Firewall address object

Question 8

You are configuring an SD-WAN rule to route traffic to a critical SaaS application. You want the rule to select the best link based on multiple performance metrics: latency, jitter, and packet loss. You have created a Performance SLA that monitors these metrics. Which SD-WAN rule strategy should you use to achieve this?

Accepted Answer

Best Quality. The Best Quality strategy is designed to select the SD-WAN member that offers the best performance according to the SLA metrics. It continuously monitors latency, jitter, and packet loss, and dynamically chooses the link with the highest quality. This ensures that critical traffic always uses the optimal path, improving user experience.

Answer

Manual

Answer

Load Balance

Answer

Priority

Question 9

What is the purpose of the 'Gateway' override in an SD-WAN member configuration?

Accepted Answer

To specify a manual gateway for the SD-WAN member.. The Gateway override in an SD-WAN member configuration lets the administrator manually specify the next-hop gateway IP for that member interface, overriding the gateway learned via DHCP or the interface's default. This is used when the SD-WAN member's traffic must be sent to a specific next-hop — for example, when the ISP provides a gateway that differs from the DHCP-assigned one, or when the interface is in a non-standard topology. It does not change which ISP is used or bypass policies; it only pins the next-hop.

Answer

To force the use of a secondary ISP.

Answer

To bypass the firewall policy.

Answer

To enable load balancing.

Question 10

An administrator is configuring an IPsec VPN tunnel that will be used as an SD-WAN member. The tunnel must be able to carry multicast traffic for OSPF. Which IPsec Phase 2 configuration parameter must be enabled to support this requirement?

Accepted Answer

Enable 'Multicast' in Phase 2.. To carry multicast traffic such as OSPF hellos over an IPsec tunnel, the Phase 2 configuration must have the 'Multicast' option enabled. This allows the tunnel to encapsulate and forward multicast and broadcast packets, which are otherwise blocked by default. Enabling this is essential for dynamic routing protocols to operate over IPsec.

Answer

Enable 'Diffie-Hellman Group 14' in Phase 2.

Answer

Enable 'Auto-negotiate' in Phase 2.

Answer

Enable 'Replay Detection' in Phase 2.

Question 11

A network administrator is managing a FortiManager that has provisioned an SD-WAN template to a group of managed FortiGates. The administrator needs to verify that each FortiGate is actually running the intended SD-WAN configuration and that no device is out of sync. Which FortiManager workflow should the administrator use to compare the intended SD-WAN template configuration against the running configuration on each managed device?

Accepted Answer

Use the Configuration Diff feature in FortiManager to compare the device's running configuration with the provisioned template.. FortiManager's Configuration Diff feature is designed to compare the intended configuration from templates and policy packages with the actual running configuration on a managed FortiGate. It highlights differences so administrators can detect drift, such as manual CLI changes, and ensure the SD-WAN template is correctly applied and synchronized across all managed devices.

Answer

Review the FortiManager Task Monitor for successful installation logs of the SD-WAN template.

Answer

Use the Reinstall Policy Package option on each managed FortiGate from the Device Manager.

Answer

Run a CLI script from FortiManager that executes 'get system status' on all managed FortiGates.

Question 12

You are configuring an SD-WAN rule that must load-balance traffic across two WAN links while guaranteeing that both links meet a 100 ms latency SLA. Which strategy should you select for the rule?

Accepted Answer

SLA. The SLA strategy is the only one that both filters members by the referenced Performance SLA and spreads sessions over all qualifying members. Lowest Cost (SLA), Maximum Bandwidth (SLA), and Best Quality all pick a single preferred member, so they fail the load-balancing half of the requirement. Only the SLA strategy keeps both links in use while each meets the 100 ms latency threshold.

Answer

Maximum Bandwidth (SLA)

Answer

Best Quality

Answer

Lowest Cost (SLA)

Question 13

What is required before FortiManager can display SD-WAN monitoring data?

Accepted Answer

The FortiGate must be sending logs to FortiManager. FortiManager's SD-WAN Monitor relies on log data received from managed FortiGates to populate its dashboards and health-check widgets. Without the FortiGate forwarding its logs (including SD-WAN and SLA health-check logs) to FortiManager, the monitor has no telemetry to display. The cloud license, firmware version, and operating mode are not prerequisites for the SD-WAN Monitor to render data.

Answer

The FortiGate must have a cloud license

Answer

The FortiGate must be running a specific firmware

Answer

The FortiGate must be in Transparent mode

Question 14

An administrator wants to apply a Web Filtering security profile to traffic that is being dynamically steered via an SD-WAN rule. Where must this security profile be enforced in FortiOS?

Accepted Answer

Inside the firewall policy that matches the traffic being steered by the SD-WAN rule. In FortiOS, security profiles such as Web Filtering are enforced by the firewall policy that matches the traffic, not by the SD-WAN rule itself. SD-WAN rules only determine the outgoing interface or path; they do not apply security inspection. Therefore, the Web Filtering profile must be attached to the firewall policy that permits and steers the traffic via the SD-WAN rule.

