NSE7_SDW Practice Test 7 — 10 Questions

Question 1

An administrator configures an SD-WAN rule using the 'Volume' strategy across two IPsec tunnels with different bandwidth capacities (Tunnel A: 100 Mbps, Tunnel B: 50 Mbps). How does FortiOS distribute traffic across these members when using the Volume strategy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Traffic is distributed proportionally based on the configured weight or bandwidth ratio of each member interface. The Volume strategy in SD-WAN distributes traffic proportional to the configured volume/weight (bandwidth capacity) of each member interface.

Answer

Traffic is balanced equally (50/50) regardless of interface capacity

Answer

Traffic is sent exclusively over Tunnel A until it reaches 100% packet loss, then fails over to Tunnel B

Answer

Traffic is steered strictly based on real-time latency measured by health checks

Question 2

An administrator is configuring BGP over SD-WAN IPsec tunnels between a headquarters FortiGate and branch FortiGates. Which TWO configuration steps are required to ensure robust and stable dynamic routing over the SD-WAN IPsec tunnels? (Choose two)

Accepted Answer

Configure BGP neighbors using the loopback interface IP addresses or tunnel specific IP addresses rather than physical interface IPs. Robust BGP over SD-WAN requires configuring the BGP router ID, setting up appropriate timers or neighbor relationships, and ensuring that the underlying SD-WAN members and IPsec tunnels allow routing protocol traffic. Additionally, managing BGP timers or enabling graceful restart helps maintain stability during brief IPsec reconnections.

Answer

Set the BGP administrative distance to 255 to disable all routing updates

Answer

Configure static default routes on all BGP neighbors pointing to the null0 interface

Answer

Disable IPsec phase 2 encryption to allow BGP plaintext hello packets to pass through without encapsulation overhead

Question 3

A FortiGate SD-WAN deployment uses a firewall policy with an Intrusion Prevention System (IPS) profile applied. After turning on IPS, administrators notice that throughput over an IPsec SD-WAN tunnel drops significantly. What is the primary reason for this throughput reduction, and how can it be mitigated?

Accepted Answer

IPS inspection requires intensive CPU processing for packet payload analysis, which can be optimized by using flow-based inspection mode and ensuring hardware offloading is active where supported. IPS inspection performs deep packet inspection and signature matching, which is CPU-intensive. While NP6/NP7 hardware offloading accelerates IPsec encryption, full content inspection like IPS typically requires CPU processing unless offloaded or optimized. Using flow-based inspection or hardware offloading settings where supported helps mitigate performance impact.

Answer

IPS requires proxy-based inspection, which permanently disables IPsec hardware acceleration

Answer

IPS blocks all IPsec AH/ESP headers, forcing fallback to unencrypted GRE tunnels

Answer

The IPS database size exceeds the IPsec Phase 2 buffer limit

Question 4

An administrator troubleshoots an ADVPN 2.0 deployment where dynamic shortcut tunnels fail to establish between branch spokes. Which THREE diagnostic steps or log checks should the administrator perform on the FortiGate hub or spoke to isolate the issue? (Choose three)

Accepted Answer

Check 'diagnose vpn tunnel list' to verify if dynamic shortcut child security associations are being created. Troubleshooting ADVPN shortcut failures requires checking IPsec status, IKE exchanges, routing table entries, and network device creation. Valid diagnostic steps include checking IKE daemon output, verifying IPsec tunnel status, and inspecting routing table entries for shortcut triggers.

Answer

Check the firewall policy statistics to ensure SD-WAN rules have zero hit counts globally

Answer

Execute 'execute format disk' to reset the internal flash storage and clear corrupted ADVPN certificates

Question 5

Which TWO of the following can cause an SD-WAN member to be marked as 'down' in an SLA?

Accepted Answer

The probe times out.. An interface is marked down if the probe fails to receive a response or if the response exceeds configured thresholds.

Answer

The system clock is updated.

Answer

The firewall policy is disabled.

Answer

The interface IP address is changed.

Question 6

Which of the following is required to successfully implement SD-WAN?

Accepted Answer

At least two physical interfaces.. At least two interfaces are typically required to make SD-WAN selection meaningful, though one is technically possible.

Answer

A FortiManager instance.

Answer

A subscription to FortiGuard SD-WAN service.

Answer

An external load balancer.

Question 7

You are configuring a Performance SLA to monitor reachability to a SaaS application. Which parameter determines the threshold for an interface to be considered 'unhealthy' in the SD-WAN routing table?

Accepted Answer

Packet Loss Threshold. The 'threshold-alert' or the individual latency/jitter/packet loss thresholds within the Performance SLA configuration dictate when a member is marked failed.

Answer

Probe Mode

Answer

Sequence Number

Answer

Update Interval

Question 8

What is the purpose of the 'Gateway' override in an SD-WAN member configuration?

Accepted Answer

To specify a manual gateway for the SD-WAN member.. The gateway override allows the FortiGate to use a specific IP for the probe that is different from the interface's gateway, or to define a manual gateway where DHCP is used.

Answer

To force the use of a secondary ISP.

Answer

To bypass the firewall policy.

Answer

To enable load balancing.

Question 9

An SD-WAN rule is configured with 'Lowest Cost (SLA)' strategy. If all members in the SLA meet the requirements, how does the FortiGate select the outgoing interface?

Accepted Answer

The member with the lowest interface cost value defined in the SD-WAN member configuration.. In 'Lowest Cost (SLA)' mode, the FortiGate selects the member with the lowest configured cost that meets the SLA requirements.

Answer

Round Robin

Answer

The interface with the highest bandwidth.

Answer

The interface that was most recently added to the zone.

Question 10

Which TWO of the following steps are required to correctly configure a Performance SLA?

Accepted Answer

Select the probe protocol.. To configure an SLA, you must define the destination IP (or server) and the probe protocol.

Answer

Configure a firewall address object for the probe.

Answer

Enable BGP on the interface.

Answer

Assign the probe to a VPN tunnel.