NSE7_SDW Security Profiles Routing And IPsec Practice Test 6 — 15 Questions

Question 1

An administrator configures a static route where the gateway is an SD-WAN zone instead of a specific IP address. How does FortiOS process this SD-WAN static route?

Accepted Answer

The FortiOS SD-WAN engine intercepts the route lookup and applies SD-WAN rules to dynamically select the best member interface based on performance SLAs. FortiOS supports SD-WAN static routes where the gateway is an SD-WAN zone rather than a next-hop IP. When such a route matches, the SD-WAN engine takes over the route lookup and applies SD-WAN rules (SLA-based, priority-based, or load-balance) to select the best member interface dynamically based on measured performance against configured SLAs.

Answer

The FortiGate drops the packet because static routes require a valid IP address gateway

Answer

The packet is forwarded exclusively through the physical interface with the lowest index number

Answer

Traffic is load-balanced equally across all physical interfaces in the FortiGate chassis using round-robin

Question 2

An administrator is configuring BGP over SD-WAN IPsec tunnels between a headquarters FortiGate and branch FortiGates. Which TWO configuration steps are required to ensure robust and stable dynamic routing over the SD-WAN IPsec tunnels? (Choose two)

Accepted Answer

Configure BGP neighbors using the loopback interface IP addresses or tunnel specific IP addresses rather than physical interface IPs. Option B is correct because peering BGP over loopback or tunnel-specific IP addresses (rather than physical WAN interface IPs) ties the session to the SD-WAN overlay, so the BGP session survives physical link changes and failover events since the tunnel/loopback address remains reachable regardless of which underlying WAN link carries the IPsec traffic. Option C is correct because WAN links and IPsec tunnels can experience latency spikes and reconvergence delays during failover; enabling BGP graceful restart or tuning keepalive/holddown timers prevents the session from flapping and dropping routes unnecessarily during those transient conditions. Option A is wrong because setting administrative distance to 255 makes the BGP routes unusable (never installed in the routing table), which disables dynamic routing rather than stabilizing it. Option D is wrong because static default routes pointing to null0 would black-hole traffic and are not a BGP-over-SD-WAN requirement. Option E is wrong because disabling IPsec Phase 2 encryption breaks the secure tunnel and is not needed for BGP, which is encapsulated inside the tunnel anyway.

Answer

Set the BGP administrative distance to 255 to disable all routing updates

Answer

Configure static default routes on all BGP neighbors pointing to the null0 interface

Answer

Disable IPsec phase 2 encryption to allow BGP plaintext hello packets to pass through without encapsulation overhead

Question 3

An administrator applies security profiles (Antivirus, Web Filtering, and IPS) to traffic steered by an SD-WAN rule. Performance issues arise. Which TWO methods can the administrator use to optimize inspection performance without completely disabling security? (Choose two)

Accepted Answer

Switch the inspection mode from proxy-based to flow-based where supported, allowing hardware offloading (NP6/NP7) to accelerate packet processing. Option A is correct because switching from proxy-based to flow-based inspection allows supported FortiGate models to use hardware acceleration (NP6/NP7 processors) for packet processing, which significantly reduces latency and improves throughput while still applying the security profiles. Option C is correct because configuring security profile exemptions or antivirus inspection overrides for trusted internal subnets or latency-sensitive VoIP traffic reduces the volume of traffic subjected to deep inspection, thereby optimizing performance without fully disabling security. Option B is incorrect because DES is a weak, deprecated encryption algorithm and would not meaningfully speed up IPsec decryption; it also degrades security rather than optimizing inspection. Option D is incorrect because disabling SSL inspection globally removes a critical security control entirely, which violates the requirement to avoid completely disabling security. Option E is incorrect because removing the SD-WAN virtual interface from all firewall zones would break the SD-WAN routing and security policy enforcement, not optimize inspection performance.

Answer

Set the IPsec Phase 1 encryption algorithm to DES to speed up decryptions

Answer

Disable all SSL inspection globally across the entire FortiGate device

Answer

Remove the SD-WAN virtual interface from all firewall zones

Question 4

An enterprise network uses OSPF over SD-WAN IPsec tunnels. The administrator notices that OSPF adjacency is constantly dropping over a specific backup SD-WAN member link due to intermittent packet loss. Which THREE configuration adjustments can improve OSPF stability over unstable SD-WAN IPsec links? (Choose three)

