NSE7_SDW Practice Questions 2 — 50 Questions

Question 1

An administrator is creating an SD-WAN template in FortiManager to be applied to multiple FortiGate devices. The administrator wants to ensure that the template can be reused across devices with different WAN interface names. Which configuration element in the SD-WAN template allows the use of variables for interface names?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Dynamic interface mapping. Dynamic interface mapping in FortiManager SD-WAN templates uses metadata variables to represent interface names, which are resolved per device during installation. This allows a single template to be reused across FortiGates with different interface naming schemes. The other options involve static configuration that would not adapt automatically, making them unsuitable for this requirement.

Answer

Interface role assignment

Answer

Static interface selection

Answer

SD-WAN zone configuration

Question 2

A network administrator is troubleshooting an SD-WAN deployment managed by FortiManager. The administrator notices that after installing an SD-WAN template, some FortiGates are not using the expected health check server. The administrator verifies that the template is correctly configured with the health check server IP. What is the most likely cause for the discrepancy?

Accepted Answer

The health check server IP is overridden by a per-device setting or metadata variable.. Per-device overrides or metadata variables in FortiManager can supersede template settings, including health check server IPs. If a device has a specific value defined, it will use that instead of the template's value. This is the most likely reason for the observed discrepancy. The other options do not directly explain why a different server IP would be used while the template is correct.

Answer

The health check server IP is not reachable from the FortiGates.

Answer

The FortiGates are running an older FortiOS version that does not support the configured health check protocol.

Answer

The SD-WAN template was not installed on those FortiGates.

Question 3

When viewing the SD-WAN Monitor in FortiManager, what information is provided for the 'Health Check' status?

Accepted Answer

Latency, jitter, and packet loss metrics. The SD-WAN Monitor's Health Check status is built from the SLA probe results that FortiGates send for each member link. These probes measure latency, jitter, and packet loss, which are the exact metrics displayed for each health-check entry. This lets administrators see in real time whether a link meets the SLA thresholds defined in the SD-WAN rules.

Answer

The firmware version of the device

Answer

The number of active users

Answer

The current IP address of the interface

Question 4

You have a large SD-WAN deployment. Why would you use a 'Centralized Policy' in FortiManager instead of local policies?

Accepted Answer

To enforce global security and traffic routing policies consistently across multiple sites. Centralized policies in FortiManager let administrators define security and SD-WAN traffic routing rules once and push them consistently to many managed FortiGates, ensuring uniform enforcement across a large deployment. This is essential in SD-WAN environments where inconsistent per-device policies cause routing asymmetry, security gaps, and configuration drift. Centralized policy also supports provisioning templates and policy packages that scale to hundreds of sites.

Answer

To eliminate the need for logs

Answer

To reduce the CPU load on the FortiGate

Answer

To allow local admins to override global policies

Question 5

An administrator is configuring an SD-WAN template in FortiManager. The template includes multiple health checks that monitor the performance of different WAN links. The administrator wants to ensure that if a health check fails, the SD-WAN rule automatically redirects traffic to another member. Which component of the SD-WAN template is responsible for defining the action taken when a health check fails?

Accepted Answer

SD-WAN Rule. In an SD-WAN template, the SD-WAN rule is the component that specifies how traffic is handled, including the action to take when a health check fails. It references the Performance SLA to determine link status and then applies the configured strategy to redirect traffic to a healthy member, ensuring continuity.

Answer

Performance SLA

Answer

SD-WAN Zone

Answer

SD-WAN Member

Question 6

A network engineer is configuring an SD-WAN template in FortiManager. They want to define a performance SLA that monitors the quality of two WAN links using HTTP probes to a specific server. Which FortiManager object should they configure to define the HTTP probe parameters?

Accepted Answer

SD-WAN Health Check. To define HTTP probe parameters for a performance SLA, you configure an SD-WAN Health Check object in FortiManager. This object allows you to specify the protocol, target, interval, and other settings. It is then referenced in SD-WAN rules to make routing decisions based on link quality.

