NSE7_SDW Practice Test 3 — 30 Questions

Question 1

A FortiGate is configured with an SD-WAN rule that uses a health check to monitor two IPsec tunnels. The health check is configured with a single ping probe to 8.8.8.8. The administrator notices that the SD-WAN rule fails over to the secondary tunnel even when the primary tunnel is up, but with high latency. The administrator wants the health check to consider latency and only fail over when latency exceeds a threshold. What should the administrator configure to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable 'sla' in the health check and set the latency threshold to the desired value.. To make the health check consider latency and fail over only when latency exceeds a threshold, the administrator must enable SLA in the health check and set the latency threshold. This allows the FortiGate to monitor latency and trigger failover according to the configured threshold. Other options either do not enable latency monitoring or focus on different metrics.

Answer

Set the health check to use 'ping' with a larger packet size and configure 'sla' with packet loss threshold.

Answer

Add a second ping probe to a different destination and enable 'sla' with latency threshold.

Answer

Configure the health check to use 'http' probe and set latency threshold in the SLA.

Question 2

You are configuring an SD-WAN rule to load-balance traffic across three WAN links. You want to ensure that the rule uses all available links while respecting the SLA status of each member. Which strategy should you select?

Accepted Answer

Maximize Bandwidth (SLA). Maximize Bandwidth (SLA) is designed to load-balance traffic across all SD-WAN members that satisfy the SLA, effectively combining their bandwidth. The other strategies either select a single best or cheapest link, or use a priority order, none of which distribute traffic across all links. Thus, only Maximize Bandwidth (SLA) fulfills the requirement.

Answer

Priority

Answer

Best Quality

Answer

Lowest Cost (SLA)

Question 3

A network administrator is adding a new WAN interface to an existing SD-WAN deployment. The interface is currently not referenced by any SD-WAN zone. What is the required first step before the interface can be used as an SD-WAN member?

Accepted Answer

Assign the interface to an SD-WAN zone.. SD-WAN members are defined within SD-WAN zones. Before an interface can be configured as a member, it must be placed into a zone. This zone construct allows multiple interfaces to share the same steering and health-check logic. Only after zone assignment can the member be created and referenced by SD-WAN rules.

Answer

Add the interface to a virtual wire pair.

Answer

Enable DHCP client on the interface.

Answer

Create a static route pointing to the interface.

Question 4

An administrator is validating a new SD-WAN deployment before going live. The design requires that the FortiGate detect link degradation before users notice it and that failover decisions be based on measured path quality rather than physical link state. Which two configuration elements are required to meet these goals? (Choose two.)

Accepted Answer

A Performance SLA attached to the SD-WAN members, with latency, jitter, and packet-loss thresholds configured.. Proactive, quality-based failover requires two things working together: a Performance SLA that measures latency, jitter, and packet loss per member, and an SD-WAN rule that references those members and reacts to the SLA state. The SLA supplies the health signal, and the rule acts on it. Static routes, dead peer detection, and interface role labels do not provide quality measurement or trigger path changes based on degradation.

Answer

Dead peer detection enabled on each IPsec tunnel member.

Answer

Interface role set to WAN on every member interface.

Answer

A static route for each member pointing to its gateway, with equal distance values.

Question 5

An engineer is configuring an SD-WAN member on a FortiGate to use a static gateway that differs from the interface's detected next-hop. Which CLI configuration correctly applies this override?

Accepted Answer

config system sdwan / config members / edit 1 / set gateway 203.0.113.1. The SD-WAN member gateway setting under config system sdwan members is the designated override for the detected next-hop. It applies to both health-check probing and traffic forwarding decisions for that member. Configuring it elsewhere, such as on the interface or in a static route, does not change the SD-WAN member's gateway and will not produce the intended behavior.

Answer

config system interface / edit wan1 / set gateway 203.0.113.1

Answer

config router static / edit 0 / set gateway 203.0.113.1 / set interface wan1

Answer

config system sdwan / config health-check / edit "ping" / set gateway 203.0.113.1

Question 6

A FortiGate is configured with an SD-WAN rule that uses a health check to monitor an IPsec tunnel. The health check is configured with a ping probe to a remote IP. The administrator notices that the tunnel is marked as down even though the remote IP is reachable via the tunnel. What is a possible cause?

Accepted Answer

The health check's probe is using the wrong source interface, causing the probe to be sent outside the tunnel.. A health check probe must be sent through the correct interface to accurately test the tunnel. If the probe's source interface is misconfigured, the probe may bypass the tunnel and fail, causing the tunnel to be marked down despite being operational. Ensuring the health check uses the tunnel interface as the source is essential.

Answer

The health check is configured with 'security-mode' set to 'none', allowing probes to bypass the tunnel.