Accepted Answer

Configure OSPF network type as point-to-point on the IPsec tunnel interfaces to eliminate unnecessary DR/BDR elections. Option A is correct because setting the OSPF network type to point-to-point on IPsec tunnel interfaces removes DR/BDR election overhead and reduces the number of OSPF protocol packets needed, which is ideal for a single neighbor across an SD-WAN tunnel and minimizes the impact of intermittent loss. Option B is correct because OSPF graceful restart (and helper mode on the neighbors) allows the router to restart or fail over its OSPF process without tearing down adjacencies and re-converging, which preserves stability when the backup link is flapping. Option D is correct because increasing the hello and dead intervals on the affected IPsec tunnel interfaces makes OSPF more tolerant of temporary packet loss, preventing the dead timer from expiring and dropping the adjacency during brief outages. Option C is not valid because a router ID of 0.0.0.0 is not a usable OSPF router ID and would prevent OSPF from forming adjacencies. Option E is not valid because disabling OSPF hellos breaks neighbor detection and adjacency maintenance, and relying on static default routes does not provide the dynamic OSPF stability being sought.

Answer

Set the OSPF router ID to 0.0.0.0 on all branch spokes

Answer

Disable OSPF hello packets entirely and rely on static default routes

Question 5

When configuring advanced IPsec VPN tunnels to act as members of an SD-WAN zone, which TWO configuration parameters on the FortiGate are critical for ensuring proper IPsec tunnel operation and traffic steering? (Choose two)

Accepted Answer

Ensure the IPsec interface is added to an SD-WAN zone and assigned a valid virtual IP/interface configuration. Option A is correct because an IPsec interface must be a member of the SD-WAN zone to participate in SD-WAN path selection and traffic steering; the interface also needs a valid IP/virtual interface configuration so the zone can reference it as a member and apply SD-WAN rules to it. Option E is correct because Phase 2 selectors define the traffic that the IPsec SA protects: matching the exact source/destination subnets ensures only intended traffic is encrypted, while 0.0.0.0/0 selectors are commonly used for route-based VPNs so routing and SD-WAN rules, rather than narrow proxy IDs, determine which traffic enters the tunnel. Option B is wrong because NAT-T (UDP encapsulation on port 4500) is often required for IPsec to traverse NAT devices and should not be globally disabled. Option C is wrong because not all participating spokes should be dialup servers; typically the hub is the dialup server and spokes are dialup clients, or all are static peers. Option D is wrong because restricting Phase 1 authentication to RSA certificates only is not required for SD-WAN membership and would unnecessarily break pre-shared-key deployments.

Answer

Disable NAT traversal (NAT-T) globally on all IPsec phase 1 tunnels

Answer

Configure the IPsec tunnel mode as dialup server on all participating branch spokes

Answer

Set the IPsec phase 1 authentication method strictly to RSA certificates only, disabling pre-shared keys

Question 6

An administrator troubleshoots a scenario where traffic matching an application-based SD-WAN rule is bypassing the preferred high-speed MPLS tunnel and taking the backup broadband tunnel instead. Which THREE factors should the administrator check to resolve this routing discrepancy? (Choose three)

Accepted Answer

Inspect the member priorities and weights configured within the specific SD-WAN rule. Option C is correct because SD-WAN rule member priorities and weights directly determine which member is preferred; if the MPLS member has a lower priority or weight than the broadband member, traffic will be steered to broadband. Option D is correct because the SD-WAN engine continuously probes members against the configured performance SLA (e.g., latency, jitter, packet loss); if MPLS fails those thresholds, it is marked ineligible and the next-best member (broadband) is selected. Option E is correct because SD-WAN rules are evaluated top-down by sequence order, so an earlier rule matching the same application/traffic could override the intended rule and send traffic out the broadband tunnel. Option A is irrelevant because changing the default admin password is a hardening step unrelated to SD-WAN path selection. Option B is irrelevant because cable category is a physical-layer attribute that does not influence SD-WAN rule matching or member eligibility decisions.

Answer

Verify the FortiGate factory default administrator password is changed

Answer

Check the physical layer OSI Model cable category connected to the FortiGate port

Question 7

An administrator is troubleshooting BGP route propagation over SD-WAN IPsec tunnels where a branch office is not receiving specific routes from the datacenter hub. Which TWO CLI commands on the FortiGate are most useful for diagnosing BGP peering and advertised route issues? (Choose two)

Accepted Answer

get router info bgp neighbors advertised-routes. Option D, 'get router info bgp neighbors advertised-routes', is correct because it shows exactly which prefixes the local FortiGate is advertising to a specific BGP neighbor, directly revealing whether the missing branch routes are being sent out the IPsec-over-SD-WAN peering. Option E, 'get router info bgp summary', is correct because it verifies the BGP session state (Established vs. Active/Idle), uptime, and prefix counters per neighbor, confirming whether the peering across the SD-WAN IPsec tunnel is actually up before investigating route contents. Option A, 'execute ipsec tunnel list', only lists IPsec tunnel status and does not expose BGP peering or route advertisement details. Option B, 'diagnose sys sdwan member', reports SD-WAN member health and SLA metrics, not BGP neighbor or prefix information. Option C, 'get system interface physical', merely displays physical interface configuration/status and is unrelated to BGP route propagation.

