NSE7_SDW Practice Test 8 — 10 Questions

Question 1

You are configuring an SD-WAN rule to route business-critical traffic (HTTP and HTTPS) over the best available link based on lowest latency. You have two members in the SD-WAN zone: WAN1 and WAN2. You create a Performance SLA named 'Latency-SLA' that monitors 8.8.8.8 using ICMP probes with a threshold of 150 ms. You apply this SLA to both members. In the SD-WAN rule, you set the strategy to 'Lowest Latency' and select the SLA. After applying the configuration, you notice that HTTP traffic is still using WAN1 even though WAN2 has lower latency according to the SLA monitor. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The SD-WAN rule is configured with a manual order or priority that overrides the latency-based selection, or the rule is not matching the HTTP traffic due to a missing service definition.. For an SD-WAN rule using 'Lowest Latency' strategy to select the best member, the rule must correctly match the traffic and not be overridden by another rule or manual priority settings. If the rule's service definition does not include HTTP/HTTPS, or if a higher-priority rule matches first, the latency-based selection will not apply. Verify rule order and match criteria.

Answer

The SD-WAN rule is missing a required 'Gateway' configuration for each member, so it cannot determine the next-hop for the lower-latency path.

Answer

The SD-WAN rule's 'Lowest Latency' strategy only considers latency if the members are in the same SD-WAN zone and the rule is applied to that zone; otherwise it defaults to the first member.

Answer

The Performance SLA must be configured with TCP probes on port 80 and 443 to accurately measure latency for HTTP and HTTPS traffic.

Question 2

An engineer is configuring a new SD-WAN deployment on a FortiGate running FortiOS 7.2. The SD-WAN zone named 'virtual-wan-link' already exists with two members, but the engineer needs to add a third member that is a VLAN sub-interface named 'WAN3_VLAN'. After adding the interface to the zone, traffic still does not traverse the new member. What is the most likely reason?

Accepted Answer

The VLAN interface does not have a gateway configured or the next-hop gateway is unreachable, causing the member to be marked as down by the health check.. Adding an interface to an SD-WAN zone does not automatically make it usable. The member must have a working next-hop gateway and pass the Performance SLA health check. If the gateway is missing or unreachable, the member remains down and the SD-WAN rule will not select it. Verifying the gateway and SLA status is the first troubleshooting step.

Answer

The VLAN interface was added to the zone but is not configured as a member of the SD-WAN rule, so it is not eligible for selection.

Answer

The VLAN interface must be assigned an IP address and have an administrative distance lower than the existing members before it can be used in the zone.

Answer

The VLAN interface is not referenced in any firewall policy, so the FortiGate cannot forward traffic through it.

Question 3

You are setting up an SD-WAN configuration on a FortiGate. You want to ensure that the SD-WAN rules you create will be able to use the WAN interfaces. You have already configured the interfaces with IP addresses and default gateways. Which additional configuration object must you create to group the interfaces for use in SD-WAN rules?

Accepted Answer

An SD-WAN zone.. SD-WAN zones are the correct configuration object to group member interfaces for use in SD-WAN rules. They allow you to manage multiple WAN links as a single entity in rules, simplifying policy creation and enabling dynamic path selection based on performance SLAs.

Answer

A software switch.

Answer

A virtual domain (VDOM) for each WAN interface.

Answer

A link aggregation group (LAG).

Question 4

You are configuring an SD-WAN rule to route VoIP traffic. You want the rule to select the member with the best quality for voice, considering both latency and jitter. You have enabled Performance SLA on both WAN1 and WAN2, monitoring latency and jitter. You need to ensure the rule uses the appropriate strategy and that the SLA is correctly referenced. Which two actions must you perform to achieve this? (Choose two.)

Accepted Answer

Set the SD-WAN rule strategy to 'Best Quality'.. To route VoIP traffic based on both latency and jitter, set the SD-WAN rule strategy to 'Best Quality' and ensure the Performance SLA that monitors these metrics is assigned to the relevant SD-WAN members. This allows the SD-WAN engine to evaluate the quality of each link and select the best one for voice traffic.

Answer

Enable 'Link Health Monitor' on the SD-WAN rule.

Answer

Configure the Performance SLA to use HTTP probes to measure jitter.

Answer

Set the SD-WAN rule strategy to 'Lowest Latency'.

Question 5

A network administrator is configuring an SD-WAN rule to steer traffic from the internal network to a critical cloud application. The rule uses the 'SLA' strategy and references a Performance SLA that monitors latency and jitter. The administrator notices that traffic is intermittently being sent over a WAN link that does not meet the SLA thresholds. The Performance SLA is configured with a probe interval of 5 seconds and a failure threshold of 3. What is the most likely reason for this intermittent behavior?

Accepted Answer

The Performance SLA probe interval and failure threshold cause a delay in marking the member as out of SLA, allowing traffic to continue briefly after the threshold is exceeded.. The Performance SLA evaluates member health based on probe results. With a probe interval of 5 seconds and a failure threshold of 3, the member is only marked as out of SLA after three consecutive failed probes, which takes at least 15 seconds. During that period, the SD-WAN rule continues to consider the member as meeting the SLA and may route traffic over it. This delay causes intermittent use of a link that has actually breached the latency or jitter thresholds.

