NSE7_SDW Central Management — Timed 50 Questions

Question 1

Which menu path in FortiManager is used to define SD-WAN templates?

Accepted Answer

Device Manager > SD-WAN Template. SD-WAN templates are managed under the 'Policy & Objects' tab within the device configuration context.

Answer

System Settings > SD-WAN

Answer

Policy & Objects > Firewall Policy

Answer

Log View > SD-WAN

Question 2

Which feature in FortiManager allows you to monitor SD-WAN performance across all managed FortiGates?

Accepted Answer

Dashboard > SD-WAN Monitor. SD-WAN Monitor within FortiManager provides visibility into performance metrics for all managed SD-WAN devices.

Answer

Device Manager

Answer

Log View

Answer

Policy & Objects

Question 3

What is the benefit of using 'SD-WAN Zones' in templates when managing 100+ branches?

Accepted Answer

They allow for easier mapping to physical ports across different hardware models. Zones allow you to assign generic names to interfaces, so the template can refer to 'WAN_ZONE' rather than specific port names.

Answer

They allow for multiple internet service providers

Answer

They automatically configure static routes

Answer

They increase the speed of the internet connection

Question 4

When using SD-WAN templates, which option allows you to manage different ISPs on different branches within the same template?

Accepted Answer

Dynamic Mapping. Dynamic Mapping in SD-WAN templates allows a single template to be applied across branches with different ISP configurations by mapping template variables to device-specific values at provisioning time. This means the same template can reference a variable like 'wan1_interface' and each branch's actual ISP interface is substituted dynamically, so different ISPs on different branches are handled within one template. It is the mechanism FortiManager uses to make templates reusable across heterogeneous branch environments.

Answer

Global Objects

Answer

Device Groups

Answer

SD-WAN Rules

Question 5

Which TWO of these are valid SD-WAN health check protocols?

Accepted Answer

HTTP. HTTP (Option C) is a valid SD-WAN health check protocol because SD-WAN solutions such as Cisco SD-WAN (Viptela) and Fortinet SD-WAN use HTTP/HTTPS probes to verify application-layer reachability and response codes against a target URL or server. Ping (Option D) is also valid because ICMP echo requests are a standard SD-WAN health check method used to measure reachability, latency, jitter, and packet loss to a specified destination IP. SSH (Option A), FTP (Option B), and SNMP (Option E) are not SD-WAN health check protocols: SSH and FTP are management/file-transfer protocols, and SNMP is used for monitoring and management data collection rather than active path health probing.

Answer

SSH

Answer

FTP

Answer

SNMP

Question 6

Which THREE interface types are supported as SD-WAN members?

Accepted Answer

VLAN interfaces. SD-WAN members can be physical interfaces, VLANs, or VPN tunnel interfaces.

Answer

Loopback interfaces

Answer

Aggregate interfaces

Question 7

A network administrator is using FortiManager to manage 30 FortiGate devices. They have created a new SD-WAN template that references a performance SLA health check. After applying the template to all devices, the administrator notices that some devices show the health check as 'down' and traffic is not being routed correctly. The health check is configured to ping 8.8.8.8. What is the most likely cause of this issue?

Accepted Answer

The FortiGates do not have a static route to 8.8.8.8, so the health check packets are not sent out the intended SD-WAN member.. The health check failing on some devices suggests a routing or connectivity issue specific to those devices. The most likely cause is that the FortiGates lack a proper route to the health check target, so the ICMP packets do not egress the intended SD-WAN member. Without a route, the health check cannot succeed, causing the SLA to fail and traffic to be misrouted.

Answer

The SD-WAN template was not installed on the FortiGates; templates are only applied when a policy package is installed.

Answer

The health check is using the wrong source interface; it must be explicitly set to 'auto' to use the SD-WAN member.

Answer

The SD-WAN template does not support ICMP health checks; only HTTP and DNS are supported.

