NSE7_SDW Central Management Practice Test 5 — 15 Questions

Question 1

Which THREE pieces of information are displayed in the SD-WAN Monitor in FortiManager?

Accepted Answer

Status of SD-WAN members. Option A is correct because the SD-WAN Monitor in FortiManager displays the operational status of each SD-WAN member interface, showing whether members are up, down, or degraded. Option B is correct because the monitor presents the health metrics collected by the SD-WAN performance SLA probes, specifically latency, jitter, and packet loss for each member. Option C is correct because the SD-WAN Monitor also shows interface bandwidth usage, allowing administrators to see throughput per SD-WAN member. Option D is not part of the SD-WAN Monitor, as system temperature is a hardware sensor value found in device dashboards or sensor views, not SD-WAN monitoring. Option E is also not displayed there, since the logged-in admin username is a session/administrative detail unrelated to SD-WAN member monitoring.

Answer

System temperature of the FortiGate

Answer

The current username of the logged-in admin

Question 2

Which THREE factors can affect the 'Performance SLA' logic in an SD-WAN template?

Accepted Answer

Packet loss threshold. The Performance SLA logic in an SD-WAN template is driven by the SLA criteria defined for each member, and those criteria are the three measured metrics: packet loss threshold (A), jitter threshold (C), and latency threshold (E). FortiGate continuously probes each SD-WAN member (e.g., via ping or HTTP) and compares the measured packet loss, jitter, and latency against these configured thresholds to determine whether the link is within SLA and to trigger SLA-based steering or failover. Option B is incorrect because the FortiGate firmware version is not an SLA metric; it may affect available features but does not feed the Performance SLA calculation. Option D is incorrect because the number of active VPN tunnels is a topology/state value, not a measured SLA parameter used by the Performance SLA logic.

Answer

The firmware version of the FortiGate

Answer

The number of active VPN tunnels

Question 3

Which TWO methods can be used to update SD-WAN policies across all managed devices in FortiManager?

Accepted Answer

Using a CLI script to push updates. Option A is correct because FortiManager allows administrators to run CLI scripts (via Script > Scripts, executed with 'Run Script' or as part of a policy package install) that push configuration commands to all managed FortiGates, which can include SD-WAN policy changes. Option B is correct because SD-WAN templates in FortiManager (found under Policy & Objects > SD-WAN Templates or in the SD-WAN Manager) are centralized configuration templates; modifying the template and then installing the changes to the managed devices propagates the updated SD-WAN policies to all devices assigned to that template. Option C is not correct because editing an individual FortiGate policy only affects that single device, not all managed devices. Option D is not correct because creating a new ADOM is an administrative grouping action and does not update SD-WAN policies on existing managed devices. Option E is not correct because rebooting FortiManager does not push or update any SD-WAN policy configuration to managed devices.

Answer

Editing the individual FortiGate policy

Answer

Creating a new ADOM

Answer

Rebooting the FortiManager

Question 4

Which TWO criteria can be used in SD-WAN rules to select an outgoing interface?

Accepted Answer

Source and destination address. Option D (Source and destination address) is correct because SD-WAN rules commonly match traffic based on IP header fields such as source and destination IP addresses (and often ports), allowing the policy to steer specific flows out a chosen interface. Option E (Application or service type) is correct because SD-WAN solutions perform application-aware routing, identifying applications or services via signatures/DPI and using that classification to select the outgoing interface. Option A (administrator name) is not a traffic-matching criterion for interface selection, as it identifies a person, not a flow. Option B (system temperature) is a hardware health metric, not a routing rule criterion. Option C (device serial number) identifies the device itself, not the traffic to be steered, so it cannot be used to select an outgoing interface per flow.

Answer

The name of the administrator

Answer

System temperature

Answer

Device serial number

Question 5

Which TWO configuration changes require a push from FortiManager to the FortiGate?

