NSE7_SDW Security Profiles Routing And IPsec Practice Test 3 — 15 Questions

Question 1

A FortiGate is configured as an ADVPN hub with an IPsec tunnel template and BGP over the overlay. Spokes establish dynamic tunnels to each other, but a spoke administrator reports that traffic to a remote spoke subnet is still hairpinning through the hub. BGP sessions are up and routes are exchanged. Which configuration item on the hub is most likely preventing the shortcut tunnel from being used for that traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The hub is configured with 'set shortcut' disabled on the IPsec tunnel template or the corresponding ADVPN tunnel interface.. ADVPN shortcuts are negotiated only when the shortcut feature is enabled on the tunnel template or dynamic tunnel interface. With shortcut disabled, spokes still build tunnels to the hub and exchange BGP routes, so connectivity works but all spoke-to-spoke traffic continues through the hub. The other options either prevent tunnel formation entirely or describe unrelated BGP or forwarding settings that would not produce this specific hairpinning behavior.

Answer

The hub advertises the remote spoke subnet with the same BGP next-hop as the hub itself, causing spokes to prefer the hub path.

Answer

The hub's BGP configuration uses 'set route-reflector' instead of 'set route-reflector-client' on the spoke peer group.

Answer

The hub's IPsec Phase 1 has 'auto-discovery-forwarder' disabled.

Question 2

An administrator has configured an SD-WAN rule that uses the 'lowest-cost (SLA)' strategy with two IPsec tunnels as members. The administrator notices that traffic is being sent over the tunnel with higher cost even though both tunnels meet the SLA. What could explain this behavior?

Accepted Answer

The SD-WAN rule priority is lower than another rule that matches the traffic and uses a different strategy.. The most likely explanation is that a higher-priority SD-WAN rule is matching the traffic before the intended rule. SD-WAN rules are evaluated in order of priority; if a more general rule with a higher priority (lower number) matches, it will take precedence and may use a different path selection strategy, leading to the higher-cost tunnel being used.

Answer

The cost value is configured on the interface, not on the SD-WAN member, so it is ignored.

Answer

The tunnel with lower cost is not meeting the SLA, so the higher-cost tunnel is selected.

Answer

The SD-WAN rule is configured with 'load-balance' enabled, which overrides the cost.

Question 3

A FortiGate is configured with an SD-WAN rule that uses a health check to monitor two IPsec tunnels. The health check uses both ping and HTTP probes. The administrator wants to ensure that the SD-WAN rule only selects a tunnel when both probes succeed. Which two statements about the health check configuration are true? (Choose two.)

Accepted Answer

The health check's probe responses are used to calculate SLA metrics, and the SD-WAN rule uses those metrics to select a member.. A health check with multiple probes considers the tunnel alive only when all probes succeed, and the probe results feed into SLA metrics that the SD-WAN rule uses for member selection. These two statements accurately describe how health checks integrate with SD-WAN rules to enforce both probe success and performance thresholds.

Answer

Each probe in the health check must be configured with a unique source IP address.

Answer

The 'update-static-route' option must be enabled for the health check to influence SD-WAN rule selection.

Answer

The health check must be configured with 'sla' criteria that include both latency and packet loss thresholds.

Question 4

A FortiGate is configured with an SD-WAN rule that uses an SLA health check to select between two IPsec tunnels. The administrator wants to ensure that if both tunnels fail the SLA, traffic is dropped rather than sent over a non-compliant tunnel. Which SD-WAN rule configuration achieves this?

Accepted Answer

Set the rule's 'SLA' configuration to 'SLA Target' and configure the 'SLA Fail' action to 'Drop'.. To drop traffic when no SD-WAN member meets the SLA, the rule must have an SLA target configured with an action of 'Drop' for SLA failure. This prevents traffic from being sent over a non-compliant tunnel. Other strategies or manual configurations do not provide this explicit drop behavior when SLA conditions are not met.

Answer

Set the rule's 'Strategy' to 'Manual' and order the members so that only compliant tunnels are listed.

Answer

Set the rule's 'Strategy' to 'Lowest Cost (SLA)' and enable 'SLA Target' with a strict threshold.

Answer

Enable 'Link Health Monitor' on the SD-WAN zone and set the 'Failover' action to 'Drop'.

Question 5

A network administrator has configured an SD-WAN rule that uses the 'lowest-cost' strategy with two IPsec tunnels: Tunnel A (cost 10) and Tunnel B (cost 20). Both tunnels are up and passing health checks. However, the administrator notices that all traffic is being sent over Tunnel B instead of Tunnel A. What is the most likely cause?

Accepted Answer

The SD-WAN rule is configured with a higher priority for Tunnel B.. The 'lowest-cost' strategy in SD-WAN selects the member with the lowest cost value. However, priority is used as a tiebreaker or can override cost if configured. If Tunnel B has a higher priority (lower numerical value) than Tunnel A, it will be chosen despite its higher cost. The other options are either contradicted by the scenario or less likely given the information.

Answer

The SD-WAN rule is configured with 'lowest-cost' but the cost values are reversed in the GUI.

