NSE7_SDW Central Management Practice Test 4 — 15 Questions

Question 1

What happens if you modify an SD-WAN template that is already applied to a FortiGate?

Accepted Answer

The configuration status shows 'Modified' and requires an installation task. When you modify an SD-WAN template already applied to a FortiGate, FortiManager marks the device's configuration status as 'Modified', indicating the device is out of sync with the template. The changes are not pushed automatically; an administrator must run an installation task (Install Wizard or Install Device) to push the updated configuration to the FortiGate. This staged workflow prevents unintended immediate changes to production devices.

Answer

The changes take effect immediately without a push

Answer

The FortiGate automatically pulls the new config

Answer

The FortiGate configuration is reverted

Question 2

You want to standardize the SD-WAN configuration for 50 remote branch offices. Which FortiManager feature should you use?

Accepted Answer

SD-WAN Templates. SD-WAN Templates in FortiManager are purpose-built to standardize SD-WAN configuration across many managed FortiGates. They define members, zones, health checks, SLA targets, and rules once, then can be assigned to device groups or provisioning templates so all 50 branches receive identical SD-WAN logic. This is the correct feature for consistent, scalable SD-WAN rollout.

Answer

Policy Packages

Answer

Firmware Images

Answer

CLI Scripts

Question 3

During SD-WAN template deployment, what is the role of 'Dynamic Mapping'?

Accepted Answer

To map a single template object to different physical settings on different devices. Dynamic Mapping in FortiManager SD-WAN templates allows a single template object (e.g., an interface or zone) to be mapped to different physical settings on different managed devices. This enables one template to be reused across devices with varying interface names or configurations, with FortiManager resolving the mapping at install time.

Answer

To automate firmware updates

Answer

To monitor bandwidth usage

Answer

To dynamically change the SD-WAN rule based on time

Answer

To calculate the latency of paths

Question 4

If an SD-WAN template contains a reference to an interface that does not exist on a target FortiGate, what occurs during the installation process?

Accepted Answer

The installation fails with a configuration error. When an SD-WAN template references an interface that does not exist on the target FortiGate, the installation process fails with a configuration error. The template cannot be applied because the referenced interface is missing, and FortiManager reports the failure.

Answer

The FortiGate automatically creates a dummy interface

Answer

The installation proceeds and ignores the missing interface

Answer

The FortiGate enters an 'Emergency' state

Question 5

When configuring SD-WAN in FortiManager, why would you use 'Shared Objects'?

Accepted Answer

To enable reuse of configuration elements across different templates. Shared Objects in FortiManager SD-WAN configuration allow you to define configuration elements (such as health checks, SLA targets, or SD-WAN rules) once and reuse them across multiple SD-WAN templates. This promotes consistency and reduces duplication when managing many templates or devices. It is the mechanism for reusing configuration elements across different templates.

Answer

To increase the number of VDOMs supported

Answer

To allow FortiGates to share logs

Answer

To create a site-to-site VPN

Question 6

When viewing the SD-WAN Monitor in FortiManager, what information is provided for the 'Health Check' status?

Accepted Answer

Latency, jitter, and packet loss metrics. The SD-WAN Monitor's Health Check status is built from the SLA probe results that FortiGates send for each member link. These probes measure latency, jitter, and packet loss, which are the exact metrics displayed for each health-check entry. This lets administrators see in real time whether a link meets the SLA thresholds defined in the SD-WAN rules.

Answer

The firmware version of the device

Answer

The number of active users

Answer

The current IP address of the interface

Question 7

What is required before FortiManager can display SD-WAN monitoring data?

Accepted Answer

The FortiGate must be sending logs to FortiManager. FortiManager's SD-WAN Monitor relies on log data received from managed FortiGates to populate its dashboards and health-check widgets. Without the FortiGate forwarding its logs (including SD-WAN and SLA health-check logs) to FortiManager, the monitor has no telemetry to display. The cloud license, firmware version, and operating mode are not prerequisites for the SD-WAN Monitor to render data.

Answer

The FortiGate must have a cloud license

Answer

The FortiGate must be running a specific firmware

Answer

The FortiGate must be in Transparent mode

Question 8

When configuring SD-WAN services in a template, what does the 'Performance SLA' setting determine?

Accepted Answer

The criteria for path selection based on link quality. The Performance SLA setting defines the health-check parameters — probe protocol, target, latency, jitter, and packet-loss thresholds — that FortiGate uses to decide whether an SD-WAN member is within acceptable quality. Those results feed the SD-WAN rule's path-selection logic, so the SLA effectively determines which links are considered 'alive' and eligible for traffic.

Answer

The physical port priority

Answer

The maximum bandwidth allowed

Answer

The number of tunnels created

Question 9

Which interface can be used as an SD-WAN member in an SD-WAN template?

Accepted Answer

Physical ports, VLANs, and VPN tunnels. In an SD-WAN template on FortiManager, SD-WAN members can be physical ports, VLAN interfaces, and VPN tunnels (including IPsec and ADVPN tunnels). This flexibility allows branches to use whatever WAN transport is available — a physical DSL port, a VLAN-tagged fiber connection, or an IPsec tunnel over the internet — as an SD-WAN member. The template abstracts these into SD-WAN zones and members for centralized management.