Answer

The health check is configured with 'protocol' set to 'ping' but the remote IP does not respond to ICMP.

Answer

The health check's source IP is not specified, so it uses the outgoing interface's IP, which is not routable over the tunnel.

Question 7

An administrator has configured an SD-WAN rule to steer traffic based on the "maximize bandwidth (SLA)" strategy. The rule uses two IPsec tunnels: one with 100 Mbps and one with 50 Mbps. The administrator expects traffic to be load-balanced proportionally to the bandwidth. However, all traffic is going through the 100 Mbps tunnel. What is the most likely reason?

Accepted Answer

The 50 Mbps tunnel is not meeting the SLA criteria, so it is excluded.. The "maximize bandwidth" strategy distributes traffic across links based on their available bandwidth, but only if they meet the SLA. If the 50 Mbps tunnel is not meeting the SLA, it is excluded, and all traffic goes to the 100 Mbps tunnel. The administrator should verify the health check status and SLA targets for the 50 Mbps tunnel.

Answer

The SD-WAN rule's priority is set to 1 for the 100 Mbps tunnel and 2 for the 50 Mbps tunnel.

Answer

The 50 Mbps tunnel is configured with a higher cost, causing it to be less preferred.

Answer

The "maximize bandwidth" strategy requires equal bandwidth links to load-balance.

Question 8

An administrator has an SD-WAN template in FortiManager that is already assigned to a managed FortiGate. The administrator edits the template to change the SD-WAN zone membership of an interface from 'virtual-wan-link' to a custom zone named 'overlay'. After saving the template, what must the administrator do to push this change to the FortiGate?

Accepted Answer

Install the policy package that contains the SD-WAN template to the managed FortiGate.. After modifying an SD-WAN template in FortiManager, the changes are not automatically pushed to managed FortiGates. The administrator must install the policy package that includes the SD-WAN template to the target device. This installation process compiles the template and device settings into a configuration that is pushed to the FortiGate, applying the updated zone membership.

Answer

Reboot the FortiGate so it pulls the updated template from FortiManager on startup.

Answer

Enable 'Auto Update' in the SD-WAN template settings so changes are pushed automatically.

Answer

Run the 'Retrieve' operation on the FortiGate from FortiManager to sync the change.

Question 9

An administrator is configuring an SD-WAN rule to route traffic from a specific source subnet to a destination subnet over a preferred IPsec tunnel. The administrator wants to ensure that if the preferred tunnel fails, traffic automatically switches to a backup tunnel. Which SD-WAN rule configuration is required to achieve this?

Accepted Answer

Configure the rule with multiple interfaces and associate a health check that includes both interfaces.. The correct answer is to configure the rule with multiple interfaces and associate a health check that includes both interfaces. This allows the SD-WAN rule to monitor the health of each interface and automatically switch to the backup if the preferred interface fails. Health checks are essential for dynamic failover in SD-WAN.

Answer

Configure the rule with a single interface and enable 'failover' in the rule settings.

Answer

Configure the rule with a single interface and rely on the FortiGate's routing table to fail over.

Answer

Configure the rule with multiple interfaces and set the strategy to 'lowest-cost'.

Question 10

A network administrator is using FortiManager to manage SD-WAN configurations for multiple FortiGates. The administrator wants to ensure that all devices use the same health check server IP address for their SD-WAN performance SLAs. Where in FortiManager should the administrator define this shared health check server?

Accepted Answer

In the SD-WAN template under 'Performance SLA' settings.. To ensure all managed FortiGates use the same health check server for SD-WAN performance SLAs, the administrator should define it in the SD-WAN template's 'Performance SLA' section. This template is then applied to multiple devices, propagating the health check server configuration consistently. This centralized approach is a key benefit of using FortiManager for SD-WAN management.

Answer

In the FortiGate's local CLI under 'config system sdwan'.

Answer

In the FortiManager 'Device Manager' under 'System Settings'.

Answer

In the 'Policy & Objects' section under 'Health Check' objects.

Question 11

You are configuring an SD-WAN rule to route business-critical traffic (HTTP and HTTPS) over the best available link based on lowest latency. You have two members in the SD-WAN zone: WAN1 and WAN2. You create a Performance SLA named 'Latency-SLA' that monitors 8.8.8.8 using ICMP probes with a threshold of 150 ms. You apply this SLA to both members. In the SD-WAN rule, you set the strategy to 'Lowest Latency' and select the SLA. After applying the configuration, you notice that HTTP traffic is still using WAN1 even though WAN2 has lower latency according to the SLA monitor. What is the most likely cause?

