NSE7_SDW System Configuration And Setup — 30 Questions

Question 1

Which protocol is NOT a valid option for Performance SLA probes?

Accepted Answer

UDP Broadcast. FortiGate Performance SLA probes support ICMP, TCP Echo, HTTP, and UDP Echo, but not UDP Broadcast. UDP Broadcast is not a valid probe type because SLA probes are unicast measurements between the FortiGate and a specific SLA server; broadcasting would not yield a meaningful per-link latency, jitter, or packet loss measurement. Therefore UDP Broadcast is the protocol that is NOT a valid option.

Answer

TCP Echo

Answer

HTTP

Answer

ICMP

Question 2

You are using 'SLA Target' as your strategy. What happens if multiple members meet the SLA?

Accepted Answer

The system selects the first member in the list.. When multiple members meet the SLA in 'SLA Target' mode, the FortiGate uses the member with the best performance metric (e.g., lowest latency).

Answer

The system selects the one with the highest bandwidth capacity.

Answer

The system selects the member with the best performance (e.g., lowest latency).

Answer

Traffic is sent through all of them simultaneously.

Question 3

Which of the following is required to successfully implement SD-WAN?

Accepted Answer

At least two physical interfaces.. To implement SD-WAN, at least two physical interfaces are required — one for the WAN underlay (typically the internet or MPLS link) and one for the LAN side, or two WAN links if the design uses multiple transports. Fortinet's SD-WAN configuration requires at least two interfaces to create SD-WAN members and apply performance SLAs and load-balancing rules. Without two interfaces, there is nothing to steer traffic between.

Answer

A FortiManager instance.

Answer

A subscription to FortiGuard SD-WAN service.

Answer

An external load balancer.

Question 4

Which CLI command displays the SD-WAN routing table?

Accepted Answer

get system sdwan neighbor. The command 'get system sdwan neighbor' shows the current routing status of SD-WAN members.

Answer

show system sdwan

Answer

get router info routing-table all

Answer

diagnose sys route list

Question 5

What is the maximum number of members allowed in a single SD-WAN zone?

Accepted Answer

Depends on the model, but generally limited by system resources.. FortiOS does not publish a fixed numeric cap on SD-WAN zone membership; the practical limit depends on the FortiGate model's resources (memory, CPU, interface count) and the number of members the platform can support. Smaller desktop models support fewer members than high-end chassis, so the correct answer is that it is model/resource dependent. Fixed numbers such as 2, 4, or 8 are not accurate universal limits.

Answer

8

Answer

2

Answer

4

Question 6

Which THREE of the following protocols can be used for Performance SLA probes?

Accepted Answer

ICMP. Performance SLA probes in FortiGate (SD-WAN) support several probe protocols, and ICMP (option B) is correct because it sends echo requests to measure latency, jitter, and packet loss to a target. TCP Echo (option C) is correct because it establishes a TCP handshake on a specified port to measure round-trip time and availability. HTTP (option D) is correct because it performs an HTTP GET request to a configured URL and can measure response time and detect application-layer failures. FTP (option A) and DHCP (option E) are not selectable probe protocols for Performance SLA monitoring, as FortiGate only supports ICMP, TCP Echo, HTTP, HTTPS, PING, and DNS-style probes (depending on firmware) for this feature.

Answer

FTP

Answer

DHCP

Question 7

Which TWO of the following occur when a member is removed from an SD-WAN zone?

Accepted Answer

The interface can then be used for other configurations like static routes.. Option B is correct because once an interface is removed from the SD-WAN zone, it is no longer bound to the SD-WAN virtual interface and becomes a regular physical/logical interface that can be referenced in other configuration objects such as static routes. Option E is correct because SD-WAN rules reference member interfaces (or the SD-WAN zone); if an interface that was a member is removed from the zone, any SD-WAN rule still referencing that interface must be updated or the interface removed from those rules, otherwise the configuration is invalid or the rule cannot use it. Option A is incorrect because removing a member from an SD-WAN zone does not trigger a FortiGate reboot. Option C is incorrect because the interface does not automatically become a WAN port; its role is determined by its own configuration, not by SD-WAN membership. Option D is incorrect because firewall policies referencing the SD-WAN zone are not automatically deleted when a member interface is removed.

