NSE7_SDW Central Management Practice Test 6 — 15 Questions

Question 1

A network engineer is configuring an SD-WAN template in FortiManager. They want to define a performance SLA that monitors the quality of two WAN links using HTTP probes to a specific server. Which FortiManager object should they configure to define the HTTP probe parameters?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SD-WAN Health Check. To define HTTP probe parameters for a performance SLA, you configure an SD-WAN Health Check object in FortiManager. This object allows you to specify the protocol, target, interval, and other settings. It is then referenced in SD-WAN rules to make routing decisions based on link quality.

Answer

Firewall Address

Answer

SD-WAN Zone

Answer

SD-WAN Rule

Question 2

A network administrator at a large enterprise uses FortiManager to manage 120 FortiGates. The security team wants to enforce a consistent SD-WAN configuration across all branches, but the branches have different WAN link counts and interface names. The administrator wants to avoid manually editing each device's configuration. Which FortiManager feature should the administrator use to create a reusable SD-WAN configuration that can adapt to each device's interface names?

Accepted Answer

SD-WAN template with metadata variables. SD-WAN templates in FortiManager are designed to centralize and standardize SD-WAN configurations across many devices. By incorporating metadata variables, the template can reference device-specific values such as interface names, which are resolved during installation. This allows a single template to be applied to branches with different physical interface naming, ensuring consistency without manual per-device edits. Other options lack the SD-WAN specific constructs and dynamic mapping capability.

Answer

Provisioning template with static interface mapping

Answer

CLI template script with hardcoded interface names

Answer

Policy package with per-device installation targets

Question 3

An administrator has configured an SD-WAN template in FortiManager and applied it to a FortiGate. Later, the administrator modifies the template by adding a new SD-WAN zone and a new performance SLA. What happens when the administrator installs the modified template to the FortiGate?

Accepted Answer

The FortiGate will receive the new zone and SLA, but the new zone will be empty until interfaces are assigned to it.. Modifying an SD-WAN template to add a new zone and SLA results in those objects being created on the managed FortiGate upon installation. However, the new zone will have no member interfaces until they are explicitly assigned, either via the template or manually. Existing rules are not automatically updated to use the new zone. This behavior ensures that the administrator retains control over which interfaces belong to which zone.

Answer

The FortiGate will receive the new zone and SLA, but existing SD-WAN rules referencing the old zone will be automatically updated to include the new zone.

Answer

The FortiGate will receive the new SLA, but the new zone will not be created because zones must be defined in a separate provisioning template.

Answer

The FortiGate will reject the installation because the new zone conflicts with existing zones, requiring a reboot.

Question 4

An administrator is reviewing the SD-WAN configuration in FortiManager after applying a template to several FortiGates. They notice that one FortiGate has a different SD-WAN rule order than the others. What is the most likely reason for this discrepancy?

Accepted Answer

The SD-WAN template was not properly installed on that FortiGate, so it retained its previous configuration.. The most likely reason for the different SD-WAN rule order is that the template was not successfully installed on that FortiGate. Without a successful installation, the device retains its previous configuration, which may have a different rule order. This can occur if the device was offline or excluded from the installation.

Answer

The SD-WAN template includes a dynamic mapping that reorders rules based on metadata.

Answer

The FortiGate has a local SD-WAN configuration that overrides the template.

Answer

The FortiGate is using a different firmware version that changes the default rule order.

Question 5

An administrator has an SD-WAN template applied to 30 FortiGates via FortiManager. The template includes a performance SLA named 'Critical_SLA' that monitors two WAN links. The administrator needs to change the SLA's probe interval from 500ms to 1000ms without affecting other settings. After modifying the template, what must the administrator do to propagate the change to all managed FortiGates?

Accepted Answer

Install the SD-WAN template to the managed FortiGates.. Modifying an SD-WAN template in FortiManager does not automatically update managed FortiGates. The administrator must explicitly install the template to the devices to push the changes. This ensures the new probe interval is applied consistently. Other actions like synchronization, reboot, or CLI scripts do not properly propagate template changes and can lead to inconsistencies or extra downtime.

Answer

Run a CLI script on each FortiGate to modify the SLA settings.

Answer

Reboot each FortiGate to apply the updated template.

