NSE7_SDW Security Profiles Routing And IPsec Practice Test 7 — 15 Questions

Question 1

An administrator is configuring an IPsec VPN tunnel between two FortiGate devices for SD-WAN. The administrator wants to ensure that the tunnel interface can be used in SD-WAN rules and that the tunnel is established only when the underlying physical interface is up. Which IPsec Phase 1 configuration parameter is required to bind the tunnel to a specific outgoing interface?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

interface. The 'interface' parameter in IPsec Phase 1 explicitly binds the tunnel to a specific outgoing interface. This ensures the tunnel uses only that interface and is established only when it is up, which is critical for SD-WAN member association and health checking. Other parameters like local-gw or remote-gw do not provide this binding.

Answer

psksecret

Answer

remote-gw

Answer

local-gw

Question 2

An administrator is configuring an IPsec VPN tunnel between two FortiGate devices for SD-WAN. The administrator wants to ensure that the tunnel interface can be used in SD-WAN rules and that the tunnel is established only when the underlying physical interface is up. Which IPsec Phase 1 configuration parameter is required to bind the tunnel to a specific outgoing interface?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the IPsec tunnel as a member of an SD-WAN zone and enable 'update-static-route' in the health check.. To ensure the IPsec tunnel is only used for routing when the health check passes, the tunnel should be part of an SD-WAN zone, and the health check must have update-static-route enabled. This causes FortiOS to install a static route only when the health check is successful, effectively gating routing on tunnel health.

Answer

Enable 'net-device' on the IPsec phase1-interface.

Answer

Enable 'auto-discovery-forwarder' on the IPsec phase1-interface.

Answer

Set the IPsec tunnel's 'distance' to a higher value than other routes.

Question 3

An administrator is setting up an IPsec VPN tunnel between a FortiGate hub and a branch office FortiGate. The administrator wants to ensure that the branch office can access the internet through the hub's internet connection while also accessing resources at the headquarters. Which type of IPsec VPN configuration should the administrator use to achieve this?

Accepted Answer

Site-to-site IPsec VPN with full tunneling and default route through the tunnel.. To route all traffic, including internet-bound traffic, from the branch through the hub, a site-to-site IPsec VPN with full tunneling and a default route through the tunnel is required. This ensures that the branch uses the hub's internet connection while still accessing headquarters resources. Other options either do not route internet traffic through the hub or are not suitable for site-to-site connectivity.

Answer

Dial-up IPsec VPN with dynamic routing.

Answer

Site-to-site IPsec VPN with split tunneling enabled.

Answer

Remote access IPsec VPN with full tunneling.

Question 4

An administrator is configuring an SD-WAN rule to route VoIP traffic over the MPLS link, which has lower latency. The administrator wants to ensure that if the MPLS link fails the SLA for latency, the traffic is automatically routed over the internet VPN. Which SD-WAN strategy should be used to achieve this?

Accepted Answer

Lowest Latency (SLA). Lowest Latency (SLA) is designed to select the member with the lowest latency that also meets the SLA. This ensures VoIP traffic uses the MPLS link when it meets the latency SLA, and if it fails, the rule automatically selects the next member (internet VPN) that meets the SLA. This strategy provides the desired automatic failover based on latency.

Answer

Lowest Cost (SLA)

Answer

Maximize Bandwidth (SLA)

Answer

Manual

Question 5

An administrator is troubleshooting an IPsec VPN tunnel that is part of an SD-WAN zone. The tunnel is up, but SD-WAN health checks are failing, causing the tunnel to be marked as down. The administrator verifies that the Phase 2 selectors include the health check server's IP address. What is the next most likely cause to investigate?

Accepted Answer

The health check server is not reachable via the tunnel due to missing route.. After verifying Phase 2 selectors, the next most likely cause for SD-WAN health check failure on an up tunnel is a missing route to the health check server. Without a route, the probes cannot reach the server, and the health check fails. The other options are either contradicted by the scenario (tunnel up) or less likely given the context. Ensuring proper routing is essential for health checks to traverse the tunnel.

Answer

The tunnel interface is not added to the SD-WAN zone.

Answer

The SD-WAN health check is configured with the wrong protocol (e.g., HTTP instead of ping).

Answer

The IPsec tunnel's Phase 1 proposal does not match the remote gateway.

Question 6

A FortiGate is configured with an SD-WAN rule that uses a health check to monitor an IPsec tunnel. The health check is configured with a ping probe to a remote IP. The administrator notices that the tunnel is marked as down even though the remote IP is reachable via the tunnel. What is a possible cause?

Accepted Answer

The health check's probe is using the wrong source interface, causing the probe to be sent outside the tunnel.. A health check probe must be sent through the correct interface to accurately test the tunnel. If the probe's source interface is misconfigured, the probe may bypass the tunnel and fail, causing the tunnel to be marked down despite being operational. Ensuring the health check uses the tunnel interface as the source is essential.

