NSE7_SDW System Configuration And Setup Practice Test 3 — 15 Questions

Question 1

You have configured an SD-WAN rule that uses the 'Manual' strategy with port1 as the preferred member and port2 as standby. You notice that traffic is not failing over to port2 when port1 becomes unavailable. What could be the reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Performance SLA is not configured or is not associated with the members.. The most likely reason is that the Performance SLA is either not configured or not associated with the SD-WAN members. Without an SLA, the FortiGate cannot detect that port1 is down, so it continues to use it even if it is unavailable. The Manual strategy requires SLA monitoring to trigger failover to the standby member. Other options are either incorrect or not the primary cause.

Answer

Port2 is configured with a higher priority than port1.

Answer

The 'Manual' strategy does not support failover.

Answer

The SD-WAN rule is disabled.

Question 2

You are configuring a Performance SLA to monitor the quality of a WAN link for SD-WAN. The SLA will use UDP probes to a remote server. You want the SLA to mark the link as failed if packet loss exceeds 5% or if jitter exceeds 30 ms. You configure the SLA with the appropriate thresholds. However, after applying the configuration, you notice that the link is never marked as failed even when packet loss is high. What is the most likely reason?

Accepted Answer

The SLA's 'Packet Loss' threshold is configured as a percentage, but the FortiGate expects a decimal value (e.g., 0.05 for 5%), so entering '5' sets the threshold to 500%.. The most likely reason the link is never marked as failed despite high packet loss is that the packet loss threshold is misconfigured. If the threshold is set to a value that is effectively higher than 100% (e.g., 500% due to decimal misinterpretation), the link will never exceed it. Always verify that the threshold is entered in the correct format as expected by the FortiGate.

Answer

The SLA is not assigned to the SD-WAN member, so the FortiGate is not monitoring that link.

Answer

The SLA probe interval is set too high, so the FortiGate does not send probes frequently enough to detect the loss.

Answer

The SLA is configured with a 'Failures before inactive' value that is too low, causing the link to be marked as failed prematurely, but the SD-WAN rule is not using the SLA.

Question 3

You are configuring an SD-WAN member on a FortiGate. The member uses a WAN interface that is also used for other services. You need to ensure that the SD-WAN member can monitor link health and that the FortiGate can correctly forward traffic out of the member. (Choose two.)

Accepted Answer

Specify the gateway IP address for the member.. For an SD-WAN member to forward traffic and monitor health, it must have a gateway IP address so the FortiGate knows the next-hop, and it must have detection enabled with a Performance SLA to evaluate link quality. These two settings are fundamental for member operation and dynamic steering. Other settings like cost or zone assignment, while important for policies, do not directly enable monitoring or forwarding.

Answer

Set the member's cost to 0 to ensure it is always preferred.

Answer

Assign the member to an SD-WAN zone.

Answer

Configure a static route to the Performance SLA server.

Question 4

You are setting up a new SD-WAN deployment on a FortiGate. You want to ensure that the SD-WAN configuration is applied to traffic from a specific VLAN. Which step must you take to include the VLAN interface in the SD-WAN configuration?

Accepted Answer

Create an SD-WAN rule that matches the VLAN interface as the source.. To include traffic from a VLAN in SD-WAN, you create an SD-WAN rule that matches the VLAN interface as the source. The rule then selects an SD-WAN member based on the configured strategy. VLAN interfaces are not SD-WAN members and cannot be added to SD-WAN zones; they are matched in rules as internal sources.

Answer

Assign the VLAN interface to the SD-WAN zone.

Answer

Add the VLAN interface as an SD-WAN member.

Answer

Enable 'SD-WAN' on the VLAN interface under Network > Interfaces.

Question 5

You are deploying a new FortiGate SD-WAN solution at a site with two internet links: wan1 (static IP) and wan2 (DHCP). You want to add both interfaces to an SD-WAN zone named 'virtual-wan-link'. You have already created the zone in the GUI. Which step must you complete before the interfaces can be added to the zone?