Accepted Answer

The SD-WAN rule is configured with a manual order or priority that overrides the latency-based selection, or the rule is not matching the HTTP traffic due to a missing service definition.. For an SD-WAN rule using 'Lowest Latency' strategy to select the best member, the rule must correctly match the traffic and not be overridden by another rule or manual priority settings. If the rule's service definition does not include HTTP/HTTPS, or if a higher-priority rule matches first, the latency-based selection will not apply. Verify rule order and match criteria.

Answer

The SD-WAN rule is missing a required 'Gateway' configuration for each member, so it cannot determine the next-hop for the lower-latency path.

Answer

The SD-WAN rule's 'Lowest Latency' strategy only considers latency if the members are in the same SD-WAN zone and the rule is applied to that zone; otherwise it defaults to the first member.

Answer

The Performance SLA must be configured with TCP probes on port 80 and 443 to accurately measure latency for HTTP and HTTPS traffic.

Question 12

An engineer is configuring a new SD-WAN deployment on a FortiGate running FortiOS 7.2. The SD-WAN zone named 'virtual-wan-link' already exists with two members, but the engineer needs to add a third member that is a VLAN sub-interface named 'WAN3_VLAN'. After adding the interface to the zone, traffic still does not traverse the new member. What is the most likely reason?

Accepted Answer

The VLAN interface does not have a gateway configured or the next-hop gateway is unreachable, causing the member to be marked as down by the health check.. Adding an interface to an SD-WAN zone does not automatically make it usable. The member must have a working next-hop gateway and pass the Performance SLA health check. If the gateway is missing or unreachable, the member remains down and the SD-WAN rule will not select it. Verifying the gateway and SLA status is the first troubleshooting step.

Answer

The VLAN interface was added to the zone but is not configured as a member of the SD-WAN rule, so it is not eligible for selection.

Answer

The VLAN interface must be assigned an IP address and have an administrative distance lower than the existing members before it can be used in the zone.

Answer

The VLAN interface is not referenced in any firewall policy, so the FortiGate cannot forward traffic through it.

Question 13

You are setting up an SD-WAN configuration on a FortiGate. You want to ensure that the SD-WAN rules you create will be able to use the WAN interfaces. You have already configured the interfaces with IP addresses and default gateways. Which additional configuration object must you create to group the interfaces for use in SD-WAN rules?

Accepted Answer

An SD-WAN zone.. SD-WAN zones are the correct configuration object to group member interfaces for use in SD-WAN rules. They allow you to manage multiple WAN links as a single entity in rules, simplifying policy creation and enabling dynamic path selection based on performance SLAs.

Answer

A software switch.

Answer

A virtual domain (VDOM) for each WAN interface.

Answer

A link aggregation group (LAG).

Question 14

You are configuring an SD-WAN rule to route VoIP traffic. You want the rule to select the member with the best quality for voice, considering both latency and jitter. You have enabled Performance SLA on both WAN1 and WAN2, monitoring latency and jitter. You need to ensure the rule uses the appropriate strategy and that the SLA is correctly referenced. Which two actions must you perform to achieve this? (Choose two.)

Accepted Answer

Set the SD-WAN rule strategy to 'Best Quality'.. To route VoIP traffic based on both latency and jitter, set the SD-WAN rule strategy to 'Best Quality' and ensure the Performance SLA that monitors these metrics is assigned to the relevant SD-WAN members. This allows the SD-WAN engine to evaluate the quality of each link and select the best one for voice traffic.

Answer

Enable 'Link Health Monitor' on the SD-WAN rule.

Answer

Configure the Performance SLA to use HTTP probes to measure jitter.

Answer

Set the SD-WAN rule strategy to 'Lowest Latency'.

Question 15

A network administrator is configuring an SD-WAN rule to steer traffic from the internal network to a critical cloud application. The rule uses the 'SLA' strategy and references a Performance SLA that monitors latency and jitter. The administrator notices that traffic is intermittently being sent over a WAN link that does not meet the SLA thresholds. The Performance SLA is configured with a probe interval of 5 seconds and a failure threshold of 3. What is the most likely reason for this intermittent behavior?

Accepted Answer

The Performance SLA probe interval and failure threshold cause a delay in marking the member as out of SLA, allowing traffic to continue briefly after the threshold is exceeded.. The Performance SLA evaluates member health based on probe results. With a probe interval of 5 seconds and a failure threshold of 3, the member is only marked as out of SLA after three consecutive failed probes, which takes at least 15 seconds. During that period, the SD-WAN rule continues to consider the member as meeting the SLA and may route traffic over it. This delay causes intermittent use of a link that has actually breached the latency or jitter thresholds.

Answer

The SD-WAN rule is incorrectly configured with a manual priority that overrides the SLA status.

Answer

The Performance SLA is only applied to one member, so the other member's SLA status is unknown and defaults to in-SLA.

