NSE7_SDW Central Management Practice Test 7 — 15 Questions

Question 1

A network administrator is configuring an SD-WAN template in FortiManager. The template includes multiple SD-WAN rules that reference different Performance SLAs. The administrator wants to ensure that if a link fails an SLA, traffic is automatically routed to another link that meets the SLA. Which SD-WAN rule strategy should be used to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Best Quality. The Best Quality strategy is designed to select the link with the best performance metrics as defined by the SLA. If a link fails to meet the SLA, the rule automatically switches to another link that does meet the SLA, ensuring continuous compliance. Other strategies like Lowest Cost or Maximize Bandwidth prioritize cost or bandwidth, which may not align with the goal of maintaining SLA compliance.

Answer

Maximize Bandwidth (SLA)

Answer

Manual

Answer

Lowest Cost (SLA)

Question 2

A network administrator is managing an SD-WAN deployment with multiple FortiGates using FortiManager. The administrator needs to ensure that all SD-WAN health checks are consistent across all devices and that any changes to the health check parameters are automatically propagated. Which FortiManager object should the administrator use to achieve this?

Accepted Answer

SD-WAN Health Check Template. An SD-WAN Health Check Template is a reusable object in FortiManager that centralizes health check parameters. When referenced by multiple SD-WAN templates, any update to the health check template is automatically reflected in all associated SD-WAN configurations. This ensures uniform health check behavior across all managed FortiGates and simplifies administration by eliminating the need to update each device individually.

Answer

Virtual IP

Answer

SD-WAN Rule

Answer

Firewall Address Object

Question 3

A network administrator is using FortiManager to manage an SD-WAN deployment. They want to create a new SD-WAN template that includes a health check for the 'MPLS' interface. Where in the FortiManager GUI should the administrator navigate to create this template?

Accepted Answer

Policy & Objects > SD-WAN Templates. SD-WAN templates in FortiManager are created under Policy & Objects > SD-WAN Templates. This section provides the interface to define templates that can include SD-WAN interfaces, Performance SLAs, and rules. Once created, these templates can be assigned to policy packages and installed on managed FortiGates, enabling centralized management of SD-WAN configurations across multiple devices.

Answer

FortiView > SD-WAN > Templates

Answer

System Settings > SD-WAN > Template Library

Answer

Device Manager > SD-WAN > Templates

Question 4

An administrator is using FortiManager to manage an SD-WAN deployment with 80 FortiGates. The SD-WAN template includes a health check that pings the destination '8.8.8.8' every 500ms. The administrator notices that some branches have high latency to that destination, causing unnecessary failovers. The administrator wants to change the health check destination to a regional server with lower latency for each branch. However, the branches are in different geographic regions. What is the most efficient way to customize the health check destination per region without creating multiple templates?

Accepted Answer

Use metadata variables in the SD-WAN template to define the health check destination per device.. Metadata variables in SD-WAN templates enable per-device customization without creating multiple templates. By defining a variable for the health check destination and assigning values based on region, the administrator can maintain a single template that adapts to each branch. This approach is efficient, scalable, and consistent with FortiManager best practices. Other methods like multiple templates, local modifications, or CLI scripts introduce complexity, drift, or administrative overhead.

Answer

Use a CLI script to change the health check destination on all devices at once.

Answer

Create a separate SD-WAN template for each region and assign devices accordingly.

Answer

Modify the health check on each FortiGate locally after template installation.

Question 5

An administrator is configuring an SD-WAN template in FortiManager. The template includes a performance SLA that monitors two health checks: one for latency and one for packet loss. Which FortiManager object must be referenced in the SD-WAN template to define these health checks?

Accepted Answer

SD-WAN health check. SD-WAN health check objects in FortiManager are used to define the parameters for monitoring SLA targets, including latency and packet loss. These objects are referenced within SD-WAN templates to specify which health checks to use. The template then applies these settings to the managed FortiGates. Other objects like zones or services do not contain health check definitions.

