NSE7_SDW Hard Questions — 25 Difficult Questions

Question 1

A Performance SLA bound to an SD-WAN zone is configured with a 200 ms latency threshold and a 5% packet-loss threshold. A member reports 180 ms latency but 8% packet loss. What is the member's SLA state, and how does it affect rule selection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The member is considered out of SLA because packet loss exceeds the threshold, so rules exclude it from selection.. Performance SLA health requires every configured threshold to be met, so exceeding the packet-loss limit alone marks the member out of SLA even though latency is acceptable. Rules referencing that SLA then skip the member, steering traffic to healthier links. The member is not merely warned, and both thresholds do not need to fail together.

Answer

The member is considered in SLA because latency is within threshold, so it remains eligible for rules.

Answer

The member is in SLA but is flagged with a warning that only affects logging, not rule selection.

Answer

The member is out of SLA only if latency and packet loss both exceed their thresholds simultaneously.

Question 2

An administrator has created an SD-WAN template in FortiManager and applied it to a FortiGate. The administrator then modifies the template to add a new SD-WAN rule that directs traffic from a specific subnet to a new overlay interface. After installing the policy package, the administrator notices that the rule is not taking effect on the FortiGate. What is the most likely reason?

Accepted Answer

The new overlay interface is not included in the SD-WAN zone on the FortiGate.. The most likely reason an SD-WAN rule is not taking effect after a template update is that the new overlay interface referenced in the rule is not a member of the SD-WAN zone on the FortiGate. SD-WAN rules can only select interfaces that are part of the SD-WAN zone. The administrator should verify that the interface is correctly mapped and included in the zone after installation.

Answer

The FortiGate requires a reboot after installing a new SD-WAN rule.

Answer

The SD-WAN template was not saved before installation.

Answer

The SD-WAN rule priority is lower than the default route.

Question 3

An administrator is configuring an IPsec VPN tunnel between two FortiGate devices for SD-WAN. The administrator wants to ensure that the tunnel interface can be used in SD-WAN rules and that the tunnel is established only when the underlying physical interface is up. Which IPsec Phase 1 configuration parameter is required to bind the tunnel to a specific outgoing interface?

Accepted Answer

interface. The 'interface' parameter in IPsec Phase 1 explicitly binds the tunnel to a specific outgoing interface. This ensures the tunnel uses only that interface and is established only when it is up, which is critical for SD-WAN member association and health checking. Other parameters like local-gw or remote-gw do not provide this binding.

Answer

psksecret

Answer

remote-gw

Answer

local-gw

Question 4

An administrator is configuring an SD-WAN template in FortiManager. The template includes a performance SLA that monitors two health checks: one for latency and one for jitter. The administrator wants the SD-WAN rule to select the member with the lowest latency. Which FortiManager configuration element must be used to achieve this?

Accepted Answer

SD-WAN rule with strategy set to 'lowest latency' and the latency SLA referenced.. To select the SD-WAN member with the lowest latency, the SD-WAN rule must use the 'lowest latency' strategy and reference the latency SLA. This strategy evaluates all members that meet the SLA and picks the one with the lowest measured latency. Other strategies focus on cost, bandwidth, or load distribution, and do not guarantee the lowest latency member is selected.

Answer

SD-WAN rule with strategy set to 'lowest cost (SLA)' and the latency SLA referenced.

Answer

SD-WAN rule with strategy set to 'maximize bandwidth (SLA)' and the latency SLA referenced.

Answer

SD-WAN rule with strategy set to 'load balance' and the latency SLA referenced.

Question 5

A network engineer is using FortiManager to manage SD-WAN templates for multiple FortiGates. They need to ensure that a specific SD-WAN rule is only applied to branch offices that have a specific tag. Which FortiManager feature should they use?

Accepted Answer

Dynamic mapping. Dynamic mapping in FortiManager enables the conditional assignment of configuration objects, including SD-WAN templates and rules, based on device metadata such as tags. This allows administrators to target specific devices without manually assigning templates to each one. By using dynamic mapping, the SD-WAN rule is applied only to branch offices that have the designated tag, ensuring precise configuration management.

Answer

Meta fields

Answer

Provisioning templates

Answer

Policy packages

Question 6

An administrator configures an SD-WAN rule that uses the 'maximize bandwidth (SLA)' strategy across three IPsec overlays. A security profile group containing IPS and Application Control is applied to the firewall policy that references the SD-WAN zone. Users report that some sessions are being re-evaluated mid-stream and reset when a health check fails. Which FortiOS behavior explains the resets?