Answer

The FortiGate restarts automatically.

Answer

The interface automatically reverts to a WAN port.

Answer

All firewall policies referencing the zone are deleted.

Question 8

Which TWO of the following are necessary to enable SD-WAN on a FortiGate?

Accepted Answer

Creating at least one SD-WAN rule.. Option B is correct because an SD-WAN rule (config system sdwan / config service) is what actually defines the traffic-steering policy — matching traffic and selecting the preferred member or SLA-based path — so SD-WAN functionality is not operational until at least one rule exists. Option C is correct because SD-WAN requires member interfaces, and on FortiGate these interfaces must be assigned to an SD-WAN zone (config system sdwan / config zone) before rules can reference them as members. Option A is not required: SD-WAN is configured under Network > SD-WAN (or via CLI), and Feature Visibility only controls GUI menu display, not the underlying capability. Option D is not required: FortiGuard updates affect signatures and databases, not SD-WAN enablement. Option E is not required: BGP peering is an optional routing design choice for SD-WAN, not a prerequisite for enabling it.

Answer

Enabling SD-WAN in the Feature Visibility menu.

Answer

Updating the FortiGuard database.

Answer

Configuring a BGP peer.

Question 9

You are deploying a new FortiGate SD-WAN solution with two WAN links. You want the FortiGate to automatically detect link degradation and dynamically steer traffic away from the failed link without manual intervention. Which feature must you configure to achieve this?

Accepted Answer

Performance SLA. Performance SLA is the FortiGate feature that continuously monitors SD-WAN member health and triggers automatic traffic steering when thresholds are breached. It integrates directly with SD-WAN rules, enabling dynamic failover without manual intervention. The other options are static or legacy mechanisms that cannot provide the required automatic detection and redirection.

Answer

Policy routes

Answer

Static route with distance

Answer

Link Health Monitor

Question 10

An administrator is configuring an SD-WAN member on a FortiGate. The member uses a physical WAN interface with a dynamic IP address from the ISP. The design requires that the FortiGate use a specific public IP address for the overlay tunnel source, which differs from the interface IP assigned by the ISP. Which SD-WAN member setting should the administrator configure to achieve this?

Accepted Answer

Set the member's 'Gateway' to the ISP gateway and configure the IPsec phase 1 local gateway to the desired public IP.. The member Gateway is the next-hop for the underlay and must be the ISP gateway. The desired public IP for the overlay is controlled at the IPsec phase 1 level by setting the local gateway. This combination ensures proper routing and the required tunnel source address.

Answer

Enable the member's 'Source IP' option and specify the desired public IP.

Answer

Set the member's Gateway to the desired public IP address.

Answer

Configure the member's 'Interface' to a loopback interface that holds the desired public IP.

Question 11

You are configuring a Performance SLA to monitor an SD-WAN member. You want to ensure that the SLA accurately reflects the link's ability to carry business-critical traffic. Which two parameters must you configure to define the SLA thresholds? (Choose two.)

Accepted Answer

Latency threshold. Performance SLA in FortiGate uses latency, jitter, and packet loss as its core metrics. For business-critical traffic like VoIP, latency and jitter thresholds are essential to ensure call quality. While packet loss is also important, the question specifically asks for two parameters, and latency and jitter are the primary thresholds that must be configured to define the SLA for such traffic. Bandwidth and MTU are not part of the SLA probe metrics.

Answer

Bandwidth threshold

Answer

Packet loss threshold

Answer

MTU threshold

Question 12

You are setting up a new SD-WAN deployment on a FortiGate. You have two WAN interfaces, wan1 and wan2, that you want to combine into an SD-WAN zone called 'virtual-wan-link'. After creating the zone, you attempt to add wan1 to it, but the interface is not available in the member list. What is the most likely reason?