Answer

The health check for Tunnel A is failing, causing it to be excluded from the rule.

Answer

Tunnel A is a member of a different SD-WAN zone than Tunnel B.

Question 6

A FortiGate is configured with an SD-WAN rule that uses a health check to monitor two IPsec tunnels. The health check is configured with 'sla' criteria for latency and jitter. The administrator notices that traffic is not failing over to the secondary tunnel when the primary tunnel's latency exceeds the SLA threshold. What is the most likely cause?

Accepted Answer

The SD-WAN rule's 'sla' configuration has 'link-cost-factor' set to 'latency' but the health check is configured with 'sla' criteria that do not include latency.. The correct answer is that the SD-WAN rule's 'link-cost-factor' is set to latency, but the health check's SLA criteria do not include latency. For the SD-WAN rule to consider latency for failover, the health check must be configured to measure latency and have SLA criteria that include latency thresholds. If the health check does not include latency, the rule will not see latency violations.

Answer

The health check's 'sla' criteria are not referenced in the SD-WAN rule's 'sla' configuration.

Answer

The SD-WAN rule's 'sla' configuration has a 'link-cost-factor' set to 'latency' but the health check is not configured to measure latency.

Answer

The health check's 'sla' criteria are configured with a 'link-cost-factor' that is not enabled in the SD-WAN rule.

Question 7

An administrator is deploying ADVPN 2.0 with BGP on a hub-and-spoke topology. The hub must advertise a default route to all spokes, but spokes should not advertise the default route to each other. Which two BGP configurations on the hub are required to achieve this? (Choose two.)

Accepted Answer

Configure a route-map on the hub to set the default route with a specific community and apply it outbound to spokes.. To prevent spokes from advertising the default route to each other, the hub must tag the default route with a BGP community and spokes must filter that community in outbound advertisements. This ensures the default route is only learned from the hub and not propagated further. The combination of tagging and filtering is required.

Answer

Enable "default-originate" on the hub's BGP neighbor configuration for each spoke.

Answer

Configure a route-map on the hub to deny the default route when advertising to other spokes.

Answer

Set the hub as a route reflector and configure spokes as clients.

Question 8

An administrator deploys ADVPN 2.0 with BGP on a hub and multiple spokes. Spokes must dynamically learn routes to other spokes' LAN subnets so that direct shortcut tunnels can be established. Which BGP configuration on the hub enables this behavior?

Accepted Answer

Configure the hub to propagate spoke routes with the originating spoke as the next hop and enable 'set next-hop-self' only on the hub's own routes.. ADVPN 2.0 relies on BGP to distribute spoke routes with the originating spoke as the next hop. When the hub reflects these routes without changing the next hop, a receiving spoke can resolve the next hop over the overlay and trigger a shortcut negotiation. Setting next-hop-self for the hub's own routes ensures hub reachability, but applying it to spoke routes would force traffic through the hub and prevent shortcuts.

Answer

Enable 'set advertisement-interval' to a low value on the hub so that spoke routes are propagated quickly.

Answer

Configure the hub to reflect routes between spokes by using 'set route-reflector' on the BGP neighbor group and enabling 'next-hop-self' on all spoke peerings.

Answer

Advertise the hub as the next hop for all spoke routes and rely on the hub to forward traffic between spokes.

Question 9

An administrator is configuring an IPsec VPN tunnel between two FortiGates for an SD-WAN deployment. The administrator wants to ensure that the tunnel is highly available and can fail over to a secondary WAN link if the primary link fails. Which two configuration steps are required to achieve this? (Choose two.)

Accepted Answer

Configure the IPsec tunnel with multiple remote gateways and enable dead peer detection (DPD).. To achieve high availability for IPsec tunnels in an SD-WAN deployment, two key steps are needed: first, configure the IPsec tunnel with multiple remote gateways and enable DPD to detect link failures; second, add the tunnels to an SD-WAN zone and create an SD-WAN rule with a health check to monitor and steer traffic. These steps together ensure that if the primary link fails, traffic is automatically redirected to the secondary link.

Answer

Configure BGP with route redistribution to advertise the tunnel interfaces.

Answer

Set the IPsec tunnel to 'aggressive' mode to speed up failover.

Answer

Enable 'auto-discovery' on the IPsec tunnel to automatically find alternate paths.

Question 10

An administrator applies an IPsec tunnel template to a FortiGate hub in an ADVPN 2.0 deployment. A spoke behind a NAT device fails to establish an IKEv2 Phase 1 with the hub, while spokes with public IPs succeed. Which Phase 1 setting must be adjusted on the hub to allow the NATed spoke to connect?

Accepted Answer

Enable NAT traversal (NAT-T) and set the dead peer detection (DPD) mode to on-idle.. For an IPsec tunnel to work through NAT, NAT traversal (NAT-T) must be enabled on both peers. On the hub, enabling NAT-T allows the spoke behind NAT to encapsulate ESP in UDP. Additionally, setting DPD to on-idle prevents unnecessary DPD probes that could time out and tear down the tunnel when the spoke is idle. This combination ensures the NATed spoke can establish and maintain the IKEv2 Phase 1 with the hub.

