NSE7_SDW System Configuration And Setup Practice Test 5 — 15 Questions

Question 1

When setting up a Performance SLA, what is the 'Participant' setting?

Accepted Answer

The SD-WAN member that originates the probe.. The Participant setting in a Performance SLA defines which SD-WAN member (interface or link) originates the probe traffic. This determines the source of the health-check probes used to measure latency, jitter, and packet loss for that SLA.

Answer

The monitoring interval.

Answer

The user group assigned to the probe.

Answer

The destination IP address.

Question 2

Which THREE of the following are valid strategies for SD-WAN rules?

Accepted Answer

Priority. In FortiGate SD-WAN, the strategy field of an SD-WAN rule determines how traffic is distributed across the selected members, and the valid strategies include Priority, Maximize Bandwidth (formerly Maximize Bandwidth (SLA)), and SLA Target. Option A (Priority) is correct because it sends traffic through the highest-priority member that is up and meets any configured SLA, falling back to lower-priority members only when the preferred one fails. Option B (Maximize Bandwidth) is correct because it distributes sessions across all eligible members to aggregate their available bandwidth rather than using a single link. Option D (SLA Target) is correct because it selects the member that best satisfies the configured SLA targets (such as latency, jitter, and packet loss) measured by performance SLAs. Option C (Load Balance) is not a valid SD-WAN rule strategy in FortiOS, and Option E (Round Robin) is likewise not an available strategy, since session-based distribution is handled by Maximize Bandwidth instead.

Answer

Load Balance

Answer

Round Robin

Question 3

Which THREE of the following are benefits of using SD-WAN?

Accepted Answer

Simplified WAN management through zones.. Option B is correct because SD-WAN controllers abstract WAN transport links into logical zones (e.g., VPN zones, service zones), letting administrators apply consistent policy and routing across many sites from a single management plane instead of configuring each device individually. Option C is correct because SD-WAN continuously monitors link health (via BFD, IP SLA, or similar probes) and automatically reroutes traffic to a backup WAN link—LTE, broadband, or MPLS—when the primary link degrades or fails, without manual intervention. Option E is correct because SD-WAN's application-aware routing engine classifies traffic by application and steers it over the path with the best measured performance (latency, jitter, packet loss), enforcing policies such as sending VoIP over the lowest-latency link. Option A does not belong because SD-WAN is a software overlay/control technology and does not provide or install physical layer cabling. Option D does not belong because automatic hardware replacement is a vendor support/logistics function, not a capability of the SD-WAN software itself.

Answer

Built-in physical layer cabling.

Answer

Automatic hardware replacement.

Question 4

Which TWO of the following steps are required to correctly configure a Performance SLA?

Accepted Answer

Select the probe protocol.. Option C is correct because a Performance SLA health check must specify the probe protocol (e.g., Ping, HTTP, TCP-echo, or UDP-echo) so FortiGate knows how to generate and evaluate the probe traffic. Option D is correct because the SLA requires a destination IP address (the server or target being monitored) to which the probes are sent and against which latency, jitter, and packet loss are measured. Option A is not required, since the probe destination is defined directly in the SLA configuration rather than through a firewall address object. Option B is not required, as BGP is unrelated to Performance SLA probing and is only needed for dynamic routing. Option E is not required, because an SLA probe is bound to a specific outgoing interface or link, not to a VPN tunnel.

Answer

Configure a firewall address object for the probe.

Answer

Enable BGP on the interface.

Answer

Assign the probe to a VPN tunnel.

Question 5

Which TWO of the following can be used as a 'Source' in an SD-WAN rule?

Accepted Answer

Source IP address object.. In an SD-WAN rule, the Source field matches traffic by the origin of the flow, and a Source IP address object (Option A) is a valid match criterion because SD-WAN rules can select traffic based on source address objects defined in the firewall address book. A User group (Option E) is also valid as a Source, since FortiGate SD-WAN rules can match traffic by authenticated user or user group identity, allowing policy-based steering per user population. SLA target name (Option B) is not a source match; it is a performance SLA object referenced in the rule's outgoing interface/strategy configuration to measure link health. Interface MAC address (Option C) is not a supported Source match criterion in SD-WAN rules, and Firewall policy ID (Option D) is not a source selector either, as policy IDs identify firewall policies rather than traffic origin.