Answer

Only WAN physical ports

Answer

Only VLANs

Answer

Only loopback interfaces

Question 10

You have a large SD-WAN deployment. Why would you use a 'Centralized Policy' in FortiManager instead of local policies?

Accepted Answer

To enforce global security and traffic routing policies consistently across multiple sites. Centralized policies in FortiManager let administrators define security and SD-WAN traffic routing rules once and push them consistently to many managed FortiGates, ensuring uniform enforcement across a large deployment. This is essential in SD-WAN environments where inconsistent per-device policies cause routing asymmetry, security gaps, and configuration drift. Centralized policy also supports provisioning templates and policy packages that scale to hundreds of sites.

Answer

To eliminate the need for logs

Answer

To reduce the CPU load on the FortiGate

Answer

To allow local admins to override global policies

Question 11

If you modify a shared SD-WAN health check object that is referenced by ten different templates, what happens to the FortiGates?

Accepted Answer

All FortiGates using those templates will be affected after an install. When a shared SD-WAN health check object referenced by multiple templates is modified, the change is propagated to all FortiGates using those templates after a configuration install. FortiManager does not push changes in real time; an explicit install operation is required to apply the updated configuration to the managed devices. This ensures controlled rollout and consistency across the estate.

Answer

The FortiGates will automatically revert to the old settings

Answer

The health check will be disabled on all devices

Answer

Only the templates are updated, not the FortiGates

Question 12

Which TWO of the following are benefits of using SD-WAN templates in FortiManager?

Accepted Answer

Consistent SD-WAN policy application across devices. Option A is correct because SD-WAN templates in FortiManager let you define SD-WAN settings (members, zones, health checks, and rules) once and assign them to many managed FortiGates, ensuring the same SD-WAN policy is applied consistently across devices. Option E is correct because these templates enable simplified, scalable configuration deployment for large branch deployments by pushing a standardized SD-WAN configuration to many FortiGates at once instead of configuring each device individually. Option B is not correct because firmware upgrades are handled by FortiManager's firmware management features, not by SD-WAN templates. Option C is not correct because log analysis is performed by FortiAnalyzer, not by SD-WAN templates in FortiManager. Option D is not correct because direct CLI access is a separate administrative capability and is not a benefit provided by SD-WAN templates.

Answer

Automatic firmware upgrades

Answer

Automated log analysis

Answer

Direct access to the FortiGate CLI

Question 13

How can you verify that an SD-WAN configuration change was successfully applied to a FortiGate via FortiManager?

Accepted Answer

By checking the Device Manager installation status. In FortiManager, after you install a configuration change to a managed FortiGate, the Device Manager provides a real-time installation status for each device. This status shows whether the installation succeeded, failed, or is pending, and includes details such as the specific policy package or configuration revision applied. Therefore, checking the Device Manager installation status is the direct and authoritative way to verify that an SD-WAN configuration change was successfully applied.

Answer

By checking the FortiAnalyzer logs

Answer

By restarting the FortiGate

Answer

By viewing the system dashboard of the FortiGate locally

Question 14

Which THREE tasks are required to successfully deploy SD-WAN via FortiManager?

Accepted Answer

Installing the configuration to the devices. Option B is correct because FortiManager deploys SD-WAN through a centralized SD-WAN template (or SD-WAN overlay template) that defines the member interfaces, zones, and performance SLAs before it can be pushed to devices. Option E is correct because the template must be assigned to the target managed FortiGates, which binds the template to those devices so FortiManager knows which FortiGates should receive the SD-WAN configuration. Option A is correct because after the template is created and assigned, the configuration must be installed to the devices, which pushes the SD-WAN settings into the FortiGate running configuration. Option C is not required, since a hard factory reset is unnecessary and would only disrupt the existing management connection to FortiManager. Option D is also not required, because existing firewall policies do not need to be deleted for SD-WAN deployment; policies can be adjusted or referenced as needed.

Answer

Performing a hard factory reset on the FortiGate

Answer

Deleting all existing firewall policies

Question 15

Which TWO items must be configured within an SD-WAN template for SD-WAN traffic steering to work?

Accepted Answer

SD-WAN Members. Option B (SD-WAN Members) is correct because traffic steering requires the physical or logical WAN interfaces to be defined as SD-WAN members, which are the egress paths the SD-WAN engine can select among. Option C (SD-WAN Rules) is correct because these rules define the match criteria (source/destination, application, etc.) and the steering action (best quality, lowest cost, SLA-based) that tells the SD-WAN engine how to forward matched traffic. Together, SD-WAN Members provide the available links and SD-WAN Rules provide the selection logic, so both are mandatory for traffic steering to function. Option A (DHCP server settings) is not required, since DHCP only provides IP addressing and is unrelated to path selection. Option D (VLAN tagging) is not required, as VLANs are a Layer 2 segmentation mechanism and not a prerequisite for SD-WAN steering. Option E (Local users) is not required, because local user accounts are for administrative authentication and have no role in traffic steering.

Answer

DHCP server settings

Answer

VLAN tagging

Answer

Local users