NSE7_SDW Multiple Select — 40 Questions

Question 1

An administrator applies security profiles (Antivirus, Web Filtering, and IPS) to traffic steered by an SD-WAN rule. Performance issues arise. Which TWO methods can the administrator use to optimize inspection performance without completely disabling security? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Switch the inspection mode from proxy-based to flow-based where supported, allowing hardware offloading (NP6/NP7) to accelerate packet processing. Option A is correct because switching from proxy-based to flow-based inspection allows supported FortiGate models to use hardware acceleration (NP6/NP7 processors) for packet processing, which significantly reduces latency and improves throughput while still applying the security profiles. Option C is correct because configuring security profile exemptions or antivirus inspection overrides for trusted internal subnets or latency-sensitive VoIP traffic reduces the volume of traffic subjected to deep inspection, thereby optimizing performance without fully disabling security. Option B is incorrect because DES is a weak, deprecated encryption algorithm and would not meaningfully speed up IPsec decryption; it also degrades security rather than optimizing inspection. Option D is incorrect because disabling SSL inspection globally removes a critical security control entirely, which violates the requirement to avoid completely disabling security. Option E is incorrect because removing the SD-WAN virtual interface from all firewall zones would break the SD-WAN routing and security policy enforcement, not optimize inspection performance.

Answer

Set the IPsec Phase 1 encryption algorithm to DES to speed up decryptions

Answer

Disable all SSL inspection globally across the entire FortiGate device

Answer

Remove the SD-WAN virtual interface from all firewall zones

Question 2

You are configuring an SD-WAN rule to route business-critical traffic. You want to ensure that the rule uses the best available link based on performance SLAs, and that it can fail over to a secondary link if the primary link's SLA is violated. Which two configuration elements are required to achieve this? (Choose two.)

Accepted Answer

Set the rule's strategy to 'SLA' and specify the SLA targets.. To route based on SLA and fail over when the SLA is violated, you must configure Performance SLAs on the members and use the 'SLA' strategy in the rule, specifying the SLA targets. This enables the rule to monitor link health and switch to a secondary link when the primary fails to meet the SLA.

Answer

Configure a static route with equal distance for both WAN links.

Answer

Set the rule's strategy to 'Lowest Cost' and assign costs to each member.

Answer

Enable 'Link Health Monitor' on the SD-WAN zone.

Question 3

Which THREE of the following are benefits of using SD-WAN?

Accepted Answer

Simplified WAN management through zones.. Option B is correct because SD-WAN controllers abstract WAN transport links into logical zones (e.g., VPN zones, service zones), letting administrators apply consistent policy and routing across many sites from a single management plane instead of configuring each device individually. Option C is correct because SD-WAN continuously monitors link health (via BFD, IP SLA, or similar probes) and automatically reroutes traffic to a backup WAN link—LTE, broadband, or MPLS—when the primary link degrades or fails, without manual intervention. Option E is correct because SD-WAN's application-aware routing engine classifies traffic by application and steers it over the path with the best measured performance (latency, jitter, packet loss), enforcing policies such as sending VoIP over the lowest-latency link. Option A does not belong because SD-WAN is a software overlay/control technology and does not provide or install physical layer cabling. Option D does not belong because automatic hardware replacement is a vendor support/logistics function, not a capability of the SD-WAN software itself.

Answer

Built-in physical layer cabling.

Answer

Automatic hardware replacement.

Question 4

Which TWO methods can be used to update SD-WAN policies across all managed devices in FortiManager?

Accepted Answer

Using a CLI script to push updates. Option A is correct because FortiManager allows administrators to run CLI scripts (via Script > Scripts, executed with 'Run Script' or as part of a policy package install) that push configuration commands to all managed FortiGates, which can include SD-WAN policy changes. Option B is correct because SD-WAN templates in FortiManager (found under Policy & Objects > SD-WAN Templates or in the SD-WAN Manager) are centralized configuration templates; modifying the template and then installing the changes to the managed devices propagates the updated SD-WAN policies to all devices assigned to that template. Option C is not correct because editing an individual FortiGate policy only affects that single device, not all managed devices. Option D is not correct because creating a new ADOM is an administrative grouping action and does not update SD-WAN policies on existing managed devices. Option E is not correct because rebooting FortiManager does not push or update any SD-WAN policy configuration to managed devices.