Accepted Answer

Changes to an SD-WAN template. Option B is correct because SD-WAN templates are FortiManager-managed objects: when you edit an SD-WAN template in FortiManager, the change is stored in the ADOM and must be installed/pushed to the managed FortiGate for it to take effect. Option C is correct because a firewall policy package is also a FortiManager-managed configuration object, so any modification must be installed to the target FortiGate device. Option A is incorrect because changes made directly in the FortiGate local GUI are local to the device and do not require a FortiManager push. Option D is incorrect because adding a local user directly on the FortiGate is a local device change, not a FortiManager-managed object requiring installation. Option E is incorrect because changing the FortiManager admin password affects only FortiManager itself and is not pushed to managed FortiGates.

Answer

Changes to the log settings on the FortiGate local GUI

Answer

Adding a new user to the FortiGate local database

Answer

Changing the FortiManager admin password

Question 6

A network administrator is using FortiManager to manage SD-WAN configurations for multiple FortiGates. The administrator wants to define a health check that will be used across several SD-WAN templates and needs to ensure that any changes to this health check are automatically propagated to all templates that reference it. Which FortiManager object should the administrator create?

Accepted Answer

SD-WAN health check. The correct answer is an SD-WAN health check object. FortiManager allows you to create reusable health check definitions that can be referenced by multiple SD-WAN templates. This ensures that when the health check parameters are updated, all templates using it reflect the changes automatically, maintaining consistency and reducing administrative overhead across managed devices.

Answer

SD-WAN template

Answer

Virtual IP

Answer

Firewall address object

Question 7

An administrator has an SD-WAN template in FortiManager that is assigned to a managed FortiGate. The FortiGate is currently offline. The administrator modifies the template and installs the configuration. What happens to the FortiGate when it comes back online?

Accepted Answer

The FortiGate retains its previous configuration until the administrator manually installs the updated template.. FortiManager does not automatically push configuration changes to managed devices. When an SD-WAN template is modified, the changes are stored in FortiManager but must be explicitly installed to the FortiGate. If the FortiGate is offline during the modification, it will not receive the update until the administrator performs an install after the device is back online.

Answer

The FortiGate receives the update only if the template is set to auto-install.

Answer

The FortiGate downloads the updated template when it reconnects, but the changes are not applied until a reboot.

Answer

The FortiGate automatically retrieves the updated configuration from FortiManager.

Question 8

A company uses FortiManager to manage 200 FortiGates with SD-WAN enabled. The administrator needs to update the SD-WAN health check settings for all branches to use a new server IP. The health check is referenced by a single SD-WAN template that is assigned to all branches. After modifying the health check object in FortiManager, what must the administrator do to apply the changes to all FortiGates?

Accepted Answer

Use the 'Install Wizard' to push the updated template to all managed FortiGates.. The correct action is to use the Install Wizard to push the updated template to all managed FortiGates. FortiManager's Install Wizard allows bulk installation of configuration changes, including SD-WAN templates and referenced objects like health checks. After modifying the shared health check, the administrator can select all affected devices and install the changes in a single operation, ensuring all branches receive the update efficiently.

Answer

Install the SD-WAN template on each FortiGate individually.

Answer

Manually edit the SD-WAN configuration on each FortiGate via CLI.

Answer

Reboot each FortiGate to apply the new health check settings.

Question 9

An administrator is configuring an SD-WAN template in FortiManager for a new branch deployment. The template will include multiple SD-WAN members and a performance SLA that monitors the health of these members. Which two statements about the relationship between SD-WAN templates and health check objects are true? (Choose two.)

Accepted Answer

If a health check object is modified, the change is reflected in all templates that reference it, but an install is needed to push to FortiGates.. Two statements are true: a health check object can be referenced by multiple SD-WAN templates, and modifying a health check object updates all referencing templates in FortiManager but requires an install to push changes to FortiGates. These reflect the centralized, reusable nature of health check objects and the need for an explicit install step to apply configuration changes to managed devices.

Answer

An SD-WAN template can reference only one health check object at a time.

Answer

Health check objects are defined within each SD-WAN template and cannot be shared.

Answer

Modifying a health check object automatically updates all FortiGates that use templates referencing it, without requiring an install.

Question 10

A network engineer is using FortiManager to manage SD-WAN templates for multiple FortiGates. They need to ensure that a specific SD-WAN rule is only applied to branch offices that have a specific tag. Which FortiManager feature should they use?