Accepted Answer

When an SLA member fails, FortiOS re-runs the SD-WAN rule and may steer existing sessions to a different member, causing the security profile to re-inspect and reset sessions that cannot be re-evaluated.. SD-WAN rules that monitor SLA can trigger re-evaluation of existing sessions when a member's SLA degrades or fails. If the rule permits re-evaluation, FortiOS may move flows to a different member. Stateful security profiles such as IPS and Application Control may not be able to maintain inspection state across members, leading to session resets. Administrators can control this by disabling re-evaluation for sensitive rules or by designing SLA thresholds that avoid frequent flapping, ensuring stable session steering.

Answer

IPS and Application Control cannot be applied to SD-WAN zones; the profiles are silently ignored, and the resets are caused by the missing inspection.

Answer

The 'maximize bandwidth (SLA)' strategy ignores SLA health checks and only uses link capacity, so when a member saturates, IPS drops packets and resets the session.

Answer

The security profile group is applied to the SD-WAN zone, but FortiOS requires profiles to be bound to each member interface individually; the zone-level binding causes mid-stream resets.

Question 7

An SD-WAN rule uses the lowest-cost (SLA) strategy with two members, wan1 and wan2. wan1 has a lower configured cost than wan2, and both currently meet the SLA. A network engineer observes that all matching traffic egresses wan1. The engineer now wants traffic to prefer wan2 whenever wan2 meets the SLA, while still failing over to wan1 if wan2 degrades. What should the engineer change?

Accepted Answer

Set the rule strategy to priority and give wan2 a lower priority value than wan1. Preference between healthy members is expressed by the rule strategy. The lowest-cost strategy always favors the lower-cost member, so no cost or probe tuning produces a manual preference. Switching to the priority strategy and giving the desired member the lowest priority number makes it preferred while it passes the SLA, with automatic failover to the higher-numbered member.

Answer

Increase the cost value configured on wan2 above the cost on wan1

Answer

Add a Performance SLA probe on wan2 with a shorter probe interval than wan1

Answer

Lower the cost value configured on wan1 below the cost on wan2

Question 8

What happens if you modify an SD-WAN template that is already applied to a FortiGate?

Accepted Answer

The configuration status shows 'Modified' and requires an installation task. When you modify an SD-WAN template already applied to a FortiGate, FortiManager marks the device's configuration status as 'Modified', indicating the device is out of sync with the template. The changes are not pushed automatically; an administrator must run an installation task (Install Wizard or Install Device) to push the updated configuration to the FortiGate. This staged workflow prevents unintended immediate changes to production devices.

Answer

The changes take effect immediately without a push

Answer

The FortiGate automatically pulls the new config

Answer

The FortiGate configuration is reverted

Question 9

You are configuring an SD-WAN rule to route business-critical traffic. You want to ensure that the rule uses the best available link based on performance SLAs, and that it can fail over to a secondary link if the primary link's SLA is violated. Which two configuration elements are required to achieve this? (Choose two.)

Accepted Answer

Set the rule's strategy to 'SLA' and specify the SLA targets.. To route based on SLA and fail over when the SLA is violated, you must configure Performance SLAs on the members and use the 'SLA' strategy in the rule, specifying the SLA targets. This enables the rule to monitor link health and switch to a secondary link when the primary fails to meet the SLA.

Answer

Configure a static route with equal distance for both WAN links.

Answer

Set the rule's strategy to 'Lowest Cost' and assign costs to each member.

Answer

Enable 'Link Health Monitor' on the SD-WAN zone.

Question 10

Which THREE interface types are supported as SD-WAN members?

Accepted Answer

VLAN interfaces. SD-WAN members can be physical interfaces, VLANs, or VPN tunnel interfaces.

Answer

Loopback interfaces

Answer

Aggregate interfaces

Question 11

You are using 'SLA Target' as your strategy. What happens if multiple members meet the SLA?

Accepted Answer

The system selects the first member in the list.. When multiple members meet the SLA in 'SLA Target' mode, the FortiGate uses the member with the best performance metric (e.g., lowest latency).

Answer

The system selects the one with the highest bandwidth capacity.

Answer

The system selects the member with the best performance (e.g., lowest latency).

Answer

Traffic is sent through all of them simultaneously.

