NSE7_SDW Security Profiles Routing And IPsec Practice Test 5 — 15 Questions

Question 1

An administrator is deploying ADVPN 2.0 with BGP on a FortiGate hub. The administrator wants to ensure that spoke-to-spoke shortcut tunnels are established dynamically. Which two BGP-related configurations are required on the hub to support this? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the hub as a BGP route reflector.. In ADVPN 2.0 with BGP, the hub must be configured as a route reflector and each spoke must be marked as a route-reflector client. This allows the hub to reflect routes between spokes, enabling them to learn each other's prefixes. Once a spoke has a route to a remote subnet with the remote spoke's tunnel IP as next-hop, it can initiate a shortcut tunnel. Without these two BGP settings, spokes would not receive the necessary routing information, and shortcuts would not be established. The other options are either not required or would actively prevent shortcut formation.

Answer

Configure BGP to advertise the default route from the hub to all spokes.

Answer

Enable 'set next-hop-self' on the hub for all iBGP neighbors.

Answer

Configure BGP to use a unique cluster ID on the hub.

Question 2

An administrator has configured an SD-WAN rule that routes traffic to an IPsec overlay zone. The administrator wants to ensure that if the primary IPsec tunnel fails, traffic is automatically redirected to a backup IPsec tunnel. Which SD-WAN rule setting should be configured to achieve this?

Accepted Answer

Set the primary tunnel's priority lower than the backup tunnel's priority.. In an SD-WAN rule, the priority of member links determines the order of preference. Lower values are preferred. By setting the primary tunnel's priority lower than the backup, the primary is used when healthy, and the backup is used only when the primary fails. This achieves automatic failover. Other settings like 'Best Quality' or 'Update cascade interfaces' do not provide deterministic failover to a specific backup tunnel.

Answer

Configure the SD-WAN rule to use 'Best Quality' strategy.

Answer

Enable 'Link failover' and set the priority of the backup tunnel lower than the primary.

Answer

Enable 'Update cascade interfaces' on the health check.

Question 3

An administrator wants to apply a Web Filtering security profile to traffic that is being dynamically steered via an SD-WAN rule. Where must this security profile be enforced in FortiOS?

Accepted Answer

Inside the firewall policy that matches the traffic being steered by the SD-WAN rule. In FortiOS, security profiles such as Web Filtering are enforced by the firewall policy that matches the traffic, not by the SD-WAN rule itself. SD-WAN rules only determine the outgoing interface or path; they do not apply security inspection. Therefore, the Web Filtering profile must be attached to the firewall policy that permits and steers the traffic via the SD-WAN rule.

Answer

Directly inside the SD-WAN rule configuration under the advanced settings tab

Answer

Globally under the system settings as an SD-WAN overlay inspection profile

Answer

Within the IPsec tunnel phase 2 security association settings

Question 4

An IPsec VPN tunnel used as an SD-WAN member is experiencing intermittent flapping due to DPD (Dead Peer Detection) timeout issues over a high-latency satellite link. How should the administrator adjust the Phase 1 IPsec settings on FortiOS to stabilize the tunnel without completely disabling failure detection?

Accepted Answer

Increase the DPD retry count and interval settings under the IPsec Phase 1 configuration. DPD (Dead Peer Detection) uses periodic hello/ack probes to verify the remote peer is alive; if probes go unanswered within the configured retry count and interval, FortiOS tears down the Phase 1 SA. On a high-latency satellite link, the default interval (often 20s) and retry count (3) are too aggressive, so legitimate replies arrive after the timeout and the tunnel flaps. Increasing both the DPD interval and retry count under Phase 1 gives the peer more time to respond before the tunnel is declared dead, stabilizing the tunnel while keeping failure detection active.

Answer

Disable DPD entirely so the FortiGate never tears down the tunnel

Answer

Enable NP6/NP7 hardware offloading for Phase 1 SA renegotiation

Answer

Change the IPsec phase 1 mode from Main mode to Aggressive mode

Question 5

An enterprise network uses ADVPN 2.0 with BGP running over IPsec tunnels. A spoke needs to initiate a shortcut tunnel to another spoke. Which FortiOS CLI command is used on the hub to verify the active shortcut tunnels and view the shortcut state information?

Accepted Answer

diagnose vpn tunnel list. The command 'diagnose vpn tunnel list' on the hub displays all active IPsec tunnels, including ADVPN shortcut tunnels established between spokes. It shows tunnel names, source/destination IPs, and state information, allowing the administrator to verify that shortcut tunnels are up and active. This is the standard FortiOS diagnostic command for inspecting IPsec tunnel status in ADVPN deployments.

