NSE7_SDW System Configuration And Setup Practice Test 2 — 15 Questions

Question 1

You are deploying a FortiGate SD-WAN solution with two internet links, wan1 and wan2, in the same SD-WAN zone named 'virtual-wan-link'. You want to ensure that if the primary link's Performance SLA fails, traffic automatically uses the secondary link, but if both fail, traffic is still allowed on the primary. Which configuration should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an SD-WAN rule with strategy 'priority' and set wan1 as the highest priority, wan2 as lower priority, and enable 'implicit failback' and 'SLA fail-action' set to 'allow'.. The requirement is to prefer wan1, fall back to wan2 if wan1 fails SLA, and still allow traffic on wan1 if both fail SLA. Priority strategy with wan1 highest achieves the preference. Implicit failback ensures return to wan1 after recovery. SLA fail-action set to 'allow' is the key setting that permits traffic when no member meets SLA, ensuring connectivity even when both links degrade.

Answer

Create an SD-WAN rule with strategy 'lowest-cost (SLA)' and enable 'implicit failback'.

Answer

Create an SD-WAN rule with strategy 'priority' and set wan1 as the highest priority, wan2 as lower priority, and enable 'link-cost-factor' with 'SLA'.

Answer

Create an SD-WAN rule with strategy 'priority' and set wan1 as the highest priority, wan2 as lower priority, and enable 'implicit failback'.

Question 2

You are configuring SD-WAN on a FortiGate and need to add a new interface to an SD-WAN zone. Which two prerequisites must be met before the interface can be added to the zone? (Choose two.)

Accepted Answer

The interface must be administratively up.. Before adding an interface to an SD-WAN zone, ensure it is not referenced in other configuration objects like static routes or firewall policies, and that it is administratively up. These prerequisites prevent conflicts and ensure the interface is available for SD-WAN operations.

Answer

The interface must be assigned to a virtual domain (VDOM).

Answer

The interface must have a gateway defined.

Answer

The interface must have an IP address assigned.

Question 3

You are configuring an SD-WAN member on a FortiGate running FortiOS 7.2. The member is a 5G/LTE modem interface that gets its IP address dynamically from the carrier. You need to enable the FortiGate to build a secure SD-WAN overlay with a remote FortiGate over that dynamic interface. Which SD-WAN member setting must you configure to identify the remote peer when the local address is not statically assigned?

Accepted Answer

Enable 'Dynamic peering' and specify the remote peer's serial number in the member configuration.. For SD-WAN members whose local address is not static, such as 5G/LTE or DHCP WAN links, the FortiGate must identify the remote peer without relying on a fixed IP. Dynamic peering lets the member be associated with a remote FortiGate's serial number, and the current address is discovered through the overlay or FortiManager. This allows the secure SD-WAN tunnel to come up even when the local modem address changes on each reconnect.

Answer

Set the 'Gateway' field to the remote FortiGate's public IP address.

Answer

Configure the member with a 'Dynamic gateway' and enable 'Detect' to learn the peer.

Answer

Set the 'Interface' to the modem and add a static route to the remote peer.

Question 4

You are deploying a new FortiGate SD-WAN solution at a branch office. The branch has two ISP connections: a 100 Mbps fiber link and a 50 Mbps cable link. You want to add both interfaces to an SD-WAN zone so that SD-WAN rules can select between them. After configuring the interfaces with static IP addresses and default gateways, you attempt to create an SD-WAN zone and add the interfaces, but the interfaces do not appear in the available list. Which configuration step is missing?

Accepted Answer

You must first add the interfaces as SD-WAN members in the 'config system sdwan' section, then they become available for zone assignment.. To add an interface to an SD-WAN zone, the interface must first be configured as an SD-WAN member under 'config system sdwan' with a gateway. Once the member is defined, it becomes available for selection in an SD-WAN zone. This two-step process ensures that only properly configured WAN links are used in SD-WAN rules.

Answer

You must create a static route for each interface pointing to the SD-WAN zone, which automatically adds the interfaces to the zone.

Answer

You must assign the interfaces to a virtual wire pair before they can be used in an SD-WAN zone.

Answer

You must enable SD-WAN on the FortiGate by running the command 'config system sdwan' and then 'set status enable'.

Question 5

You are configuring a Performance SLA on a FortiGate to monitor the quality of your WAN links. You want to ensure that the SLA probe uses HTTP to check the availability of a critical web application. Which configuration parameter must you set to specify the protocol used for the probe?

Accepted Answer

Protocol. In a Performance SLA configuration, the 'Protocol' parameter determines the type of probe, such as ping, tcp-echo, http, or dns. To use HTTP for checking a web application, you must set the protocol to 'http'. This ensures the SLA generates HTTP requests to the specified server and evaluates the response.