Answer

SD-WAN zone

Answer

SD-WAN member

Answer

SD-WAN service

Question 6

A network engineer is using FortiManager to manage a FortiGate that already has a local SD-WAN configuration. The engineer wants to transition to centralized management by assigning an SD-WAN template to the device. After the template is assigned and installed, what is the effect on the existing local SD-WAN settings?

Accepted Answer

The local SD-WAN settings are overwritten by the template configuration when the policy package is installed.. When an SD-WAN template is assigned to a FortiGate in FortiManager and the policy package is installed, the template configuration overwrites the device's local SD-WAN settings. This is by design to enforce centralized management and consistency. The engineer must ensure the template includes all necessary SD-WAN members, health checks, and rules before installation.

Answer

The local SD-WAN settings are merged with the template, with template values taking precedence for any conflicting parameters.

Answer

The local SD-WAN settings remain active until the FortiGate is rebooted, after which the template takes effect.

Answer

The local SD-WAN settings are preserved, and the template is applied only to interfaces not already configured for SD-WAN.

Question 7

A network engineer is creating an SD-WAN template in FortiManager. They want to define a health check that monitors the quality of an internet link by sending HTTP requests to a specific URL. Which configuration element in the SD-WAN template should they use to accomplish this?

Accepted Answer

Performance SLA. Performance SLA is the SD-WAN template component designed for health checking. It supports HTTP as a protocol and allows specifying a URL to monitor. The SLA generates probes and evaluates link quality, which is essential for SD-WAN to make informed routing decisions based on real-time performance metrics.

Answer

SD-WAN rule

Answer

SD-WAN zone

Answer

Static route

Question 8

A network administrator is managing a FortiManager that has provisioned an SD-WAN template to a group of managed FortiGates. The administrator needs to verify that each FortiGate is actually running the intended SD-WAN configuration and that no device is out of sync. Which FortiManager workflow should the administrator use to compare the intended SD-WAN template configuration against the running configuration on each managed device?

Accepted Answer

Use the Configuration Diff feature in FortiManager to compare the device's running configuration with the provisioned template.. FortiManager's Configuration Diff feature is designed to compare the intended configuration from templates and policy packages with the actual running configuration on a managed FortiGate. It highlights differences so administrators can detect drift, such as manual CLI changes, and ensure the SD-WAN template is correctly applied and synchronized across all managed devices.

Answer

Review the FortiManager Task Monitor for successful installation logs of the SD-WAN template.

Answer

Use the Reinstall Policy Package option on each managed FortiGate from the Device Manager.

Answer

Run a CLI script from FortiManager that executes 'get system status' on all managed FortiGates.

Question 9

An administrator is configuring an SD-WAN template in FortiManager. The template includes a performance SLA that monitors two health checks: one for latency and one for jitter. The administrator wants the SD-WAN rule to select the member with the lowest latency. Which FortiManager configuration element must be used to achieve this?

Accepted Answer

SD-WAN rule with strategy set to 'lowest latency' and the latency SLA referenced.. To select the SD-WAN member with the lowest latency, the SD-WAN rule must use the 'lowest latency' strategy and reference the latency SLA. This strategy evaluates all members that meet the SLA and picks the one with the lowest measured latency. Other strategies focus on cost, bandwidth, or load distribution, and do not guarantee the lowest latency member is selected.

Answer

SD-WAN rule with strategy set to 'lowest cost (SLA)' and the latency SLA referenced.

Answer

SD-WAN rule with strategy set to 'maximize bandwidth (SLA)' and the latency SLA referenced.

Answer

SD-WAN rule with strategy set to 'load balance' and the latency SLA referenced.

Question 10

An administrator is using FortiManager to manage SD-WAN configurations for multiple FortiGates. They need to update the SD-WAN template to change the health check target for all devices. After modifying the template, they want to ensure the changes are pushed to all managed FortiGates efficiently. Which action should they take in FortiManager?