Accepted Answer

Ensure that each interface is not referenced by any other SD-WAN zone or virtual-wan-link configuration.. Before adding an interface to an SD-WAN zone, you must ensure that the interface is not already a member of another SD-WAN zone or virtual-wan-link. FortiOS does not allow an interface to belong to multiple SD-WAN zones simultaneously. Once the interface is free of other zone memberships, you can add it to the desired zone. Other settings such as IP addresses or gateways are configured independently and do not block zone membership.

Answer

Configure each interface as a member of the SD-WAN zone by enabling 'sdwan' on the interface.

Answer

Remove any existing IP address and administrative access settings from the interfaces.

Answer

Assign a unique gateway IP address to each interface in the SD-WAN member settings.

Question 6

An administrator is setting up a new SD-WAN deployment on a FortiGate running FortiOS 7.4. The ISP provides a single physical WAN link, but the administrator needs to run separate SD-WAN rules for voice and guest traffic. Which FortiGate configuration object must be created BEFORE the physical interface can be referenced in an SD-WAN rule?

Accepted Answer

An SD-WAN zone that contains the physical interface as a member.. In FortiOS 7.x, SD-WAN rules are configured against SD-WAN zones, not individual physical interfaces. The zone acts as a logical grouping of one or more WAN links. Before a rule can be created, the administrator must define an SD-WAN zone and add the physical interface as a member. This design allows multiple rules to share the same physical link while applying different strategies and SLA targets.

Answer

A policy route that directs traffic to the physical interface.

Answer

A virtual WAN link (VWL) interface bound to the physical interface.

Answer

A link health monitor (Performance SLA) attached to the physical interface.

Question 7

An administrator is configuring a Performance SLA on a FortiGate to monitor the health of SD-WAN members. The SLA will be used to trigger failover when thresholds are breached. Which two parameters must be configured in the Performance SLA to define the health check? (Choose two.)

Accepted Answer

Server or target IP address/FQDN. A Performance SLA requires a probe protocol and a target server to perform health checks. The protocol determines the packet type, and the target specifies the destination. Threshold values are used to evaluate the results but are not part of the fundamental definition of the health check. Zone names and policy IDs are not configured within the Performance SLA.

Answer

SLA threshold values (latency, jitter, packet loss)

Answer

SD-WAN zone name

Answer

Firewall policy ID

Question 8

A FortiGate is configured with an SD-WAN rule that uses the 'Lowest Cost (SLA)' strategy. The rule includes two members: wan1 (cost 10) and wan2 (cost 20). Both members meet the SLA. However, the administrator observes that all matching traffic is being sent out wan2. What is the most likely reason for this behavior?

Accepted Answer

wan2 has a lower cost value than wan1 in the SD-WAN member configuration.. The 'Lowest Cost (SLA)' strategy chooses the member with the lowest configured cost among those that satisfy the SLA. If both members meet the SLA but traffic goes to the higher-cost member, the most likely explanation is that the cost values are reversed. The administrator should verify the cost settings in the SD-WAN member configuration for wan1 and wan2.

Answer

The SD-WAN rule's priority setting is overriding the cost-based selection, forcing traffic to wan2.

Answer

The Performance SLA attached to wan1 is failing, causing wan1 to be excluded from selection.

Answer

The 'Lowest Cost (SLA)' strategy selects the member with the lowest cost only when costs are equal; otherwise it uses the first member in the list.

Question 9

You are configuring an SD-WAN rule to steer traffic based on application signatures. You want to ensure that the rule matches traffic for Microsoft 365 and selects the best link based on performance. Which configuration step is necessary to enable application-based matching in the SD-WAN rule?

Accepted Answer

Configure an application signature list in the SD-WAN rule's match criteria.. SD-WAN rules have built-in support for matching applications by name or category. To steer Microsoft 365 traffic, you simply select the application in the rule's match criteria. This uses the FortiGuard application signature database. Security profiles like Application Control or Deep Inspection are not required for this matching and serve different purposes.

Answer

Create a custom application signature and apply it to the SD-WAN zone.

Answer

Enable 'Deep Inspection' in the firewall policy to identify applications.

Answer

Enable 'Application Control' in the firewall policy that references the SD-WAN zone.

Question 10

You are configuring a new SD-WAN Performance SLA to monitor the quality of a WAN link. You want the SLA to send probes to a public DNS server at 8.8.8.8 and measure round-trip time. Which protocol should you select for the Performance SLA probes to achieve this with minimal overhead?

