NSE7_SDW Practice Test 2 — 30 Questions

Question 1

If an SD-WAN template contains a reference to an interface that does not exist on a target FortiGate, what occurs during the installation process?

Accepted Answer

The installation fails with a configuration error. When an SD-WAN template references an interface that does not exist on the target FortiGate, the installation process fails with a configuration error. The template cannot be applied because the referenced interface is missing, and FortiManager reports the failure.

Answer

The FortiGate automatically creates a dummy interface

Answer

The installation proceeds and ignores the missing interface

Answer

The FortiGate enters an 'Emergency' state

Question 2

A network administrator is using FortiManager to manage an SD-WAN deployment. They want to create a new SD-WAN template that includes a health check for the 'MPLS' interface. Where in the FortiManager GUI should the administrator navigate to create this template?

Accepted Answer

Policy & Objects > SD-WAN Templates. SD-WAN templates in FortiManager are created under Policy & Objects > SD-WAN Templates. This section provides the interface to define templates that can include SD-WAN interfaces, Performance SLAs, and rules. Once created, these templates can be assigned to policy packages and installed on managed FortiGates, enabling centralized management of SD-WAN configurations across multiple devices.

Answer

FortiView > SD-WAN > Templates

Answer

System Settings > SD-WAN > Template Library

Answer

Device Manager > SD-WAN > Templates

Question 3

Which object must be created before assigning a health check to an SD-WAN service rule in an SD-WAN template?

Accepted Answer

An SD-WAN Health Check. Before assigning a health check to an SD-WAN service rule in an SD-WAN template, you must first create an SD-WAN Health Check object. The health check defines the probe parameters (protocol, interval, failure thresholds) that determine link quality and availability for the service rule.

Answer

A routing protocol

Answer

A firewall address object

Answer

An SD-WAN Zone

Question 4

An SD-WAN rule is configured with the Best Quality strategy and includes two members: WAN1 and WAN2. The Performance SLA for both members is set to monitor latency, jitter, and packet loss. The SLA thresholds are latency 100 ms, jitter 20 ms, and packet loss 1%. Currently, WAN1 has latency 80 ms, jitter 10 ms, and packet loss 0.5%; WAN2 has latency 90 ms, jitter 25 ms, and packet loss 0.2%. Both members are up. Which member will be selected by the Best Quality strategy?

Accepted Answer

WAN1, because it meets all SLA thresholds while WAN2 exceeds the jitter threshold.. The Best Quality strategy selects the member that meets all SLA thresholds and has the best overall quality. WAN1 satisfies latency, jitter, and packet loss thresholds, while WAN2 violates the jitter threshold. Therefore, WAN2 is excluded, and WAN1 is chosen as the only compliant member.

Answer

WAN2, because it has lower packet loss than WAN1, which is the most important metric.

Answer

WAN2, because it has the lowest latency among the members that meet the packet loss threshold.

Answer

Neither member will be selected because both must meet all SLA thresholds for any to be chosen.

Question 5

Which TWO methods can be used to update SD-WAN policies across all managed devices in FortiManager?

Accepted Answer

Using a CLI script to push updates. Option A is correct because FortiManager allows administrators to run CLI scripts (via Script > Scripts, executed with 'Run Script' or as part of a policy package install) that push configuration commands to all managed FortiGates, which can include SD-WAN policy changes. Option B is correct because SD-WAN templates in FortiManager (found under Policy & Objects > SD-WAN Templates or in the SD-WAN Manager) are centralized configuration templates; modifying the template and then installing the changes to the managed devices propagates the updated SD-WAN policies to all devices assigned to that template. Option C is not correct because editing an individual FortiGate policy only affects that single device, not all managed devices. Option D is not correct because creating a new ADOM is an administrative grouping action and does not update SD-WAN policies on existing managed devices. Option E is not correct because rebooting FortiManager does not push or update any SD-WAN policy configuration to managed devices.

