NSE7_SDW System Configuration And Setup Practice Test 6 — 15 Questions

Question 1

An engineer needs to configure an SD-WAN rule that sends traffic out the member with the lowest latency for a specific application, but also wants the rule to automatically fail over to the next-best member if the primary member's latency exceeds a threshold. Which SD-WAN strategy and configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the lowest-latency strategy and enable the performance SLA on the members.. The lowest-latency strategy is the only one that actively measures latency and selects the member with the best value. When combined with a performance SLA that defines a latency threshold, the member is marked out of SLA if the threshold is exceeded, triggering failover to the next-best member. This provides both optimal path selection and automatic failover.

Answer

Use the manual strategy and specify a preferred member order.

Answer

Use the priority strategy and assign priorities to members.

Answer

Use the volume-based strategy and set a maximum bandwidth threshold.

Question 2

A network administrator is setting up an SD-WAN rule to steer traffic to a SaaS application. The rule uses a performance SLA that monitors the SaaS application's IP address. The administrator wants the SD-WAN rule to prefer the member with the lowest latency. Which SD-WAN rule strategy should be selected?

Accepted Answer

Lowest Latency (SLA). The Lowest Latency (SLA) strategy is designed to pick the member with the lowest latency that also meets the SLA. It directly aligns with the goal of preferring the lowest latency path for the SaaS application. Other strategies consider cost, bandwidth, or a composite quality score, which do not guarantee the lowest latency.

Answer

Best Quality (SLA)

Answer

Maximize Bandwidth (SLA)

Answer

Lowest Cost (SLA)

Question 3

You are deploying an SD-WAN rule that must prioritize VoIP traffic over the best available link based on real-time performance. You have configured a Performance SLA with strict latency and jitter thresholds. Which SD-WAN rule strategy ensures that VoIP traffic uses the link with the lowest jitter that meets the SLA?

Accepted Answer

Best Quality. Best Quality is the only strategy that actively selects the member with the best measured quality, including jitter. It continuously evaluates the SLA metrics and chooses the optimal link for real-time traffic like VoIP. The other strategies either prioritize cost, load-balancing, or static priority, none of which guarantee the lowest jitter link. Therefore, Best Quality is correct.

Answer

Maximize Bandwidth (SLA)

Answer

Lowest Cost (SLA)

Answer

Priority

Question 4

You are configuring an SD-WAN rule to route traffic to a critical SaaS application. You want the rule to select the best link based on multiple performance metrics: latency, jitter, and packet loss. You have created a Performance SLA that monitors these metrics. Which SD-WAN rule strategy should you use to achieve this?

Accepted Answer

Best Quality. The Best Quality strategy is designed to select the SD-WAN member that offers the best performance according to the SLA metrics. It continuously monitors latency, jitter, and packet loss, and dynamically chooses the link with the highest quality. This ensures that critical traffic always uses the optimal path, improving user experience.

Answer

Manual

Answer

Load Balance

Answer

Priority

Question 5

You are adding a new physical interface to an existing SD-WAN deployment. Which step must be completed before the interface can be referenced by an SD-WAN rule?

Accepted Answer

Assign the interface to an SD-WAN zone.. SD-WAN rules match on zones, so an interface must first be assigned to an SD-WAN zone before it can be selected by any rule. Static routes, management designation, and virtual wire pairing do not confer rule eligibility. Zone membership is the mandatory prerequisite in the configuration workflow.

Answer

Enable the interface as a dedicated management port.

Answer

Create a static route that points to the interface.

Answer

Bind the interface to a virtual wire pair.

Question 6

You are deploying a new SD-WAN topology and must ensure that SD-WAN rules can distinguish business-critical traffic from bulk traffic. Which two rule match conditions can you configure to classify traffic for this purpose? (Choose two.)