Answer

Editing the individual FortiGate policy

Answer

Creating a new ADOM

Answer

Rebooting the FortiManager

Question 5

Which TWO of the following can be used as a 'Source' in an SD-WAN rule?

Accepted Answer

Source IP address object.. In an SD-WAN rule, the Source field matches traffic by the origin of the flow, and a Source IP address object (Option A) is a valid match criterion because SD-WAN rules can select traffic based on source address objects defined in the firewall address book. A User group (Option E) is also valid as a Source, since FortiGate SD-WAN rules can match traffic by authenticated user or user group identity, allowing policy-based steering per user population. SLA target name (Option B) is not a source match; it is a performance SLA object referenced in the rule's outgoing interface/strategy configuration to measure link health. Interface MAC address (Option C) is not a supported Source match criterion in SD-WAN rules, and Firewall policy ID (Option D) is not a source selector either, as policy IDs identify firewall policies rather than traffic origin.

Answer

SLA target name.

Answer

Interface MAC address.

Answer

Firewall policy ID.

Question 6

An administrator is using FortiManager 7.2 to manage SD-WAN templates across 150 FortiGates. They need to ensure that when a template is updated, the changes are propagated efficiently and that the FortiGates maintain high availability. The administrator wants to use the 'Install Wizard' to push the updated template. Which two statements are true about installing an SD-WAN template with the Install Wizard in this scenario? (Choose two.)

Accepted Answer

The Install Wizard automatically creates a revision history entry for each FortiGate after a successful template installation, allowing rollback if needed.. The Install Wizard in FortiManager supports phased rollouts by allowing selection of specific FortiGates within an ADOM, and it automatically records revision history for each device after a successful installation. These features enable efficient, controlled updates across large SD-WAN deployments while providing rollback capabilities. The wizard does not operate across ADOMs in a single operation, nor does it require devices to be offline, and it can install individual templates rather than only full policy packages.

Answer

The Install Wizard can only install the entire policy package, not just the SD-WAN template, when multiple FortiGates are selected.

Answer

The Install Wizard can push the updated SD-WAN template to all managed FortiGates simultaneously, regardless of their ADOM membership.

Answer

The Install Wizard requires that all FortiGates be offline before installing an SD-WAN template to prevent configuration conflicts.

Question 7

An administrator is validating a new SD-WAN deployment before going live. The design requires that the FortiGate detect link degradation before users notice it and that failover decisions be based on measured path quality rather than physical link state. Which two configuration elements are required to meet these goals? (Choose two.)

Accepted Answer

A Performance SLA attached to the SD-WAN members, with latency, jitter, and packet-loss thresholds configured.. Proactive, quality-based failover requires two things working together: a Performance SLA that measures latency, jitter, and packet loss per member, and an SD-WAN rule that references those members and reacts to the SLA state. The SLA supplies the health signal, and the rule acts on it. Static routes, dead peer detection, and interface role labels do not provide quality measurement or trigger path changes based on degradation.

Answer

Dead peer detection enabled on each IPsec tunnel member.

Answer

Interface role set to WAN on every member interface.

Answer

A static route for each member pointing to its gateway, with equal distance values.

Question 8

You are configuring an SD-WAN rule to route VoIP traffic. You want the rule to select the member with the best quality for voice, considering both latency and jitter. You have enabled Performance SLA on both WAN1 and WAN2, monitoring latency and jitter. You need to ensure the rule uses the appropriate strategy and that the SLA is correctly referenced. Which two actions must you perform to achieve this? (Choose two.)

Accepted Answer

Set the SD-WAN rule strategy to 'Best Quality'.. To route VoIP traffic based on both latency and jitter, set the SD-WAN rule strategy to 'Best Quality' and ensure the Performance SLA that monitors these metrics is assigned to the relevant SD-WAN members. This allows the SD-WAN engine to evaluate the quality of each link and select the best one for voice traffic.

