NSE7_SDW Central Management Practice Test 3 — 15 Questions

Question 1

An administrator is using FortiManager to manage SD-WAN templates across multiple FortiGates. The administrator needs to ensure that the SD-WAN configuration remains consistent and that changes can be rolled back if necessary. Which two FortiManager features support these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configuration Revision. Revision History and Configuration Revision are FortiManager features that provide version control and rollback capabilities. Revision History tracks changes to individual objects and policies, while Configuration Revision saves full configuration snapshots. Together, they enable administrators to maintain consistency and revert to previous states if needed.

Answer

Workspace Mode

Answer

Script Execution

Answer

Policy Package Installation

Question 2

A network engineer is troubleshooting an SD-WAN deployment managed by FortiManager. The engineer notices that one of the SD-WAN health checks is failing on a specific FortiGate, but the health check template shows as 'In Sync' in FortiManager. Which action should the engineer take to verify the actual health check status on the FortiGate?

Accepted Answer

Check the SD-WAN monitor in FortiManager for the specific device.. FortiManager's SD-WAN monitor provides real-time operational status of health checks for each managed FortiGate. Even when the configuration is in sync, the monitor reflects the actual health check results, including latency, jitter, and packet loss. This allows the engineer to quickly verify if a health check is failing and gather data for further troubleshooting without needing to access the device directly.

Answer

Review the configuration revision history in FortiManager.

Answer

Run a CLI script from FortiManager to execute 'diagnose sys sdwan health-check' on the FortiGate.

Answer

Use the FortiGate's local GUI to check the SD-WAN health check status.

Question 3

A network administrator is using FortiManager to manage SD-WAN templates across multiple FortiGates. The administrator needs to ensure that the SD-WAN templates can be applied to devices with different interface names and that the configuration remains consistent. Which two actions must the administrator perform to achieve this? (Choose two.)

Accepted Answer

Define SD-WAN zones in the template and assign member interfaces to zones on each device.. Using dynamic mapping and SD-WAN zones allows a single SD-WAN template to be applied to devices with different interface names. Dynamic mapping replaces placeholders with actual interfaces during installation, while zones abstract interface names so rules reference logical groups. Both methods ensure consistency and reduce manual configuration.

Answer

Enable per-device mapping in FortiManager to manually assign each interface for every FortiGate.

Answer

Configure a separate SD-WAN template for each device model to accommodate interface differences.

Answer

Use the same interface names on all FortiGates by renaming interfaces to match the template.

Question 4

A network administrator manages 30 FortiGate devices through FortiManager. The administrator needs to deploy an SD-WAN template to all devices, but each device has a different WAN interface name (wan1, wan2, port1, port2). The administrator wants to avoid creating separate templates for each device. Which FortiManager feature should the administrator use when applying the SD-WAN template?

Accepted Answer

Dynamic Mapping. Dynamic Mapping is the FortiManager feature that enables a single SD-WAN template to be applied to multiple FortiGates with different physical interface names. It maps template-defined interface placeholders to the actual local interface names during installation, removing the need for per-device template customization. This directly solves the challenge of heterogeneous interface naming across a large device fleet.

Answer

Provisioning Templates

Answer

Meta Fields

Answer

Normalized Interfaces

Question 5

A network engineer is designing an SD-WAN template in FortiManager for a hub-and-spoke topology. The engineer needs to define health checks that will be used by SD-WAN rules. Which two protocols can be used for SD-WAN health checks in FortiManager? (Choose two.)

Accepted Answer

Ping. FortiManager SD-WAN templates support several health check protocols, including Ping and HTTP. Ping checks basic reachability using ICMP, while HTTP checks application-layer responsiveness by requesting a URL. Both are valid for defining performance SLAs that SD-WAN rules use to select the best link based on latency, jitter, and packet loss.

Answer

SNMP

Answer

NetFlow

Answer

DNS

Question 6

A network administrator manages 45 branch FortiGates with FortiManager using SD-WAN templates. Headquarters requires that all branches use the same SD-WAN rule to steer Microsoft 365 traffic over the lowest-latency member. The administrator wants to guarantee that the rule cannot be locally overridden on any branch FortiGate, and that any local change is reverted automatically. Which FortiManager configuration should the administrator use?

Accepted Answer

Assign the SD-WAN template to the FortiGates and enable 'Auto Update' in the FortiManager policy package that references the template.. Enforcement of SD-WAN templates in FortiManager happens through the managed-device policy package workflow rather than a template-level lock. When the policy package that references the SD-WAN template is installed with Auto Update enabled, FortiManager periodically reconciles the device against the template and reverts local modifications, ensuring the branch SD-WAN rule steering Microsoft 365 traffic remains uniform and cannot be overridden locally.

Answer

Enable the 'Lock SD-WAN Template' option in the template settings for each managed FortiGate.

Answer

Set the FortiGate's provisioning template to 'Enforce' mode and push the configuration with the 'Install Wizard'.

Answer

Add the FortiGates to a managed FortiManager group, then enable 'Auto Update' in the group's SD-WAN template assignment.

Question 7

A network administrator is designing an SD-WAN deployment in FortiManager for 120 FortiGates spread across three ADOMs. Each ADOM has different WAN interfaces and different performance SLA thresholds, but all FortiGates must share the same SD-WAN rule structure for SaaS steering. The administrator wants to minimize manual per-device configuration and reuse the layout across ADOMs. Which two FortiManager capabilities should the administrator use to meet these requirements? (Choose two.)

Accepted Answer

Copy the SD-WAN template between ADOMs using the 'Import Template' function in the ADOM's template menu.. Reusing an SD-WAN layout across ADOMs is achieved by importing or copying the template into each ADOM, then adapting thresholds locally, while metavariables in interface member mappings let one template resolve to different physical WAN interfaces per device at install time. Together these minimize manual configuration, preserve a shared SaaS steering rule structure, and accommodate the differing WAN interfaces and SLA thresholds of each ADOM.