Answer

execute ipsec tunnel list

Answer

diagnose sys sdwan member

Answer

get system interface physical

Question 8

An administrator configures an SD-WAN health check with multiple probes (e.g., ping and HTTP) to monitor a set of IPsec VPN tunnels. Which THREE criteria or settings govern how FortiOS determines whether an SD-WAN member has met or failed the performance SLA? (Choose three)

Accepted Answer

The restoretime parameter, which specifies how many consecutive successful probes are required before restoring a failed member to healthy status. Option B is correct because the restoretime setting in an SD-WAN health check defines how many consecutive successful probes must occur before a previously failed member is returned to healthy status, preventing flapping. Option D is correct because the failtime parameter specifies the number of consecutive probe failures required before FortiOS marks the SD-WAN member as failed and removes it from SLA compliance. Option E is correct because the health check's configured thresholds for latency, jitter, and packet loss are the actual performance SLA criteria that each probe result is compared against to decide whether the member meets the SLA. Option A is incorrect because the BGP AS number is a routing attribute unrelated to SD-WAN health check SLA evaluation. Option C is incorrect because physical cable length is not a parameter FortiOS uses in SD-WAN performance SLA determination.

Answer

The BGP AS number assigned to the WAN interface gateway

Answer

The physical cable length calculated in meters between the FortiGate and the nearest ISP switch

Question 9

An administrator wants to route traffic from a specific source subnet through an SD-WAN zone that contains two member interfaces: a dedicated internet link and an MPLS link. The administrator needs to ensure that traffic from that subnet always uses the MPLS link when it is available, but falls back to the internet link if the MPLS link fails. Which SD-WAN rule configuration should be used?

Accepted Answer

Create an SD-WAN rule with the source subnet as the match criteria, set the strategy to 'Manual', and order the MPLS interface first, then the internet interface.. The 'Manual' strategy in an SD-WAN rule allows explicit ordering of member interfaces. By listing the MPLS interface first, traffic will use it when it is available, and fall back to the internet interface if the MPLS link fails health checks. This meets the requirement of always using MPLS when available.

Answer

Create an SD-WAN rule with the source subnet as the match criteria, set the strategy to 'Lowest Cost', and assign a lower cost to the MPLS link.

Answer

Create an SD-WAN rule with the source subnet as the match criteria, set the strategy to 'Best Quality', and enable 'SLA target' for the MPLS link only.

Answer

Create an SD-WAN rule with the source subnet as the match criteria, set the strategy to 'Maximize Bandwidth', and enable 'SLA target' for both links.

Question 10

An administrator configures an IPsec VPN tunnel between two FortiGates for SD-WAN use. The tunnel is up, but traffic from the local subnet 10.10.10.0/24 to the remote subnet 10.20.20.0/24 is not passing. The administrator verifies that the Phase 2 selectors are configured with the correct local and remote subnets. What is the most likely cause?

Accepted Answer

There is no firewall policy allowing traffic from the local subnet to the remote subnet over the IPsec tunnel.. For traffic to traverse an IPsec tunnel in FortiOS, a firewall policy must explicitly allow it, referencing the tunnel interface as the outbound interface. Even with correct Phase 2 selectors and an established tunnel, without a policy, packets are dropped. This is a frequent misconfiguration in SD-WAN deployments.

Answer

The Phase 2 proposal encryption and authentication algorithms do not match between peers.

Answer

The SD-WAN rule is not configured to use the IPsec tunnel as a member.

Answer

The remote gateway's Phase 1 configuration is missing the local subnet in the interesting traffic selector.

Question 11

An administrator is configuring an IPsec VPN tunnel that will be used as an SD-WAN member. The tunnel must be able to carry multicast traffic for OSPF. Which IPsec Phase 2 configuration parameter must be enabled to support this requirement?