Answer

Firewall Address

Answer

SD-WAN Zone

Answer

SD-WAN Rule

Question 7

A network administrator is using FortiManager to manage a large SD-WAN deployment. They need to create a new SD-WAN template that will be applied to multiple FortiGates. The administrator wants to ensure that the template can be easily modified in the future without having to manually update each device. Which FortiManager object should they use to define the SD-WAN template?

Accepted Answer

SD-WAN Template. The SD-WAN Template object in FortiManager is the correct choice because it is specifically designed for centralized SD-WAN configuration management. It allows the administrator to define SD-WAN settings once and apply them to multiple FortiGates, ensuring consistency and simplifying future modifications. Other objects like Policy Packages or Provisioning Templates serve different purposes and cannot manage SD-WAN templates directly.

Answer

Policy Package

Answer

Provisioning Template

Answer

Device Group

Question 8

An administrator is using FortiManager 7.2 to manage SD-WAN templates across 150 FortiGates. They need to ensure that when a template is updated, the changes are propagated efficiently and that the FortiGates maintain high availability. The administrator wants to use the 'Install Wizard' to push the updated template. Which two statements are true about installing an SD-WAN template with the Install Wizard in this scenario? (Choose two.)

Accepted Answer

The Install Wizard automatically creates a revision history entry for each FortiGate after a successful template installation, allowing rollback if needed.. The Install Wizard in FortiManager supports phased rollouts by allowing selection of specific FortiGates within an ADOM, and it automatically records revision history for each device after a successful installation. These features enable efficient, controlled updates across large SD-WAN deployments while providing rollback capabilities. The wizard does not operate across ADOMs in a single operation, nor does it require devices to be offline, and it can install individual templates rather than only full policy packages.

Answer

The Install Wizard can only install the entire policy package, not just the SD-WAN template, when multiple FortiGates are selected.

Answer

The Install Wizard can push the updated SD-WAN template to all managed FortiGates simultaneously, regardless of their ADOM membership.

Answer

The Install Wizard requires that all FortiGates be offline before installing an SD-WAN template to prevent configuration conflicts.

Question 9

An administrator is using FortiManager to manage an SD-WAN deployment with 80 FortiGates. The SD-WAN template includes a health check that pings the destination '8.8.8.8' every 500ms. The administrator notices that some branches have high latency to that destination, causing unnecessary failovers. The administrator wants to change the health check destination to a regional server with lower latency for each branch. However, the branches are in different geographic regions. What is the most efficient way to customize the health check destination per region without creating multiple templates?

Accepted Answer

Use metadata variables in the SD-WAN template to define the health check destination per device.. Metadata variables in SD-WAN templates enable per-device customization without creating multiple templates. By defining a variable for the health check destination and assigning values based on region, the administrator can maintain a single template that adapts to each branch. This approach is efficient, scalable, and consistent with FortiManager best practices. Other methods like multiple templates, local modifications, or CLI scripts introduce complexity, drift, or administrative overhead.

Answer

Use a CLI script to change the health check destination on all devices at once.

Answer

Create a separate SD-WAN template for each region and assign devices accordingly.

Answer

Modify the health check on each FortiGate locally after template installation.

Question 10

An administrator needs to deploy an SD-WAN template to a FortiGate that has two WAN interfaces: wan1 and wan2. The template includes an SD-WAN rule that load-balances traffic across both interfaces. During installation, the administrator receives an error that the interface mapping is incomplete. What is the most likely cause?

Accepted Answer

The administrator did not map the template's SD-WAN member interfaces to the FortiGate's physical interfaces.. The error indicates that the template's interface mapping is incomplete. In FortiManager, SD-WAN templates require that each abstract interface in the template be mapped to a physical interface on the target FortiGate. If the administrator fails to perform this mapping, the installation cannot proceed.

Answer

The FortiGate does not have the required firmware version to support SD-WAN templates.

Answer

The SD-WAN template does not include a health check for both interfaces.

Answer

The SD-WAN rule is configured to use dynamic mapping instead of static mapping.

Question 11

A FortiGate is configured with an SD-WAN rule that uses a health check to monitor two IPsec tunnels. The health check is configured with a single ping probe to 8.8.8.8. The administrator notices that the SD-WAN rule fails over to the secondary tunnel even when the primary tunnel is up, but with high latency. The administrator wants the health check to consider latency and only fail over when latency exceeds a threshold. What should the administrator configure to achieve this?