Question 8

A company uses FortiManager to manage a large SD-WAN deployment. They have created a metadata variable named 'Region' with values 'EMEA', 'APAC', and 'AMER'. They want to assign different SD-WAN templates based on the region of each FortiGate. Which FortiManager feature should they use to dynamically assign the correct SD-WAN template to each device?

Accepted Answer

SD-WAN Manager with dynamic mapping using metadata variables.. FortiManager's SD-WAN Manager includes a dynamic mapping capability that uses metadata variables to assign SD-WAN templates to devices automatically. By defining a metadata variable such as 'Region' and configuring mapping rules, the administrator ensures each FortiGate receives the template appropriate for its region, reducing manual effort and errors.

Answer

Policy Packages with installation targets filtered by metadata.

Answer

Scripts that run on FortiManager to modify device settings based on metadata.

Answer

Provisioning Templates with device groups based on metadata.

Question 9

A network administrator manages 80 FortiGates in a hub-and-spoke SD-WAN topology using FortiManager 7.2. The administrator wants to push a new SD-WAN rule to all branch FortiGates that routes traffic from the 'VoIP' internet service to the MPLS overlay when the MPLS Performance SLA is within SLA, otherwise to the broadband overlay. The administrator creates an SD-WAN template with the rule and assigns it to a new policy package. After installation, the administrator notices the rule is missing from the branch FortiGates. What is the most likely cause?

Accepted Answer

The SD-WAN template was not applied to the FortiGates through a policy package that includes the SD-WAN interface configuration.. SD-WAN templates in FortiManager are not automatically deployed to managed FortiGates; they must be included in a policy package that is installed on the devices. Creating the template alone does not push the configuration. The administrator must assign the template to the correct policy package and ensure that package is installed on the branch FortiGates. Without this step, the SD-WAN rule will not appear on the devices, even if the template is correctly configured.

Answer

The SD-WAN template was not locked before installation, so FortiManager skipped its deployment.

Answer

The Performance SLA 'MPLS' was configured with a manual update interval, so the rule could not evaluate the SLA status.

Answer

The FortiGates are running FortiOS 6.4, which does not support SD-WAN rules with Performance SLA-based selection.

Question 10

An administrator is using FortiManager to manage SD-WAN configurations. They need to ensure that SD-WAN templates are correctly applied and that the configuration is synchronized. Which two statements about SD-WAN template installation in FortiManager are true? (Choose two.)

Accepted Answer

SD-WAN templates are installed as part of a policy package installation.. SD-WAN templates are installed with the policy package, ensuring that SD-WAN rules and firewall policies are consistent. They can be assigned to multiple devices using device groups or dynamic mapping, which simplifies management at scale. These two statements reflect standard FortiManager behavior for SD-WAN template deployment.

Answer

If a device is offline during installation, the SD-WAN template is queued and applied when the device reconnects.

Answer

Modifying an SD-WAN template automatically pushes the changes to all assigned devices.

Answer

You can install an SD-WAN template independently without installing a policy package.

Question 11

A network administrator is using FortiManager to manage 30 FortiGates for a retail chain. The company wants to ensure that each store's SD-WAN configuration follows a standard template, but also needs to allow local customization of the WAN interface IP addresses at each site. Which FortiManager feature should be used to achieve this?

Accepted Answer

SD-WAN template with metadata variables. Metadata variables within SD-WAN templates allow administrators to define placeholders for values that vary per device, such as WAN IP addresses. When the template is applied to multiple FortiGates, each device receives its own value, ensuring both standardization and local customization. This is the recommended approach for managing SD-WAN configurations at scale in FortiManager.

Answer

Provisioning template with dynamic interface mapping

Answer

Centralized policy package with installation targets

Answer

SD-WAN template with per-device override

Question 12

An administrator is configuring an SD-WAN template in FortiManager for a hub-and-spoke topology. The template includes multiple Performance SLAs that monitor different health checks. The administrator wants to ensure that the SD-WAN rules can dynamically select the best path based on the SLA results. Which two actions must be performed to achieve this? (Choose two.)