Answer

Enable 'Link Health Monitor' on the SD-WAN rule.

Answer

Configure the Performance SLA to use HTTP probes to measure jitter.

Answer

Set the SD-WAN rule strategy to 'Lowest Latency'.

Question 9

An administrator is configuring SD-WAN on a FortiGate with two WAN interfaces: port1 and port2. They need to ensure that the SD-WAN can properly direct traffic based on application type and link performance. Which two configuration steps are required to enable application-based steering with SLA enforcement? (Choose two.)

Accepted Answer

Create an SD-WAN zone and add port1 and port2 as members.. To enable application-based steering with SLA enforcement, the administrator must first create an SD-WAN zone and add the WAN interfaces as members. Then, a Performance SLA must be configured and applied to the zone to monitor link health. These two steps provide the foundation for SD-WAN rules to match applications and steer traffic based on SLA status. Without the zone, members cannot be managed collectively; without the SLA, there is no performance data to enforce.

Answer

Create a firewall policy that includes the SD-WAN zone as the outgoing interface and enable NAT.

Answer

Configure a static route for each WAN interface with the same distance.

Answer

Enable application control on the firewall policy that references the SD-WAN zone.

Question 10

An administrator is configuring an SD-WAN rule that must ensure business-critical traffic always uses the best path based on measured latency and jitter, while also allowing the rule to fail over to a secondary link if the primary link's SLA is violated. The rule includes three members: wan1, wan2, and wan3. Which two actions must be performed to achieve this? (Choose two.)

Accepted Answer

Configure the SD-WAN rule to use the 'Best Quality' strategy.. To dynamically select the best path based on latency and jitter, the SD-WAN rule must use the 'Best Quality' strategy, which relies on a Performance SLA that monitors those metrics. The Performance SLA must be created and associated with the members. Together, these two actions allow the rule to choose the member with the best measured quality and fail over if the SLA is violated.

Answer

Enable 'Gateway' override on all three members to ensure they are prioritized equally.

Answer

Set the SD-WAN rule strategy to 'Lowest Cost (SLA)' and assign costs based on link quality.

Answer

Assign the same cost value to all three members to allow the rule to choose based on quality.

Question 11

You are configuring a Performance SLA on a FortiGate to monitor the quality of two WAN links. You need to ensure that the SLA probe uses HTTP to check a specific URL and that it considers the link healthy only if the round-trip time is below 100 ms and packet loss is below 2%. Which two parameters must you configure in the Performance SLA? (Choose two.)

Accepted Answer

Configure the latency threshold to 100 ms and packet loss threshold to 2%.. To use HTTP for the SLA probe, you must set the protocol to HTTP and specify the URL. To enforce the health criteria, you must configure the latency threshold to 100 ms and the packet loss threshold to 2%. These two settings are directly required. Other options like update-static-route, probe interval, or jitter are not necessary to meet the stated monitoring conditions.

Answer

Enable 'update-static-route' to automatically adjust routing based on SLA.

Answer

Configure the SLA to use 'jitter' as the primary metric.

Answer

Set the probe interval to 100 ms to match the latency threshold.

Question 12

Which THREE tasks are required to successfully deploy SD-WAN via FortiManager?

Accepted Answer

Installing the configuration to the devices. Option B is correct because FortiManager deploys SD-WAN through a centralized SD-WAN template (or SD-WAN overlay template) that defines the member interfaces, zones, and performance SLAs before it can be pushed to devices. Option E is correct because the template must be assigned to the target managed FortiGates, which binds the template to those devices so FortiManager knows which FortiGates should receive the SD-WAN configuration. Option A is correct because after the template is created and assigned, the configuration must be installed to the devices, which pushes the SD-WAN settings into the FortiGate running configuration. Option C is not required, since a hard factory reset is unnecessary and would only disrupt the existing management connection to FortiManager. Option D is also not required, because existing firewall policies do not need to be deleted for SD-WAN deployment; policies can be adjusted or referenced as needed.