Question 12

An enterprise network implements BGP over ADVPN. Spoke units advertise their local subnets to the hub via BGP. To prevent spokes from learning each other's subnets directly through the hub via regular BGP route propagation before an ADVPN shortcut is established (forcing them to route through the hub unnecessarily), or conversely, to optimize route distribution, what BGP feature is typically configured on the hub?

Accepted Answer

BGP Route Reflection configured on the hub with spoke routers set as clients. BGP Route Reflection is the standard solution for iBGP full-mesh scalability. In an ADVPN, spokes establish iBGP sessions with the hub, and without route reflection, the hub would not re-advertise routes learned from one spoke to another because of iBGP split-horizon rules. Configuring the hub as a route reflector with spokes as clients allows the hub to reflect routes between spokes, enabling them to learn each other's subnets via BGP. This ensures that before an ADVPN shortcut is established, spokes have the necessary routes to initiate shortcut negotiation, and after the shortcut is up, BGP can still be used to exchange routes directly or via the hub as needed.

Answer

BGP Multipath relaxing with maximum-paths set to 32

Answer

Static default route redistribution with aggregate-address suppression

Answer

BGP Confederation with each spoke acting as a separate autonomous system

Question 13

If an SD-WAN template contains a reference to an interface that does not exist on a target FortiGate, what occurs during the installation process?

Accepted Answer

The installation fails with a configuration error. When an SD-WAN template references an interface that does not exist on the target FortiGate, the installation process fails with a configuration error. The template cannot be applied because the referenced interface is missing, and FortiManager reports the failure.

Answer

The FortiGate automatically creates a dummy interface

Answer

The installation proceeds and ignores the missing interface

Answer

The FortiGate enters an 'Emergency' state

Question 14

A FortiGate device is configured with an SD-WAN rule utilizing a SLA rule for latency and packet loss. Security profiles including Deep Packet Inspection (DPI) SSL inspection and an Antivirus profile are applied to the firewall policy allowing this traffic. Users report intermittent connection drops on real-time UDP-based applications. Upon troubleshooting, the administrator notices that packet drops occur only when the SD-WAN rule dynamically steers traffic to a backup IPsec tunnel that has a smaller MTU. What is the most likely root cause and mitigation for this behavior?

Accepted Answer

Path MTU Discovery is failing because ICMP unreachable messages are blocked, and TCP MSS clamping is not adjusting the encapsulated IPsec packet size correctly. The most likely root cause is that Path MTU Discovery (PMTD) is failing because ICMP unreachable messages are blocked, and TCP MSS clamping is not correctly adjusting the encapsulated IPsec packet size. When traffic is steered to a backup IPsec tunnel with a smaller MTU, large UDP packets may exceed the tunnel MTU and be dropped if PMTUD cannot signal the need for fragmentation. The mitigation is to ensure ICMP unreachable messages are allowed and to configure TCP MSS clamping appropriately, though for UDP, adjusting the MTU or enabling fragmentation before encryption may be necessary.

Answer

SD-WAN health check probes are overwhelming the IPsec tunnel bandwidth

Answer

The Antivirus proxy buffer is overflowing due to UDP streaming packets

Answer

The SSL inspection profile is attempting to decrypt UDP traffic, causing kernel panic and packet drops

Question 15

An administrator has configured BGP over multiple SD-WAN IPsec tunnels to provide redundant paths to a datacenter. However, asymmetric routing is causing stateful inspection drops on a secondary FortiGate firewall downstream. To ensure that BGP selects the preferred primary SD-WAN member consistently, which BGP attribute is best manipulated via a route-map applied to the BGP neighbor in FortiOS?

Accepted Answer

Local Preference. Local Preference is the best BGP attribute to manipulate via a route-map applied to the BGP neighbor in FortiOS to ensure consistent primary path selection. Local Preference is used within an autonomous system to indicate the preferred exit point for outbound traffic. By setting a higher local preference on routes learned from the primary SD-WAN member, BGP will prefer that path. This attribute is propagated only within the local AS, making it ideal for influencing outbound path selection without affecting external peers.

Answer

AS-PATH prepend

Answer

Cluster ID

Answer

Origin code

Question 16

An SD-WAN rule is configured with the Best Quality strategy and includes two members: WAN1 and WAN2. The Performance SLA for both members is set to monitor latency, jitter, and packet loss. The SLA thresholds are latency 100 ms, jitter 20 ms, and packet loss 1%. Currently, WAN1 has latency 80 ms, jitter 10 ms, and packet loss 0.5%; WAN2 has latency 90 ms, jitter 25 ms, and packet loss 0.2%. Both members are up. Which member will be selected by the Best Quality strategy?