Accepted Answer

wan1 is currently referenced in a static route or firewall policy.. Before an interface can be added to an SD-WAN zone, it must not be referenced by other configuration elements such as static routes, firewall policies, or other SD-WAN zones. This ensures that the interface's role is solely within the SD-WAN framework, preventing conflicts and ensuring predictable routing behavior.

Answer

wan1 is already assigned to a different SD-WAN zone.

Answer

wan1 does not have an IP address assigned.

Answer

wan1 is configured as a DHCP client.

Question 13

You have two SD-WAN members, wan1 and wan2, in separate zones. You want sessions that egress wan1 to return through wan1 even when wan2 has a lower-cost route to the return destination. Which member setting enforces this?

Accepted Answer

Mark wan1 as the preferred member for the zone or rule so return traffic is matched to it.. Symmetric routing in SD-WAN is achieved by making a member preferred for the matching traffic, which causes both directions of a session to be handled by the same member. Gateway values, cost values, and other member attributes influence selection or reachability but do not pin return traffic. Only the preferred-member designation enforces the stated requirement.

Answer

Set the Gateway on wan1 to the next-hop address of the remote peer.

Answer

Set the wan2 member's cost to a higher value than wan1.

Answer

Enable the 'Preserve Session' option on the wan1 member.

Question 14

A FortiGate is configured with SD-WAN, and the administrator notices that a specific application is not being steered by an SD-WAN rule even though the rule matches the application signature. What is the most likely reason?

Accepted Answer

The application control profile is not applied to the firewall policy that permits the traffic.. For an SD-WAN rule to match on application, the FortiGate must first identify the application. This requires an application control profile applied to the firewall policy that allows the traffic. Without it, the application is seen as unknown, and the SD-WAN rule with application criteria will not match. Ensuring the profile is in place resolves the issue.

Answer

The SD-WAN rule is placed below a more general rule that matches all traffic.

Answer

The performance SLA is disabled on the member.

Answer

The interface is not assigned to an SD-WAN zone.

Question 15

An administrator is configuring an SD-WAN rule that uses the 'Manual' strategy. The rule must ensure that traffic is load-balanced across two members, but only when both members meet the performance SLA. If one member fails the SLA, all traffic should use the remaining member. Which two configuration steps are required to achieve this? (Choose two.)

Accepted Answer

Assign a performance SLA to the SD-WAN rule and enable it for both members.. To load-balance with the Manual strategy while respecting SLA, you must assign a performance SLA to the rule and enable it on both members, and then list both members with equal priority in the Manual strategy. These two steps ensure that traffic is distributed when both are healthy and fails over when one fails.

Answer

Configure the rule to use 'Best Quality (SLA)' and assign costs to each member.

Answer

Enable 'Load Balance' mode and set the method to 'Source IP'.

Answer

Set the rule's action to 'Maximize Bandwidth (SLA)' and enable both members.

Question 16

You are deploying a FortiGate SD-WAN solution with two internet links, wan1 and wan2, in the same SD-WAN zone named 'virtual-wan-link'. You want to ensure that if the primary link's Performance SLA fails, traffic automatically uses the secondary link, but if both fail, traffic is still allowed on the primary. Which configuration should you use?

Accepted Answer

Create an SD-WAN rule with strategy 'priority' and set wan1 as the highest priority, wan2 as lower priority, and enable 'implicit failback' and 'SLA fail-action' set to 'allow'.. The requirement is to prefer wan1, fall back to wan2 if wan1 fails SLA, and still allow traffic on wan1 if both fail SLA. Priority strategy with wan1 highest achieves the preference. Implicit failback ensures return to wan1 after recovery. SLA fail-action set to 'allow' is the key setting that permits traffic when no member meets SLA, ensuring connectivity even when both links degrade.

