NSE7_SDW Security Profiles Routing And IPsec Practice Test 4 — 15 Questions

Question 1

An administrator is configuring an IPsec VPN tunnel between two FortiGates for SD-WAN. The administrator wants to ensure that the tunnel can recover quickly from a failure and that routing information is exchanged dynamically. Which two protocols or features should be configured to achieve these goals? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Dead Peer Detection (DPD). The correct answers are Dead Peer Detection (DPD) and BGP. DPD enables quick detection of a failed peer, triggering tunnel renegotiation or failover. BGP provides dynamic routing over the IPsec tunnels, allowing the network to adapt to changes. Together, they ensure fast recovery and dynamic routing, which are essential for SD-WAN.

Answer

Keepalive

Answer

NAT traversal

Answer

OSPF

Question 2

An administrator is implementing an SD-WAN solution with IPsec tunnels between a hub and multiple spokes. The administrator wants to ensure that the SD-WAN rules can dynamically select the best tunnel based on performance metrics. Which two configuration steps are required to enable SD-WAN to monitor and select tunnels based on SLA? (Choose two.)

Accepted Answer

Configure SD-WAN health checks for each tunnel with appropriate SLA thresholds.. To enable SD-WAN to monitor and select tunnels based on SLA, the administrator must configure health checks with SLA thresholds and assign the tunnels to an SD-WAN zone referenced in SD-WAN rules. These steps ensure that the tunnels are monitored for performance and can be dynamically selected. Other options are either not required or do not directly enable SLA-based selection.

Answer

Enable 'auto-asic-offload' on the IPsec tunnels to improve performance monitoring.

Answer

Configure BGP on the tunnels to exchange routing information and metrics.

Answer

Enable 'sla' in the SD-WAN rule and set the strategy to 'lowest-cost (SLA)'.

Question 3

A FortiGate hub in an ADVPN 2.0 topology uses IPsec tunnel templates to dynamically create spoke tunnels. A newly onboarded spoke completes Phase 1 and Phase 2 negotiation, but the hub's routing table never installs the spoke's remote subnet, even though the spoke advertises it over BGP. The administrator confirms the spoke's BGP session is Established. What is the most likely cause?

Accepted Answer

The hub's IPsec tunnel template is missing 'set add-route disable' or the network-overlay setting, so the hub's BGP process cannot map the learned prefix to the dynamic tunnel interface.. For ADVPN 2.0 hub templates, the network-overlay and add-route parameters ensure that the remote subnet learned from a spoke is mapped to the dynamically created tunnel interface. When these are missing, BGP can still form an adjacency but the hub will not install the prefix into the routing table because it cannot associate the next-hop with a valid tunnel. The other settings affect tunnel formation, eBGP multihop for shortcuts, or overlap handling, none of which explain a single unique spoke prefix being absent.

Answer

The hub's BGP configuration is missing 'set ebgp-enforce-multihop enable', so the eBGP session cannot install routes learned over multiple hops.

Answer

The spoke's BGP next-hop is the tunnel IP, but the hub has not enabled 'set route-overlap allow' on the template, so overlapping routes are silently dropped.

Answer

The hub's IPsec tunnel template lacks a dynamic gateway, so the hub cannot form the tunnel interface required for the BGP next-hop.

Question 4

An administrator is configuring an SD-WAN rule that uses a health check to monitor two IPsec tunnels. The administrator wants the rule to prefer the tunnel with the lowest latency. Which SD-WAN rule strategy should be selected?

Accepted Answer

Lowest Latency (SLA). The Lowest Latency (SLA) strategy is designed to select the SD-WAN member with the lowest latency that meets the SLA criteria. This is the most direct way to ensure the rule prefers the tunnel with the lowest latency, as measured by the health check.

Answer

Lowest Cost (SLA)

Answer

Best Quality (SLA)

Answer

Maximize Bandwidth (SLA)

Question 5

An administrator has configured an ADVPN 2.0 network with a hub and multiple spokes. The hub uses BGP to exchange routes with the spokes. A spoke wants to advertise its local subnet to other spokes. Which BGP configuration on the spoke is required to ensure that the route is propagated to other spokes via the hub?

Accepted Answer

Configure the spoke to use iBGP with the hub and set the hub as a route reflector.. To propagate a spoke's local subnet to other spokes via the hub in ADVPN 2.0, the recommended BGP design is to use iBGP with the hub acting as a route reflector. The spoke advertises its subnet to the hub, and the hub reflects the route to other spokes. This allows other spokes to learn the route and potentially establish direct shortcuts. Other configurations like eBGP with next-hop-self or unique AS numbers are not suitable for this purpose.

Answer

Configure the spoke to use eBGP with the hub and set the spoke to use a unique AS number.

Answer

Configure the spoke to use eBGP with the hub and set the next-hop-self on the hub.

Answer

Configure the spoke to use OSPF instead of BGP for route propagation.

