NSE7_SDW Practice Test 2 — 30 Questions

Question 1

You are troubleshooting an issue where traffic is not using an SD-WAN rule despite meeting criteria. What is the most likely cause?

Accepted Answer

A higher-priority SD-WAN rule is matching the traffic first.. SD-WAN rules are evaluated top-down. If a higher-priority rule matches the traffic, the lower-priority rule will never be reached.

Answer

The SD-WAN rule is disabled.

Answer

The Performance SLA has timed out.

Answer

The interface is not in an SD-WAN zone.

Question 2

An enterprise network uses OSPF over SD-WAN IPsec tunnels. The administrator notices that OSPF adjacency is constantly dropping over a specific backup SD-WAN member link due to intermittent packet loss. Which THREE configuration adjustments can improve OSPF stability over unstable SD-WAN IPsec links? (Choose three)

Accepted Answer

Configure OSPF network type as point-to-point on the IPsec tunnel interfaces to eliminate unnecessary DR/BDR elections. To stabilize OSPF over unstable WAN links, adjusting OSPF hello and dead intervals, configuring OSPF dead-drop or fast-hello settings carefully, or utilizing passive interfaces/MD5 authentication correctly helps. Furthermore, ensuring that OSPF timers match and are relaxed prevents unnecessary adjacency drops.

Answer

Set the OSPF router ID to 0.0.0.0 on all branch spokes

Answer

Disable OSPF hello packets entirely and rely on static default routes

Question 3

An administrator troubleshoots a scenario where traffic matching an application-based SD-WAN rule is bypassing the preferred high-speed MPLS tunnel and taking the backup broadband tunnel instead. Which THREE factors should the administrator check to resolve this routing discrepancy? (Choose three)

Accepted Answer

Inspect the member priorities and weights configured within the specific SD-WAN rule. When an SD-WAN rule bypasses preferred paths, potential causes include SLA health check failure (the preferred link fails the SLA threshold), incorrect rule evaluation order (an earlier rule matches first), or interface priority/weight settings within the rule. Checking these three areas is standard practice.

Answer

Verify the FortiGate factory default administrator password is changed

Answer

Check the physical layer OSI Model cable category connected to the FortiGate port

Question 4

An enterprise deploys ADVPN 2.0 with BGP and security profiles applied to traffic traversing the VPN overlay. Which THREE statements are correct regarding how security profiles and ADVPN 2.0 interact in FortiOS? (Choose three)

Accepted Answer

SSL inspection (DPI) applied on spoke firewall policies inspects decrypted traffic traversing the ADVPN shortcut tunnel. In ADVPN 2.0, when spokes establish direct shortcut tunnels, data flows directly between spokes without passing through the hub. Therefore, firewall policies and security profiles enforcing inspection must exist on the spoke FortiGates, not just the hub. Additionally, shortcut tunnels permit direct inspection on the spoke interfaces.

Answer

ADVPN 2.0 automatically disables all firewall inspection profiles on shortcut interfaces to maximize throughput

Answer

The hub FortiGate inspects all data packets exchanged between spokes even after a direct shortcut tunnel is established

Question 5

An administrator is troubleshooting BGP route propagation over SD-WAN IPsec tunnels where a branch office is not receiving specific routes from the datacenter hub. Which TWO CLI commands on the FortiGate are most useful for diagnosing BGP peering and advertised route issues? (Choose two)

Accepted Answer

get router info bgp neighbors advertised-routes. To troubleshoot BGP routing issues on FortiOS, commands examining the BGP summary, advertised routes, and received routes are essential. These include 'get router info bgp summary' and 'get router info bgp neighbors <ip> advertised-routes'.

Answer

execute ipsec tunnel list

Answer

diagnose sys sdwan member

Answer

get system interface physical

Question 6

Which command is used to verify the current status of SD-WAN members and their SLA health from the CLI?

Accepted Answer

diagnose sys sdwan health-check. The command 'diagnose sys sdwan health-check' shows the status of configured health checks and member reachability.

Answer

show router info bgp

Answer

get system interface

Answer

get system sdwan member

Question 7

When using SD-WAN templates, how are SD-WAN rules ordered?

Accepted Answer

Top to bottom. SD-WAN rules are evaluated from top to bottom, similar to standard firewall policies.

Answer

Based on the creation date

Answer

By the interface speed

Answer

Randomly

Question 8

When configuring SD-WAN services in a template, what does the 'Performance SLA' setting determine?

Accepted Answer

The criteria for path selection based on link quality. The Performance SLA defines the criteria (latency, jitter, loss) that must be met for a path to be considered 'healthy' for traffic.

