NSE7_SDW Practice Questions 1 — 50 Questions

Question 1

You are deploying a new SD-WAN interface. What is the mandatory step before you can add an interface to an SD-WAN zone?

Accepted Answer

Remove all firewall policy, static route, and DHCP references from the interface.. Before an interface can be added to an SD-WAN zone, it must be free of references from firewall policies, static routes, and DHCP server configurations. FortiOS enforces this because SD-WAN zones take over the routing and policy handling for member interfaces, and conflicting references would create ambiguous or broken behavior. Removing these references is therefore the mandatory prerequisite step.

Answer

Configure a performance SLA for that specific interface.

Answer

Assign a VLAN ID to the interface.

Answer

Enable SD-WAN on the global system settings.

Question 2

A Performance SLA bound to an SD-WAN zone is configured with a 200 ms latency threshold and a 5% packet-loss threshold. A member reports 180 ms latency but 8% packet loss. What is the member's SLA state, and how does it affect rule selection?

Accepted Answer

The member is considered out of SLA because packet loss exceeds the threshold, so rules exclude it from selection.. Performance SLA health requires every configured threshold to be met, so exceeding the packet-loss limit alone marks the member out of SLA even though latency is acceptable. Rules referencing that SLA then skip the member, steering traffic to healthier links. The member is not merely warned, and both thresholds do not need to fail together.

Answer

The member is considered in SLA because latency is within threshold, so it remains eligible for rules.

Answer

The member is in SLA but is flagged with a warning that only affects logging, not rule selection.

Answer

The member is out of SLA only if latency and packet loss both exceed their thresholds simultaneously.

Question 3

An administrator has created an SD-WAN template in FortiManager and applied it to a FortiGate. The administrator then modifies the template to add a new SD-WAN rule that directs traffic from a specific subnet to a new overlay interface. After installing the policy package, the administrator notices that the rule is not taking effect on the FortiGate. What is the most likely reason?

Accepted Answer

The new overlay interface is not included in the SD-WAN zone on the FortiGate.. The most likely reason an SD-WAN rule is not taking effect after a template update is that the new overlay interface referenced in the rule is not a member of the SD-WAN zone on the FortiGate. SD-WAN rules can only select interfaces that are part of the SD-WAN zone. The administrator should verify that the interface is correctly mapped and included in the zone after installation.

Answer

The FortiGate requires a reboot after installing a new SD-WAN rule.

Answer

The SD-WAN template was not saved before installation.

Answer

The SD-WAN rule priority is lower than the default route.

Question 4

In an ADVPN 2.0 deployment, a hub unit uses BGP to advertise routes to spokes. When a spoke learns a prefix via BGP from the hub, what mechanism allows the spoke to automatically initiate an ADVPN shortcut tunnel directly to another spoke when traffic flows between them?

Accepted Answer

The FortiGate kernel detects traffic matching a dynamic BGP route over the IPsec interface and initiates an IKE shortcut negotiation with the target spoke. In ADVPN, when a spoke receives a BGP route from the hub pointing to another spoke's subnet, the route's next-hop resolves over the IPsec tunnel. When the spoke's kernel sees traffic destined for that prefix, it triggers the ADVPN shortcut logic: the spoke initiates an IKE negotiation directly with the target spoke to build a dynamic shortcut tunnel, bypassing the hub for that traffic. This is the core ADVPN 'shortcut' behavior.

Answer

OSPF sends a special multicast hello packet across the hub to establish mesh point-to-point links

Answer

FortiManager pushes a dynamic static route to both spokes simultaneously

Answer

The Web Filtering profile intercepts the packet and redirects it via proxy to the destination spoke

Question 5

A network engineer is creating an SD-WAN template in FortiManager. They want to define a health check that monitors the quality of an internet link by sending HTTP requests to a specific URL. Which configuration element in the SD-WAN template should they use to accomplish this?

Accepted Answer

Performance SLA. Performance SLA is the SD-WAN template component designed for health checking. It supports HTTP as a protocol and allows specifying a URL to monitor. The SLA generates probes and evaluates link quality, which is essential for SD-WAN to make informed routing decisions based on real-time performance metrics.

Answer

SD-WAN rule

Answer

SD-WAN zone

Answer

Static route

Question 6

What is the default behavior when all SD-WAN members in a rule fail their SLA?