Answer

execute router clear bgp all

Answer

get system sdwan neighbor

Answer

diagnose netlink interface list

Question 6

When troubleshooting SD-WAN performance SLA packet loss, an administrator wants to view real-time latency, jitter, and packet loss statistics for individual health check members. Which CLI command should be executed?

Accepted Answer

diagnose sys sdwan health-check. The command 'diagnose sys sdwan health-check' displays real-time performance SLA statistics for SD-WAN health check members, including latency, jitter, and packet loss. It is the correct tool to troubleshoot SLA violations and monitor link quality. This command provides per-member details essential for diagnosing SD-WAN performance issues.

Answer

get system interface physical

Answer

execute ping-server status

Answer

show system sdwan

Question 7

When configuring an SD-WAN health check to monitor internet reachability using HTTP/HTTPS requests, which parameter defines the specific string the FortiGate expects to receive in the server response body to validate that the path is healthy?

Accepted Answer

http-match. The http-match parameter in an SD-WAN health check defines the specific string that the FortiGate expects to find in the HTTP/HTTPS response body to consider the path healthy. This allows the firewall to validate not just reachability but also that the correct application or service is responding. It is a key configuration for application-aware health checks.

Answer

probe-packet-size

Answer

sla-break-time

Answer

server-response-timeout

Question 8

An administrator is troubleshooting an SD-WAN deployment where traffic matching an SD-WAN rule with a destination service object (e.g., HTTPS) is not being steered according to the SLA priority. Instead, it is always taking the default static route member. Upon checking the firewall policies, what is the most common reason why an SD-WAN rule fails to process application or service-based traffic matching?

Accepted Answer

The SD-WAN rules are evaluated sequentially from top to bottom; an earlier broad SD-WAN rule with matching source/destination IP addresses is intercepting the traffic before the service-specific rule is reached. SD-WAN rules are evaluated in order from top to bottom, and the first matching rule is applied. If a broad rule (e.g., matching any source/destination or all services) appears above a more specific service-based rule, it will intercept the traffic and prevent the service-specific rule from being evaluated. This is the most common misconfiguration causing service-based SD-WAN rules to be bypassed.

Answer

IPsec VPN phase 2 selectors must be set to 0.0.0.0/0 for service-based rules to evaluate

Answer

The firewall policy containing the traffic has SSL inspection disabled, preventing service-based identification

Answer

The FortiGate kernel requires hardware acceleration (NP7) to be disabled for service-based SD-WAN rules to function

Question 9

An enterprise deploys BGP over SD-WAN with multiple MPLS and broadband connections. A route-map is applied to incoming BGP updates on the FortiGate to set a specific weight for routes learned over the MPLS interface. Why is the 'weight' attribute particularly effective in this FortiOS SD-WAN and BGP integration scenario?

Accepted Answer

Weight is evaluated first in the BGP best-path selection algorithm on FortiOS, allowing local preference override without altering global AS path attributes. In FortiOS BGP, the weight attribute is evaluated first in the best-path selection algorithm, before local preference and other attributes. Setting a higher weight on routes learned from the MPLS interface makes those routes preferred locally without affecting other routers, since weight is local to the FortiGate and not propagated in BGP updates. This allows granular, per-device control in an SD-WAN environment.

Answer

Weight replaces the need for SD-WAN SLA rules by performing layer 7 packet inspection

Answer

Weight automatically adjusts the SD-WAN health check probe frequency based on route stability

Answer

Weight is propagated to all iBGP peers, ensuring cluster-wide path synchronization

Question 10

In an ADVPN 2.0 deployment, a hub unit uses BGP to advertise routes to spokes. When a spoke learns a prefix via BGP from the hub, what mechanism allows the spoke to automatically initiate an ADVPN shortcut tunnel directly to another spoke when traffic flows between them?

Accepted Answer

The FortiGate kernel detects traffic matching a dynamic BGP route over the IPsec interface and initiates an IKE shortcut negotiation with the target spoke. In ADVPN, when a spoke receives a BGP route from the hub pointing to another spoke's subnet, the route's next-hop resolves over the IPsec tunnel. When the spoke's kernel sees traffic destined for that prefix, it triggers the ADVPN shortcut logic: the spoke initiates an IKE negotiation directly with the target spoke to build a dynamic shortcut tunnel, bypassing the hub for that traffic. This is the core ADVPN 'shortcut' behavior.