Accepted Answer

Enable 'Multicast' in Phase 2.. To carry multicast traffic such as OSPF hellos over an IPsec tunnel, the Phase 2 configuration must have the 'Multicast' option enabled. This allows the tunnel to encapsulate and forward multicast and broadcast packets, which are otherwise blocked by default. Enabling this is essential for dynamic routing protocols to operate over IPsec.

Answer

Enable 'Diffie-Hellman Group 14' in Phase 2.

Answer

Enable 'Auto-negotiate' in Phase 2.

Answer

Enable 'Replay Detection' in Phase 2.

Question 12

A FortiGate is configured with an SD-WAN rule that steers traffic to an IPsec overlay tunnel. A security administrator needs to inspect the traffic with an IPS sensor before it egresses the tunnel. Where must the IPS sensor be applied so that it inspects traffic matching the SD-WAN rule?

Accepted Answer

In the firewall policy that permits the traffic and references the SD-WAN zone as the outgoing interface.. The firewall policy that permits the session is where UTM profiles such as IPS are enforced. Because the SD-WAN rule only chooses the egress member after the policy is matched, the policy must reference the SD-WAN zone as its outgoing interface. This way, any member selected by the rule inherits the same IPS inspection, ensuring consistent protection regardless of which tunnel carries the traffic.

Answer

Inside the SD-WAN rule definition, by enabling the 'security-profile' option and selecting the IPS sensor.

Answer

In the IPsec Phase 2 selector, by attaching the IPS sensor to the tunnel's proxy ID.

Answer

In the SD-WAN health-check definition, by binding the IPS sensor to the SLA probe.

Question 13

A network administrator has deployed SD-WAN with two IPsec overlays and one internet breakout on a FortiGate. The administrator wants to ensure that traffic from a specific source subnet uses the VPN overlay for a business-critical application, while all other traffic follows the default route. The SD-WAN rule must also verify that the overlay meets an SLA for jitter. Which SD-WAN configuration object should the administrator use to define the source subnet and application criteria?

Accepted Answer

SD-WAN service rule with match criteria specifying source address and application, and an SLA target. The SD-WAN service rule is the correct construct because it supports matching on source address, application, and other criteria, and can reference an SLA target that uses health-check results to select the best member. This allows the administrator to steer the business-critical application over the overlay only when it meets the jitter SLA, while other traffic follows the default route.

Answer

Policy route with destination and service objects, and an outgoing interface of the SD-WAN zone

Answer

SD-WAN zone with a preferred member and a priority-based selection

Answer

Static route with a gateway pointing to the SD-WAN zone and a priority value

Question 14

An administrator configures an SD-WAN rule that steers Microsoft 365 traffic over the IPsec tunnel 'MPLS-VPN' and sets the rule's 'Priority' to 1. A second SD-WAN rule for the same traffic exists, but its 'Priority' is 10. Which statement accurately describes how FortiOS evaluates these rules?

Accepted Answer

The rule with Priority 1 is evaluated first; if its SLA health check fails, the rule with Priority 10 is evaluated next.. SD-WAN rules are processed in ascending priority order. The rule with the lowest priority number is evaluated first; if its SLA health check fails, FortiOS moves to the next rule. This design provides deterministic failover. The other options misstate the direction of priority or incorrectly describe parallel evaluation, which is not how FortiOS SD-WAN rule processing works.

Answer

Both rules are evaluated simultaneously, and traffic is load-balanced across the tunnels defined in each rule.

Answer

The rule with Priority 1 is applied only if the rule with Priority 10 is disabled or deleted.

Answer

The rule with Priority 10 is evaluated first because a higher numeric value indicates a higher precedence in FortiOS SD-WAN.

Question 15

A FortiGate is configured with an SD-WAN rule that uses a health check to monitor two IPsec tunnels. The health check is configured with a single ping probe to 8.8.8.8. The administrator notices that the SD-WAN rule fails over to the secondary tunnel even when the primary tunnel is up, but with high latency. The administrator wants the health check to consider latency and only fail over when latency exceeds a threshold. What should the administrator configure to achieve this?

Accepted Answer

Enable 'sla' in the health check and set the latency threshold to the desired value.. To make the health check consider latency and fail over only when latency exceeds a threshold, the administrator must enable SLA in the health check and set the latency threshold. This allows the FortiGate to monitor latency and trigger failover according to the configured threshold. Other options either do not enable latency monitoring or focus on different metrics.

Answer

Set the health check to use 'ping' with a larger packet size and configure 'sla' with packet loss threshold.

Answer

Add a second ping probe to a different destination and enable 'sla' with latency threshold.

Answer

Configure the health check to use 'http' probe and set latency threshold in the SLA.