Accepted Answer

The traffic uses all members.. By default, when all SD-WAN members in a rule fail their SLA, FortiOS falls back to using all members in the rule rather than dropping traffic. This 'best effort' behaviour ensures connectivity is maintained even when no member meets the SLA thresholds.

Answer

The traffic is routed to the management interface.

Answer

The rule becomes inactive.

Answer

The traffic is dropped.

Question 7

An administrator is configuring an IPsec VPN tunnel between two FortiGate devices for SD-WAN. The administrator wants to ensure that the tunnel interface can be used in SD-WAN rules and that the tunnel is established only when the underlying physical interface is up. Which IPsec Phase 1 configuration parameter is required to bind the tunnel to a specific outgoing interface?

Accepted Answer

interface. The 'interface' parameter in IPsec Phase 1 explicitly binds the tunnel to a specific outgoing interface. This ensures the tunnel uses only that interface and is established only when it is up, which is critical for SD-WAN member association and health checking. Other parameters like local-gw or remote-gw do not provide this binding.

Answer

psksecret

Answer

remote-gw

Answer

local-gw

Question 8

A network administrator wants to ensure that IPsec traffic between two FortiGate SD-WAN members is encrypted with a specific set of algorithms. The administrator configures Phase 2 selectors on both peers. Which Phase 2 parameter must match on both ends for the tunnel to come up?

Accepted Answer

The Phase 2 proposal, including encryption and authentication algorithms.. For an IPsec Phase 2 SA to establish, the proposal—encryption and authentication algorithms—must match on both peers. Other parameters like key lifetime, selectors, and replay window are either locally significant or must be complementary rather than identical. In SD-WAN deployments, consistent Phase 2 proposals across all overlay members prevent negotiation failures and ensure stable tunnels. Administrators should verify proposals when troubleshooting tunnel establishment issues.

Answer

The Phase 2 replay window size, which must be set to the same value on both peers.

Answer

The Phase 2 key lifetime, which must be identical in seconds on both peers.

Answer

The Phase 2 local and remote subnets, which must be mirrored exactly on both peers.

Question 9

An administrator is configuring an SD-WAN template in FortiManager. The template includes a performance SLA that monitors two health checks: one for latency and one for jitter. The administrator wants the SD-WAN rule to select the member with the lowest latency. Which FortiManager configuration element must be used to achieve this?

Accepted Answer

SD-WAN rule with strategy set to 'lowest latency' and the latency SLA referenced.. To select the SD-WAN member with the lowest latency, the SD-WAN rule must use the 'lowest latency' strategy and reference the latency SLA. This strategy evaluates all members that meet the SLA and picks the one with the lowest measured latency. Other strategies focus on cost, bandwidth, or load distribution, and do not guarantee the lowest latency member is selected.

Answer

SD-WAN rule with strategy set to 'lowest cost (SLA)' and the latency SLA referenced.

Answer

SD-WAN rule with strategy set to 'maximize bandwidth (SLA)' and the latency SLA referenced.

Answer

SD-WAN rule with strategy set to 'load balance' and the latency SLA referenced.

Question 10

Which command is used to verify the current status of SD-WAN members and their SLA health from the CLI?

Accepted Answer

diagnose sys sdwan health-check. On FortiGate SD-WAN, the health of each member link and its SLA probes is inspected with 'diagnose sys sdwan health-check', which shows per-SLA state (up/down), latency, jitter, and packet loss for each member. This is the canonical CLI command for verifying that SLA-based steering decisions are being made on accurate telemetry.

Answer

show router info bgp

Answer

get system interface

Answer

get system sdwan member

Question 11

You are configuring SD-WAN on a FortiGate that will be managed by FortiManager. You want to ensure that the SD-WAN configuration is consistent across multiple devices and that changes can be deployed centrally. Which action must you take in FortiManager to support SD-WAN configuration?

Accepted Answer

Use the SD-WAN template in FortiManager.. FortiManager's SD-WAN template is designed for centralized configuration of SD-WAN settings. It allows you to define members, zones, performance SLAs, and rules once and assign them to multiple FortiGates. This ensures consistency and simplifies deployment. Other options do not provide the centralized SD-WAN configuration capability required.

Answer

Enable 'Central Management' on each FortiGate under System > Settings.

Answer

Install a 'SD-WAN' license on the FortiGate.