Answer

Synchronize the FortiManager ADOM with the FortiGates.

Question 6

An administrator is configuring an SD-WAN template in FortiManager for a hub-and-spoke topology. The administrator wants to ensure that the SD-WAN rules can dynamically select the best path based on performance. Which two components must be configured within the SD-WAN template to achieve this? (Choose two.)

Accepted Answer

SD-WAN rules with path selection criteria. To enable dynamic path selection based on performance, an SD-WAN template must include performance SLA definitions and SD-WAN rules that reference those SLAs. The performance SLAs measure link quality, and the rules use that data to select the best path. Other components like static routes, BGP, or bandwidth settings are not essential for this specific functionality.

Answer

Interface bandwidth settings

Answer

Static route priorities

Answer

BGP neighbor configurations

Question 7

A network administrator is troubleshooting an SD-WAN deployment managed by FortiManager. They notice that a specific SD-WAN rule is not being enforced on a FortiGate, even though the template was installed successfully. The rule uses a performance SLA to select the best path. What is the most likely cause?

Accepted Answer

The performance SLA health check is not properly configured or is failing.. The most likely cause is that the performance SLA health check is not properly configured or is failing. Without a valid health check, the SD-WAN rule cannot evaluate SLA compliance and thus may not enforce the rule as intended. Successful template installation does not guarantee that health checks are operational.

Answer

The SD-WAN rule is configured with a manual interface selection instead of using the SLA.

Answer

The SD-WAN template was applied to the wrong device group.

Answer

The FortiGate does not support SD-WAN performance SLAs.

Question 8

A network engineer is configuring an SD-WAN template in FortiManager. They want to define a performance SLA that monitors the quality of two WAN links using HTTP probes to a specific server. Which FortiManager object should they configure to define the HTTP probe parameters?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Performance SLA. Performance SLA defines the acceptable thresholds for latency, jitter, and packet loss. When a link's health check measurements violate these thresholds, the link is marked as out of SLA, and SD-WAN rules can then select an alternative link. This enables dynamic failover based on link quality. Health checks provide the data, but the SLA sets the criteria. SD-WAN rules use the SLA status to make routing decisions, but they do not define the thresholds themselves.

Answer

Interface priority

Answer

SD-WAN rule

Answer

SD-WAN health check

Question 9

A network administrator manages 30 FortiGate devices in FortiManager. The administrator wants to ensure that all devices use the same SD-WAN health check settings for a specific SLA target. Which FortiManager object should the administrator configure to achieve this?

Accepted Answer

SD-WAN health check template. SD-WAN health check templates are shared objects in FortiManager that define the parameters for performance monitoring, such as protocol, server, and thresholds. By referencing the same health check template in multiple SD-WAN templates, the administrator ensures that all managed FortiGates use identical health check settings. This centralizes management and reduces configuration drift, which is essential for consistent SLA enforcement across many devices.

Answer

SD-WAN zone

Answer

Virtual IP

Answer

Firewall address object

Question 10

A network administrator manages 80 FortiGate devices in FortiManager. The company wants to ensure that all devices use the same SD-WAN health check settings for a critical business application, but each device has a different WAN IP address. Which FortiManager feature should the administrator use to meet this requirement?

Accepted Answer

SD-WAN template with dynamic mapping. Dynamic mapping in SD-WAN templates allows the use of variables that are resolved per device during installation, making it the ideal solution for standardizing health check settings across devices with different WAN IP addresses. The template remains consistent, while the variables ensure each device uses its own IP.

Answer

SD-WAN template with static interface mapping

Answer

Per-device SD-WAN configuration in FortiManager

Answer

SD-WAN template with a shared health check object

Question 11

A company uses FortiManager to manage 100 FortiGates. They have an SD-WAN template applied to all devices. The administrator modifies a health check within the template to change the probe interval from 500ms to 1000ms. After saving the template, they want to push the change to all managed FortiGates. What must the administrator do to ensure the updated health check is applied to all devices?

Accepted Answer

Use the 'Install Wizard' to install the SD-WAN template to all devices.. After modifying an SD-WAN template in FortiManager, the administrator must use the Install Wizard to deploy the changes to the managed FortiGates. This centralized installation process ensures that all devices receive the updated health check configuration. Without an explicit install, the changes remain only in the FortiManager database.