Question 6

An administrator configures an SD-WAN rule that uses the 'Maximize Bandwidth (SLA)' strategy across two IPsec tunnels. The rule includes a health check that monitors latency and jitter. After deployment, traffic is not load-balanced as expected; instead, all traffic uses a single tunnel. What is the most likely cause?

Accepted Answer

The health check is not assigned to both IPsec tunnels in the SD-WAN configuration, so only one tunnel is considered for load balancing.. The Maximize Bandwidth (SLA) strategy selects interfaces based on their measured bandwidth and SLA status. For each interface to be considered, it must have a health check that monitors its performance. If the health check is only applied to one tunnel, the other tunnel is not evaluated for SLA and may be excluded from the load-balancing decision. Therefore, the most likely cause is that the health check is not assigned to both tunnels, resulting in only one tunnel being used.

Answer

The 'Maximize Bandwidth (SLA)' strategy requires the use of dynamic routing protocols to distribute traffic; without BGP, it falls back to a single tunnel.

Answer

The health check is configured with a single probe and the SLA target for jitter is too strict, causing one tunnel to be marked as out-of-SLA.

Answer

The SD-WAN rule is configured with a source IP address and the sessions are sticky, so all traffic from that source uses the same tunnel.

Question 7

An administrator is configuring an IPsec VPN tunnel between two FortiGates for SD-WAN. The administrator wants to ensure that the tunnel can recover quickly from a failure and that routing information is exchanged dynamically. Which two protocols or features should be configured to achieve these goals? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the Phase 1 'ike-version' to 2.. IKEv2 supports multiple Phase 2 selectors within a single Phase 1 security association, allowing different subnets to be protected under the same tunnel. Therefore, setting the IKE version to 2 is required. Other parameters like aggressive mode, multiple-proposal-match, or local/remote IDs do not provide this capability. This is a fundamental difference between IKEv1 and IKEv2 in FortiOS.

Answer

Enable 'multiple-proposal-match' in Phase 1.

Answer

Configure the Phase 1 'local-id' and 'remote-id' to match the subnets.

Answer

Set the Phase 1 'mode' to aggressive.

Question 8

An administrator is configuring an IPsec VPN tunnel between two FortiGates for SD-WAN. The administrator wants to ensure that the tunnel can recover quickly from a failure and that routing information is exchanged dynamically. Which two protocols or features should be configured to achieve these goals? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable 'set shortcut' on the IPsec tunnel template or the dynamic tunnel interface.. To enable ADVPN shortcut negotiation, the hub must have auto-discovery-forwarder enabled on the IPsec Phase 1 so it can relay shortcut proposals between spokes. Additionally, the shortcut setting must be enabled on the tunnel template or dynamic tunnel interface so that spokes will attempt to build direct tunnels. These two settings work together to allow spoke-to-spoke shortcuts, while BGP is configured separately on the tunnel interfaces.

Answer

Configure 'set net-device disable' on the IPsec Phase 1 to allow multiple dynamic tunnels.

Answer

Configure 'set exchange-interface-ip enable' on the IPsec Phase 1 to advertise BGP next-hop addresses.

Answer

Configure BGP on the hub with 'set route-reflector' to reflect routes between spokes.

Question 9

A FortiGate is configured with an SD-WAN rule that uses the 'lowest-cost' strategy based on latency. The administrator notices that traffic is not switching to the backup link when the primary link's latency exceeds the SLA threshold. What could be the cause?

Accepted Answer

The SLA target for latency is not configured or is set too high.. The 'lowest-cost' strategy relies on an SLA target to determine when a link's performance is unacceptable. If the latency SLA target is missing or set too high, the primary link may still be considered within SLA even when latency increases, so no switch occurs. Configuring an appropriate latency threshold ensures the SD-WAN rule can react to degradation and steer traffic to the backup link.

Answer

The backup link is not included in the SD-WAN zone.

Answer

The SD-WAN rule is using the 'manual' strategy instead of 'lowest-cost'.

Answer

The SD-WAN rule is missing a health check configuration.

Question 10

An administrator configures an IPsec VPN tunnel between a FortiGate hub and a spoke. The administrator wants to ensure that the tunnel only comes up when there is interesting traffic, and goes down after a period of inactivity to save resources. Which Phase 2 setting should be configured?

Accepted Answer

Enable 'autokey' and set the 'idle-timeout' in Phase 2.. To achieve on-demand tunnel establishment and teardown, the Phase 2 configuration must include an idle-timeout. When traffic matches the policy, the tunnel is initiated (autokey). After the idle-timeout expires with no traffic, the tunnel is torn down. This saves resources by not keeping the tunnel up when not needed. The idle-timeout is set in the Phase 2 settings, not Phase 1.

Answer

Set the Phase 2 proposal to null encryption and enable PFS.

Answer

Configure the tunnel as dial-up and set the idle timeout.

Answer

Enable auto-negotiate and set a short SA lifetime.