Accepted Answer

Configure the Performance SLAs with appropriate thresholds and health checks.. To enable dynamic path selection based on SLA results, the administrator must define SD-WAN rules that reference the Performance SLAs and ensure the SLAs are properly configured with thresholds and health checks. These two actions ensure that the rules have the necessary data to make informed decisions. Other options like manual strategy or assigning SLAs to interfaces do not contribute to dynamic selection.

Answer

Assign the Performance SLAs to the SD-WAN interfaces.

Answer

Set the SD-WAN rule strategy to 'Manual'.

Answer

Enable 'SLA Target' in the SD-WAN rule configuration.

Question 13

An administrator is using FortiManager 7.4 to manage a large SD-WAN deployment. They need to ensure that when a new SD-WAN template version is installed, the FortiGates automatically update their SD-WAN rules without requiring a full policy package reinstall. The administrator wants to use the 'Install Wizard' to push only the SD-WAN template changes. Which statement describes the correct behavior of the FortiManager Install Wizard when installing an SD-WAN template?

Accepted Answer

The Install Wizard allows selecting 'Install Template' to push only the SD-WAN template changes, but it requires the template to be in a policy package that is already installed.. The FortiManager Install Wizard supports installing specific templates, including SD-WAN templates, without requiring a full policy package reinstall. This is possible when the template is already part of an installed policy package. The wizard then pushes only the updated template configuration to the managed FortiGates, enabling efficient incremental updates. This approach is particularly useful in large deployments where full reinstallations would be time-consuming and disruptive.

Answer

The Install Wizard can only install complete policy packages; there is no option to push individual template changes.

Answer

The Install Wizard can push SD-WAN template changes only if the FortiGates are in the same ADOM as the template and the template is locked.

Answer

The Install Wizard requires a full policy package reinstall whenever an SD-WAN template is modified, because templates are embedded in the package.

Question 14

An administrator is using FortiManager to manage SD-WAN templates. They need to ensure that the SD-WAN configuration is consistent across all managed FortiGates. Which two actions can be performed to verify that the SD-WAN template is correctly applied to a FortiGate? (Choose two.)

Accepted Answer

Check the installation status in FortiManager's task monitor.. To verify that an SD-WAN template is correctly applied, you can check FortiManager's task monitor for installation status and review the FortiGate's SD-WAN configuration via CLI. These methods provide confirmation from both the management side and the device side. Other options do not directly verify template application.

Answer

Run a 'diagnose debug application sdwan' on the FortiGate.

Answer

Check the FortiGate's system event logs for template installation messages.

Answer

Use FortiManager's 'Policy & Objects' to view the SD-WAN rules.

Question 15

A network administrator at a company with 30 branch offices uses FortiManager to manage all FortiGates. They need to ensure that the SD-WAN configuration on all branches is consistent and can be updated centrally. They decide to use SD-WAN templates. After creating a template, they want to assign it to all managed FortiGates that belong to the 'Branch' group. Which FortiManager feature allows them to assign the SD-WAN template to multiple FortiGates at once?

Accepted Answer

Device Manager > SD-WAN Templates. SD-WAN templates are configured and assigned to managed FortiGates under Device Manager in FortiManager. The administrator can create a template and then assign it to multiple devices or device groups in one operation, ensuring consistent SD-WAN configuration across all branches. This centralized approach simplifies management and reduces configuration drift.

Answer

AP Manager > SD-WAN Templates

Answer

Policy & Objects > SD-WAN Templates

Answer

Device Manager > Provisioning Templates

Question 16

A network administrator is using FortiManager to manage a set of FortiGates with SD-WAN configured. They want to apply a consistent SD-WAN template to all devices. Which FortiManager feature allows them to apply the template to multiple devices at once?

Accepted Answer

SD-WAN Templates. SD-WAN Templates in FortiManager allow administrators to define SD-WAN configurations centrally and apply them to multiple FortiGates at once. This feature is purpose-built for managing SD-WAN settings across many devices, ensuring consistency and reducing manual effort. Other features like Device Manager or Policy & Objects do not provide this bulk application capability for SD-WAN templates.