Answer

Create a firewall policy on FortiManager that references SD-WAN zones.

Question 12

A network engineer is using FortiManager to manage SD-WAN templates for multiple FortiGates. They need to ensure that a specific SD-WAN rule is only applied to branch offices that have a specific tag. Which FortiManager feature should they use?

Accepted Answer

Dynamic mapping. Dynamic mapping in FortiManager enables the conditional assignment of configuration objects, including SD-WAN templates and rules, based on device metadata such as tags. This allows administrators to target specific devices without manually assigning templates to each one. By using dynamic mapping, the SD-WAN rule is applied only to branch offices that have the designated tag, ensuring precise configuration management.

Answer

Meta fields

Answer

Provisioning templates

Answer

Policy packages

Question 13

An administrator applies security profiles (Antivirus, Web Filtering, and IPS) to traffic steered by an SD-WAN rule. Performance issues arise. Which TWO methods can the administrator use to optimize inspection performance without completely disabling security? (Choose two)

Accepted Answer

Switch the inspection mode from proxy-based to flow-based where supported, allowing hardware offloading (NP6/NP7) to accelerate packet processing. Option A is correct because switching from proxy-based to flow-based inspection allows supported FortiGate models to use hardware acceleration (NP6/NP7 processors) for packet processing, which significantly reduces latency and improves throughput while still applying the security profiles. Option C is correct because configuring security profile exemptions or antivirus inspection overrides for trusted internal subnets or latency-sensitive VoIP traffic reduces the volume of traffic subjected to deep inspection, thereby optimizing performance without fully disabling security. Option B is incorrect because DES is a weak, deprecated encryption algorithm and would not meaningfully speed up IPsec decryption; it also degrades security rather than optimizing inspection. Option D is incorrect because disabling SSL inspection globally removes a critical security control entirely, which violates the requirement to avoid completely disabling security. Option E is incorrect because removing the SD-WAN virtual interface from all firewall zones would break the SD-WAN routing and security policy enforcement, not optimize inspection performance.

Answer

Set the IPsec Phase 1 encryption algorithm to DES to speed up decryptions

Answer

Disable all SSL inspection globally across the entire FortiGate device

Answer

Remove the SD-WAN virtual interface from all firewall zones

Question 14

An administrator configures an SD-WAN rule that uses the 'maximize bandwidth (SLA)' strategy across three IPsec overlays. A security profile group containing IPS and Application Control is applied to the firewall policy that references the SD-WAN zone. Users report that some sessions are being re-evaluated mid-stream and reset when a health check fails. Which FortiOS behavior explains the resets?

Accepted Answer

When an SLA member fails, FortiOS re-runs the SD-WAN rule and may steer existing sessions to a different member, causing the security profile to re-inspect and reset sessions that cannot be re-evaluated.. SD-WAN rules that monitor SLA can trigger re-evaluation of existing sessions when a member's SLA degrades or fails. If the rule permits re-evaluation, FortiOS may move flows to a different member. Stateful security profiles such as IPS and Application Control may not be able to maintain inspection state across members, leading to session resets. Administrators can control this by disabling re-evaluation for sensitive rules or by designing SLA thresholds that avoid frequent flapping, ensuring stable session steering.

Answer

IPS and Application Control cannot be applied to SD-WAN zones; the profiles are silently ignored, and the resets are caused by the missing inspection.

Answer

The 'maximize bandwidth (SLA)' strategy ignores SLA health checks and only uses link capacity, so when a member saturates, IPS drops packets and resets the session.

Answer

The security profile group is applied to the SD-WAN zone, but FortiOS requires profiles to be bound to each member interface individually; the zone-level binding causes mid-stream resets.

Question 15

How can you verify that an SD-WAN configuration change was successfully applied to a FortiGate via FortiManager?

Accepted Answer

By checking the Device Manager installation status. In FortiManager, after you install a configuration change to a managed FortiGate, the Device Manager provides a real-time installation status for each device. This status shows whether the installation succeeded, failed, or is pending, and includes details such as the specific policy package or configuration revision applied. Therefore, checking the Device Manager installation status is the direct and authoritative way to verify that an SD-WAN configuration change was successfully applied.

