NSE7_SDW Central Management Practice Test 2 — 15 Questions

Question 1

A network administrator is using FortiManager to manage a set of FortiGates with SD-WAN configured. They want to apply a consistent SD-WAN template to all devices. Which FortiManager feature allows them to apply the template to multiple devices at once?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SD-WAN Templates. SD-WAN Templates in FortiManager allow administrators to define SD-WAN configurations centrally and apply them to multiple FortiGates at once. This feature is purpose-built for managing SD-WAN settings across many devices, ensuring consistency and reducing manual effort. Other features like Device Manager or Policy & Objects do not provide this bulk application capability for SD-WAN templates.

Answer

Device Manager

Answer

Policy & Objects

Answer

Provisioning Templates

Question 2

A network engineer is configuring an SD-WAN template in FortiManager to be used across multiple FortiGates. The template includes a Performance SLA named 'Internet_SLA' that monitors two members: 'wan1' and 'wan2'. The engineer wants the SLA to consider the link as within SLA only if both members meet the configured latency threshold. Which configuration in the SD-WAN template achieves this requirement?

Accepted Answer

Create a separate Performance SLA for each member and then use an SD-WAN rule that requires both SLAs to be met.. To enforce that both 'wan1' and 'wan2' meet the latency threshold for the link to be considered within SLA, the engineer must create two separate Performance SLA objects, each monitoring one interface. Then, an SD-WAN rule can reference both SLAs and require both to be satisfied. This is because each Performance SLA in FortiManager is tied to a single interface and does not aggregate multiple members. The SD-WAN rule then uses the SLA results to make forwarding decisions.

Answer

Set the Performance SLA 'Internet_SLA' to use 'OR' logic, so that the link is within SLA if either member meets the threshold.

Answer

Configure the Performance SLA 'Internet_SLA' with a 'Combined' metric that averages the latency of both members.

Answer

Set the Performance SLA 'Internet_SLA' to 'All' mode, so that all members must meet the SLA for the link to be considered up.

Question 3

A network engineer is using FortiManager to manage an SD-WAN deployment. After applying an SD-WAN template to a managed FortiGate, the engineer notices that the SD-WAN member interfaces are not correctly mapped to the physical interfaces on the device. The device model is FG-100F, but the template was originally created for FG-60F. Which FortiManager feature should the engineer use to resolve this interface mapping issue?

Accepted Answer

Dynamic Mapping. Dynamic Mapping is the FortiManager feature that automatically assigns physical interfaces to logical interface references in an SD-WAN template based on the target device's available ports. When a template designed for one FortiGate model is applied to another, Dynamic Mapping ensures the SD-WAN members are correctly bound to the appropriate physical interfaces, preventing configuration errors and manual rework.

Answer

Meta Fields

Answer

Provisioning Templates

Answer

Interface Groups

Question 4

A network administrator at a managed service provider needs to deploy an SD-WAN configuration to 40 FortiGate devices using FortiManager. The administrator wants to ensure that interface names and IP addresses are automatically substituted per device without manual editing. Which FortiManager SD-WAN template feature should the administrator configure?

Accepted Answer

SD-WAN template with dynamic interface mapping using metadata variables. Dynamic interface mapping in FortiManager SD-WAN templates allows the use of metadata variables to automatically assign interface names and IP addresses based on each device's unique metadata. This ensures that a single template can be deployed across many FortiGates without manual customization, which is essential for scalability and consistency. The other options either require manual work or do not address the substitution requirement.

Answer

SD-WAN template with static interface assignments and hardcoded IP addresses

Answer

SD-WAN template with manual per-device overrides after provisioning

Answer

SD-WAN template with a global health check profile only

Question 5

A network administrator is using FortiManager to manage a set of FortiGates with SD-WAN configured. They want to apply a consistent SD-WAN template to all devices. Which FortiManager feature allows them to apply the template to multiple devices at once?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Dynamic Mapping. Dynamic Mapping allows SD-WAN templates to use placeholders for interface names, which are then mapped to actual interfaces on each managed device. This is essential when devices have different interface naming conventions, ensuring a single template can be applied universally. The other options do not provide this automatic resolution capability.

Answer

Interface Mapping

Answer

Meta Fields

Answer

Normalized Interfaces

Question 6

An administrator has an SD-WAN template applied to a FortiGate. The template includes a health check that monitors two WAN links. The administrator notices that the health check is not working as expected and wants to troubleshoot. Which FortiManager tool should the administrator use to view the health check status and logs for the FortiGate?

Accepted Answer

SD-WAN Monitor. SD-WAN Monitor in FortiManager is specifically designed to provide visibility into SD-WAN health check status and performance metrics. It offers a centralized view of link health, SLA compliance, and logs, making it the ideal tool for troubleshooting health check issues on managed FortiGates.

Answer

Device Manager

Answer

FortiView

Answer

Log View

Question 7

An administrator is creating an SD-WAN template in FortiManager for a new branch office. The branch has two WAN links: one primary and one backup. They want to configure an SD-WAN rule that directs all internet traffic through the primary link and uses the backup link only when the primary link fails. Which SD-WAN rule configuration should they use?

Accepted Answer

Set the primary link as the preferred member and enable 'Failover' with the backup link as the secondary member.. To direct traffic through a primary link and use a backup only on failure, the SD-WAN rule should specify the primary link as the preferred member and configure the backup link as a failover member. This setup enables automatic switchover when the primary link's health check fails, ensuring uninterrupted internet access.

Answer

Create two separate SD-WAN rules: one for the primary link and one for the backup link, with the backup rule having a lower priority.

Answer

Set the primary link as the only member in the SD-WAN rule and manually switch to the backup link if needed.

