NSE7_SDW Practice Test 9 — 10 Questions

Question 1

You are configuring an SD-WAN rule for a branch office that must use the lowest-latency path for Microsoft 365 traffic. You have already created a Performance SLA named 'M365_SLA' that measures latency to several Microsoft 365 endpoints. You want the SD-WAN rule to select the member with the best latency among those that meet the SLA. Which SD-WAN rule strategy should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

lowest-latency (SLA). For latency-sensitive applications such as Microsoft 365, the SD-WAN rule strategy must dynamically select the member with the lowest measured latency. The lowest-latency strategy uses the Performance SLA results to compare members and choose the one with the best latency, ensuring optimal user experience. Other strategies focus on cost, bandwidth, or static priority, which do not directly optimize for latency and may select a suboptimal path.

Answer

lowest-cost (SLA)

Answer

maximize-bandwidth (SLA)

Answer

priority (SLA)

Question 2

An administrator wants an SD-WAN rule to select the member with the best measured quality for Microsoft 365 traffic, and also to ensure that if the best member degrades, traffic moves to the next-best member without manual intervention. The rule must continuously evaluate all eligible members. Which strategy satisfies these requirements?

Accepted Answer

Best quality. Best quality evaluates every in-SLA member using the Performance SLA measurements and steers traffic to the member currently offering the best value for the monitored metric. Because the comparison repeats as new probe results arrive, a member that degrades is automatically bypassed in favor of the next-best healthy member. Strategies such as manual, lowest cost, and maximize bandwidth either ignore live quality or optimize for a different objective.

Answer

Manual

Answer

Lowest cost

Answer

Maximize bandwidth

Question 3

You have an SD-WAN zone named 'virtual-wan-link' with members 'wan1' and 'wan2'. You notice that a member interface is administratively up and has a valid IP address, but it is not appearing as a selectable member when you edit the SD-WAN member list. Which condition most likely explains why the interface cannot be added?

Accepted Answer

The interface is currently assigned to a different SD-WAN zone.. An interface can be a member of only one SD-WAN zone. If it already belongs to another zone, it will not be offered as a selectable member when editing a different zone. Administrative role, static routes pointing to the zone, and Performance SLA membership do not restrict member selectability, so zone exclusivity is the condition that explains the symptom.

Answer

The interface has not been added to a Performance SLA.

Answer

The interface is already referenced by a static route that points to the SD-WAN zone.

Answer

The interface is assigned an administrative role of LAN rather than WAN.

Question 4

An administrator is configuring an SD-WAN rule that must ensure business-critical traffic always uses the best path based on measured latency and jitter, while also allowing the rule to fail over to a secondary link if the primary link's SLA is violated. The rule includes three members: wan1, wan2, and wan3. Which two actions must be performed to achieve this? (Choose two.)

Accepted Answer

Configure the SD-WAN rule to use the 'Best Quality' strategy.. To dynamically select the best path based on latency and jitter, the SD-WAN rule must use the 'Best Quality' strategy, which relies on a Performance SLA that monitors those metrics. The Performance SLA must be created and associated with the members. Together, these two actions allow the rule to choose the member with the best measured quality and fail over if the SLA is violated.

Answer

Enable 'Gateway' override on all three members to ensure they are prioritized equally.

Answer

Set the SD-WAN rule strategy to 'Lowest Cost (SLA)' and assign costs based on link quality.

Answer

Assign the same cost value to all three members to allow the rule to choose based on quality.

Question 5

A network administrator is configuring an IPsec VPN tunnel between a FortiGate hub and a spoke. The administrator wants to ensure that the spoke can dynamically learn routes from the hub and also advertise its local subnets. Which routing protocol is most commonly used in Fortinet SD-WAN deployments to achieve this?

Accepted Answer

BGP. In Fortinet SD-WAN deployments, BGP is the de facto routing protocol for dynamic route exchange between hub and spoke over IPsec tunnels. It provides scalability, policy control, and seamless integration with ADVPN for on-demand tunnels. BGP enables spokes to advertise their local subnets and learn hub routes, which is essential for dynamic routing in SD-WAN. While OSPF and other protocols are supported, BGP is the most commonly used and recommended for this purpose.

Answer

IS-IS

Answer

OSPF

Answer

RIP

Question 6

An administrator is configuring a new SD-WAN rule to steer traffic based on application signatures. The administrator wants to ensure that the rule only matches traffic for Microsoft Teams and prioritizes it over other traffic. Which SD-WAN rule configuration should be used?