Answer

The health check is configured with 'security-mode' set to 'none', allowing probes to bypass the tunnel.

Answer

The health check is configured with 'protocol' set to 'ping' but the remote IP does not respond to ICMP.

Answer

The health check's source IP is not specified, so it uses the outgoing interface's IP, which is not routable over the tunnel.

Question 7

An administrator has configured an SD-WAN rule to steer traffic based on the "maximize bandwidth (SLA)" strategy. The rule uses two IPsec tunnels: one with 100 Mbps and one with 50 Mbps. The administrator expects traffic to be load-balanced proportionally to the bandwidth. However, all traffic is going through the 100 Mbps tunnel. What is the most likely reason?

Accepted Answer

The 50 Mbps tunnel is not meeting the SLA criteria, so it is excluded.. The "maximize bandwidth" strategy distributes traffic across links based on their available bandwidth, but only if they meet the SLA. If the 50 Mbps tunnel is not meeting the SLA, it is excluded, and all traffic goes to the 100 Mbps tunnel. The administrator should verify the health check status and SLA targets for the 50 Mbps tunnel.

Answer

The SD-WAN rule's priority is set to 1 for the 100 Mbps tunnel and 2 for the 50 Mbps tunnel.

Answer

The 50 Mbps tunnel is configured with a higher cost, causing it to be less preferred.

Answer

The "maximize bandwidth" strategy requires equal bandwidth links to load-balance.

Question 8

A network administrator is configuring a static route on a FortiGate to direct traffic to a remote subnet through an IPsec VPN tunnel. The tunnel interface is named 'VPN_Tunnel'. Which of the following is the correct way to configure the static route?

Accepted Answer

Set the destination to the remote subnet, the gateway to 0.0.0.0, and the interface to 'VPN_Tunnel'.. For a route-based IPsec VPN, the static route must direct traffic to the remote subnet through the tunnel interface. The correct configuration uses the remote subnet as destination, 0.0.0.0 as gateway, and the tunnel interface as the outgoing interface. This ensures that traffic is encrypted and sent through the tunnel. Other configurations would either bypass the tunnel or send traffic unencrypted.

Answer

Set the destination to the remote subnet, the gateway to the remote public IP, and the interface to the WAN interface.

Answer

Set the destination to the remote subnet, the gateway to the local public IP, and the interface to the WAN interface.

Answer

Set the destination to the remote subnet, the gateway to the VPN tunnel's remote IP, and the interface to 'VPN_Tunnel'.

Question 9

A FortiGate is configured with an SD-WAN rule that steers traffic based on application control. The administrator applies a security profile (Antivirus and IPS) to the SD-WAN zone. However, they notice that traffic matching the SD-WAN rule is not being inspected by the security profiles. What is the most likely reason?

Accepted Answer

The security profiles are applied to the wrong policy; the SD-WAN rule is referenced in a policy that does not have security profiles enabled.. Security profiles are applied to firewall policies, not directly to SD-WAN rules. When traffic matches an SD-WAN rule, it is processed by the firewall policy that contains that rule. If that policy lacks security profiles, no inspection occurs. Even if profiles are configured on the SD-WAN zone, they must also be enabled on the policy. Therefore, the most likely reason is that the policy referencing the SD-WAN rule does not have security profiles enabled.

Answer

The SD-WAN rule is using the 'volume' strategy, which disables security inspection.

Answer

The SD-WAN rule is configured with the 'pass-through' action, which bypasses security inspection.

Answer

Security profiles cannot be applied to SD-WAN zones; they must be applied to the individual member interfaces.

Question 10

A FortiGate is running SD-WAN with two IPsec tunnels to different data centers. The administrator wants to apply a Web Filtering profile only to HTTP/HTTPS traffic that is steered by a specific SD-WAN rule, while other traffic on the same tunnels remains unfiltered. Where should the Web Filtering profile be applied?

Accepted Answer

In the firewall policy that references the SD-WAN zone and matches the desired traffic, by enabling the Web Filtering profile in that policy.. Security profiles in FortiOS are enforced by firewall policies, not by SD-WAN rules or tunnel interfaces. To filter only the traffic handled by a specific SD-WAN rule, the administrator must ensure that traffic matches a firewall policy that references the SD-WAN zone and has the Web Filtering profile enabled. The SD-WAN rule then selects the outgoing member based on its criteria, while the firewall policy applies the security inspection.

Answer

On the IPsec Phase 1 configuration for each tunnel, by enabling 'set web-filter-profile'.

Answer

On the SD-WAN zone member interfaces in the firewall policy that matches the SD-WAN rule.

Answer

In the SD-WAN rule itself, by selecting the Web Filtering profile from the 'Security Profile' drop-down.

