NSE7_SDW Security Profiles Routing And IPsec Practice Test 2 — 15 Questions

Question 1

An administrator is deploying an IPsec VPN tunnel between two FortiGates that will be members of an SD-WAN zone. The administrator wants the tunnel interface to be automatically assigned to the correct SD-WAN zone based on the tunnel's configuration, without manually adding it to the zone. Which configuration step is required to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the IPsec tunnel configuration, set the 'zone' parameter to the desired SD-WAN zone name.. In FortiOS, the IPsec tunnel configuration includes an optional 'zone' parameter that directly assigns the tunnel interface to an SD-WAN zone upon creation. This is the only method that automatically places the tunnel into the zone without manual intervention. Other options either refer to unrelated features or misrepresent CLI syntax.

Answer

Create a firewall address object for the tunnel and add it to an SD-WAN zone via a policy route.

Answer

Set the 'interface' parameter in the SD-WAN zone configuration to reference the tunnel.

Answer

Enable 'auto-discovery' in the IPsec Phase 1 settings.

Question 2

A FortiGate hub is configured with an IPsec VPN tunnel to a branch office. The branch FortiGate is behind a broadband router performing NAT, and the tunnel frequently drops after a period of inactivity. The administrator wants the tunnel to remain established even when no interesting traffic is present. Which configuration parameter should be enabled on the hub's Phase 1 configuration?

Accepted Answer

Enable 'keepalive' on the Phase 2 configuration.. The correct answer is to enable keepalive on the Phase 2 configuration. In IPsec VPNs, especially when NAT traversal is involved, the tunnel can be torn down if no traffic is sent for a period. Keepalive packets sent at regular intervals keep the tunnel and the NAT session active. This ensures the tunnel remains established and ready for traffic.

Answer

Enable 'dpd' (Dead Peer Detection) on the Phase 1 configuration.

Answer

Enable 'auto-negotiate' on the Phase 1 configuration.

Answer

Set the Phase 1 'nattraversal' to 'forced'.

Question 3

A network administrator is deploying ADVPN 2.0 between a hub and multiple spokes. The administrator wants to ensure that when a spoke-to-spoke shortcut tunnel is established, the routing protocol automatically installs the shortcut route without manual intervention. Which routing protocol feature must be enabled on the hub and spokes to support this dynamic shortcut route installation?

Accepted Answer

Enable BGP route exchange and ensure that the hub reflects the spoke routes to other spokes using BGP route reflection or full mesh.. ADVPN 2.0 uses BGP to exchange routes between hub and spokes. When a shortcut tunnel is established, the spoke advertises its local routes over the shortcut using BGP. For other spokes to learn these routes, the hub must either reflect them (using BGP route reflection) or the spokes must have direct BGP sessions with each other (full mesh). This ensures that the shortcut route is installed dynamically without manual configuration.

Answer

Use RIP with split horizon disabled on all ADVPN interfaces.

Answer

Enable OSPF with point-to-multipoint network type on all ADVPN interfaces.

Answer

Configure BGP with the 'advertise-shortcut' option under the neighbor configuration.

Question 4

A network administrator has deployed an IPsec VPN tunnel between two FortiGate devices. The administrator wants to ensure that the tunnel only carries traffic from specific subnets, and that any other traffic is dropped. Which IPsec Phase 2 configuration parameter should be configured to achieve this?

Accepted Answer

Configure the Phase 2 'src-subnet' and 'dst-subnet' to the desired subnets.. The correct approach is to configure the Phase 2 'src-subnet' and 'dst-subnet' parameters to define the traffic selectors for the IPsec tunnel. These selectors determine which traffic is encrypted and sent through the tunnel. However, to drop non-matching traffic, firewall policies must be configured to deny it. The other options do not achieve the desired filtering because they either do not exist or serve a different purpose.

Answer

Enable 'inbound' and 'outbound' filters in Phase 2.

Answer

Set the Phase 2 'src-name' and 'dst-name' to the desired subnets.

Answer

Set the Phase 2 'keylifeseconds' to a low value to force rekeying and drop non-matching traffic.

Question 5

An administrator has deployed an SD-WAN solution with two IPsec overlays (Overlay_A and Overlay_B) and one underlay MPLS circuit. A new SD-WAN rule is configured to route Microsoft 365 traffic exclusively over Overlay_A, while all other business traffic uses the underlay. Users report that Microsoft 365 is intermittently failing over to the underlay. Which FortiOS configuration element must the administrator verify to ensure that only the IPsec overlay is eligible for the Microsoft 365 rule?

Accepted Answer

The SD-WAN rule's 'Interface' member list must include only Overlay_A.. To force Microsoft 365 traffic exclusively over an IPsec overlay, the rule's member list must be restricted. The 'Interface' parameter defines the eligible SD-WAN members for that rule. Including only the desired overlay ensures that the underlay and other overlays are never considered, preventing unintended failover and maintaining consistent security and performance.