Answer

Place all FortiGates in a single ADOM with one SD-WAN template and use device groups to differentiate SLA thresholds.

Answer

Enable 'Per-Device Mapping' on the SD-WAN template so each FortiGate stores its own copy of the template in its local flash.

Answer

Create the SD-WAN template in the global ADOM and assign it to each ADOM so all FortiGates inherit the same template.

Question 8

A network administrator uses FortiManager with an SD-WAN template to manage two data center FortiGates in an HA pair. After the administrator changes a performance SLA's probe interval in the template and installs the policy package, the secondary FortiGate reports the old probe interval while the primary reports the new value. The administrator confirms both devices are managed and in sync. What is the most likely cause?

Accepted Answer

The policy package install targeted only the primary FortiGate, so the secondary was not updated from the template.. The mismatch arises because the policy package install was scoped to the primary FortiGate only, leaving the secondary with the previously installed SD-WAN performance SLA settings. Selecting both HA members during install pushes the template-derived configuration to each unit, aligning the probe interval. Managed and in-sync status can still appear for other configuration, so install scope must be verified explicitly.

Answer

The template's performance SLA uses a metavariable that cannot resolve on the secondary FortiGate, so the old value is preserved.

Answer

The secondary FortiGate's HA role prevents it from applying SD-WAN performance SLA configuration until a failover occurs.

Answer

The SD-WAN template was assigned only to the primary FortiGate in the HA pair.

Question 9

When using SD-WAN templates, how are SD-WAN rules ordered?

Accepted Answer

Top to bottom. SD-WAN rules in FortiGate templates are evaluated in a strict top-to-bottom order, exactly like firewall policies. The first rule whose matching criteria (source, destination, application, etc.) are satisfied is applied, and subsequent rules are not evaluated. This deterministic ordering lets administrators control which traffic takes which member link and ensures predictable path selection.

Answer

Based on the creation date

Answer

By the interface speed

Answer

Randomly

Question 10

In SD-WAN central management, what is the 'SD-WAN Zone' used for?

Accepted Answer

To group multiple SD-WAN members for logical policy routing. In SD-WAN central management, an SD-WAN Zone is a logical grouping of multiple SD-WAN members (interfaces or tunnels) that share the same path selection and policy routing characteristics. It allows administrators to apply policies to a group of links rather than individual interfaces, simplifying configuration and enabling logical routing decisions based on zone-level metrics.

Answer

To define the physical port speed

Answer

To limit bandwidth for specific users

Answer

To isolate the SD-WAN traffic from the WAN

Question 11

You are troubleshooting a scenario where an SD-WAN template is not pushing to a FortiGate. Which log file on the FortiManager is most useful to identify the specific CLI command causing the failure?

Accepted Answer

fmg_debug.log. The fmg_debug.log on FortiManager captures detailed debug output, including the CLI commands that FortiManager generates and attempts to push to managed FortiGates during template installation. When a template push fails, this log reveals the exact command that was rejected or errored, making it the most useful file for pinpointing the failing CLI line.

Answer

fmg_event.log

Answer

fmg_audit.log

Answer

fmg_system.log

Question 12

When creating an SD-WAN template, what must be defined before you can add an SD-WAN interface to the template?

Accepted Answer

Individual SD-WAN member interfaces. Before you can add an SD-WAN interface to an SD-WAN template in FortiManager, you must first define the individual SD-WAN member interfaces (the physical or logical links that will participate in SD-WAN). The template's SD-WAN interface object is built on top of these member interfaces, so they are the prerequisite.

Answer

The SD-WAN health check probes

Answer

Global firewall policies

Answer

The virtual domain (VDOM) settings

Question 13

Which object must be created before assigning a health check to an SD-WAN service rule in an SD-WAN template?

Accepted Answer

An SD-WAN Health Check. Before assigning a health check to an SD-WAN service rule in an SD-WAN template, you must first create an SD-WAN Health Check object. The health check defines the probe parameters (protocol, interval, failure thresholds) that determine link quality and availability for the service rule.

Answer

A routing protocol

Answer

A firewall address object

Answer

An SD-WAN Zone

Question 14

You are configuring SD-WAN templates in FortiManager. What is the primary purpose of using SD-WAN Central Management instead of configuring SD-WAN directly on individual FortiGates?

Accepted Answer

To enable SD-WAN template inheritance and synchronized policy updates across multiple managed devices. SD-WAN Central Management in FortiManager enables the use of SD-WAN templates that can be inherited by multiple FortiGates, ensuring consistent configuration and synchronized policy updates across the managed estate. This centralizes control, reduces configuration drift, and simplifies large-scale deployments. The primary purpose is to achieve scalable, template-driven management rather than per-device manual configuration.

Answer

To perform local traffic analysis on the FortiGate only

Answer

To allow FortiGates to manage their own SD-WAN interfaces independently

Answer

To bypass the need for ADOMs

Question 15

How do you apply an SD-WAN template to multiple managed FortiGates simultaneously?

Accepted Answer

By assigning the template in the Device Manager tab. In FortiManager, SD-WAN templates are applied to managed devices through the Device Manager tab, where you can assign a template to one or many FortiGates at once. This centralized push means the same SD-WAN configuration (members, zones, health checks, SLA rules) is deployed consistently across all selected devices without touching each unit individually. It is the standard workflow for provisioning SD-WAN at scale in a FortiManager-managed environment.

Answer

By manually editing each FortiGate config

Answer

Through individual CLI console sessions

Answer

By creating a global profile