Question 11

An administrator configures an SD-WAN rule that matches traffic to a specific destination subnet and sets the strategy to 'Lowest Cost (SLA)'. The rule includes two members: 'Tunnel-1' with cost 10 and 'Tunnel-2' with cost 20. Both tunnels pass their SLA health checks. Which tunnel will be selected for the traffic?

Accepted Answer

Tunnel-1, because it has the lower cost and both meet SLA.. The 'Lowest Cost (SLA)' strategy chooses the member with the lowest cost that also passes its SLA health check. Since both tunnels meet SLA, the one with cost 10 is selected. This strategy does not load-balance or require a cost difference threshold. It is commonly used to prefer a cheaper link while maintaining performance guarantees.

Answer

Traffic is load-balanced across both tunnels because both meet SLA.

Answer

Tunnel-1 is selected only if its cost is lower than the other member's cost by at least 50%.

Answer

Tunnel-2, because a higher cost indicates a higher priority in the 'Lowest Cost (SLA)' strategy.

Question 12

An administrator is configuring an SD-WAN rule to route VoIP traffic over the MPLS link and all other traffic over the internet link. The administrator wants to ensure that VoIP traffic is prioritized and that the rule only selects the MPLS link if it meets specific latency and jitter thresholds. Which SD-WAN configuration should be used?

Accepted Answer

Create an SD-WAN rule with the 'SLA' strategy, referencing a health check that monitors latency and jitter on the MPLS link, and set the rule to match VoIP traffic.. The 'SLA' strategy is designed to route traffic based on health check metrics such as latency and jitter. By referencing a health check that monitors these metrics on the MPLS link, the SD-WAN rule can ensure that VoIP traffic is only sent over the MPLS link when it meets the specified thresholds. If the thresholds are not met, the rule can fail over to another link, maintaining call quality.

Answer

Create an SD-WAN rule with the 'volume' strategy, assigning a higher weight to the MPLS link for VoIP traffic.

Answer

Create an SD-WAN rule with the 'priority' strategy, setting the MPLS link as the highest priority for VoIP traffic.

Answer

Create an SD-WAN rule with the 'manual' strategy, explicitly selecting the MPLS link for VoIP traffic.

Question 13

A FortiGate is configured with an IPsec VPN tunnel to a remote peer. The administrator wants to apply an IPS sensor to traffic traversing the tunnel. However, the IPS sensor must inspect traffic after decryption but before it is routed to the internal network. Where should the IPS sensor be applied?

Accepted Answer

On the IPsec tunnel interface as an incoming interface in a firewall policy.. To inspect decrypted traffic from an IPsec tunnel, the IPS sensor must be applied to a firewall policy where the tunnel interface is the incoming interface. This ensures inspection occurs after decryption and before routing to the internal network. Applying it on the physical interface would inspect encrypted packets, and other placements are either inefficient or impossible.

Answer

On the internal LAN interface as an outgoing interface in a firewall policy.

Answer

In the IPsec phase 2 configuration as a proposal parameter.

Answer

On the physical WAN interface that carries the IPsec tunnel traffic.

Question 14

An administrator is configuring an SD-WAN rule to route traffic from a specific source subnet to a destination subnet over a preferred IPsec tunnel. The administrator wants to ensure that if the preferred tunnel fails, traffic automatically switches to a backup tunnel. Which SD-WAN rule configuration is required to achieve this?

Accepted Answer

Configure the rule with multiple interfaces and associate a health check that includes both interfaces.. The correct answer is to configure the rule with multiple interfaces and associate a health check that includes both interfaces. This allows the SD-WAN rule to monitor the health of each interface and automatically switch to the backup if the preferred interface fails. Health checks are essential for dynamic failover in SD-WAN.

Answer

Configure the rule with a single interface and enable 'failover' in the rule settings.

Answer

Configure the rule with a single interface and rely on the FortiGate's routing table to fail over.

Answer

Configure the rule with multiple interfaces and set the strategy to 'lowest-cost'.

Question 15

An administrator configures an SD-WAN rule with an SLA target that includes latency, jitter, and packet loss. The rule uses the 'lowest cost (SLA)' strategy. Both tunnels meet the SLA, but one tunnel has a lower configured cost. How does FortiOS select the egress interface for a new session?

Accepted Answer

It selects the tunnel with the lowest cost among those that meet the SLA.. The 'lowest cost (SLA)' strategy evaluates members against the SLA criteria first. Members that meet all thresholds are eligible. Among those, FortiOS selects the member with the lowest configured cost. If multiple members share the same cost, further tie-breaking may occur, but cost is the primary differentiator. This ensures that quality requirements are met while optimizing for cost.

Answer

It selects the tunnel with the lowest jitter because jitter is the most important SLA metric.

Answer

It selects the tunnel with the best measured latency, regardless of configured cost.

Answer

It load-balances sessions across both tunnels because both meet the SLA.