Answer

Editing the individual FortiGate policy

Answer

Creating a new ADOM

Answer

Rebooting the FortiManager

Question 6

An administrator is troubleshooting an IPsec VPN tunnel that is part of an SD-WAN zone. The tunnel is up, but SD-WAN health checks are failing, causing the tunnel to be marked as down. The administrator verifies that the Phase 2 selectors include the health check server's IP address. What is the next most likely cause to investigate?

Accepted Answer

The health check server is not reachable via the tunnel due to missing route.. After verifying Phase 2 selectors, the next most likely cause for SD-WAN health check failure on an up tunnel is a missing route to the health check server. Without a route, the probes cannot reach the server, and the health check fails. The other options are either contradicted by the scenario (tunnel up) or less likely given the context. Ensuring proper routing is essential for health checks to traverse the tunnel.

Answer

The tunnel interface is not added to the SD-WAN zone.

Answer

The SD-WAN health check is configured with the wrong protocol (e.g., HTTP instead of ping).

Answer

The IPsec tunnel's Phase 1 proposal does not match the remote gateway.

Question 7

You are building a new SD-WAN template in FortiManager to push to 40 branch FortiGates. The template must define two SD-WAN zones, the member interfaces, and the Performance SLA health checks, but the branch WAN IP addresses differ per site and must not be part of the template. Which FortiManager object type should you use to package the shared SD-WAN configuration?

Accepted Answer

An SD-WAN template in the FortiManager device manager. The SD-WAN template is the FortiManager object designed to normalize SD-WAN zones, member mappings, Performance SLA checks, and rules across many FortiGates. Keeping per-site WAN addressing out of the template is exactly what the normalized object model enables, since interface references resolve on each managed device. A CLI script or an address group cannot provide that reusable, metadata-aware structure.

Answer

A firewall address group object bound to the ADOM

Answer

A normalized interface template with SD-WAN member mappings

Answer

A CLI script template assigned through a policy package

Question 8

An administrator implements BGP over SD-WAN tunnels to a cloud provider. The cloud provider requires BGP MD5 authentication on all peering sessions. Where is BGP MD5 authentication configured on the FortiGate?

Accepted Answer

Under the router bgp neighbor configuration block in the CLI. BGP MD5 authentication is configured per neighbor under the 'config router bgp' → 'config neighbor' block using the 'set password' command. This applies TCP MD5 signature authentication to the BGP peering session, which the cloud provider requires for all peering sessions.

Answer

Within the firewall policy authentication settings

Answer

Under the IPsec phase 1 interface advanced settings

Answer

Inside the SD-WAN health check probe configuration

Question 9

A company uses FortiManager to manage 200 FortiGates with SD-WAN enabled. The administrator needs to update the SD-WAN health check settings for all branches to use a new server IP. The health check is referenced by a single SD-WAN template that is assigned to all branches. After modifying the health check object in FortiManager, what must the administrator do to apply the changes to all FortiGates?

Accepted Answer

Use the 'Install Wizard' to push the updated template to all managed FortiGates.. The correct action is to use the Install Wizard to push the updated template to all managed FortiGates. FortiManager's Install Wizard allows bulk installation of configuration changes, including SD-WAN templates and referenced objects like health checks. After modifying the shared health check, the administrator can select all affected devices and install the changes in a single operation, ensuring all branches receive the update efficiently.

Answer

Install the SD-WAN template on each FortiGate individually.

Answer

Manually edit the SD-WAN configuration on each FortiGate via CLI.

Answer

Reboot each FortiGate to apply the new health check settings.

Question 10

An administrator is creating an SD-WAN template in FortiManager and needs to define the member interfaces. Which FortiManager object is used to group these interfaces for the SD-WAN configuration?

Accepted Answer

SD-WAN zone. In FortiManager, SD-WAN zones are used to group member interfaces within an SD-WAN template. Zones allow policies and rules to reference a logical group rather than individual interfaces, simplifying configuration. The administrator defines zones and assigns interfaces to them. Other objects like address groups or interface groups serve different purposes and are not used for SD-WAN member grouping.