Answer

By checking the FortiAnalyzer logs

Answer

By restarting the FortiGate

Answer

By viewing the system dashboard of the FortiGate locally

Question 16

A network engineer is configuring an SD-WAN template in FortiManager for a new branch office. The branch has two internet links: one via DHCP and one via static IP. The engineer wants to ensure that the SD-WAN rule prefers the static link for business-critical traffic but can fail over to the DHCP link if the static link's performance degrades. Which SD-WAN template component should the engineer configure to define the performance thresholds that trigger failover?

Accepted Answer

Performance SLA. Performance SLA defines the acceptable thresholds for latency, jitter, and packet loss. When a link's health check measurements violate these thresholds, the link is marked as out of SLA, and SD-WAN rules can then select an alternative link. This enables dynamic failover based on link quality. Health checks provide the data, but the SLA sets the criteria. SD-WAN rules use the SLA status to make routing decisions, but they do not define the thresholds themselves.

Answer

Interface priority

Answer

SD-WAN rule

Answer

SD-WAN health check

Question 17

Where do you configure the 'Gateway' IP address for an SD-WAN member?

Accepted Answer

Under Network > SD-WAN > SD-WAN Members.. The Gateway IP address for an SD-WAN member is configured in the member's settings under Network > SD-WAN > SD-WAN Members. This gateway is the next-hop IP address used for health checks and for forwarding traffic over that member, and it is specific to the SD-WAN member configuration rather than the interface or static route table.

Answer

Under Firewall Policy.

Answer

Under Network > Static Routes.

Answer

Under System > Interfaces.

Question 18

An administrator is configuring an SD-WAN rule to route VoIP traffic over the MPLS link and all other traffic over the internet link. The administrator wants to ensure that VoIP traffic is prioritized and that the rule only selects the MPLS link if it meets specific latency and jitter thresholds. Which SD-WAN configuration should be used?

Accepted Answer

Create an SD-WAN rule with the 'SLA' strategy, referencing a health check that monitors latency and jitter on the MPLS link, and set the rule to match VoIP traffic.. The 'SLA' strategy is designed to route traffic based on health check metrics such as latency and jitter. By referencing a health check that monitors these metrics on the MPLS link, the SD-WAN rule can ensure that VoIP traffic is only sent over the MPLS link when it meets the specified thresholds. If the thresholds are not met, the rule can fail over to another link, maintaining call quality.

Answer

Create an SD-WAN rule with the 'volume' strategy, assigning a higher weight to the MPLS link for VoIP traffic.

Answer

Create an SD-WAN rule with the 'priority' strategy, setting the MPLS link as the highest priority for VoIP traffic.

Answer

Create an SD-WAN rule with the 'manual' strategy, explicitly selecting the MPLS link for VoIP traffic.

Question 19

An administrator needs to configure an SD-WAN rule that load-balances traffic across two WAN links based on the volume of traffic, ensuring that both links are utilized proportionally to their configured weights. Which SD-WAN rule strategy should be selected?

Accepted Answer

Weighted Load Balance. The 'Weighted Load Balance' strategy is designed to distribute traffic across SD-WAN members according to their configured weights. This is the only strategy that allows the administrator to specify a proportional split, such as 70% on one link and 30% on another. It ensures both links are utilized in proportion to their weights, which matches the scenario's requirement.

Answer

Maximize Bandwidth (SLA)

Answer

Priority

Answer

Lowest Cost (SLA)

Question 20

An SD-WAN rule uses the lowest-cost (SLA) strategy with two members, wan1 and wan2. wan1 has a lower configured cost than wan2, and both currently meet the SLA. A network engineer observes that all matching traffic egresses wan1. The engineer now wants traffic to prefer wan2 whenever wan2 meets the SLA, while still failing over to wan1 if wan2 degrades. What should the engineer change?

Accepted Answer

Set the rule strategy to priority and give wan2 a lower priority value than wan1. Preference between healthy members is expressed by the rule strategy. The lowest-cost strategy always favors the lower-cost member, so no cost or probe tuning produces a manual preference. Switching to the priority strategy and giving the desired member the lowest priority number makes it preferred while it passes the SLA, with automatic failover to the higher-numbered member.

Answer

Increase the cost value configured on wan2 above the cost on wan1

Answer

Add a Performance SLA probe on wan2 with a shorter probe interval than wan1

Answer

Lower the cost value configured on wan1 below the cost on wan2