Answer

SLA target name.

Answer

Interface MAC address.

Answer

Firewall policy ID.

Question 6

Which THREE of the following are parameters that can be monitored in a Performance SLA?

Accepted Answer

Packet Loss. In a Performance SLA (as used by SD-WAN/performance-monitoring features such as Fortinet's Performance SLA), the monitored parameters are the network-quality metrics measured by probes: Packet Loss (A), Jitter (C), and Latency (E). Packet Loss (A) is correct because the SLA tracks the percentage of probe packets that never arrive, which directly reflects link reliability. Jitter (C) is correct because it measures the variation in delay between probe packets, a key indicator of voice/video quality. Latency (E) is correct because it measures the round-trip or one-way delay of the probe traffic, the primary SLA threshold metric. CPU load (B) and Disk usage (D) are not part of a Performance SLA; they are system-resource metrics monitored by device health/SNMP or resource-usage tools, not by the SLA probe mechanism.

Answer

CPU load

Answer

Disk usage

Question 7

Which THREE of the following criteria are used for SD-WAN rule traffic matching?

Accepted Answer

Destination address. In FortiGate SD-WAN rules, traffic is matched using criteria such as destination address (B), application/service (D), and source address (E), which are all standard SD-WAN rule match fields used to steer traffic to the appropriate member link. Destination address (B) is correct because SD-WAN rules can match on the destination IP/subnet to route specific traffic. Application/Service (D) is correct because SD-WAN rules commonly match on application signatures or service objects to steer application traffic. Source address (E) is correct because SD-WAN rules can match on the source IP/subnet to differentiate traffic from specific hosts or networks. Interface speed (A) is not a match criterion; it is a link attribute used for SLA/load-balancing decisions, not traffic matching. VLAN priority (C) is not a standard SD-WAN rule match criterion; QoS/priority handling is separate from SD-WAN traffic matching.

Answer

Interface speed

Answer

VLAN priority

Question 8

Which TWO of the following can cause an SD-WAN member to be marked as 'down' in an SLA?

Accepted Answer

The probe times out.. Option A is correct because an SD-WAN SLA probe (such as a bidirectional forwarding detection or performance-monitoring probe) that times out means the member stops receiving replies, so the health check fails and the member is marked down. Option C is correct because SLA criteria include packet-loss thresholds; when measured loss on the member exceeds the configured threshold, the SLA is violated and the member is marked down. Option B is not correct because a system clock update affects timestamps and logging but does not itself fail an SLA probe. Option D is not correct because disabling a firewall policy changes traffic handling, not the SLA health-check result for the member. Option E is not correct because changing an interface IP address is a configuration change that may disrupt connectivity, but it is not the SLA condition that directly marks the member down.

Answer

The system clock is updated.

Answer

The firewall policy is disabled.

Answer

The interface IP address is changed.

Question 9

What is the impact of checking the 'Interface Preference' box in an SD-WAN rule?

Accepted Answer

It overrides the SLA strategy selection.. In Fortinet SD-WAN, the 'Interface Preference' option in an SD-WAN rule forces traffic to use a specific preferred interface (or set of interfaces) regardless of what the SLA strategy would otherwise select. This effectively overrides the SLA-based path selection, ensuring the rule's traffic egresses through the chosen member(s) even if another member has better SLA scores. It is used when business policy requires a specific WAN link for certain applications.

Answer

It enables failover to the default gateway.

Answer

It enables load balancing across interfaces.

Answer

It increases the probe frequency.

Question 10

You are configuring an SD-WAN rule to load-balance traffic across three WAN links. You want to ensure that the rule uses all available links while respecting the SLA status of each member. Which strategy should you select?

Accepted Answer

Maximize Bandwidth (SLA). Maximize Bandwidth (SLA) is designed to load-balance traffic across all SD-WAN members that satisfy the SLA, effectively combining their bandwidth. The other strategies either select a single best or cheapest link, or use a priority order, none of which distribute traffic across all links. Thus, only Maximize Bandwidth (SLA) fulfills the requirement.