Accepted Answer

Internet service database entry, such as a specific cloud service.. Application category and internet service database entries are both supported match conditions that identify traffic by what it is, enabling rules to treat business-critical flows differently from bulk flows. Physical link attributes, route administrative distance, and probe interval describe infrastructure or health-check behaviour and cannot classify traffic. Only the two traffic-identification conditions satisfy the requirement.

Answer

The administrative distance of the static route covering the destination.

Answer

The Performance SLA probe interval configured on the member.

Answer

Interface duplex and speed settings of the egress member.

Question 7

A network engineer is adding a new WAN link to an existing SD-WAN deployment on a FortiGate. The physical interface 'wan3' has been configured with an IP address and is up, but it does not appear in the list of available interfaces when the engineer tries to add it to an SD-WAN zone. Which action should the engineer take to resolve this?

Accepted Answer

Set the interface role to 'WAN' in the interface configuration.. For a physical interface to be available as an SD-WAN member, it must have its role set to 'WAN' in the interface configuration. This is a mandatory prerequisite in FortiOS. Once the role is set, the interface becomes selectable when adding members to an SD-WAN zone.

Answer

Assign the interface to a virtual WAN link (vwan) before adding it to the SD-WAN zone.

Answer

Ensure the interface is not used by any firewall policy.

Answer

Enable 'sdwan' on the interface under Network > Interfaces.

Question 8

A Performance SLA bound to an SD-WAN zone is configured with a 200 ms latency threshold and a 5% packet-loss threshold. A member reports 180 ms latency but 8% packet loss. What is the member's SLA state, and how does it affect rule selection?

Accepted Answer

The member is considered out of SLA because packet loss exceeds the threshold, so rules exclude it from selection.. Performance SLA health requires every configured threshold to be met, so exceeding the packet-loss limit alone marks the member out of SLA even though latency is acceptable. Rules referencing that SLA then skip the member, steering traffic to healthier links. The member is not merely warned, and both thresholds do not need to fail together.

Answer

The member is considered in SLA because latency is within threshold, so it remains eligible for rules.

Answer

The member is in SLA but is flagged with a warning that only affects logging, not rule selection.

Answer

The member is out of SLA only if latency and packet loss both exceed their thresholds simultaneously.

Question 9

A network engineer is adding a new physical interface to an existing SD-WAN zone on a FortiGate. The interface is currently used for management access. Which prerequisite must be met before the interface can be added to the SD-WAN zone?

Accepted Answer

The interface must have an IP address and be administratively up.. Before an interface can be added to an SD-WAN zone, it must have an IP address and be administratively up. These are fundamental requirements for the interface to function as an SD-WAN member. Other options describe global settings or optional features that are not prerequisites for zone membership.

Answer

The interface must have a performance SLA bound to it.

Answer

The interface must be assigned to a VDOM in NAT mode.

Answer

The interface must be part of a redundant interface pair.

Question 10

You are deploying an SD-WAN solution with two WAN links: port1 (primary) and port2 (secondary). You need to ensure that when port1 fails its Performance SLA, the FortiGate automatically removes it from the SD-WAN zone until it recovers. Which configuration step is required to achieve this behavior?

Accepted Answer

Configure a Performance SLA and reference it in the SD-WAN member settings. The correct approach is to configure a Performance SLA and assign it to the SD-WAN member. This allows the FortiGate to monitor the link's health and automatically remove the member from the SD-WAN zone if the SLA fails, ensuring traffic is not routed over a degraded link. Other options either misrepresent features or are not part of the SD-WAN configuration workflow.

Answer

Set the interface's priority to 0 to enable automatic failover

Answer

Enable 'SLA Target' on the SD-WAN interface

Answer

Enable 'Dynamic Zone Membership' globally under SD-WAN settings

Question 11

A FortiGate is deployed in an SD-WAN environment with two WAN links: port1 (static, 100 Mbps) and port2 (DHCP, 50 Mbps). The administrator wants SD-WAN rules to automatically prefer port1 for all traffic unless its measured latency exceeds 150 ms, in which case traffic should fail over to port2. Which configuration element must be defined and referenced by the SD-WAN rule to achieve this behavior?