Answer

The SD-WAN rule's 'Gateway' must be set to the remote gateway IP of Overlay_A.

Answer

The SD-WAN rule's 'Priority' member list must include only Overlay_A.

Answer

The SD-WAN rule's 'Source' must be set to the local subnet that uses Microsoft 365.

Question 6

An administrator is configuring an IPsec VPN tunnel as an SD-WAN member. The administrator wants to ensure that the tunnel is only used when the underlay path meets specific latency and jitter thresholds. Which SD-WAN component should be configured to monitor the tunnel's performance?

Accepted Answer

SLA health check. An SD-WAN health check is the correct component to monitor tunnel performance. It sends probes at regular intervals and measures latency, jitter, and packet loss. When associated with an SD-WAN rule, the rule can select members based on whether they meet the SLA thresholds, ensuring that the tunnel is used only when performance is acceptable.

Answer

Interface bandwidth monitor

Answer

Link health monitor

Answer

Performance SLA profile

Question 7

A FortiGate hub in an ADVPN 2.0 deployment uses IPsec tunnel templates to dynamically create spoke tunnels. Spoke A and Spoke B are behind the same NAT device and both establish tunnels to the hub. The administrator notices that only one spoke tunnel is active at a time, and when Spoke B connects, Spoke A's tunnel is torn down. Which configuration change on the hub resolves this issue?

Accepted Answer

Enable 'exchange-interface-ip' on the spokes' IPsec phase1-interface.. In ADVPN 2.0, when multiple spokes share the same NATed public IP, the hub uses the peer ID to distinguish tunnels. Without a unique identifier, the hub treats them as the same peer and tears down the existing tunnel. Enabling exchange-interface-ip on the spokes makes each spoke include its local interface IP in the IKE exchange, creating a unique peer ID and allowing simultaneous tunnels.

Answer

Enable 'unique-psk' under the IPsec phase1-interface settings.

Answer

Configure 'exchange-interface-ip' on the hub's IPsec phase1-interface.

Answer

Set 'peer-id' validation to 'disable' on the hub.

Question 8

A network administrator has configured an SD-WAN rule that uses a health check to steer traffic to the best link based on latency. The health check uses ICMP probes to two different destinations. The administrator notices that the SD-WAN rule is not switching to the backup link even when the primary link's latency exceeds the threshold. What could be the cause?

Accepted Answer

The SD-WAN rule is configured with a link quality threshold that is not being met due to the health check's SLA target being too lenient.. The health check's SLA target defines the acceptable latency. If the target is set higher than the actual latency that the administrator considers excessive, the link remains within SLA and no failover occurs. Adjusting the SLA target to a lower value will cause the health check to mark the link as out-of-SLA when latency exceeds that value, triggering the SD-WAN rule to switch.

Answer

The health check's server is reachable via the backup link, causing false positives.

Answer

The health check's probe interval is set too high, causing delayed detection.

Answer

The SD-WAN rule's priority is set to manual, overriding health check results.

Question 9

An administrator is troubleshooting an ADVPN 2.0 deployment where a spoke is not learning routes from other spokes via the hub. The administrator verifies that BGP is configured on all devices and that the hub is advertising routes. What is the most likely cause?

Accepted Answer

The spoke is not configured to use the hub as its BGP next-hop for routes learned from other spokes.. In ADVPN, when a spoke learns a route from the hub that points to another spoke, the next-hop is typically the other spoke's tunnel IP. For the route to be installed and used, the spoke must have a route to that next-hop, often via the hub. If the next-hop is not reachable, the route is not installed. This is a common cause of spokes not learning routes from other spokes.

Answer

The hub is not configured to reflect routes between spokes.

Answer

The hub is not using the 'set-route-tag' command to tag routes for spokes.

Answer

The spoke's BGP configuration is missing the 'ebgp-enforce-multihop' command.

Question 10

An administrator is configuring an SD-WAN rule to steer traffic based on application type. The rule uses the 'Application' strategy and includes multiple applications. The administrator wants to ensure that traffic for these applications is load-balanced across two IPsec tunnels. Which SD-WAN rule configuration parameter must be set to achieve load balancing?

Accepted Answer

Configure the 'strategy' as 'load-balance' in the SD-WAN rule.. The correct answer is to configure the 'strategy' as 'load-balance' in the SD-WAN rule. The strategy parameter defines how traffic is distributed among the members. Setting it to 'load-balance' enables per-packet or per-flow load balancing across the selected interfaces. This is the standard method to achieve load balancing in FortiOS SD-WAN.

Answer

Enable 'load-balance' on each IPsec tunnel interface.

Answer

Set the 'mode' to 'load-balance' in the SD-WAN zone configuration.

Answer

Set the 'load-balance' option to 'enable' in the SD-WAN rule.

Question 11

An administrator is configuring an SD-WAN rule that uses a security profile to inspect traffic. The administrator wants to ensure that the security profile is applied only to traffic that matches the SD-WAN rule and is forwarded over a specific IPsec tunnel. Which FortiOS feature should be used to achieve this?