Answer

OSPF sends a special multicast hello packet across the hub to establish mesh point-to-point links

Answer

FortiManager pushes a dynamic static route to both spokes simultaneously

Answer

The Web Filtering profile intercepts the packet and redirects it via proxy to the destination spoke

Question 11

An administrator implements BGP over SD-WAN tunnels to a cloud provider. The cloud provider requires BGP MD5 authentication on all peering sessions. Where is BGP MD5 authentication configured on the FortiGate?

Accepted Answer

Under the router bgp neighbor configuration block in the CLI. BGP MD5 authentication is configured per neighbor under the 'config router bgp' → 'config neighbor' block using the 'set password' command. This applies TCP MD5 signature authentication to the BGP peering session, which the cloud provider requires for all peering sessions.

Answer

Within the firewall policy authentication settings

Answer

Under the IPsec phase 1 interface advanced settings

Answer

Inside the SD-WAN health check probe configuration

Question 12

An administrator needs to inspect encrypted traffic traversing an SD-WAN IPsec tunnel using Deep Packet Inspection (DPI). What must be installed on the client endpoints or configured on the FortiGate to prevent browser trust warnings when using SSL/TLS full inspection?

Accepted Answer

The FortiGate's self-signed CA certificate must be installed in the trusted root certificate store of the client endpoints. To prevent browser trust warnings during SSL/TLS full inspection, the FortiGate's self-signed CA certificate must be installed in the trusted root certificate store of the client endpoints. When full inspection is enabled, the FortiGate acts as a man-in-the-middle, presenting its own certificate to the client. If the client does not trust the FortiGate's CA, the browser will display a warning.

Answer

ADVPN 2.0 shortcut certificates must be exchanged between spokes

Answer

BGP MD5 authentication keys must match on both routers

Answer

A pre-shared key must be configured in the IPsec Phase 1 proposal

Question 13

An administrator wants to view the active SD-WAN rule hit counts and verify which traffic is matching a specific SD-WAN rule in FortiOS. Which command should be used?

Accepted Answer

diagnose sys sdwan service. The command 'diagnose sys sdwan service' displays the SD-WAN service rules along with their hit counts and the sessions currently matching each rule, making it the correct tool to verify which traffic is hitting a specific rule. It is a diagnostic command run from the FortiGate CLI that exposes the internal SD-WAN service table. Other commands either show configuration, clear caches, or display firewall policy statistics that do not map to SD-WAN rule matching.

Answer

show system sdwan

Answer

execute router clear sdwan cache

Answer

get firewall policy statistics

Question 14

An administrator configures an SD-WAN rule using the 'Volume' strategy across two IPsec tunnels with different bandwidth capacities (Tunnel A: 100 Mbps, Tunnel B: 50 Mbps). How does FortiOS distribute traffic across these members when using the Volume strategy?

Accepted Answer

Traffic is distributed proportionally based on the configured weight or bandwidth ratio of each member interface. The Volume strategy in FortiOS SD-WAN distributes traffic across members proportionally based on the configured weight or bandwidth ratio of each interface. With Tunnel A at 100 Mbps and Tunnel B at 50 Mbps, traffic is split roughly 2:1, not equally. This ensures that higher-capacity links carry more traffic, optimizing utilization.

Answer

Traffic is balanced equally (50/50) regardless of interface capacity

Answer

Traffic is sent exclusively over Tunnel A until it reaches 100% packet loss, then fails over to Tunnel B

Answer

Traffic is steered strictly based on real-time latency measured by health checks

Question 15

A FortiGate SD-WAN deployment uses a firewall policy with an Intrusion Prevention System (IPS) profile applied. After turning on IPS, administrators notice that throughput over an IPsec SD-WAN tunnel drops significantly. What is the primary reason for this throughput reduction, and how can it be mitigated?

Accepted Answer

IPS inspection requires intensive CPU processing for packet payload analysis, which can be optimized by using flow-based inspection mode and ensuring hardware offloading is active where supported. Enabling IPS on a FortiGate forces each packet's payload to be inspected against the IPS signature database, which is CPU-intensive. When IPS is applied to traffic traversing an IPsec SD-WAN tunnel, the added deep inspection work reduces throughput because packets must be reassembled and scanned before encryption/decryption offload can complete. Mitigation is to use flow-based inspection (which inspects packets as they stream rather than buffering full content) and to ensure NPU/hardware offloading is active where the platform supports it.

Answer

IPS requires proxy-based inspection, which permanently disables IPsec hardware acceleration

Answer

IPS blocks all IPsec AH/ESP headers, forcing fallback to unencrypted GRE tunnels

Answer

The IPS database size exceeds the IPsec Phase 2 buffer limit