Accepted Answer

Enable 'sla' in the health check and set the latency threshold to the desired value.. To make the health check consider latency and fail over only when latency exceeds a threshold, the administrator must enable SLA in the health check and set the latency threshold. This allows the FortiGate to monitor latency and trigger failover according to the configured threshold. Other options either do not enable latency monitoring or focus on different metrics.

Answer

Set the health check to use 'ping' with a larger packet size and configure 'sla' with packet loss threshold.

Answer

Add a second ping probe to a different destination and enable 'sla' with latency threshold.

Answer

Configure the health check to use 'http' probe and set latency threshold in the SLA.

Question 12

You are configuring an SD-WAN rule to load-balance traffic across three WAN links. You want to ensure that the rule uses all available links while respecting the SLA status of each member. Which strategy should you select?

Accepted Answer

Maximize Bandwidth (SLA). Maximize Bandwidth (SLA) is designed to load-balance traffic across all SD-WAN members that satisfy the SLA, effectively combining their bandwidth. The other strategies either select a single best or cheapest link, or use a priority order, none of which distribute traffic across all links. Thus, only Maximize Bandwidth (SLA) fulfills the requirement.

Answer

Priority

Answer

Best Quality

Answer

Lowest Cost (SLA)

Question 13

A network administrator is adding a new WAN interface to an existing SD-WAN deployment. The interface is currently not referenced by any SD-WAN zone. What is the required first step before the interface can be used as an SD-WAN member?

Accepted Answer

Assign the interface to an SD-WAN zone.. SD-WAN members are defined within SD-WAN zones. Before an interface can be configured as a member, it must be placed into a zone. This zone construct allows multiple interfaces to share the same steering and health-check logic. Only after zone assignment can the member be created and referenced by SD-WAN rules.

Answer

Add the interface to a virtual wire pair.

Answer

Enable DHCP client on the interface.

Answer

Create a static route pointing to the interface.

Question 14

An administrator is validating a new SD-WAN deployment before going live. The design requires that the FortiGate detect link degradation before users notice it and that failover decisions be based on measured path quality rather than physical link state. Which two configuration elements are required to meet these goals? (Choose two.)

Accepted Answer

A Performance SLA attached to the SD-WAN members, with latency, jitter, and packet-loss thresholds configured.. Proactive, quality-based failover requires two things working together: a Performance SLA that measures latency, jitter, and packet loss per member, and an SD-WAN rule that references those members and reacts to the SLA state. The SLA supplies the health signal, and the rule acts on it. Static routes, dead peer detection, and interface role labels do not provide quality measurement or trigger path changes based on degradation.

Answer

Dead peer detection enabled on each IPsec tunnel member.

Answer

Interface role set to WAN on every member interface.

Answer

A static route for each member pointing to its gateway, with equal distance values.

Question 15

An engineer is configuring an SD-WAN member on a FortiGate to use a static gateway that differs from the interface's detected next-hop. Which CLI configuration correctly applies this override?

Accepted Answer

config system sdwan / config members / edit 1 / set gateway 203.0.113.1. The SD-WAN member gateway setting under config system sdwan members is the designated override for the detected next-hop. It applies to both health-check probing and traffic forwarding decisions for that member. Configuring it elsewhere, such as on the interface or in a static route, does not change the SD-WAN member's gateway and will not produce the intended behavior.

Answer

config system interface / edit wan1 / set gateway 203.0.113.1

Answer

config router static / edit 0 / set gateway 203.0.113.1 / set interface wan1

Answer

config system sdwan / config health-check / edit "ping" / set gateway 203.0.113.1

Question 16

A FortiGate is configured with an SD-WAN rule that uses a health check to monitor an IPsec tunnel. The health check is configured with a ping probe to a remote IP. The administrator notices that the tunnel is marked as down even though the remote IP is reachable via the tunnel. What is a possible cause?

Accepted Answer

The health check's probe is using the wrong source interface, causing the probe to be sent outside the tunnel.. A health check probe must be sent through the correct interface to accurately test the tunnel. If the probe's source interface is misconfigured, the probe may bypass the tunnel and fail, causing the tunnel to be marked down despite being operational. Ensuring the health check uses the tunnel interface as the source is essential.