Answer

Performing a hard factory reset on the FortiGate

Answer

Deleting all existing firewall policies

Question 13

An administrator troubleshoots a scenario where traffic matching an application-based SD-WAN rule is bypassing the preferred high-speed MPLS tunnel and taking the backup broadband tunnel instead. Which THREE factors should the administrator check to resolve this routing discrepancy? (Choose three)

Accepted Answer

Inspect the member priorities and weights configured within the specific SD-WAN rule. Option C is correct because SD-WAN rule member priorities and weights directly determine which member is preferred; if the MPLS member has a lower priority or weight than the broadband member, traffic will be steered to broadband. Option D is correct because the SD-WAN engine continuously probes members against the configured performance SLA (e.g., latency, jitter, packet loss); if MPLS fails those thresholds, it is marked ineligible and the next-best member (broadband) is selected. Option E is correct because SD-WAN rules are evaluated top-down by sequence order, so an earlier rule matching the same application/traffic could override the intended rule and send traffic out the broadband tunnel. Option A is irrelevant because changing the default admin password is a hardening step unrelated to SD-WAN path selection. Option B is irrelevant because cable category is a physical-layer attribute that does not influence SD-WAN rule matching or member eligibility decisions.

Answer

Verify the FortiGate factory default administrator password is changed

Answer

Check the physical layer OSI Model cable category connected to the FortiGate port

Question 14

Which THREE factors can affect the 'Performance SLA' logic in an SD-WAN template?

Accepted Answer

Packet loss threshold. The Performance SLA logic in an SD-WAN template is driven by the SLA criteria defined for each member, and those criteria are the three measured metrics: packet loss threshold (A), jitter threshold (C), and latency threshold (E). FortiGate continuously probes each SD-WAN member (e.g., via ping or HTTP) and compares the measured packet loss, jitter, and latency against these configured thresholds to determine whether the link is within SLA and to trigger SLA-based steering or failover. Option B is incorrect because the FortiGate firmware version is not an SLA metric; it may affect available features but does not feed the Performance SLA calculation. Option D is incorrect because the number of active VPN tunnels is a topology/state value, not a measured SLA parameter used by the Performance SLA logic.

Answer

The firmware version of the FortiGate

Answer

The number of active VPN tunnels

Question 15

Which TWO of the following are benefits of using SD-WAN templates in FortiManager?

Accepted Answer

Consistent SD-WAN policy application across devices. Option A is correct because SD-WAN templates in FortiManager let you define SD-WAN settings (members, zones, health checks, and rules) once and assign them to many managed FortiGates, ensuring the same SD-WAN policy is applied consistently across devices. Option E is correct because these templates enable simplified, scalable configuration deployment for large branch deployments by pushing a standardized SD-WAN configuration to many FortiGates at once instead of configuring each device individually. Option B is not correct because firmware upgrades are handled by FortiManager's firmware management features, not by SD-WAN templates. Option C is not correct because log analysis is performed by FortiAnalyzer, not by SD-WAN templates in FortiManager. Option D is not correct because direct CLI access is a separate administrative capability and is not a benefit provided by SD-WAN templates.

Answer

Automatic firmware upgrades

Answer

Automated log analysis

Answer

Direct access to the FortiGate CLI

Question 16

Which TWO configuration changes require a push from FortiManager to the FortiGate?

Accepted Answer

Changes to an SD-WAN template. Option B is correct because SD-WAN templates are FortiManager-managed objects: when you edit an SD-WAN template in FortiManager, the change is stored in the ADOM and must be installed/pushed to the managed FortiGate for it to take effect. Option C is correct because a firewall policy package is also a FortiManager-managed configuration object, so any modification must be installed to the target FortiGate device. Option A is incorrect because changes made directly in the FortiGate local GUI are local to the device and do not require a FortiManager push. Option D is incorrect because adding a local user directly on the FortiGate is a local device change, not a FortiManager-managed object requiring installation. Option E is incorrect because changing the FortiManager admin password affects only FortiManager itself and is not pushed to managed FortiGates.

