NSE7_SDW Practice Test 4 — 10 Questions

Question 1

If an SD-WAN template contains a reference to an interface that does not exist on a target FortiGate, what occurs during the installation process?

Accepted Answer

The installation fails with a configuration error. When an SD-WAN template references an interface that does not exist on the target FortiGate, the installation process fails with a configuration error. The template cannot be applied because the referenced interface is missing, and FortiManager reports the failure.

Answer

The FortiGate automatically creates a dummy interface

Answer

The installation proceeds and ignores the missing interface

Answer

The FortiGate enters an 'Emergency' state

Question 2

A network administrator is using FortiManager to manage an SD-WAN deployment. They want to create a new SD-WAN template that includes a health check for the 'MPLS' interface. Where in the FortiManager GUI should the administrator navigate to create this template?

Accepted Answer

Policy & Objects > SD-WAN Templates. SD-WAN templates in FortiManager are created under Policy & Objects > SD-WAN Templates. This section provides the interface to define templates that can include SD-WAN interfaces, Performance SLAs, and rules. Once created, these templates can be assigned to policy packages and installed on managed FortiGates, enabling centralized management of SD-WAN configurations across multiple devices.

Answer

FortiView > SD-WAN > Templates

Answer

System Settings > SD-WAN > Template Library

Answer

Device Manager > SD-WAN > Templates

Question 3

Which object must be created before assigning a health check to an SD-WAN service rule in an SD-WAN template?

Accepted Answer

An SD-WAN Health Check. Before assigning a health check to an SD-WAN service rule in an SD-WAN template, you must first create an SD-WAN Health Check object. The health check defines the probe parameters (protocol, interval, failure thresholds) that determine link quality and availability for the service rule.

Answer

A routing protocol

Answer

A firewall address object

Answer

An SD-WAN Zone

Question 4

An SD-WAN rule is configured with the Best Quality strategy and includes two members: WAN1 and WAN2. The Performance SLA for both members is set to monitor latency, jitter, and packet loss. The SLA thresholds are latency 100 ms, jitter 20 ms, and packet loss 1%. Currently, WAN1 has latency 80 ms, jitter 10 ms, and packet loss 0.5%; WAN2 has latency 90 ms, jitter 25 ms, and packet loss 0.2%. Both members are up. Which member will be selected by the Best Quality strategy?

Accepted Answer

WAN1, because it meets all SLA thresholds while WAN2 exceeds the jitter threshold.. The Best Quality strategy selects the member that meets all SLA thresholds and has the best overall quality. WAN1 satisfies latency, jitter, and packet loss thresholds, while WAN2 violates the jitter threshold. Therefore, WAN2 is excluded, and WAN1 is chosen as the only compliant member.

Answer

WAN2, because it has lower packet loss than WAN1, which is the most important metric.

Answer

WAN2, because it has the lowest latency among the members that meet the packet loss threshold.

Answer

Neither member will be selected because both must meet all SLA thresholds for any to be chosen.

Question 5

Which TWO methods can be used to update SD-WAN policies across all managed devices in FortiManager?

Accepted Answer

Using a CLI script to push updates. Option A is correct because FortiManager allows administrators to run CLI scripts (via Script > Scripts, executed with 'Run Script' or as part of a policy package install) that push configuration commands to all managed FortiGates, which can include SD-WAN policy changes. Option B is correct because SD-WAN templates in FortiManager (found under Policy & Objects > SD-WAN Templates or in the SD-WAN Manager) are centralized configuration templates; modifying the template and then installing the changes to the managed devices propagates the updated SD-WAN policies to all devices assigned to that template. Option C is not correct because editing an individual FortiGate policy only affects that single device, not all managed devices. Option D is not correct because creating a new ADOM is an administrative grouping action and does not update SD-WAN policies on existing managed devices. Option E is not correct because rebooting FortiManager does not push or update any SD-WAN policy configuration to managed devices.