Answer

Disable the exchange of local and remote IDs and rely on the peer IP address for authentication.

Answer

Set the IKE version to IKEv1 and configure aggressive mode.

Answer

Reduce the Phase 1 proposal encryption algorithm to DES and enable XAUTH.

Question 11

An administrator is configuring an IPsec VPN tunnel between two FortiGate devices to securely connect two sites. The administrator wants to ensure that the tunnel uses strong encryption and authentication. Which two parameters should be configured in Phase 1 to achieve this? (Choose two.)

Accepted Answer

Set the encryption algorithm to AES-256.. To ensure strong encryption and authentication in Phase 1, the administrator should configure AES-256 for encryption and SHA-256 for authentication. These algorithms provide robust security for the IKE negotiation. Other options like DH group 1, aggressive mode, and IKEv1 are either weak or less secure and should be avoided when strong security is required.

Answer

Enable aggressive mode.

Answer

Set the DH group to 1 (768-bit).

Answer

Set the IKE version to IKEv1.

Question 12

An administrator configures an SD-WAN rule that uses a health check with two SLA targets: one for latency below 100 ms and one for packet loss below 2%. The rule is set to use the 'Best Quality' strategy. After a brief ISP outage, the administrator notices that traffic is still being steered to a member that violates the packet loss SLA. What is the most likely reason the member remains in use?

Accepted Answer

The health check is configured with 'set sla-fail-log' and the rule has no other member meeting the SLA, so the FortiGate falls back to the best available member.. An SD-WAN rule with Best Quality and multiple SLA targets will prefer members that meet all SLAs. However, if no member meets the full SLA set, the FortiGate does not drop traffic; it falls back to the best-performing member based on the configured link-cost-factor. The observed behavior is expected when all members violate at least one SLA, so the rule keeps using the best available path rather than blackholing traffic.

Answer

The SD-WAN rule is configured with 'set link-cost-factor latency' only, so packet loss is not evaluated.

Answer

The SD-WAN rule is configured with 'set update-static-route disable', preventing the FortiGate from removing the member from the active set.

Answer

The health check has 'set sla-fail-log' disabled, so the FortiGate does not act on SLA failures.

Question 13

A FortiGate is configured with an IPsec VPN tunnel used in an SD-WAN zone. The administrator wants to enable ADVPN 2.0 and ensure that shortcut tunnels are established between spokes. Which two configuration elements are required on the hub to support ADVPN 2.0 shortcut negotiation? (Choose two.)

Accepted Answer

Configure the hub to advertise all spoke routes via BGP or OSPF to other spokes.. ADVPN 2.0 requires the hub to forward shortcut proposals between spokes and to propagate routing information so spokes can reach each other. Enabling auto-discovery-forwarder on the hub and advertising spoke routes via a dynamic routing protocol are both essential. The receiver role belongs on spokes, and the other options are unrelated or incorrect for this scenario.

Answer

Set the hub's IPsec phase 1 'net-device' to disable.

Answer

Enable 'auto-discovery-receiver' on the hub's IPsec phase 1 interface.

Answer

Enable 'exchange-interface-ip' on the hub's IPsec phase 1 interface.

Question 14

A FortiGate is configured with an SD-WAN rule that steers traffic to an IPsec VPN overlay zone. The administrator wants to ensure that only traffic matching a specific application is allowed through the tunnel and that all other traffic is dropped. Which SD-WAN rule configuration should be used?

Accepted Answer

Create an allow rule for the specific application and a subsequent deny rule for all other traffic.. SD-WAN rules are evaluated sequentially. To allow only a specific application and drop all other traffic, you need an allow rule that matches that application, followed by a deny rule that catches all remaining traffic. This ensures the application is steered correctly while providing a default-deny posture for the overlay. The other options either incorrectly deny the desired application or rely on non-existent features.

Answer

Use a single rule with the action set to 'allow' and enable the 'explicit-deny' option.

Answer

Configure the rule to match the application and set the action to 'deny' with a high priority.

Answer

Set the rule's action to 'deny' and place a more specific allow rule above it.

Question 15

A FortiGate has two IPsec tunnels in an SD-WAN zone. The administrator configures a health check using ping probes to a public IP. Users report that VoIP traffic is sometimes routed over a tunnel with high jitter even though the other tunnel is healthy. What is the most likely cause?

Accepted Answer

The health check uses only ICMP probes, which do not measure jitter, so the SD-WAN rule cannot detect the high-jitter condition.. Ping-based health checks measure reachability and round-trip time but do not provide jitter or packet-loss metrics with the granularity needed for real-time traffic. An SD-WAN rule using an SLA that relies only on ping can consider a tunnel healthy even when jitter is high. To properly steer VoIP, the health check should use UDP or HTTP probes with jitter and packet-loss thresholds.

Answer

The health check is bound to the wrong source interface, causing probes to fail and the tunnel to be marked dead.

Answer

The IPsec tunnels are not members of the SD-WAN zone, so the rule cannot steer traffic based on health.

Answer

The SD-WAN rule is configured with the 'lowest cost' strategy, so it always chooses the tunnel with the lowest configured cost regardless of health.