Accepted Answer

WAN1, because it meets all SLA thresholds while WAN2 exceeds the jitter threshold.. The Best Quality strategy selects the member that meets all SLA thresholds and has the best overall quality. WAN1 satisfies latency, jitter, and packet loss thresholds, while WAN2 violates the jitter threshold. Therefore, WAN2 is excluded, and WAN1 is chosen as the only compliant member.

Answer

WAN2, because it has lower packet loss than WAN1, which is the most important metric.

Answer

WAN2, because it has the lowest latency among the members that meet the packet loss threshold.

Answer

Neither member will be selected because both must meet all SLA thresholds for any to be chosen.

Question 17

An administrator is troubleshooting an IPsec VPN tunnel that is part of an SD-WAN zone. The tunnel is up, but SD-WAN health checks are failing, causing the tunnel to be marked as down. The administrator verifies that the Phase 2 selectors include the health check server's IP address. What is the next most likely cause to investigate?

Accepted Answer

The health check server is not reachable via the tunnel due to missing route.. After verifying Phase 2 selectors, the next most likely cause for SD-WAN health check failure on an up tunnel is a missing route to the health check server. Without a route, the probes cannot reach the server, and the health check fails. The other options are either contradicted by the scenario (tunnel up) or less likely given the context. Ensuring proper routing is essential for health checks to traverse the tunnel.

Answer

The tunnel interface is not added to the SD-WAN zone.

Answer

The SD-WAN health check is configured with the wrong protocol (e.g., HTTP instead of ping).

Answer

The IPsec tunnel's Phase 1 proposal does not match the remote gateway.

Question 18

A company uses FortiManager to manage 200 FortiGates with SD-WAN enabled. The administrator needs to update the SD-WAN health check settings for all branches to use a new server IP. The health check is referenced by a single SD-WAN template that is assigned to all branches. After modifying the health check object in FortiManager, what must the administrator do to apply the changes to all FortiGates?

Accepted Answer

Use the 'Install Wizard' to push the updated template to all managed FortiGates.. The correct action is to use the Install Wizard to push the updated template to all managed FortiGates. FortiManager's Install Wizard allows bulk installation of configuration changes, including SD-WAN templates and referenced objects like health checks. After modifying the shared health check, the administrator can select all affected devices and install the changes in a single operation, ensuring all branches receive the update efficiently.

Answer

Install the SD-WAN template on each FortiGate individually.

Answer

Manually edit the SD-WAN configuration on each FortiGate via CLI.

Answer

Reboot each FortiGate to apply the new health check settings.

Question 19

Which TWO of the following can be used as a 'Source' in an SD-WAN rule?

Accepted Answer

Source IP address object.. In an SD-WAN rule, the Source field matches traffic by the origin of the flow, and a Source IP address object (Option A) is a valid match criterion because SD-WAN rules can select traffic based on source address objects defined in the firewall address book. A User group (Option E) is also valid as a Source, since FortiGate SD-WAN rules can match traffic by authenticated user or user group identity, allowing policy-based steering per user population. SLA target name (Option B) is not a source match; it is a performance SLA object referenced in the rule's outgoing interface/strategy configuration to measure link health. Interface MAC address (Option C) is not a supported Source match criterion in SD-WAN rules, and Firewall policy ID (Option D) is not a source selector either, as policy IDs identify firewall policies rather than traffic origin.

Answer

SLA target name.

Answer

Interface MAC address.

Answer

Firewall policy ID.

Question 20

A network administrator is using FortiManager to manage SD-WAN templates across multiple FortiGates. The administrator needs to ensure that the SD-WAN templates can be applied to devices with different interface names and that the configuration remains consistent. Which two actions must the administrator perform to achieve this? (Choose two.)

Accepted Answer

Define SD-WAN zones in the template and assign member interfaces to zones on each device.. Using dynamic mapping and SD-WAN zones allows a single SD-WAN template to be applied to devices with different interface names. Dynamic mapping replaces placeholders with actual interfaces during installation, while zones abstract interface names so rules reference logical groups. Both methods ensure consistency and reduce manual configuration.

Answer

Enable per-device mapping in FortiManager to manually assign each interface for every FortiGate.

Answer

Configure a separate SD-WAN template for each device model to accommodate interface differences.

Answer

Use the same interface names on all FortiGates by renaming interfaces to match the template.