Answer

Changes to the log settings on the FortiGate local GUI

Answer

Adding a new user to the FortiGate local database

Answer

Changing the FortiManager admin password

Question 17

Which TWO of the following can cause an SD-WAN member to be marked as 'down' in an SLA?

Accepted Answer

The probe times out.. Option A is correct because an SD-WAN SLA probe (such as a bidirectional forwarding detection or performance-monitoring probe) that times out means the member stops receiving replies, so the health check fails and the member is marked down. Option C is correct because SLA criteria include packet-loss thresholds; when measured loss on the member exceeds the configured threshold, the SLA is violated and the member is marked down. Option B is not correct because a system clock update affects timestamps and logging but does not itself fail an SLA probe. Option D is not correct because disabling a firewall policy changes traffic handling, not the SLA health-check result for the member. Option E is not correct because changing an interface IP address is a configuration change that may disrupt connectivity, but it is not the SLA condition that directly marks the member down.

Answer

The system clock is updated.

Answer

The firewall policy is disabled.

Answer

The interface IP address is changed.

Question 18

An administrator is troubleshooting BGP route propagation over SD-WAN IPsec tunnels where a branch office is not receiving specific routes from the datacenter hub. Which TWO CLI commands on the FortiGate are most useful for diagnosing BGP peering and advertised route issues? (Choose two)

Accepted Answer

get router info bgp neighbors advertised-routes. Option D, 'get router info bgp neighbors advertised-routes', is correct because it shows exactly which prefixes the local FortiGate is advertising to a specific BGP neighbor, directly revealing whether the missing branch routes are being sent out the IPsec-over-SD-WAN peering. Option E, 'get router info bgp summary', is correct because it verifies the BGP session state (Established vs. Active/Idle), uptime, and prefix counters per neighbor, confirming whether the peering across the SD-WAN IPsec tunnel is actually up before investigating route contents. Option A, 'execute ipsec tunnel list', only lists IPsec tunnel status and does not expose BGP peering or route advertisement details. Option B, 'diagnose sys sdwan member', reports SD-WAN member health and SLA metrics, not BGP neighbor or prefix information. Option C, 'get system interface physical', merely displays physical interface configuration/status and is unrelated to BGP route propagation.

Answer

execute ipsec tunnel list

Answer

diagnose sys sdwan member

Answer

get system interface physical

Question 19

Which THREE pieces of information are displayed in the SD-WAN Monitor in FortiManager?

Accepted Answer

Status of SD-WAN members. Option A is correct because the SD-WAN Monitor in FortiManager displays the operational status of each SD-WAN member interface, showing whether members are up, down, or degraded. Option B is correct because the monitor presents the health metrics collected by the SD-WAN performance SLA probes, specifically latency, jitter, and packet loss for each member. Option C is correct because the SD-WAN Monitor also shows interface bandwidth usage, allowing administrators to see throughput per SD-WAN member. Option D is not part of the SD-WAN Monitor, as system temperature is a hardware sensor value found in device dashboards or sensor views, not SD-WAN monitoring. Option E is also not displayed there, since the logged-in admin username is a session/administrative detail unrelated to SD-WAN member monitoring.

Answer

System temperature of the FortiGate

Answer

The current username of the logged-in admin

Question 20

Which THREE of the following criteria are used for SD-WAN rule traffic matching?

Accepted Answer

Destination address. In FortiGate SD-WAN rules, traffic is matched using criteria such as destination address (B), application/service (D), and source address (E), which are all standard SD-WAN rule match fields used to steer traffic to the appropriate member link. Destination address (B) is correct because SD-WAN rules can match on the destination IP/subnet to route specific traffic. Application/Service (D) is correct because SD-WAN rules commonly match on application signatures or service objects to steer application traffic. Source address (E) is correct because SD-WAN rules can match on the source IP/subnet to differentiate traffic from specific hosts or networks. Interface speed (A) is not a match criterion; it is a link attribute used for SLA/load-balancing decisions, not traffic matching. VLAN priority (C) is not a standard SD-WAN rule match criterion; QoS/priority handling is separate from SD-WAN traffic matching.

Answer

Interface speed

Answer

VLAN priority