Accepted Answer

SD-WAN zone as the source interface in a firewall policy with security profiles.. In FortiOS, security profiles are applied via firewall policies. To apply them to traffic handled by SD-WAN, the firewall policy should reference the SD-WAN zone as the incoming or outgoing interface. This ensures that all traffic steered by SD-WAN rules within that zone is inspected. Specifying a specific IPsec tunnel interface would bypass SD-WAN rule processing, and SD-WAN rules themselves do not contain security profile settings.

Answer

Firewall policy with 'inspection-mode' set to flow-based.

Answer

SD-WAN rule with 'security-profile' option enabled.

Answer

IPsec tunnel interface as the source in a firewall policy with security profiles.

Question 12

An administrator is configuring an IPsec VPN tunnel between two FortiGate devices for an SD-WAN deployment. The tunnel must carry traffic for multiple overlapping subnets from different tenants. The administrator needs to ensure that the tunnel comes up and that traffic is routed correctly without conflicts. Which Phase 2 configuration parameter should the administrator use to allow multiple subnets to be selected for the tunnel?

Accepted Answer

Enable 'net-device' and configure multiple Phase 2 selectors for each subnet pair.. The correct configuration for supporting multiple overlapping subnets in an IPsec VPN tunnel is to enable 'net-device' and define multiple Phase 2 selectors. This allows the tunnel to function as a network interface and handle traffic for each subnet pair individually, preventing routing conflicts. Other options either do not support multiple subnets or do not address the overlap issue effectively.

Answer

Set the Phase 2 'src-subnet' and 'dst-subnet' to 0.0.0.0/0 and use policy routes to direct traffic.

Answer

Configure multiple Phase 2 selectors with different subnets and enable 'multiple-proposal' in Phase 1.

Answer

Enable 'auto-negotiate' and specify multiple subnets in the quick mode selector.

Question 13

A FortiGate is configured with an SD-WAN rule that uses a health check to monitor two IPsec VPN tunnels. The health check is configured with a ping probe to 8.8.8.8. The administrator notices that the SD-WAN rule is not failing over when the primary tunnel experiences high latency, even though the SLA target for latency is 100ms. What is the most likely cause?

Accepted Answer

The health check is configured with the 'sla' option under the health check, but the SD-WAN rule is using the 'priority' strategy instead of 'SLA' strategy.. For an SD-WAN rule to fail over based on SLA targets such as latency, the rule must use the 'SLA' strategy. If the rule is set to 'priority', it will always use the highest-priority link as long as it is up, regardless of performance. The health check may be functioning correctly, but the rule's strategy determines whether SLA metrics are considered. Thus, the most likely cause is that the rule is not using the SLA strategy.

Answer

The health check is using a ping probe, which measures reachability but not latency; latency must be measured using an HTTP or TCP probe.

Answer

The SLA target for latency is configured but the SD-WAN rule is not referencing the correct SLA target or the health check is not assigned to the rule.

Answer

The health check probe interval and timeout are set too high, causing delayed detection of latency violations.

Question 14

A FortiGate is configured with an SD-WAN rule that uses the 'Best Quality' strategy based on an SLA health check that monitors latency and jitter. The rule includes two IPsec tunnels: Tunnel_A and Tunnel_B. Currently, Tunnel_A is the preferred member. The administrator notices that Tunnel_A is experiencing high jitter, but the SD-WAN rule is not failing over to Tunnel_B. What is the most likely cause?

Accepted Answer

The SLA health check is using only one probe (e.g., ping) and that probe is not detecting the jitter.. The most likely cause is that the SLA health check is using a single probe that does not measure jitter effectively. To detect jitter, the health check should include multiple probes or a probe type that measures jitter, such as UDP jitter. Without proper detection, the SD-WAN rule will not fail over even if jitter is high. Other options are less likely given the scenario details.

Answer

The SLA health check is configured with a high jitter threshold that Tunnel_A still meets.

Answer

The SD-WAN rule is using the 'Manual' strategy instead of 'Best Quality'.

Answer

The SD-WAN rule is configured with 'link-cost' factors that favor Tunnel_A.

Question 15

An administrator has configured an SD-WAN rule to steer traffic to an IPsec tunnel based on an SLA health check. The health check uses ICMP probes to a remote server. The administrator notices that the tunnel is marked as down even though the tunnel is up and passing traffic. What is a possible reason?

Accepted Answer

The health check probes are not being sent through the IPsec tunnel because the SD-WAN rule does not match the probe traffic.. SD-WAN health check probes must be routed through the intended interface. If the SD-WAN rule does not match the probe traffic, the probes may not use the tunnel, leading to a false down status. This can happen if the rule's criteria (e.g., source, destination, service) do not include the health check traffic.

Answer

The remote server is not responding to ICMP probes because it is behind a firewall that blocks ICMP.

Answer

The IPsec tunnel's Phase 2 selector does not include the health check server's IP address.

Answer

The health check is configured to use the wrong source IP address.