Accepted Answer

Dynamic mapping. Dynamic mapping in FortiManager enables the conditional assignment of configuration objects, including SD-WAN templates and rules, based on device metadata such as tags. This allows administrators to target specific devices without manually assigning templates to each one. By using dynamic mapping, the SD-WAN rule is applied only to branch offices that have the designated tag, ensuring precise configuration management.

Answer

Meta fields

Answer

Provisioning templates

Answer

Policy packages

Question 11

A network engineer is creating a new SD-WAN template in FortiManager. The template will be used to configure SD-WAN on several FortiGate devices. The engineer wants to define a health check that monitors the latency to a specific server using ICMP. Which configuration object should the engineer create first?

Accepted Answer

SD-WAN health check. The engineer should create an SD-WAN health check object first. This object contains the parameters for monitoring the health of SD-WAN members, such as the protocol (ICMP), server address, and thresholds. Once created, it can be referenced in the SD-WAN template when configuring members or rules, enabling the template to enforce performance SLAs.

Answer

SD-WAN member

Answer

Firewall policy

Answer

SD-WAN rule

Question 12

An administrator is troubleshooting an SD-WAN template deployment in FortiManager. The template fails to install on a managed FortiGate. Which two actions should the administrator take to identify the cause? (Choose two.)

Accepted Answer

Review the installation preview to see the generated CLI commands.. When an SD-WAN template fails to install, the administrator should first review the installation preview to see the generated CLI commands and check the task monitor for error messages. These steps provide direct insight into what went wrong, such as invalid references or syntax errors. Other actions like restarting the device or recreating the template do not address the underlying cause.

Answer

Use the FortiGate CLI to manually apply the configuration.

Answer

Restart the FortiGate to clear any temporary issues.

Answer

Delete and recreate the SD-WAN template from scratch.

Question 13

A network administrator is using FortiManager to manage a large SD-WAN deployment. They need to create a new SD-WAN template that will be applied to multiple FortiGates. The administrator wants to ensure that the template can be easily modified in the future without having to manually update each device. Which FortiManager object should they use to define the SD-WAN template?

Accepted Answer

SD-WAN Template. The SD-WAN Template object in FortiManager is the correct choice because it is specifically designed for centralized SD-WAN configuration management. It allows the administrator to define SD-WAN settings once and apply them to multiple FortiGates, ensuring consistency and simplifying future modifications. Other objects like Policy Packages or Provisioning Templates serve different purposes and cannot manage SD-WAN templates directly.

Answer

Policy Package

Answer

Provisioning Template

Answer

Device Group

Question 14

A company has an SD-WAN template in FortiManager that is assigned to 50 FortiGates. The template includes a health check object named 'HC1' that monitors a server at 10.0.0.1. The administrator modifies 'HC1' to monitor 10.0.0.2 instead. After the change, the administrator notices that some FortiGates still show the old server IP in their running configuration. What is the most likely reason for this discrepancy?

Accepted Answer

The FortiGates with the old IP have not had the updated template installed yet.. The most likely reason is that the FortiGates with the old IP have not had the updated template installed. Modifying a health check object in FortiManager updates the configuration in the database, but the changes are not automatically pushed to managed devices. An install operation is required to apply the changes. If some devices were offline or excluded from the last install, they would retain the old configuration.

Answer

The FortiGates are using a cached version of the health check and need to be rebooted.

Answer

The health check object is locked and cannot be modified.

Answer

The health check object is not referenced correctly in the SD-WAN template.

Question 15

An administrator is configuring an SD-WAN template in FortiManager. They want to ensure that the template can be applied to FortiGates with different interface names. Which feature in FortiManager allows mapping template interface references to actual device interfaces?

Accepted Answer

Dynamic Mapping. Dynamic Mapping is the FortiManager feature that enables SD-WAN templates to be portable across devices with different interface names. It allows the template to use generic interface names, which are then mapped to the actual interfaces on each managed FortiGate during installation. This simplifies template management and ensures consistency.

Answer

Device Mapping

Answer

Interface Mapping

Answer

Template Mapping