Answer

Device Manager

Answer

Policy & Objects

Answer

Provisioning Templates

Question 17

A network engineer is configuring an SD-WAN template in FortiManager to be used across multiple FortiGates. The template includes a Performance SLA named 'Internet_SLA' that monitors two members: 'wan1' and 'wan2'. The engineer wants the SLA to consider the link as within SLA only if both members meet the configured latency threshold. Which configuration in the SD-WAN template achieves this requirement?

Accepted Answer

Create a separate Performance SLA for each member and then use an SD-WAN rule that requires both SLAs to be met.. To enforce that both 'wan1' and 'wan2' meet the latency threshold for the link to be considered within SLA, the engineer must create two separate Performance SLA objects, each monitoring one interface. Then, an SD-WAN rule can reference both SLAs and require both to be satisfied. This is because each Performance SLA in FortiManager is tied to a single interface and does not aggregate multiple members. The SD-WAN rule then uses the SLA results to make forwarding decisions.

Answer

Set the Performance SLA 'Internet_SLA' to use 'OR' logic, so that the link is within SLA if either member meets the threshold.

Answer

Configure the Performance SLA 'Internet_SLA' with a 'Combined' metric that averages the latency of both members.

Answer

Set the Performance SLA 'Internet_SLA' to 'All' mode, so that all members must meet the SLA for the link to be considered up.

Question 18

A network engineer is using FortiManager to manage an SD-WAN deployment. After applying an SD-WAN template to a managed FortiGate, the engineer notices that the SD-WAN member interfaces are not correctly mapped to the physical interfaces on the device. The device model is FG-100F, but the template was originally created for FG-60F. Which FortiManager feature should the engineer use to resolve this interface mapping issue?

Accepted Answer

Dynamic Mapping. Dynamic Mapping is the FortiManager feature that automatically assigns physical interfaces to logical interface references in an SD-WAN template based on the target device's available ports. When a template designed for one FortiGate model is applied to another, Dynamic Mapping ensures the SD-WAN members are correctly bound to the appropriate physical interfaces, preventing configuration errors and manual rework.

Answer

Meta Fields

Answer

Provisioning Templates

Answer

Interface Groups

Question 19

A network administrator at a managed service provider needs to deploy an SD-WAN configuration to 40 FortiGate devices using FortiManager. The administrator wants to ensure that interface names and IP addresses are automatically substituted per device without manual editing. Which FortiManager SD-WAN template feature should the administrator configure?

Accepted Answer

SD-WAN template with dynamic interface mapping using metadata variables. Dynamic interface mapping in FortiManager SD-WAN templates allows the use of metadata variables to automatically assign interface names and IP addresses based on each device's unique metadata. This ensures that a single template can be deployed across many FortiGates without manual customization, which is essential for scalability and consistency. The other options either require manual work or do not address the substitution requirement.

Answer

SD-WAN template with static interface assignments and hardcoded IP addresses

Answer

SD-WAN template with manual per-device overrides after provisioning

Answer

SD-WAN template with a global health check profile only

Question 20

A network administrator is using FortiManager to manage a large SD-WAN deployment. They need to provision a new SD-WAN member interface on multiple FortiGate devices that are already managed by FortiManager. The interface name varies across different FortiGate models (e.g., 'wan1', 'port1'). Which FortiManager feature should the administrator use to ensure the SD-WAN template can be applied to devices with different interface naming conventions?

Accepted Answer

Dynamic Mapping. Dynamic Mapping allows SD-WAN templates to use placeholders for interface names, which are then mapped to actual interfaces on each managed device. This is essential when devices have different interface naming conventions, ensuring a single template can be applied universally. The other options do not provide this automatic resolution capability.

Answer

Interface Mapping

Answer

Meta Fields

Answer

Normalized Interfaces