Answer

The physical port priority

Answer

The maximum bandwidth allowed

Answer

The number of tunnels created

Question 9

Which THREE factors can affect the 'Performance SLA' logic in an SD-WAN template?

Accepted Answer

Packet loss threshold. Performance SLA evaluates paths based on measured latency, jitter, and packet loss compared to defined thresholds.

Answer

The firmware version of the FortiGate

Answer

The number of active VPN tunnels

Question 10

Which TWO configuration changes require a push from FortiManager to the FortiGate?

Accepted Answer

Changes to an SD-WAN template. Any change made in the FortiManager policy or template objects requires a push to keep the device config synchronized.

Answer

Changes to the log settings on the FortiGate local GUI

Answer

Adding a new user to the FortiGate local database

Answer

Changing the FortiManager admin password

Question 11

How can you verify that an SD-WAN configuration change was successfully applied to a FortiGate via FortiManager?

Accepted Answer

By checking the Device Manager installation status. The 'Installation' task status in the Task Monitor will show 'Success', and the device configuration history will show the synchronized state.

Answer

By checking the FortiAnalyzer logs

Answer

By restarting the FortiGate

Answer

By viewing the system dashboard of the FortiGate locally

Question 12

What happens if you modify an SD-WAN template that is already applied to a FortiGate?

Accepted Answer

The configuration status shows 'Modified' and requires an installation task. The change creates a configuration difference, which must be pushed to the device to take effect.

Answer

The changes take effect immediately without a push

Answer

The FortiGate automatically pulls the new config

Answer

The FortiGate configuration is reverted

Question 13

Which TWO of these are valid SD-WAN health check protocols?

Accepted Answer

HTTP. FortiGate SD-WAN supports multiple probes, including HTTP, Ping, and DNS, to verify link health.

Answer

SSH

Answer

FTP

Answer

SNMP

Question 14

In SD-WAN central management, what is the 'SD-WAN Zone' used for?

Accepted Answer

To group multiple SD-WAN members for logical policy routing. SD-WAN zones allow you to group multiple physical interfaces into a logical container for easier policy management.

Answer

To define the physical port speed

Answer

To limit bandwidth for specific users

Answer

To isolate the SD-WAN traffic from the WAN

Question 15

You have a large SD-WAN deployment. Why would you use a 'Centralized Policy' in FortiManager instead of local policies?

Accepted Answer

To enforce global security and traffic routing policies consistently across multiple sites. Centralized policy packages allow you to enforce security and SD-WAN routing rules consistently across the entire organization from one location.

Answer

To eliminate the need for logs

Answer

To reduce the CPU load on the FortiGate

Answer

To allow local admins to override global policies

Question 16

You are configuring SD-WAN templates in FortiManager. What is the primary purpose of using SD-WAN Central Management instead of configuring SD-WAN directly on individual FortiGates?

Accepted Answer

To enable SD-WAN template inheritance and synchronized policy updates across multiple managed devices. Central management enables consistent SD-WAN policy deployment, simplified configuration management across large-scale deployments, and centralized monitoring.

Answer

To perform local traffic analysis on the FortiGate only

Answer

To allow FortiGates to manage their own SD-WAN interfaces independently

Answer

To bypass the need for ADOMs

Question 17

If you modify a shared SD-WAN health check object that is referenced by ten different templates, what happens to the FortiGates?

Accepted Answer

All FortiGates using those templates will be affected after an install. The change affects all templates referencing that object; once pushed, the changes update the health check settings on all associated FortiGates.

Answer

The FortiGates will automatically revert to the old settings

Answer

The health check will be disabled on all devices

Answer

Only the templates are updated, not the FortiGates

Question 18

Which TWO of the following are benefits of using SD-WAN templates in FortiManager?

Accepted Answer

Consistent SD-WAN policy application across devices. Templates provide standardized configurations and reduce the administrative burden by avoiding per-device manual settings.

Answer

Automatic firmware upgrades

Answer

Automated log analysis

Answer

Direct access to the FortiGate CLI

Question 19

Which THREE tasks are required to successfully deploy SD-WAN via FortiManager?

Accepted Answer

Installing the configuration to the devices. Deployment requires defining the template, assigning it to devices, and installing the configuration.

Answer

Performing a hard factory reset on the FortiGate

Answer

Deleting all existing firewall policies

Question 20

Which TWO items must be configured within an SD-WAN template for SD-WAN traffic steering to work?

Accepted Answer

SD-WAN Members. You must define the members (interfaces) and the rules (policies) that dictate how traffic is steered.

Answer

DHCP server settings

Answer

VLAN tagging

Answer

Local users