Answer

The health check is configured with 'security-mode' set to 'none', allowing probes to bypass the tunnel.

Answer

The health check is configured with 'protocol' set to 'ping' but the remote IP does not respond to ICMP.

Answer

The health check's source IP is not specified, so it uses the outgoing interface's IP, which is not routable over the tunnel.

Question 17

An administrator has configured an SD-WAN rule to steer traffic based on the "maximize bandwidth (SLA)" strategy. The rule uses two IPsec tunnels: one with 100 Mbps and one with 50 Mbps. The administrator expects traffic to be load-balanced proportionally to the bandwidth. However, all traffic is going through the 100 Mbps tunnel. What is the most likely reason?

Accepted Answer

The 50 Mbps tunnel is not meeting the SLA criteria, so it is excluded.. The "maximize bandwidth" strategy distributes traffic across links based on their available bandwidth, but only if they meet the SLA. If the 50 Mbps tunnel is not meeting the SLA, it is excluded, and all traffic goes to the 100 Mbps tunnel. The administrator should verify the health check status and SLA targets for the 50 Mbps tunnel.

Answer

The SD-WAN rule's priority is set to 1 for the 100 Mbps tunnel and 2 for the 50 Mbps tunnel.

Answer

The 50 Mbps tunnel is configured with a higher cost, causing it to be less preferred.

Answer

The "maximize bandwidth" strategy requires equal bandwidth links to load-balance.

Question 18

An administrator has an SD-WAN template in FortiManager that is already assigned to a managed FortiGate. The administrator edits the template to change the SD-WAN zone membership of an interface from 'virtual-wan-link' to a custom zone named 'overlay'. After saving the template, what must the administrator do to push this change to the FortiGate?

Accepted Answer

Install the policy package that contains the SD-WAN template to the managed FortiGate.. After modifying an SD-WAN template in FortiManager, the changes are not automatically pushed to managed FortiGates. The administrator must install the policy package that includes the SD-WAN template to the target device. This installation process compiles the template and device settings into a configuration that is pushed to the FortiGate, applying the updated zone membership.

Answer

Reboot the FortiGate so it pulls the updated template from FortiManager on startup.

Answer

Enable 'Auto Update' in the SD-WAN template settings so changes are pushed automatically.

Answer

Run the 'Retrieve' operation on the FortiGate from FortiManager to sync the change.

Question 19

An administrator is configuring an SD-WAN rule to route traffic from a specific source subnet to a destination subnet over a preferred IPsec tunnel. The administrator wants to ensure that if the preferred tunnel fails, traffic automatically switches to a backup tunnel. Which SD-WAN rule configuration is required to achieve this?

Accepted Answer

Configure the rule with multiple interfaces and associate a health check that includes both interfaces.. The correct answer is to configure the rule with multiple interfaces and associate a health check that includes both interfaces. This allows the SD-WAN rule to monitor the health of each interface and automatically switch to the backup if the preferred interface fails. Health checks are essential for dynamic failover in SD-WAN.

Answer

Configure the rule with a single interface and enable 'failover' in the rule settings.

Answer

Configure the rule with a single interface and rely on the FortiGate's routing table to fail over.

Answer

Configure the rule with multiple interfaces and set the strategy to 'lowest-cost'.

Question 20

A network administrator is using FortiManager to manage SD-WAN configurations for multiple FortiGates. The administrator wants to ensure that all devices use the same health check server IP address for their SD-WAN performance SLAs. Where in FortiManager should the administrator define this shared health check server?

Accepted Answer

In the SD-WAN template under 'Performance SLA' settings.. To ensure all managed FortiGates use the same health check server for SD-WAN performance SLAs, the administrator should define it in the SD-WAN template's 'Performance SLA' section. This template is then applied to multiple devices, propagating the health check server configuration consistently. This centralized approach is a key benefit of using FortiManager for SD-WAN management.

Answer

In the FortiGate's local CLI under 'config system sdwan'.

Answer

In the FortiManager 'Device Manager' under 'System Settings'.

Answer

In the 'Policy & Objects' section under 'Health Check' objects.