Answer

Use a load-balancing algorithm with both links active and set weights to prioritize the primary link.

Question 8

A network administrator is using FortiManager to manage a set of FortiGates with SD-WAN configured. They want to apply a consistent SD-WAN template to all devices. Which FortiManager feature allows them to apply the template to multiple devices at once?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Dynamic interface mapping. Dynamic interface mapping is the FortiManager feature that enables a logical interface defined in an SD-WAN template to be automatically mapped to a physical interface on the managed FortiGate. This simplifies provisioning and supports zero-touch deployments by removing the need to manually select physical ports, which is essential when managing many devices with varying hardware.

Answer

SD-WAN zone

Answer

SD-WAN rule

Answer

Performance SLA

Question 9

A network administrator is configuring SD-WAN in FortiManager and needs to define a Performance SLA health check that monitors both latency and jitter. The health check must use a protocol that supports these metrics. Which two protocols can be used in the Performance SLA health check to measure latency and jitter? (Choose two.)

Accepted Answer

HTTP. The SD-WAN Performance SLA health check supports multiple protocols for active probing, including Ping and HTTP. Both can measure latency by timing the round-trip of probes, and jitter can be derived from the variation in those timings. These protocols are commonly used to monitor link quality and trigger failover based on SLA thresholds.

Answer

SNMP

Answer

DNS

Answer

TCP Echo

Question 10

An administrator is using FortiManager to manage SD-WAN templates for multiple FortiGates. The administrator needs to ensure that when a template is updated, only the changes are pushed to the managed devices, minimizing disruption. Which FortiManager feature should be used to achieve this?

Accepted Answer

SD-WAN template installation with 'Update' option. When installing an SD-WAN template, FortiManager offers an 'Update' option that performs a diff between the template and the device's current configuration, pushing only the necessary changes. This reduces the risk of disrupting other settings and is the most efficient method for applying template modifications. The other options either push full configurations or are not designed for incremental template updates.

Answer

Install Wizard with 'Preview Changes' option

Answer

Script execution using 'Run Script' on all devices

Answer

Policy Package installation with 'Install On' selected

Question 11

An administrator is using FortiManager to manage SD-WAN templates across multiple FortiGates. The administrator needs to ensure that a specific SD-WAN rule is applied only to devices in a particular region. Which two actions are required to accomplish this? (Choose two.)

Accepted Answer

Create a new SD-WAN template that includes the rule and assign it only to the FortiGates in that region.. To apply an SD-WAN rule only to devices in a particular region, the administrator can either create a dedicated template for that region and assign it to the relevant FortiGates, or use a device group with region-based assignment for a shared template. Both methods ensure the rule is scoped correctly. Per-device mappings and firewall policies do not control SD-WAN rule application, and global templates with overrides are inefficient.

Answer

Use a per-device mapping to enable the rule only on devices in that region.

Answer

Modify the global SD-WAN template to include the rule and rely on device-specific overrides to disable it elsewhere.

Answer

Create a firewall policy on each FortiGate in that region to allow the SD-WAN rule.

Question 12

An administrator is configuring an SD-WAN template in FortiManager. They need to ensure that the SD-WAN rules can select the best path based on real-time performance metrics. Which TWO health check protocols can be used to measure latency and jitter for SD-WAN rules? (Choose two.)

Accepted Answer

Ping. Ping and HTTP are both supported health check protocols in FortiManager SD-WAN templates. Ping uses ICMP to measure latency and packet loss, while HTTP measures response time for web services. These metrics are used by SD-WAN rules to select the best path based on performance SLA. The other protocols are not available as health check options.

Answer

TCP

Answer

UDP

Answer

DNS

Question 13

A network administrator is creating an SD-WAN template in FortiManager. The template will be used to configure SD-WAN on multiple FortiGates. Which type of object must be defined in the template to specify the performance criteria for selecting an outgoing interface?

Accepted Answer

Health check. Health checks in SD-WAN templates define the performance metrics (latency, jitter, packet loss) that determine link quality. SD-WAN rules reference these health checks to make routing decisions. Without a health check, the template cannot enforce SLA-based link selection.

Answer

SLA profile

Answer

Interface mapping

Answer

SD-WAN rule

Question 14

A network engineer is using FortiManager to manage an SD-WAN deployment across 50 sites. They have created an SD-WAN template and assigned it to all sites. The template includes a health check that monitors a public server. The engineer wants to ensure that if the public server becomes unreachable, the health check does not falsely mark the link as down. Which health check parameter should they adjust?

Accepted Answer

Server. To prevent a health check from falsely marking a link as down when a single server is unreachable, the engineer should configure multiple servers in the health check. FortiManager's SD-WAN health check supports multiple server entries, and the check is considered successful if any server responds. This redundancy ensures that the link status is not solely dependent on one public server.

Answer

Interval

Answer

Failure threshold

Answer

Recovery threshold

Question 15

A network engineer is using FortiManager to manage SD-WAN templates for multiple FortiGates. The engineer wants to ensure that when a new SD-WAN member interface is added to a template, the change is automatically pushed to all devices using that template without manual intervention. Which FortiManager feature should the engineer configure to achieve this?

Accepted Answer

Configure a scheduled install of the policy package and templates on the managed FortiGates.. Scheduling automatic installation of policy packages and templates in FortiManager ensures that any changes to an SD-WAN template, such as adding a member interface, are pushed to all managed FortiGates using that template at the defined schedule. This provides the desired automation without manual per-device intervention.

Answer

Enable 'FortiManager as a local CA' so that template changes are signed and automatically deployed.

Answer

Enable Auto Update on the managed FortiGates so they pull configuration changes from FortiManager.

Answer

Use the 'Provisioning' option in Device Manager to re-provision each FortiGate after template changes.