NSE7_SDW System Configuration And Setup — 15 Questions

Question 1

You are using 'SLA Target' as your strategy. What happens if multiple members meet the SLA?

Accepted Answer

The system selects the first member in the list.. When multiple members meet the SLA in 'SLA Target' mode, the FortiGate uses the member with the best performance metric (e.g., lowest latency).

Answer

The system selects the one with the highest bandwidth capacity.

Answer

The system selects the member with the best performance (e.g., lowest latency).

Answer

Traffic is sent through all of them simultaneously.

Question 2

Which CLI command displays the SD-WAN routing table?

Accepted Answer

get system sdwan neighbor. The command 'get system sdwan neighbor' shows the current routing status of SD-WAN members.

Answer

show system sdwan

Answer

get router info routing-table all

Answer

diagnose sys route list

Question 3

You have an SD-WAN rule with 'Priority' strategy. What happens if the highest priority member fails its SLA?

Accepted Answer

Traffic fails over to the member with the next highest priority value.. In 'Priority' strategy, if the highest priority member becomes unhealthy (SLA failure), the traffic automatically fails over to the next highest priority member.

Answer

Traffic is dropped.

Answer

The FortiGate enters an error state.

Answer

Traffic is load balanced across all remaining members.

Question 4

You are configuring a Performance SLA to monitor reachability to a SaaS application. Which parameter determines the threshold for an interface to be considered 'unhealthy' in the SD-WAN routing table?

Accepted Answer

Packet Loss Threshold. The 'threshold-alert' or the individual latency/jitter/packet loss thresholds within the Performance SLA configuration dictate when a member is marked failed.

Answer

Probe Mode

Answer

Sequence Number

Answer

Update Interval

Question 5

An SD-WAN rule is configured with 'Lowest Cost (SLA)' strategy. If all members in the SLA meet the requirements, how does the FortiGate select the outgoing interface?

Accepted Answer

The member with the lowest interface cost value defined in the SD-WAN member configuration.. In 'Lowest Cost (SLA)' mode, the FortiGate selects the member with the lowest configured cost that meets the SLA requirements.

Answer

Round Robin

Answer

The interface with the highest bandwidth.

Answer

The interface that was most recently added to the zone.

Question 6

When using SD-WAN zones, what is the primary benefit of grouping multiple physical interfaces into a single zone?

Accepted Answer

It allows you to apply a single firewall policy to the entire group.. Zones allow you to reference a group of interfaces in a single firewall policy, simplifying the configuration.

Answer

It increases the throughput of individual physical links.

Answer

It prevents the need for performance SLAs.

Answer

It automatically enables load balancing between interfaces.

Question 7

When configuring an SD-WAN rule, what is the purpose of the 'Source' address field?

Accepted Answer

To match traffic based on the source IP or user.. The 'Source' field allows you to selectively apply SD-WAN rules based on specific traffic origins, such as a subnet or user group.

Answer

To define the gateway IP for the route.

Answer

To force traffic to a specific SD-WAN zone.

Answer

To determine which ISP the traffic exits through regardless of SLA.

Question 8

Which SD-WAN rule strategy should you choose if you want to distribute traffic across multiple interfaces based on their bandwidth weights?

Accepted Answer

Maximize Bandwidth (SLA). The 'Maximize Bandwidth' strategy allows traffic distribution based on the configured bandwidth weight for each interface.

Answer

Manual

Answer

Lowest Cost (SLA)

Answer

SLA Target

Question 9

You are deploying a new SD-WAN interface. What is the mandatory step before you can add an interface to an SD-WAN zone?

Accepted Answer

Remove all firewall policy, static route, and DHCP references from the interface.. Before an interface can be added to an SD-WAN zone, it must not have any existing references, such as being used in a firewall policy, static route, or DHCP server configuration.

Answer

Configure a performance SLA for that specific interface.

Answer

Assign a VLAN ID to the interface.

Answer

Enable SD-WAN on the global system settings.

Question 10

Which command is used to verify the current status of SD-WAN members and their SLA health from the CLI?

Accepted Answer

diagnose sys sdwan health-check. The command 'diagnose sys sdwan health-check' shows the status of configured health checks and member reachability.

Answer

show router info bgp

Answer

get system interface

Answer

get system sdwan member

Question 11

Which protocol is NOT a valid option for Performance SLA probes?

Accepted Answer

UDP Broadcast. FortiGate supports ping (ICMP), TCP echo, HTTP, and Two-Way Active Measurement Protocol (TWAMP).

Answer

TCP Echo

Answer

HTTP

Answer

ICMP

Question 12

Where do you configure the 'Gateway' IP address for an SD-WAN member?

Accepted Answer

Under Network > SD-WAN > SD-WAN Members.. The gateway for an SD-WAN member is configured within the SD-WAN member settings menu.

Answer

Under Firewall Policy.

Answer

Under Network > Static Routes.

Answer

Under System > Interfaces.

Question 13

What is the effect of changing the 'Hold-down' timer in a Performance SLA?

Accepted Answer

It prevents route flapping by delaying the transition back to an 'up' state.. The 'Hold-down' timer defines how long an interface must remain healthy after a failure before it is considered 'up' again, preventing route flapping.

Answer

It changes the frequency of the probes.

Answer

It sets the maximum number of failed probes allowed.

Answer

It determines the timeout duration for a single probe.

Question 14

Which of the following is required to successfully implement SD-WAN?

Accepted Answer

At least two physical interfaces.. At least two interfaces are typically required to make SD-WAN selection meaningful, though one is technically possible.

Answer

A FortiManager instance.

Answer

A subscription to FortiGuard SD-WAN service.

Answer

An external load balancer.

Question 15

What is the purpose of the 'Inbound' interface setting in an SD-WAN rule?

Accepted Answer

To restrict the rule to traffic originating from a specific interface.. Inbound interface matching allows you to apply SD-WAN logic based on the traffic's ingress interface, providing more specific traffic steering.

Answer

To enable reverse path forwarding checks.

Answer

To define the WAN gateway.

Answer

To specify the egress interface.