Question 11

An administrator is deploying ADVPN 2.0 with IPsec tunnel templates on a FortiGate hub. Which two configuration elements are required on the hub's tunnel template to allow spokes to establish dynamic tunnels and have their subnets reachable? (Choose two.)

Accepted Answer

The 'network-overlay' setting defining the spoke's remote subnet, with add-route enabled.. For a hub to accept dynamic spoke tunnels and route to their subnets, the Phase 1 template must use a wildcard or specific remote gateway to match incoming spokes, and the template must define the network-overlay with add-route so the hub installs routes to each spoke's LAN. Per-spoke PSKs, routing protocols, and auto-discovery settings are either optional or unrelated to the fundamental tunnel and route creation. These two elements are the minimum for scalable ADVPN 2.0 hub deployment.

Answer

The 'set auto-discovery-sender enable' and 'set auto-discovery-receiver enable' on the hub template.

Answer

A unique pre-shared key per spoke configured manually on the hub template.

Answer

OSPF or BGP configured on the hub with the template's dynamic gateway as a neighbor.

Question 12

An administrator is troubleshooting an IPsec VPN tunnel used in an SD-WAN overlay. The tunnel is up, but traffic is not passing. The administrator suspects a Phase 2 selector mismatch. Which command should be used to verify the Phase 2 selectors?

Accepted Answer

diagnose vpn tunnel list. To verify Phase 2 selectors, the administrator should use 'diagnose vpn tunnel list'. This command displays the negotiated Phase 2 selectors for each IPsec SA, enabling identification of mismatches. Other commands like 'diagnose vpn ike gateway list' or 'diagnose vpn ike status' focus on Phase 1 and do not provide Phase 2 selector details. The non-existent 'diagnose vpn ipsec status' is invalid.

Answer

diagnose vpn ike gateway list

Answer

diagnose vpn ipsec status

Answer

diagnose vpn ike status

Question 13

An administrator is configuring an SD-WAN rule that uses the 'Best Quality' strategy to select among three IPsec tunnels. The health check monitors latency, jitter, and packet loss. Which two parameters must be configured in the health check to ensure the SD-WAN rule can properly evaluate the quality of each tunnel? (Choose two.)

Accepted Answer

SLA target for latency, jitter, and packet loss.. For the 'Best Quality' strategy to select the optimal tunnel, the health check must define SLA targets for latency, jitter, and packet loss, and must include timing parameters such as update interval and failtime. The SLA targets set the thresholds for acceptable performance, while the update interval and failtime determine how frequently and how reliably the metrics are measured. Together, these allow the FortiGate to continuously evaluate each tunnel's quality and choose the best one.

Answer

Probe protocol and port number for each tunnel.

Answer

Source and destination IP addresses for the probes.

Answer

Enable 'Detect and Fix' to automatically adjust SD-WAN rules.

Question 14

An administrator is troubleshooting an SD-WAN rule that uses the 'lowest cost (SLA)' strategy with two IPsec overlays. The rule is not selecting the expected overlay even though both members pass health checks. The administrator notices that the rule's priority values are both set to 1. What is the most likely reason the rule is not steering traffic as expected?

Accepted Answer

The cost value is derived from the interface's estimated bandwidth or configured cost, and if both members have the same cost, the rule cannot differentiate them.. The lowest cost (SLA) strategy chooses the member with the lowest cost among those that meet the SLA. If both members have the same cost, the rule cannot distinguish them based on cost, and selection may fall back to priority or order. To steer traffic to a preferred overlay, the administrator should assign distinct cost values or adjust priorities. Verifying interface cost settings and SLA health check results will confirm why the expected overlay is not chosen.

Answer

The 'lowest cost (SLA)' strategy ignores cost and uses only the SLA score; equal priorities mean both members have the same SLA score.

Answer

The rule requires a manual order configuration; without it, FortiOS randomly selects among members with equal priority.

Answer

The 'lowest cost (SLA)' strategy requires unique priority values; when priorities are equal, FortiOS falls back to the first member in the list, ignoring cost.

Question 15

An administrator is configuring an SD-WAN rule that must route traffic based on application control and also apply a security profile. Which two actions are required to ensure the security profile is applied to the traffic? (Choose two.)

Accepted Answer

Create a firewall policy that matches the traffic and applies the desired security profile.. To apply a security profile to traffic steered by an SD-WAN rule, you must create a firewall policy that matches the traffic and includes the security profile. The firewall policy must use the SD-WAN zone as its outgoing interface so that the SD-WAN rules are evaluated for egress selection. The security profile is then applied as part of the firewall policy processing. Other options like inspection-mode or health check are not relevant for security profile application.

Answer

Enable the 'inspection-mode' in the SD-WAN rule.

Answer

Place the firewall policy above the SD-WAN rule in the policy order.

Answer

Ensure the SD-WAN rule references the application and uses a health check.