Answer

The SD-WAN rule is using the 'SLA' strategy, which only considers the first member that meets the SLA and does not re-evaluate until the member fails completely.

Question 16

You are configuring an SD-WAN rule to steer traffic to a business-critical application. The rule uses the 'Lowest Cost (SLA)' strategy with two members: a low-cost broadband link and an expensive MPLS link. The broadband link meets the SLA most of the time but occasionally experiences high latency. You want traffic to prefer the broadband link but fail over to MPLS when broadband violates the SLA. Which additional configuration is required to ensure the rule behaves as intended?

Accepted Answer

Configure a Performance SLA and associate it with the SD-WAN rule.. The 'Lowest Cost (SLA)' strategy chooses the lowest-cost member that satisfies the SLA defined in a Performance SLA. The Performance SLA must be created separately and then referenced by the SD-WAN rule. Without it, the rule has no way to evaluate link health, so it may not fail over when the broadband link degrades. Associating a Performance SLA with appropriate thresholds ensures the rule dynamically selects the MPLS link when broadband violates the SLA.

Answer

Enable 'SLA Target' on the rule and specify the required latency threshold.

Answer

Set the broadband member's priority to a lower value than the MPLS member.

Answer

Set the MPLS member's cost to a lower value than the broadband member.

Question 17

An engineer needs to configure an SD-WAN rule that sends traffic out the member with the lowest latency for a specific application, but also wants the rule to automatically fail over to the next-best member if the primary member's latency exceeds a threshold. Which SD-WAN strategy and configuration should be used?

Accepted Answer

Use the lowest-latency strategy and enable the performance SLA on the members.. The lowest-latency strategy is the only one that actively measures latency and selects the member with the best value. When combined with a performance SLA that defines a latency threshold, the member is marked out of SLA if the threshold is exceeded, triggering failover to the next-best member. This provides both optimal path selection and automatic failover.

Answer

Use the manual strategy and specify a preferred member order.

Answer

Use the priority strategy and assign priorities to members.

Answer

Use the volume-based strategy and set a maximum bandwidth threshold.

Question 18

A company has an SD-WAN deployment with three members: port1 (MPLS), port2 (Broadband), and port3 (LTE). The administrator wants to ensure that business-critical traffic uses port1 whenever it meets the SLA, but if port1 fails the SLA, traffic should use port2. If both port1 and port2 fail, traffic should use port3. Which SD-WAN rule strategy should be used to achieve this?

Accepted Answer

Priority. The 'Priority' strategy is designed for active/standby failover based on SLA status. The administrator assigns a priority value to each member; lower values indicate higher priority. The SD-WAN rule will select the highest-priority member that meets the referenced Performance SLA. If that member fails the SLA, the next priority member is chosen. This provides the exact behavior described: port1 preferred, then port2, then port3, all conditional on SLA compliance.

Answer

Lowest Cost

Answer

Best Quality

Answer

Maximize Bandwidth

Question 19

You are troubleshooting an SD-WAN deployment where a rule configured with the 'Best Quality' strategy is not selecting the expected member. The Performance SLA shows that member1 has lower latency and jitter than member2, yet traffic is using member2. Which factor should you verify first?

Accepted Answer

Check whether the SD-WAN rule is placed above a conflicting rule in the rule list.. SD-WAN rules are processed sequentially, and the first rule that matches the traffic is used. If an earlier rule matches the same traffic, it will dictate member selection, potentially overriding the intended 'Best Quality' rule. Therefore, checking rule order is the logical first step. Other factors like cost or SLA algorithm are not relevant to the 'Best Quality' strategy, which selects the member with the best measured performance.

Answer

Confirm that member1 has a lower cost than member2.

Answer

Ensure that the Performance SLA is configured with the 'Best Quality' algorithm.

Answer

Verify that the 'Best Quality' strategy is supported on the FortiGate model.

Question 20

An administrator is configuring SD-WAN on a FortiGate with two WAN interfaces: port1 and port2. They need to ensure that the SD-WAN can properly direct traffic based on application type and link performance. Which two configuration steps are required to enable application-based steering with SLA enforcement? (Choose two.)

Accepted Answer

Create an SD-WAN zone and add port1 and port2 as members.. To enable application-based steering with SLA enforcement, the administrator must first create an SD-WAN zone and add the WAN interfaces as members. Then, a Performance SLA must be configured and applied to the zone to monitor link health. These two steps provide the foundation for SD-WAN rules to match applications and steer traffic based on SLA status. Without the zone, members cannot be managed collectively; without the SLA, there is no performance data to enforce.

Answer

Create a firewall policy that includes the SD-WAN zone as the outgoing interface and enable NAT.

Answer

Configure a static route for each WAN interface with the same distance.

Answer

Enable application control on the firewall policy that references the SD-WAN zone.