Answer

Server

Answer

Interval

Answer

Probe Type

Question 6

An administrator is configuring an SD-WAN rule to route traffic based on the lowest latency to a critical application. The rule uses the 'lowest latency' strategy and includes two members: 'wan1' and 'wan2'. Both members have Performance SLAs configured. After applying the configuration, the administrator notices that traffic is not being distributed as expected and always uses 'wan1' even when 'wan2' has lower latency. What is the most likely cause?

Accepted Answer

The Performance SLA for 'wan1' and 'wan2' are using different probe servers.. When using the 'lowest latency' strategy, the SD-WAN engine compares latency measurements from Performance SLAs. For a fair comparison, all members in the rule must reference the same SLA probe target. If they use different targets, the latency values are not comparable, and the selection may not reflect the actual lowest latency path.

Answer

The SD-WAN rule is configured with a priority order that overrides the latency-based selection.

Answer

The Performance SLA for 'wan2' is not referenced in the SD-WAN rule.

Answer

The 'lowest latency' strategy requires the latency values to be manually set on each member.

Question 7

You are configuring an SD-WAN rule to route traffic from the 'Finance' department to a critical cloud application. The rule uses the 'lowest-cost (SLA)' strategy. You have two members: wan1 (cost 10) and wan2 (cost 20). Both meet the SLA. You want to ensure that traffic from Finance always uses wan1 unless wan1 fails its SLA. What should you do?

Accepted Answer

Set wan1's cost to 10 and wan2's cost to 20, and ensure both members have an active Performance SLA.. The lowest-cost (SLA) strategy picks the lowest-cost member that satisfies its SLA. With wan1 cost 10 and wan2 cost 20, wan1 is preferred as long as it meets SLA. To make this work, both members must have Performance SLA monitors configured; otherwise, the SLA status is unknown and the strategy may not function as intended. Ensuring both have active SLAs provides the necessary health checks for the strategy to make correct decisions.

Answer

Set wan1's cost to 10 and wan2's cost to 20, and enable 'implicit failback'.

Answer

Set wan1's cost to 10 and wan2's cost to 20, and ensure that wan1's Performance SLA is monitored and wan2's is not.

Answer

Set wan1's cost to 10 and wan2's cost to 20, and configure the rule to use 'priority' strategy instead.

Question 8

An engineer is deploying a new FortiGate SD-WAN solution. The design requires that the WAN interfaces be grouped into an SD-WAN zone so that different rules can reference the zone. The interfaces are already configured with static IP addresses and are passing traffic. According to Fortinet best practice, which step must be completed before adding the interfaces to the SD-WAN zone?

Accepted Answer

Ensure the interfaces are not referenced by any SD-WAN zone and then add them as members of the new SD-WAN zone.. An interface can be a member of only one SD-WAN zone on a FortiGate. Before creating a new zone and adding interfaces, the engineer must confirm that those interfaces are not already assigned to another SD-WAN zone. This check avoids configuration errors and ensures the new zone can be used in SD-WAN rules without conflict.

Answer

Assign each interface to a separate VDOM so that SD-WAN can manage them independently.

Answer

Remove the interfaces from any existing SD-WAN zone and delete all firewall address objects that reference them.

Answer

Convert the interfaces to virtual-wan-link mode using the CLI command set vdom-mode.

Question 9

You are configuring an SD-WAN rule to route traffic based on the lowest latency. You have three members: port1, port2, and port3. You want the rule to select the member with the best latency among those that meet the SLA. Which strategy should you use?

Accepted Answer

Lowest Latency (SLA). The Lowest Latency (SLA) strategy is designed to select the SD-WAN member with the lowest latency among those that meet the SLA. This ensures that latency-sensitive traffic, such as VoIP or video conferencing, takes the best available path. Other strategies like Lowest Cost or Maximize Bandwidth focus on different metrics and would not guarantee the lowest latency.

Answer

Lowest Cost (SLA)

Answer

Best Quality (SLA)

Answer

Maximize Bandwidth (SLA)

Question 10

You are preparing a FortiGate for SD-WAN deployment. The FortiGate has two WAN interfaces, wan1 and wan2, and you want to create an SD-WAN zone named 'virtual-wan-link' that includes both. Which configuration step is required before you can add wan1 and wan2 to the SD-WAN zone?

Accepted Answer

Create an SD-WAN member for each interface and then add them to the zone.. SD-WAN zones in FortiOS aggregate SD-WAN members, not physical interfaces. Before an interface can participate in an SD-WAN zone, it must be defined as an SD-WAN member with its own settings, such as gateway and priority. Only then can it be added to the zone. This structure allows the FortiGate to apply per-member SLA and steering policies while treating the zone as a single logical interface.