Answer

Virtual WAN link

Answer

Interface group

Answer

Firewall address group

Question 11

Which TWO of the following can be used as a 'Source' in an SD-WAN rule?

Accepted Answer

Source IP address object.. In an SD-WAN rule, the Source field matches traffic by the origin of the flow, and a Source IP address object (Option A) is a valid match criterion because SD-WAN rules can select traffic based on source address objects defined in the firewall address book. A User group (Option E) is also valid as a Source, since FortiGate SD-WAN rules can match traffic by authenticated user or user group identity, allowing policy-based steering per user population. SLA target name (Option B) is not a source match; it is a performance SLA object referenced in the rule's outgoing interface/strategy configuration to measure link health. Interface MAC address (Option C) is not a supported Source match criterion in SD-WAN rules, and Firewall policy ID (Option D) is not a source selector either, as policy IDs identify firewall policies rather than traffic origin.

Answer

SLA target name.

Answer

Interface MAC address.

Answer

Firewall policy ID.

Question 12

What is the impact of checking the 'Interface Preference' box in an SD-WAN rule?

Accepted Answer

It overrides the SLA strategy selection.. In Fortinet SD-WAN, the 'Interface Preference' option in an SD-WAN rule forces traffic to use a specific preferred interface (or set of interfaces) regardless of what the SLA strategy would otherwise select. This effectively overrides the SLA-based path selection, ensuring the rule's traffic egresses through the chosen member(s) even if another member has better SLA scores. It is used when business policy requires a specific WAN link for certain applications.

Answer

It enables failover to the default gateway.

Answer

It enables load balancing across interfaces.

Answer

It increases the probe frequency.

Question 13

You are configuring a Performance SLA to monitor reachability to a SaaS application. Which parameter determines the threshold for an interface to be considered 'unhealthy' in the SD-WAN routing table?

Accepted Answer

Packet Loss Threshold. The Packet Loss Threshold is one of the SLA criteria (along with latency and jitter) that determines when a member is marked unhealthy in the SD-WAN routing table. When the measured packet loss exceeds the configured threshold, the Performance SLA marks that member as out-of-SLA, and SD-WAN rules that require SLA compliance will stop selecting it. This is the parameter that directly defines the 'unhealthy' boundary for loss-based SLA evaluation.

Answer

Probe Mode

Answer

Sequence Number

Answer

Update Interval

Question 14

When creating an SD-WAN template, what must be defined before you can add an SD-WAN interface to the template?

Accepted Answer

Individual SD-WAN member interfaces. Before you can add an SD-WAN interface to an SD-WAN template in FortiManager, you must first define the individual SD-WAN member interfaces (the physical or logical links that will participate in SD-WAN). The template's SD-WAN interface object is built on top of these member interfaces, so they are the prerequisite.

Answer

The SD-WAN health check probes

Answer

Global firewall policies

Answer

The virtual domain (VDOM) settings

Question 15

A company has an SD-WAN template in FortiManager that is assigned to 50 FortiGates. The template includes a health check object named 'HC1' that monitors a server at 10.0.0.1. The administrator modifies 'HC1' to monitor 10.0.0.2 instead. After the change, the administrator notices that some FortiGates still show the old server IP in their running configuration. What is the most likely reason for this discrepancy?

Accepted Answer

The FortiGates with the old IP have not had the updated template installed yet.. The most likely reason is that the FortiGates with the old IP have not had the updated template installed. Modifying a health check object in FortiManager updates the configuration in the database, but the changes are not automatically pushed to managed devices. An install operation is required to apply the changes. If some devices were offline or excluded from the last install, they would retain the old configuration.

Answer

The FortiGates are using a cached version of the health check and need to be rebooted.

Answer

The health check object is locked and cannot be modified.

Answer

The health check object is not referenced correctly in the SD-WAN template.

Question 16

Which interface can be used as an SD-WAN member in an SD-WAN template?

