NSE7_SDW System Configuration And Setup Practice Test 4 — 15 Questions

Question 1

An SD-WAN rule is configured with 'Lowest Cost (SLA)' strategy. If all members in the SLA meet the requirements, how does the FortiGate select the outgoing interface?

Accepted Answer

The member with the lowest interface cost value defined in the SD-WAN member configuration.. With the 'Lowest Cost (SLA)' strategy, FortiGate first filters members that meet the SLA targets, then among those selects the member with the lowest configured cost value in the SD-WAN member configuration. Cost is a numeric value (default 0) that admins set per member to express preference — lower cost means preferred. So if all members meet SLA, the one with the lowest cost wins.

Answer

Round Robin

Answer

The interface with the highest bandwidth.

Answer

The interface that was most recently added to the zone.

Question 2

When using SD-WAN zones, what is the primary benefit of grouping multiple physical interfaces into a single zone?

Accepted Answer

It allows you to apply a single firewall policy to the entire group.. SD-WAN zones allow multiple physical interfaces to be grouped and referenced as a single logical interface in firewall policies and SD-WAN rules. The primary benefit is that a single firewall policy can be applied to the entire group, simplifying configuration and ensuring consistent security and routing treatment across all member links. This reduces policy sprawl and administrative overhead.

Answer

It increases the throughput of individual physical links.

Answer

It prevents the need for performance SLAs.

Answer

It automatically enables load balancing between interfaces.

Question 3

When configuring an SD-WAN rule, what is the purpose of the 'Source' address field?

Accepted Answer

To match traffic based on the source IP or user.. In an SD-WAN rule, the Source field is a match condition that identifies traffic by source IP address, source user (via FSSO or LDAP), or source address group. It does not control routing or egress; it simply narrows which traffic the rule applies to, alongside destination, application, and service matches.

Answer

To define the gateway IP for the route.

Answer

To force traffic to a specific SD-WAN zone.

Answer

To determine which ISP the traffic exits through regardless of SLA.

Question 4

Which SD-WAN rule strategy should you choose if you want to distribute traffic across multiple interfaces based on their bandwidth weights?

Accepted Answer

Maximize Bandwidth (SLA). The Maximize Bandwidth (SLA) strategy distributes traffic across multiple eligible members proportionally to their configured bandwidth weights, provided the members meet the SLA targets. This is the only strategy that uses weight-based load distribution across interfaces. Manual, Lowest Cost, and SLA Target strategies select members based on fixed priority, cost, or SLA compliance rather than bandwidth weighting.

Answer

Manual

Answer

Lowest Cost (SLA)

Answer

SLA Target

Question 5

You are deploying a new SD-WAN interface. What is the mandatory step before you can add an interface to an SD-WAN zone?

Accepted Answer

Remove all firewall policy, static route, and DHCP references from the interface.. Before an interface can be added to an SD-WAN zone, it must be free of references from firewall policies, static routes, and DHCP server configurations. FortiOS enforces this because SD-WAN zones take over the routing and policy handling for member interfaces, and conflicting references would create ambiguous or broken behavior. Removing these references is therefore the mandatory prerequisite step.

Answer

Configure a performance SLA for that specific interface.

Answer

Assign a VLAN ID to the interface.

Answer

Enable SD-WAN on the global system settings.

Question 6

Which command is used to verify the current status of SD-WAN members and their SLA health from the CLI?

Accepted Answer

diagnose sys sdwan health-check. On FortiGate SD-WAN, the health of each member link and its SLA probes is inspected with 'diagnose sys sdwan health-check', which shows per-SLA state (up/down), latency, jitter, and packet loss for each member. This is the canonical CLI command for verifying that SLA-based steering decisions are being made on accurate telemetry.

Answer

show router info bgp

Answer

get system interface

Answer

get system sdwan member

Question 7

Where do you configure the 'Gateway' IP address for an SD-WAN member?

Accepted Answer

Under Network > SD-WAN > SD-WAN Members.. The Gateway IP address for an SD-WAN member is configured in the member's settings under Network > SD-WAN > SD-WAN Members. This gateway is the next-hop IP address used for health checks and for forwarding traffic over that member, and it is specific to the SD-WAN member configuration rather than the interface or static route table.

Answer

Under Firewall Policy.

Answer

Under Network > Static Routes.

Answer

Under System > Interfaces.

Question 8

What is the effect of changing the 'Hold-down' timer in a Performance SLA?