Answer

Assign each WAN interface to the SD-WAN zone directly from the interface list.

Answer

Create a virtual switch and add both WAN interfaces to it.

Answer

Enable 'SD-WAN' on each interface under Network > Interfaces.

Question 11

You have configured an SD-WAN rule with the 'Priority' strategy to route VoIP traffic. The rule includes two members: wan1 (priority 1) and wan2 (priority 2). Both members are currently meeting their SLA targets. However, you notice that some VoIP traffic is being routed out wan2 instead of wan1. What is the most likely explanation?

Accepted Answer

wan1 is experiencing an SLA failure, causing traffic to fail over to wan2.. With the Priority strategy, FortiGate selects the highest-priority member that meets the SLA. If wan1 fails to meet the SLA, traffic is automatically routed to wan2, the next highest-priority member. Even if you think both are meeting SLA, a temporary SLA failure or a misconfigured SLA could cause this failover.

Answer

The SD-WAN rule is configured with a load balancing algorithm that distributes traffic across both members.

Answer

The SD-WAN rule is using the 'Best Quality' strategy, which selects wan2 due to better performance.

Answer

The VoIP traffic is matching a different SD-WAN rule that uses wan2.

Question 12

You are deploying a FortiGate SD-WAN hub with two members, wan1 and wan2, and you must ensure that the SD-WAN configuration is deterministic and survives a FortiGate reboot even if the physical link status changes during startup. You want to configure the SD-WAN member interface order and priority manually, and you also want to prevent the SD-WAN from automatically adding interfaces to a zone. Which two configuration actions should you take? (Choose two.)

Accepted Answer

Configure the 'interface-order' value on each SD-WAN member to define the sequence in which members are evaluated.. To make SD-WAN member selection deterministic and independent of physical link status at boot, you must explicitly disable automatic discovery of members and define the evaluation order manually. Auto-discovery, when enabled, can add interfaces to a zone based on dynamic conditions, which breaks determinism. The interface-order setting provides the static sequence that the FortiGate uses for rule matching and failover, ensuring the intended primary path is always preferred after a reboot.

Answer

Enable the 'priority-in-zone' setting on each SD-WAN member and assign a unique priority value.

Answer

Enable 'link-health-check' on the SD-WAN zone and set the probe interval to 1000 ms.

Answer

Set the 'mode' of the SD-WAN interface to 'manual' and add each physical interface as a member with a static gateway.

Question 13

You are setting up a new FortiGate SD-WAN deployment. You have created an SD-WAN zone named 'sdwan-zone' and added two interfaces, port1 and port2. You now need to create an SD-WAN rule to route traffic from the internal network to the internet. Which configuration object must you reference in the SD-WAN rule to specify the destination?

Accepted Answer

A firewall address object representing the destination IP subnet.. SD-WAN rules are configured with source and destination criteria. The destination is defined using a firewall address object, which can represent an IP subnet, FQDN, or other address types. The SD-WAN zone is used as the outgoing interface, not as the destination. Therefore, to specify the destination in an SD-WAN rule, you must reference a firewall address object.

Answer

An SD-WAN zone name representing the destination.

Answer

A virtual WAN link (VWL) interface.

Answer

A policy route with destination defined.

Question 14

A FortiGate at a branch office is being prepared for SD-WAN. The administrator wants to add the physical wan1 and wan2 interfaces as SD-WAN members so they can be referenced by SD-WAN rules. Which step must be completed before wan1 and wan2 can be added to an SD-WAN zone?

Accepted Answer

Create an SD-WAN zone and add the interfaces as members of that zone. FortiGate SD-WAN members live inside SD-WAN zones. To use wan1 and wan2, the administrator first creates an SD-WAN zone (or uses the default virtual-wan-link zone) and adds the interfaces as members. Only then can SD-WAN rules, Performance SLA bindings, and related policy reference those members.

Answer

Assign each WAN interface a static route with the same distance

Answer

Enable asymmetric routing on each WAN interface

Answer

Configure a Performance SLA for each interface before joining a zone

Question 15

A network administrator is configuring a Performance SLA to monitor the quality of two WAN links used for SD-WAN. The SLA must send probes that can measure latency, jitter, and packet loss to a target server. Which protocol should be selected for the Performance SLA probes to meet this requirement?

Accepted Answer

HTTP. To measure latency, jitter, and packet loss, the Performance SLA must use a probe protocol that supports timestamp-based calculations. HTTP probes embed timestamps in the request and response, enabling the FortiGate to derive jitter. ICMP, UDP echo, and TCP echo cannot calculate jitter because they lack the necessary timestamp fields.

Answer

ICMP

Answer

UDP echo

Answer

TCP echo