Answer

Priority

Answer

Best Quality

Answer

Lowest Cost (SLA)

Question 11

A network engineer is deploying a new SD-WAN on a FortiGate. The design requires a single overlay tunnel that carries multiple VLANs between the branch and the hub, and each VLAN must be mapped to its own SD-WAN zone so that different SD-WAN rules can steer traffic per VLAN. Which configuration element must the engineer create on the overlay interface to support this design?

Accepted Answer

A VLAN sub-interface on the IPsec tunnel interface, assigned to a dedicated SD-WAN zone.. The requirement is one overlay carrying multiple VLANs, each in a separate SD-WAN zone. The only option that directly produces per-VLAN SD-WAN zones on the tunnel is creating VLAN sub-interfaces on the IPsec tunnel interface and assigning each to its own zone. Other options either create separate tunnels or fail to provide VLAN-level zone separation.

Answer

A second IPsec phase 1 with the same remote gateway but a different preshared key.

Answer

An SD-WAN zone that contains the physical WAN interfaces and the tunnel interface together.

Answer

A VXLAN interface bound to the IPsec tunnel interface, with one VNI per VLAN.

Question 12

An engineer is configuring an SD-WAN member on a FortiGate to use a static gateway that differs from the interface's detected next-hop. Which CLI configuration correctly applies this override?

Accepted Answer

config system sdwan / config members / edit 1 / set gateway 203.0.113.1. The SD-WAN member gateway setting under config system sdwan members is the designated override for the detected next-hop. It applies to both health-check probing and traffic forwarding decisions for that member. Configuring it elsewhere, such as on the interface or in a static route, does not change the SD-WAN member's gateway and will not produce the intended behavior.

Answer

config system interface / edit wan1 / set gateway 203.0.113.1

Answer

config router static / edit 0 / set gateway 203.0.113.1 / set interface wan1

Answer

config system sdwan / config health-check / edit "ping" / set gateway 203.0.113.1

Question 13

An administrator is validating a new SD-WAN deployment before going live. The design requires that the FortiGate detect link degradation before users notice it and that failover decisions be based on measured path quality rather than physical link state. Which two configuration elements are required to meet these goals? (Choose two.)

Accepted Answer

A Performance SLA attached to the SD-WAN members, with latency, jitter, and packet-loss thresholds configured.. Proactive, quality-based failover requires two things working together: a Performance SLA that measures latency, jitter, and packet loss per member, and an SD-WAN rule that references those members and reacts to the SLA state. The SLA supplies the health signal, and the rule acts on it. Static routes, dead peer detection, and interface role labels do not provide quality measurement or trigger path changes based on degradation.

Answer

Dead peer detection enabled on each IPsec tunnel member.

Answer

Interface role set to WAN on every member interface.

Answer

A static route for each member pointing to its gateway, with equal distance values.

Question 14

A network administrator is adding a new WAN interface to an existing SD-WAN deployment. The interface is currently not referenced by any SD-WAN zone. What is the required first step before the interface can be used as an SD-WAN member?

Accepted Answer

Assign the interface to an SD-WAN zone.. SD-WAN members are defined within SD-WAN zones. Before an interface can be configured as a member, it must be placed into a zone. This zone construct allows multiple interfaces to share the same steering and health-check logic. Only after zone assignment can the member be created and referenced by SD-WAN rules.

Answer

Add the interface to a virtual wire pair.

Answer

Enable DHCP client on the interface.

Answer

Create a static route pointing to the interface.

Question 15

You are configuring an SD-WAN rule that must load-balance traffic across two WAN links while guaranteeing that both links meet a 100 ms latency SLA. Which strategy should you select for the rule?

Accepted Answer

SLA. The SLA strategy is the only one that both filters members by the referenced Performance SLA and spreads sessions over all qualifying members. Lowest Cost (SLA), Maximum Bandwidth (SLA), and Best Quality all pick a single preferred member, so they fail the load-balancing half of the requirement. Only the SLA strategy keeps both links in use while each meets the 100 ms latency threshold.

Answer

Maximum Bandwidth (SLA)

Answer

Best Quality

Answer

Lowest Cost (SLA)