Answer

The change is automatically synchronized to all FortiGates in real-time.

Answer

Reboot each FortiGate to apply the new health check settings.

Answer

Re-install the SD-WAN template on each FortiGate individually.

Question 12

An administrator has created an SD-WAN template in FortiManager and applied it to a group of FortiGates. Later, they need to modify the template to add a new health check. What is the most efficient way to update all managed devices with this change?

Accepted Answer

Modify the SD-WAN template in FortiManager and re-apply it to the devices.. The most efficient way to update all managed devices with a change to an SD-WAN template is to modify the template in FortiManager and re-apply it. FortiManager will automatically push the updated configuration to all devices using that template, ensuring consistency and saving time. Manual edits or scripts are less efficient and more error-prone.

Answer

Create a new SD-WAN template and apply it to the devices, replacing the old one.

Answer

Manually edit the SD-WAN configuration on each FortiGate.

Answer

Use a script to push the configuration change to each device.

Question 13

An administrator has configured an SD-WAN template in FortiManager and applied it to a FortiGate. Later, the administrator needs to add a new VLAN interface as an SD-WAN member. Where should this change be made to ensure it is reflected in the FortiManager-managed configuration?

Accepted Answer

Modify the SD-WAN template in FortiManager and reinstall the configuration on the FortiGate.. SD-WAN templates in FortiManager are the authoritative source for SD-WAN configuration on managed FortiGates. To add a new member, the administrator must edit the template to include the VLAN interface and then install the updated configuration. This maintains consistency and ensures the change is properly tracked. Direct device changes or per-device overrides are not appropriate for adding new members.

Answer

Create a new SD-WAN template with the VLAN interface and apply it to the FortiGate, replacing the existing template.

Answer

Use a per-device mapping in FortiManager to override the SD-WAN member list for that FortiGate.

Answer

Directly on the FortiGate CLI, add the VLAN to the SD-WAN configuration, then retrieve the configuration in FortiManager.

Question 14

A company uses FortiManager to manage SD-WAN configurations for 50 branch offices. The administrator needs to update the SD-WAN rules across all branches to include a new application category for SaaS traffic. The update must be applied consistently and with minimal administrative effort. Which two actions should the administrator take to achieve this? (Choose two.)

Accepted Answer

Modify the SD-WAN template to include the new application category in the rules.. To update SD-WAN rules across all branches, the administrator should modify the SD-WAN template to include the new application category, then install the template to all managed FortiGates. This leverages FortiManager's centralized management to ensure consistency and efficiency. Other options either use the wrong object (policy package), involve manual per-device changes, or pull configurations instead of pushing them, none of which meet the requirement.

Answer

Create a new policy package with the updated rules and assign it to all devices.

Answer

Run a script on each FortiGate to add the application category to the local SD-WAN rules.

Answer

Synchronize the FortiManager ADOM to retrieve the latest SD-WAN rules from the devices.

Question 15

An administrator is using FortiManager 7.2 to manage SD-WAN templates across 150 FortiGates. They need to ensure that when a template is updated, the changes are propagated efficiently and that the FortiGates maintain high availability. The administrator wants to use the 'Install Wizard' to push the updated template. Which two statements are true about installing an SD-WAN template with the Install Wizard in this scenario? (Choose two.)

Accepted Answer

The Install Wizard automatically creates a revision history entry for each FortiGate after a successful template installation, allowing rollback if needed.. The Install Wizard in FortiManager supports phased rollouts by allowing selection of specific FortiGates within an ADOM, and it automatically records revision history for each device after a successful installation. These features enable efficient, controlled updates across large SD-WAN deployments while providing rollback capabilities. The wizard does not operate across ADOMs in a single operation, nor does it require devices to be offline, and it can install individual templates rather than only full policy packages.

Answer

The Install Wizard can only install the entire policy package, not just the SD-WAN template, when multiple FortiGates are selected.

Answer

The Install Wizard can push the updated SD-WAN template to all managed FortiGates simultaneously, regardless of their ADOM membership.

Answer

The Install Wizard requires that all FortiGates be offline before installing an SD-WAN template to prevent configuration conflicts.