Answer

Editing the individual FortiGate policy

Answer

Creating a new ADOM

Answer

Rebooting the FortiManager

Question 6

An administrator is troubleshooting an IPsec VPN tunnel that is part of an SD-WAN zone. The tunnel is up, but SD-WAN health checks are failing, causing the tunnel to be marked as down. The administrator verifies that the Phase 2 selectors include the health check server's IP address. What is the next most likely cause to investigate?

Accepted Answer

The health check server is not reachable via the tunnel due to missing route.. After verifying Phase 2 selectors, the next most likely cause for SD-WAN health check failure on an up tunnel is a missing route to the health check server. Without a route, the probes cannot reach the server, and the health check fails. The other options are either contradicted by the scenario (tunnel up) or less likely given the context. Ensuring proper routing is essential for health checks to traverse the tunnel.

Answer

The tunnel interface is not added to the SD-WAN zone.

Answer

The SD-WAN health check is configured with the wrong protocol (e.g., HTTP instead of ping).

Answer

The IPsec tunnel's Phase 1 proposal does not match the remote gateway.

Question 7

You are building a new SD-WAN template in FortiManager to push to 40 branch FortiGates. The template must define two SD-WAN zones, the member interfaces, and the Performance SLA health checks, but the branch WAN IP addresses differ per site and must not be part of the template. Which FortiManager object type should you use to package the shared SD-WAN configuration?

Accepted Answer

An SD-WAN template in the FortiManager device manager. The SD-WAN template is the FortiManager object designed to normalize SD-WAN zones, member mappings, Performance SLA checks, and rules across many FortiGates. Keeping per-site WAN addressing out of the template is exactly what the normalized object model enables, since interface references resolve on each managed device. A CLI script or an address group cannot provide that reusable, metadata-aware structure.

Answer

A firewall address group object bound to the ADOM

Answer

A normalized interface template with SD-WAN member mappings

Answer

A CLI script template assigned through a policy package

Question 8

An administrator implements BGP over SD-WAN tunnels to a cloud provider. The cloud provider requires BGP MD5 authentication on all peering sessions. Where is BGP MD5 authentication configured on the FortiGate?

Accepted Answer

Under the router bgp neighbor configuration block in the CLI. BGP MD5 authentication is configured per neighbor under the 'config router bgp' → 'config neighbor' block using the 'set password' command. This applies TCP MD5 signature authentication to the BGP peering session, which the cloud provider requires for all peering sessions.

Answer

Within the firewall policy authentication settings

Answer

Under the IPsec phase 1 interface advanced settings

Answer

Inside the SD-WAN health check probe configuration

Question 9

A company uses FortiManager to manage 200 FortiGates with SD-WAN enabled. The administrator needs to update the SD-WAN health check settings for all branches to use a new server IP. The health check is referenced by a single SD-WAN template that is assigned to all branches. After modifying the health check object in FortiManager, what must the administrator do to apply the changes to all FortiGates?

Accepted Answer

Use the 'Install Wizard' to push the updated template to all managed FortiGates.. The correct action is to use the Install Wizard to push the updated template to all managed FortiGates. FortiManager's Install Wizard allows bulk installation of configuration changes, including SD-WAN templates and referenced objects like health checks. After modifying the shared health check, the administrator can select all affected devices and install the changes in a single operation, ensuring all branches receive the update efficiently.

Answer

Install the SD-WAN template on each FortiGate individually.

Answer

Manually edit the SD-WAN configuration on each FortiGate via CLI.

Answer

Reboot each FortiGate to apply the new health check settings.

Question 10

An administrator is creating an SD-WAN template in FortiManager and needs to define the member interfaces. Which FortiManager object is used to group these interfaces for the SD-WAN configuration?

Accepted Answer

SD-WAN zone. In FortiManager, SD-WAN zones are used to group member interfaces within an SD-WAN template. Zones allow policies and rules to reference a logical group rather than individual interfaces, simplifying configuration. The administrator defines zones and assigns interfaces to them. Other objects like address groups or interface groups serve different purposes and are not used for SD-WAN member grouping.

Answer

Virtual WAN link

Answer

Interface group

Answer

Firewall address group