Answer

Create an SD-WAN rule with strategy 'lowest-cost (SLA)' and enable 'implicit failback'.

Answer

Create an SD-WAN rule with strategy 'priority' and set wan1 as the highest priority, wan2 as lower priority, and enable 'link-cost-factor' with 'SLA'.

Answer

Create an SD-WAN rule with strategy 'priority' and set wan1 as the highest priority, wan2 as lower priority, and enable 'implicit failback'.

Question 17

You are configuring SD-WAN on a FortiGate and need to add a new interface to an SD-WAN zone. Which two prerequisites must be met before the interface can be added to the zone? (Choose two.)

Accepted Answer

The interface must be administratively up.. Before adding an interface to an SD-WAN zone, ensure it is not referenced in other configuration objects like static routes or firewall policies, and that it is administratively up. These prerequisites prevent conflicts and ensure the interface is available for SD-WAN operations.

Answer

The interface must be assigned to a virtual domain (VDOM).

Answer

The interface must have a gateway defined.

Answer

The interface must have an IP address assigned.

Question 18

You are configuring an SD-WAN member on a FortiGate running FortiOS 7.2. The member is a 5G/LTE modem interface that gets its IP address dynamically from the carrier. You need to enable the FortiGate to build a secure SD-WAN overlay with a remote FortiGate over that dynamic interface. Which SD-WAN member setting must you configure to identify the remote peer when the local address is not statically assigned?

Accepted Answer

Enable 'Dynamic peering' and specify the remote peer's serial number in the member configuration.. For SD-WAN members whose local address is not static, such as 5G/LTE or DHCP WAN links, the FortiGate must identify the remote peer without relying on a fixed IP. Dynamic peering lets the member be associated with a remote FortiGate's serial number, and the current address is discovered through the overlay or FortiManager. This allows the secure SD-WAN tunnel to come up even when the local modem address changes on each reconnect.

Answer

Set the 'Gateway' field to the remote FortiGate's public IP address.

Answer

Configure the member with a 'Dynamic gateway' and enable 'Detect' to learn the peer.

Answer

Set the 'Interface' to the modem and add a static route to the remote peer.

Question 19

You are deploying a new FortiGate SD-WAN solution at a branch office. The branch has two ISP connections: a 100 Mbps fiber link and a 50 Mbps cable link. You want to add both interfaces to an SD-WAN zone so that SD-WAN rules can select between them. After configuring the interfaces with static IP addresses and default gateways, you attempt to create an SD-WAN zone and add the interfaces, but the interfaces do not appear in the available list. Which configuration step is missing?

Accepted Answer

You must first add the interfaces as SD-WAN members in the 'config system sdwan' section, then they become available for zone assignment.. To add an interface to an SD-WAN zone, the interface must first be configured as an SD-WAN member under 'config system sdwan' with a gateway. Once the member is defined, it becomes available for selection in an SD-WAN zone. This two-step process ensures that only properly configured WAN links are used in SD-WAN rules.

Answer

You must create a static route for each interface pointing to the SD-WAN zone, which automatically adds the interfaces to the zone.

Answer

You must assign the interfaces to a virtual wire pair before they can be used in an SD-WAN zone.

Answer

You must enable SD-WAN on the FortiGate by running the command 'config system sdwan' and then 'set status enable'.

Question 20

You are configuring a Performance SLA on a FortiGate to monitor the quality of your WAN links. You want to ensure that the SLA probe uses HTTP to check the availability of a critical web application. Which configuration parameter must you set to specify the protocol used for the probe?

Accepted Answer

Protocol. In a Performance SLA configuration, the 'Protocol' parameter determines the type of probe, such as ping, tcp-echo, http, or dns. To use HTTP for checking a web application, you must set the protocol to 'http'. This ensures the SLA generates HTTP requests to the specified server and evaluates the response.

Answer

Server

Answer

Interval

Answer

Probe Type