Answer

Directly inside the SD-WAN rule configuration under the advanced settings tab

Answer

Globally under the system settings as an SD-WAN overlay inspection profile

Answer

Within the IPsec tunnel phase 2 security association settings

Question 15

An administrator troubleshoots a scenario where traffic matching an application-based SD-WAN rule is bypassing the preferred high-speed MPLS tunnel and taking the backup broadband tunnel instead. Which THREE factors should the administrator check to resolve this routing discrepancy? (Choose three)

Accepted Answer

Inspect the member priorities and weights configured within the specific SD-WAN rule. Option C is correct because SD-WAN rule member priorities and weights directly determine which member is preferred; if the MPLS member has a lower priority or weight than the broadband member, traffic will be steered to broadband. Option D is correct because the SD-WAN engine continuously probes members against the configured performance SLA (e.g., latency, jitter, packet loss); if MPLS fails those thresholds, it is marked ineligible and the next-best member (broadband) is selected. Option E is correct because SD-WAN rules are evaluated top-down by sequence order, so an earlier rule matching the same application/traffic could override the intended rule and send traffic out the broadband tunnel. Option A is irrelevant because changing the default admin password is a hardening step unrelated to SD-WAN path selection. Option B is irrelevant because cable category is a physical-layer attribute that does not influence SD-WAN rule matching or member eligibility decisions.

Answer

Verify the FortiGate factory default administrator password is changed

Answer

Check the physical layer OSI Model cable category connected to the FortiGate port

Question 16

Which THREE factors can affect the 'Performance SLA' logic in an SD-WAN template?

Accepted Answer

Packet loss threshold. The Performance SLA logic in an SD-WAN template is driven by the SLA criteria defined for each member, and those criteria are the three measured metrics: packet loss threshold (A), jitter threshold (C), and latency threshold (E). FortiGate continuously probes each SD-WAN member (e.g., via ping or HTTP) and compares the measured packet loss, jitter, and latency against these configured thresholds to determine whether the link is within SLA and to trigger SLA-based steering or failover. Option B is incorrect because the FortiGate firmware version is not an SLA metric; it may affect available features but does not feed the Performance SLA calculation. Option D is incorrect because the number of active VPN tunnels is a topology/state value, not a measured SLA parameter used by the Performance SLA logic.

Answer

The firmware version of the FortiGate

Answer

The number of active VPN tunnels

Question 17

Which TWO of the following are benefits of using SD-WAN templates in FortiManager?

Accepted Answer

Consistent SD-WAN policy application across devices. Option A is correct because SD-WAN templates in FortiManager let you define SD-WAN settings (members, zones, health checks, and rules) once and assign them to many managed FortiGates, ensuring the same SD-WAN policy is applied consistently across devices. Option E is correct because these templates enable simplified, scalable configuration deployment for large branch deployments by pushing a standardized SD-WAN configuration to many FortiGates at once instead of configuring each device individually. Option B is not correct because firmware upgrades are handled by FortiManager's firmware management features, not by SD-WAN templates. Option C is not correct because log analysis is performed by FortiAnalyzer, not by SD-WAN templates in FortiManager. Option D is not correct because direct CLI access is a separate administrative capability and is not a benefit provided by SD-WAN templates.

Answer

Automatic firmware upgrades

Answer

Automated log analysis

Answer

Direct access to the FortiGate CLI

Question 18

Which TWO configuration changes require a push from FortiManager to the FortiGate?

Accepted Answer

Changes to an SD-WAN template. Option B is correct because SD-WAN templates are FortiManager-managed objects: when you edit an SD-WAN template in FortiManager, the change is stored in the ADOM and must be installed/pushed to the managed FortiGate for it to take effect. Option C is correct because a firewall policy package is also a FortiManager-managed configuration object, so any modification must be installed to the target FortiGate device. Option A is incorrect because changes made directly in the FortiGate local GUI are local to the device and do not require a FortiManager push. Option D is incorrect because adding a local user directly on the FortiGate is a local device change, not a FortiManager-managed object requiring installation. Option E is incorrect because changing the FortiManager admin password affects only FortiManager itself and is not pushed to managed FortiGates.

Answer

Changes to the log settings on the FortiGate local GUI

Answer

Adding a new user to the FortiGate local database

Answer

Changing the FortiManager admin password

Question 19

An enterprise network uses ADVPN 2.0 with BGP running over IPsec tunnels. A spoke needs to initiate a shortcut tunnel to another spoke. Which FortiOS CLI command is used on the hub to verify the active shortcut tunnels and view the shortcut state information?

Accepted Answer

diagnose vpn tunnel list. The command 'diagnose vpn tunnel list' on the hub displays all active IPsec tunnels, including ADVPN shortcut tunnels established between spokes. It shows tunnel names, source/destination IPs, and state information, allowing the administrator to verify that shortcut tunnels are up and active. This is the standard FortiOS diagnostic command for inspecting IPsec tunnel status in ADVPN deployments.

Answer

execute router clear bgp all

Answer

get system sdwan neighbor

Answer

diagnose netlink interface list

Question 20

In SD-WAN central management, what is the 'SD-WAN Zone' used for?

Accepted Answer

To group multiple SD-WAN members for logical policy routing. In SD-WAN central management, an SD-WAN Zone is a logical grouping of multiple SD-WAN members (interfaces or tunnels) that share the same path selection and policy routing characteristics. It allows administrators to apply policies to a group of links rather than individual interfaces, simplifying configuration and enabling logical routing decisions based on zone-level metrics.

Answer

To define the physical port speed

Answer

To limit bandwidth for specific users

Answer

To isolate the SD-WAN traffic from the WAN