Accepted Answer

Use the 'Install Wizard' to install the template on all managed FortiGates.. The Install Wizard in FortiManager is designed to deploy configuration changes, including SD-WAN template updates, to multiple managed FortiGates in one operation. This method is efficient, reduces manual effort, and ensures that all devices receive the updated configuration consistently, which is essential for large-scale SD-WAN deployments.

Answer

Export the template and import it on each FortiGate via CLI.

Answer

Install the template on each FortiGate individually.

Answer

Modify the template and wait for automatic synchronization.

Question 11

An administrator is using FortiManager to deploy an SD-WAN configuration to a new FortiGate. The administrator wants to ensure that the SD-WAN member interfaces are correctly associated with the physical interfaces on the device. Which FortiManager feature allows the administrator to define the mapping between logical SD-WAN interfaces and physical interfaces?

Accepted Answer

SD-WAN Template. The SD-WAN Template in FortiManager is the correct feature for defining SD-WAN configurations, including member interfaces and their mapping to physical interfaces. When the template is applied to a FortiGate, FortiManager uses the template's logical interface references and maps them to the device's physical interfaces, ensuring the SD-WAN setup is correctly instantiated.

Answer

Provisioning Template

Answer

Firewall Policy

Answer

Address Group

Question 12

A network engineer is configuring an SD-WAN template in FortiManager for a group of branch FortiGates. The engineer needs to define health checks that monitor the performance of WAN links. Which two health check protocols are supported in FortiManager SD-WAN templates? (Choose two.)

Accepted Answer

Ping. FortiManager SD-WAN templates support health check protocols such as Ping and HTTP. Ping uses ICMP to measure basic network performance, while HTTP performs application-layer checks. These protocols are essential for monitoring link quality and triggering SD-WAN rule actions. Other protocols like SNMP, DNS, and TCP echo are not available for this purpose in FortiManager.

Answer

SNMP

Answer

TCP echo

Answer

DNS

Question 13

An administrator is creating an SD-WAN template in FortiManager and needs to define the member interfaces. Which FortiManager object is used to group these interfaces for the SD-WAN configuration?

Accepted Answer

SD-WAN zone. In FortiManager, SD-WAN zones are used to group member interfaces within an SD-WAN template. Zones allow policies and rules to reference a logical group rather than individual interfaces, simplifying configuration. The administrator defines zones and assigns interfaces to them. Other objects like address groups or interface groups serve different purposes and are not used for SD-WAN member grouping.

Answer

Virtual WAN link

Answer

Interface group

Answer

Firewall address group

Question 14

An administrator needs to deploy an SD-WAN template to a FortiGate that has two WAN interfaces: wan1 and wan2. The template includes an SD-WAN rule that load-balances traffic across both interfaces. During installation, the administrator receives an error that the interface mapping is incomplete. What is the most likely cause?

Accepted Answer

The administrator did not map the template's SD-WAN member interfaces to the FortiGate's physical interfaces.. The error indicates that the template's interface mapping is incomplete. In FortiManager, SD-WAN templates require that each abstract interface in the template be mapped to a physical interface on the target FortiGate. If the administrator fails to perform this mapping, the installation cannot proceed.

Answer

The FortiGate does not have the required firmware version to support SD-WAN templates.

Answer

The SD-WAN template does not include a health check for both interfaces.

Answer

The SD-WAN rule is configured to use dynamic mapping instead of static mapping.

Question 15

A network administrator is using FortiManager to manage SD-WAN templates for multiple FortiGates. They need to ensure that a specific health check, which monitors a critical cloud application, is used by all SD-WAN rules across all templates. What is the most efficient way to achieve this in FortiManager?

Accepted Answer

Create a shared health check object and reference it in each SD-WAN template.. Using shared health check objects in FortiManager allows multiple SD-WAN templates to reference the same health check. This centralizes management and ensures consistency across all templates. Any update to the shared object is reflected in all templates that use it, making it the most efficient solution.

Answer

Use a meta field to define the health check and apply it to all templates.

Answer

Create a separate health check in each SD-WAN template with identical settings.

Answer

Configure the health check in the global ADOM and assign it to all templates.