Accepted Answer

It prevents route flapping by delaying the transition back to an 'up' state.. The Hold-down timer in a Performance SLA defines how long the SLA must remain in a healthy state before FortiOS marks it as 'up' again after a failure. This delay prevents rapid up/down flapping of the SLA state, which would otherwise cause routes to oscillate between members.

Answer

It changes the frequency of the probes.

Answer

It sets the maximum number of failed probes allowed.

Answer

It determines the timeout duration for a single probe.

Question 9

What is the purpose of the 'Inbound' interface setting in an SD-WAN rule?

Accepted Answer

To restrict the rule to traffic originating from a specific interface.. The 'Inbound' interface setting in an SD-WAN rule restricts the rule to traffic that originates from (ingresses) a specific interface. It is used to scope the rule so that only traffic entering via that interface is matched, which is useful when the same destination is reachable from multiple ingress points. It does not define the egress interface or gateway — those are determined by the SD-WAN member selection.

Answer

To enable reverse path forwarding checks.

Answer

To define the WAN gateway.

Answer

To specify the egress interface.

Question 10

You are troubleshooting an issue where traffic is not using an SD-WAN rule despite meeting criteria. What is the most likely cause?

Accepted Answer

A higher-priority SD-WAN rule is matching the traffic first.. SD-WAN rules are evaluated top-down in the rule list, and the first rule whose match criteria (source, destination, application, user, etc.) are satisfied wins. If a higher-priority rule matches the same traffic, the intended rule is never reached, so the traffic is steered by the earlier rule instead. This is the most common cause of 'rule not being used' symptoms in production.

Answer

The SD-WAN rule is disabled.

Answer

The Performance SLA has timed out.

Answer

The interface is not in an SD-WAN zone.

Question 11

What is the default behavior when all SD-WAN members in a rule fail their SLA?

Accepted Answer

The traffic uses all members.. By default, when all SD-WAN members in a rule fail their SLA, FortiOS falls back to using all members in the rule rather than dropping traffic. This 'best effort' behaviour ensures connectivity is maintained even when no member meets the SLA thresholds.

Answer

The traffic is routed to the management interface.

Answer

The rule becomes inactive.

Answer

The traffic is dropped.

Question 12

Where are SD-WAN zones managed in the FortiGate GUI?

Accepted Answer

Network > SD-WAN > SD-WAN Zones.. In FortiGate's GUI, SD-WAN zones are configured under Network > SD-WAN > SD-WAN Zones. This is where administrators create and manage the logical zones that group SD-WAN member interfaces for policy and steering decisions. The SD-WAN Zones page is distinct from the general interface and zone configuration pages.

Answer

Interface > Physical Interfaces.

Answer

System > Network > Zones.

Answer

Firewall > Policy > Objects.

Question 13

When configuring an SD-WAN rule for a specific application, how does the FortiGate identify the traffic?

Accepted Answer

By using the Application Control database.. FortiOS SD-WAN rules identify application traffic by referencing the Application Control database, which classifies traffic based on signatures and behavioral analysis. This allows the rule to match specific applications (e.g., Microsoft 365, Zoom) and apply the appropriate path selection.

Answer

By analyzing the packet payload size.

Answer

By looking at the source MAC address.

Answer

By forcing traffic through a specific VLAN.

Question 14

You need to ensure that VoIP traffic stays on the interface with the lowest jitter. Which strategy should you use?

Accepted Answer

SLA Target. The SLA Target strategy in an SD-WAN rule selects the member link that best meets the configured SLA target for the specified metric — in this case, lowest jitter. By defining a Performance SLA with a jitter threshold and using SLA Target as the strategy, the FortiGate steers VoIP traffic to the interface with the lowest jitter that satisfies the SLA. This is the correct approach for latency/jitter-sensitive applications like VoIP.

Answer

Load Balance

Answer

Lowest Cost (SLA)

Answer

Manual

Question 15

What is the purpose of the 'Gateway' override in an SD-WAN member configuration?

Accepted Answer

To specify a manual gateway for the SD-WAN member.. The Gateway override in an SD-WAN member configuration lets the administrator manually specify the next-hop gateway IP for that member interface, overriding the gateway learned via DHCP or the interface's default. This is used when the SD-WAN member's traffic must be sent to a specific next-hop — for example, when the ISP provides a gateway that differs from the DHCP-assigned one, or when the interface is in a non-standard topology. It does not change which ISP is used or bypass policies; it only pins the next-hop.

Answer

To force the use of a secondary ISP.

Answer

To bypass the firewall policy.

Answer

To enable load balancing.