Answer

The SD-WAN rule is incorrectly configured with a manual priority that overrides the SLA status.

Answer

The Performance SLA is only applied to one member, so the other member's SLA status is unknown and defaults to in-SLA.

Answer

The SD-WAN rule is using the 'SLA' strategy, which only considers the first member that meets the SLA and does not re-evaluate until the member fails completely.

Question 6

You are configuring an SD-WAN rule to steer traffic to a business-critical application. The rule uses the 'Lowest Cost (SLA)' strategy with two members: a low-cost broadband link and an expensive MPLS link. The broadband link meets the SLA most of the time but occasionally experiences high latency. You want traffic to prefer the broadband link but fail over to MPLS when broadband violates the SLA. Which additional configuration is required to ensure the rule behaves as intended?

Accepted Answer

Configure a Performance SLA and associate it with the SD-WAN rule.. The 'Lowest Cost (SLA)' strategy chooses the lowest-cost member that satisfies the SLA defined in a Performance SLA. The Performance SLA must be created separately and then referenced by the SD-WAN rule. Without it, the rule has no way to evaluate link health, so it may not fail over when the broadband link degrades. Associating a Performance SLA with appropriate thresholds ensures the rule dynamically selects the MPLS link when broadband violates the SLA.

Answer

Enable 'SLA Target' on the rule and specify the required latency threshold.

Answer

Set the broadband member's priority to a lower value than the MPLS member.

Answer

Set the MPLS member's cost to a lower value than the broadband member.

Question 7

An engineer needs to configure an SD-WAN rule that sends traffic out the member with the lowest latency for a specific application, but also wants the rule to automatically fail over to the next-best member if the primary member's latency exceeds a threshold. Which SD-WAN strategy and configuration should be used?

Accepted Answer

Use the lowest-latency strategy and enable the performance SLA on the members.. The lowest-latency strategy is the only one that actively measures latency and selects the member with the best value. When combined with a performance SLA that defines a latency threshold, the member is marked out of SLA if the threshold is exceeded, triggering failover to the next-best member. This provides both optimal path selection and automatic failover.

Answer

Use the manual strategy and specify a preferred member order.

Answer

Use the priority strategy and assign priorities to members.

Answer

Use the volume-based strategy and set a maximum bandwidth threshold.

Question 8

A company has an SD-WAN deployment with three members: port1 (MPLS), port2 (Broadband), and port3 (LTE). The administrator wants to ensure that business-critical traffic uses port1 whenever it meets the SLA, but if port1 fails the SLA, traffic should use port2. If both port1 and port2 fail, traffic should use port3. Which SD-WAN rule strategy should be used to achieve this?

Accepted Answer

Priority. The 'Priority' strategy is designed for active/standby failover based on SLA status. The administrator assigns a priority value to each member; lower values indicate higher priority. The SD-WAN rule will select the highest-priority member that meets the referenced Performance SLA. If that member fails the SLA, the next priority member is chosen. This provides the exact behavior described: port1 preferred, then port2, then port3, all conditional on SLA compliance.

Answer

Lowest Cost

Answer

Best Quality

Answer

Maximize Bandwidth

Question 9

You are troubleshooting an SD-WAN deployment where a rule configured with the 'Best Quality' strategy is not selecting the expected member. The Performance SLA shows that member1 has lower latency and jitter than member2, yet traffic is using member2. Which factor should you verify first?

Accepted Answer

Check whether the SD-WAN rule is placed above a conflicting rule in the rule list.. SD-WAN rules are processed sequentially, and the first rule that matches the traffic is used. If an earlier rule matches the same traffic, it will dictate member selection, potentially overriding the intended 'Best Quality' rule. Therefore, checking rule order is the logical first step. Other factors like cost or SLA algorithm are not relevant to the 'Best Quality' strategy, which selects the member with the best measured performance.

Answer

Confirm that member1 has a lower cost than member2.

Answer

Ensure that the Performance SLA is configured with the 'Best Quality' algorithm.

Answer

Verify that the 'Best Quality' strategy is supported on the FortiGate model.

Question 10

An administrator is configuring SD-WAN on a FortiGate with two WAN interfaces: port1 and port2. They need to ensure that the SD-WAN can properly direct traffic based on application type and link performance. Which two configuration steps are required to enable application-based steering with SLA enforcement? (Choose two.)

Accepted Answer

Create an SD-WAN zone and add port1 and port2 as members.. To enable application-based steering with SLA enforcement, the administrator must first create an SD-WAN zone and add the WAN interfaces as members. Then, a Performance SLA must be configured and applied to the zone to monitor link health. These two steps provide the foundation for SD-WAN rules to match applications and steer traffic based on SLA status. Without the zone, members cannot be managed collectively; without the SLA, there is no performance data to enforce.

Answer

Create a firewall policy that includes the SD-WAN zone as the outgoing interface and enable NAT.

Answer

Configure a static route for each WAN interface with the same distance.

Answer

Enable application control on the firewall policy that references the SD-WAN zone.