Accepted Answer

Use an application-based SD-WAN rule and select the Microsoft Teams application signature.. To steer traffic based on application, the SD-WAN rule must use the application-based matching capability. FortiOS includes an application database with signatures for thousands of applications, including Microsoft Teams. By creating an SD-WAN rule that specifies the Microsoft Teams application, the FortiGate can identify and steer that traffic accordingly. The rule can be prioritized by ordering it before other rules or by using the priority setting. This method is accurate and dynamic, unlike static IP or ISDB approaches.

Answer

Create a rule with 'internet-service' set to Microsoft Teams and enable 'sla'.

Answer

Set the rule's 'dst' to the Microsoft Teams IP addresses and enable 'priority'.

Answer

Configure a rule with 'src' as the internal subnet and 'dst' as 'all', then apply a web filter profile.

Question 7

A network engineer is using FortiManager to manage a FortiGate that already has a local SD-WAN configuration. The engineer wants to transition to centralized management by assigning an SD-WAN template to the device. After the template is assigned and installed, what is the effect on the existing local SD-WAN settings?

Accepted Answer

The local SD-WAN settings are overwritten by the template configuration when the policy package is installed.. When an SD-WAN template is assigned to a FortiGate in FortiManager and the policy package is installed, the template configuration overwrites the device's local SD-WAN settings. This is by design to enforce centralized management and consistency. The engineer must ensure the template includes all necessary SD-WAN members, health checks, and rules before installation.

Answer

The local SD-WAN settings are merged with the template, with template values taking precedence for any conflicting parameters.

Answer

The local SD-WAN settings remain active until the FortiGate is rebooted, after which the template takes effect.

Answer

The local SD-WAN settings are preserved, and the template is applied only to interfaces not already configured for SD-WAN.

Question 8

When configuring SD-WAN in FortiManager, why would you use 'Shared Objects'?

Accepted Answer

To enable reuse of configuration elements across different templates. Shared Objects in FortiManager SD-WAN configuration allow you to define configuration elements (such as health checks, SLA targets, or SD-WAN rules) once and reuse them across multiple SD-WAN templates. This promotes consistency and reduces duplication when managing many templates or devices. It is the mechanism for reusing configuration elements across different templates.

Answer

To increase the number of VDOMs supported

Answer

To allow FortiGates to share logs

Answer

To create a site-to-site VPN

Question 9

You are configuring a Performance SLA on a FortiGate to monitor the quality of two WAN links. You need to ensure that the SLA probe uses HTTP to check a specific URL and that it considers the link healthy only if the round-trip time is below 100 ms and packet loss is below 2%. Which two parameters must you configure in the Performance SLA? (Choose two.)

Accepted Answer

Configure the latency threshold to 100 ms and packet loss threshold to 2%.. To use HTTP for the SLA probe, you must set the protocol to HTTP and specify the URL. To enforce the health criteria, you must configure the latency threshold to 100 ms and the packet loss threshold to 2%. These two settings are directly required. Other options like update-static-route, probe interval, or jitter are not necessary to meet the stated monitoring conditions.

Answer

Enable 'update-static-route' to automatically adjust routing based on SLA.

Answer

Configure the SLA to use 'jitter' as the primary metric.

Answer

Set the probe interval to 100 ms to match the latency threshold.

Question 10

An engineer is troubleshooting an SD-WAN rule that is not steering traffic as expected. The rule is configured with the 'Lowest Cost (SLA)' strategy and includes two members: member1 (cost 10) and member2 (cost 20). Both members are passing their SLA health checks. However, all traffic is going out member1, and member2 is not used. What is the most likely explanation?

Accepted Answer

The 'Lowest Cost (SLA)' strategy always selects the member with the lowest cost and does not load-balance, so member2 is only used if member1 fails its SLA.. The Lowest Cost (SLA) strategy selects the healthy member with the lowest cost. It does not load-balance; it is designed to prefer the cheapest path that meets the SLA. Since member1 has a lower cost and is healthy, it is always chosen. Member2 remains idle unless member1 fails its SLA. This is the intended behavior, not a misconfiguration.

Answer

Member2 is not being used because its health check is failing, even though it appears to be passing in the GUI.

Answer

Member2 is not being used because it is not included in the SD-WAN rule, even though it is in the zone.

Answer

Member2 is not being used because its cost is higher than member1's, and the strategy requires equal costs for load balancing.