Accepted Answer

Physical ports, VLANs, and VPN tunnels. In an SD-WAN template on FortiManager, SD-WAN members can be physical ports, VLAN interfaces, and VPN tunnels (including IPsec and ADVPN tunnels). This flexibility allows branches to use whatever WAN transport is available — a physical DSL port, a VLAN-tagged fiber connection, or an IPsec tunnel over the internet — as an SD-WAN member. The template abstracts these into SD-WAN zones and members for centralized management.

Answer

Only WAN physical ports

Answer

Only VLANs

Answer

Only loopback interfaces

Question 17

You have an SD-WAN rule with 'Priority' strategy. What happens if the highest priority member fails its SLA?

Accepted Answer

Traffic fails over to the member with the next highest priority value.. In an SD-WAN rule using the Priority strategy, members are ranked by priority value (lower number = higher priority). If the highest-priority member fails its SLA, FortiOS fails over to the next highest-priority member that is still SLA-compliant, preserving service continuity.

Answer

Traffic is dropped.

Answer

The FortiGate enters an error state.

Answer

Traffic is load balanced across all remaining members.

Question 18

You are configuring an SD-WAN rule that uses the 'lowest-cost (SLA)' strategy. You have three members: wan1 (cost 10), wan2 (cost 20), and wan3 (cost 30). All have Performance SLAs configured. Currently, wan1 and wan2 meet their SLAs, but wan3 does not. Which member will be selected for traffic matching this rule?

Accepted Answer

wan1, because it has the lowest cost and meets the SLA.. With lowest-cost (SLA) strategy, the FortiGate selects the member with the lowest cost that also meets its Performance SLA. wan1 has the lowest cost and meets SLA, so it is chosen. wan2 meets SLA but has a higher cost, and wan3 fails SLA so it is excluded. The rule does not require all members to meet SLA; it only needs at least one eligible member.

Answer

wan3, because it has the highest cost and thus the highest priority.

Answer

No member, because wan3 fails its SLA and the rule requires all members to meet SLA.

Answer

wan2, because it has the next lowest cost after wan1.

Question 19

You are configuring SD-WAN templates in FortiManager. What is the primary purpose of using SD-WAN Central Management instead of configuring SD-WAN directly on individual FortiGates?

Accepted Answer

To enable SD-WAN template inheritance and synchronized policy updates across multiple managed devices. SD-WAN Central Management in FortiManager enables the use of SD-WAN templates that can be inherited by multiple FortiGates, ensuring consistent configuration and synchronized policy updates across the managed estate. This centralizes control, reduces configuration drift, and simplifies large-scale deployments. The primary purpose is to achieve scalable, template-driven management rather than per-device manual configuration.

Answer

To perform local traffic analysis on the FortiGate only

Answer

To allow FortiGates to manage their own SD-WAN interfaces independently

Answer

To bypass the need for ADOMs

Question 20

An enterprise deploys BGP over SD-WAN with multiple MPLS and broadband connections. A route-map is applied to incoming BGP updates on the FortiGate to set a specific weight for routes learned over the MPLS interface. Why is the 'weight' attribute particularly effective in this FortiOS SD-WAN and BGP integration scenario?

Accepted Answer

Weight is evaluated first in the BGP best-path selection algorithm on FortiOS, allowing local preference override without altering global AS path attributes. In FortiOS BGP, the weight attribute is evaluated first in the best-path selection algorithm, before local preference and other attributes. Setting a higher weight on routes learned from the MPLS interface makes those routes preferred locally without affecting other routers, since weight is local to the FortiGate and not propagated in BGP updates. This allows granular, per-device control in an SD-WAN environment.

Answer

Weight replaces the need for SD-WAN SLA rules by performing layer 7 packet inspection

Answer

Weight automatically adjusts the SD-WAN health check probe frequency based on route stability

Answer

Weight is propagated to all iBGP peers, ensuring cluster-wide path synchronization