NSE7_SDW System Configuration And Setup — 10 Questions

Question 1

Which protocol is NOT a valid option for Performance SLA probes?

Accepted Answer

UDP Broadcast. FortiGate Performance SLA probes support ICMP, TCP Echo, HTTP, and UDP Echo, but not UDP Broadcast. UDP Broadcast is not a valid probe type because SLA probes are unicast measurements between the FortiGate and a specific SLA server; broadcasting would not yield a meaningful per-link latency, jitter, or packet loss measurement. Therefore UDP Broadcast is the protocol that is NOT a valid option.

Answer

TCP Echo

Answer

HTTP

Answer

ICMP

Question 2

You are using 'SLA Target' as your strategy. What happens if multiple members meet the SLA?

Accepted Answer

The system selects the first member in the list.. When multiple members meet the SLA in 'SLA Target' mode, the FortiGate uses the member with the best performance metric (e.g., lowest latency).

Answer

The system selects the one with the highest bandwidth capacity.

Answer

The system selects the member with the best performance (e.g., lowest latency).

Answer

Traffic is sent through all of them simultaneously.

Question 3

Which of the following is required to successfully implement SD-WAN?

Accepted Answer

At least two physical interfaces.. To implement SD-WAN, at least two physical interfaces are required — one for the WAN underlay (typically the internet or MPLS link) and one for the LAN side, or two WAN links if the design uses multiple transports. Fortinet's SD-WAN configuration requires at least two interfaces to create SD-WAN members and apply performance SLAs and load-balancing rules. Without two interfaces, there is nothing to steer traffic between.

Answer

A FortiManager instance.

Answer

A subscription to FortiGuard SD-WAN service.

Answer

An external load balancer.

Question 4

Which CLI command displays the SD-WAN routing table?

Accepted Answer

get system sdwan neighbor. The command 'get system sdwan neighbor' shows the current routing status of SD-WAN members.

Answer

show system sdwan

Answer

get router info routing-table all

Answer

diagnose sys route list

Question 5

What is the maximum number of members allowed in a single SD-WAN zone?

Accepted Answer

Depends on the model, but generally limited by system resources.. FortiOS does not publish a fixed numeric cap on SD-WAN zone membership; the practical limit depends on the FortiGate model's resources (memory, CPU, interface count) and the number of members the platform can support. Smaller desktop models support fewer members than high-end chassis, so the correct answer is that it is model/resource dependent. Fixed numbers such as 2, 4, or 8 are not accurate universal limits.

Answer

8

Answer

2

Answer

4

Question 6

Which THREE of the following protocols can be used for Performance SLA probes?

Accepted Answer

ICMP. Performance SLA probes in FortiGate (SD-WAN) support several probe protocols, and ICMP (option B) is correct because it sends echo requests to measure latency, jitter, and packet loss to a target. TCP Echo (option C) is correct because it establishes a TCP handshake on a specified port to measure round-trip time and availability. HTTP (option D) is correct because it performs an HTTP GET request to a configured URL and can measure response time and detect application-layer failures. FTP (option A) and DHCP (option E) are not selectable probe protocols for Performance SLA monitoring, as FortiGate only supports ICMP, TCP Echo, HTTP, HTTPS, PING, and DNS-style probes (depending on firmware) for this feature.

Answer

FTP

Answer

DHCP

Question 7

Which TWO of the following occur when a member is removed from an SD-WAN zone?

Accepted Answer

The interface can then be used for other configurations like static routes.. Option B is correct because once an interface is removed from the SD-WAN zone, it is no longer bound to the SD-WAN virtual interface and becomes a regular physical/logical interface that can be referenced in other configuration objects such as static routes. Option E is correct because SD-WAN rules reference member interfaces (or the SD-WAN zone); if an interface that was a member is removed from the zone, any SD-WAN rule still referencing that interface must be updated or the interface removed from those rules, otherwise the configuration is invalid or the rule cannot use it. Option A is incorrect because removing a member from an SD-WAN zone does not trigger a FortiGate reboot. Option C is incorrect because the interface does not automatically become a WAN port; its role is determined by its own configuration, not by SD-WAN membership. Option D is incorrect because firewall policies referencing the SD-WAN zone are not automatically deleted when a member interface is removed.

Answer

The FortiGate restarts automatically.

Answer

The interface automatically reverts to a WAN port.

Answer

All firewall policies referencing the zone are deleted.

Question 8

Which TWO of the following are necessary to enable SD-WAN on a FortiGate?

Accepted Answer

Creating at least one SD-WAN rule.. Option B is correct because an SD-WAN rule (config system sdwan / config service) is what actually defines the traffic-steering policy — matching traffic and selecting the preferred member or SLA-based path — so SD-WAN functionality is not operational until at least one rule exists. Option C is correct because SD-WAN requires member interfaces, and on FortiGate these interfaces must be assigned to an SD-WAN zone (config system sdwan / config zone) before rules can reference them as members. Option A is not required: SD-WAN is configured under Network > SD-WAN (or via CLI), and Feature Visibility only controls GUI menu display, not the underlying capability. Option D is not required: FortiGuard updates affect signatures and databases, not SD-WAN enablement. Option E is not required: BGP peering is an optional routing design choice for SD-WAN, not a prerequisite for enabling it.

Answer

Enabling SD-WAN in the Feature Visibility menu.

Answer

Updating the FortiGuard database.

Answer

Configuring a BGP peer.

Question 9

You are deploying a new FortiGate SD-WAN solution with two WAN links. You want the FortiGate to automatically detect link degradation and dynamically steer traffic away from the failed link without manual intervention. Which feature must you configure to achieve this?

Accepted Answer

Performance SLA. Performance SLA is the FortiGate feature that continuously monitors SD-WAN member health and triggers automatic traffic steering when thresholds are breached. It integrates directly with SD-WAN rules, enabling dynamic failover without manual intervention. The other options are static or legacy mechanisms that cannot provide the required automatic detection and redirection.

Answer

Policy routes

Answer

Static route with distance

Answer

Link Health Monitor

Question 10

An administrator is configuring an SD-WAN member on a FortiGate. The member uses a physical WAN interface with a dynamic IP address from the ISP. The design requires that the FortiGate use a specific public IP address for the overlay tunnel source, which differs from the interface IP assigned by the ISP. Which SD-WAN member setting should the administrator configure to achieve this?

Accepted Answer

Set the member's 'Gateway' to the ISP gateway and configure the IPsec phase 1 local gateway to the desired public IP.. The member Gateway is the next-hop for the underlay and must be the ISP gateway. The desired public IP for the overlay is controlled at the IPsec phase 1 level by setting the local gateway. This combination ensures proper routing and the required tunnel source address.

Answer

Enable the member's 'Source IP' option and specify the desired public IP.

Answer

Set the member's Gateway to the desired public IP address.

Answer

Configure the member's 'Interface' to a loopback interface that holds the desired public IP.