Accepted Answer

ICMP. For minimal-overhead round-trip time measurement to a public DNS server, ICMP is the best choice. It is lightweight, widely supported, and does not require any application-layer handshake. The FortiGate can send ICMP echo requests and derive latency, jitter, and packet loss from the replies. Other protocols like HTTP or TCP add unnecessary overhead and may require specific server configurations.

Answer

TCP

Answer

UDP

Answer

HTTP

Question 11

A FortiGate is configured as an SD-WAN hub with two overlay members, one using IPsec and one using ADVPN. An administrator wants SD-WAN to automatically prefer the ADVPN shortcut for branch-to-branch traffic, but the shortcut path is not being selected. Which SD-WAN member setting must be enabled to allow the shortcut to be considered as a valid egress path?

Accepted Answer

Enable 'shortcut' on the ADVPN member.. For SD-WAN to consider ADVPN shortcuts as valid egress paths, the ADVPN member must have the 'shortcut' option enabled. This setting allows dynamic shortcut tunnels to be included in SD-WAN path selection and SLA monitoring, enabling branch-to-branch traffic to use the optimized shortcut instead of traversing the hub.

Answer

Enable 'auto-asic-offload' on the ADVPN member.

Answer

Set the ADVPN member's 'role' to 'primary'.

Answer

Enable 'auto-discovery' on the ADVPN member.

Question 12

An administrator is configuring an SD-WAN zone with three members: two wired WAN links and one LTE backup. The LTE member is expensive per gigabyte, so it must only be used when both wired links fail. Which SD-WAN rule configuration achieves this requirement with the least manual intervention?

Accepted Answer

Create a rule with strategy 'best-quality' and configure the LTE member as a standby member in the SD-WAN zone.. Configuring the LTE member as a standby in the SD-WAN zone ensures it is not used unless all active members fail. Combined with the best-quality strategy, which relies on performance SLA results, the rule automatically selects the best healthy active member and falls back to standby only when necessary, meeting the cost requirement without manual intervention.

Answer

Create a rule with strategy 'manual' and order members with wired links first, LTE last.

Answer

Create a rule with strategy 'lowest-cost (SLA)' and assign cost values to each member.

Answer

Create a rule with strategy 'lowest-latency' and enable 'priority' on the wired members.

Question 13

An administrator is configuring SD-WAN on a FortiGate and needs to define the members of an SD-WAN zone. Which two interface types can be added as SD-WAN members? (Choose two.)

Accepted Answer

VLAN subinterfaces. Physical WAN interfaces and VLAN subinterfaces are both valid SD-WAN members. Physical interfaces provide direct WAN connectivity, while VLAN subinterfaces allow logical separation over a single physical link. Both can be monitored by performance SLAs and selected by SD-WAN rules.

Answer

IPsec tunnel interfaces

Answer

SSL VPN tunnel interfaces

Answer

Loopback interfaces

Question 14

You have an SD-WAN rule with 'Priority' strategy. What happens if the highest priority member fails its SLA?

Accepted Answer

Traffic fails over to the member with the next highest priority value.. In an SD-WAN rule using the Priority strategy, members are ranked by priority value (lower number = higher priority). If the highest-priority member fails its SLA, FortiOS fails over to the next highest-priority member that is still SLA-compliant, preserving service continuity.

Answer

Traffic is dropped.

Answer

The FortiGate enters an error state.

Answer

Traffic is load balanced across all remaining members.

Question 15

You are configuring a Performance SLA to monitor reachability to a SaaS application. Which parameter determines the threshold for an interface to be considered 'unhealthy' in the SD-WAN routing table?

Accepted Answer

Packet Loss Threshold. The Packet Loss Threshold is one of the SLA criteria (along with latency and jitter) that determines when a member is marked unhealthy in the SD-WAN routing table. When the measured packet loss exceeds the configured threshold, the Performance SLA marks that member as out-of-SLA, and SD-WAN rules that require SLA compliance will stop selecting it. This is the parameter that directly defines the 'unhealthy' boundary for loss-based SLA evaluation.

Answer

Probe Mode

Answer

Sequence Number

Answer

Update Interval