Accepted Answer

A Performance SLA named 'WAN_MONITOR' with a latency threshold of 150 ms, applied to the SD-WAN zone members.. The Performance SLA is the SD-WAN feature that actively probes members and measures metrics like latency, jitter, and packet loss. When an SD-WAN rule references this SLA, the rule dynamically selects a member that meets the SLA targets. The administrator must configure the SLA with the 150 ms latency threshold and apply it to the SD-WAN zone so that port1 is used while it meets the threshold, and port2 takes over when it does not.

Answer

A static route with a distance of 10 for port1 and a distance of 20 for port2, combined with a route map that monitors latency.

Answer

A link health monitor configured under the SD-WAN interface settings with a latency threshold of 150 ms.

Answer

An SD-WAN rule with the 'lowest cost' strategy and a manual priority set on port1.

Question 12

You are configuring an SD-WAN rule to route business-critical traffic (HTTP and HTTPS) over the best available link based on lowest latency. You have two members in the SD-WAN zone: WAN1 and WAN2. You create a Performance SLA named 'Latency-SLA' that monitors 8.8.8.8 using ICMP probes with a threshold of 150 ms. You apply this SLA to both members. In the SD-WAN rule, you set the strategy to 'Lowest Latency' and select the SLA. After applying the configuration, you notice that HTTP traffic is still using WAN1 even though WAN2 has lower latency according to the SLA monitor. What is the most likely cause?

Accepted Answer

The SD-WAN rule is configured with a manual order or priority that overrides the latency-based selection, or the rule is not matching the HTTP traffic due to a missing service definition.. For an SD-WAN rule using 'Lowest Latency' strategy to select the best member, the rule must correctly match the traffic and not be overridden by another rule or manual priority settings. If the rule's service definition does not include HTTP/HTTPS, or if a higher-priority rule matches first, the latency-based selection will not apply. Verify rule order and match criteria.

Answer

The SD-WAN rule is missing a required 'Gateway' configuration for each member, so it cannot determine the next-hop for the lower-latency path.

Answer

The SD-WAN rule's 'Lowest Latency' strategy only considers latency if the members are in the same SD-WAN zone and the rule is applied to that zone; otherwise it defaults to the first member.

Answer

The Performance SLA must be configured with TCP probes on port 80 and 443 to accurately measure latency for HTTP and HTTPS traffic.

Question 13

You are building a new SD-WAN template in FortiManager to push to 40 branch FortiGates. The template must define two SD-WAN zones, the member interfaces, and the Performance SLA health checks, but the branch WAN IP addresses differ per site and must not be part of the template. Which FortiManager object type should you use to package the shared SD-WAN configuration?

Accepted Answer

An SD-WAN template in the FortiManager device manager. The SD-WAN template is the FortiManager object designed to normalize SD-WAN zones, member mappings, Performance SLA checks, and rules across many FortiGates. Keeping per-site WAN addressing out of the template is exactly what the normalized object model enables, since interface references resolve on each managed device. A CLI script or an address group cannot provide that reusable, metadata-aware structure.

Answer

A firewall address group object bound to the ADOM

Answer

A normalized interface template with SD-WAN member mappings

Answer

A CLI script template assigned through a policy package

Question 14

An administrator is setting up a new SD-WAN deployment on a FortiGate. They have two interfaces, port1 and port2, that will be part of the SD-WAN. They want to group these interfaces into a single SD-WAN zone named 'virtual-wan-link' to simplify rule configuration. Which step is required before adding the interfaces to the SD-WAN zone?

Accepted Answer

Enable SD-WAN on the FortiGate under System > Feature Visibility.. In FortiOS, the SD-WAN feature is not enabled by default in the GUI. The administrator must first enable it under System > Feature Visibility. After that, they can create an SD-WAN zone and add member interfaces. This step is mandatory regardless of interface type or addressing. Without enabling the feature, the SD-WAN configuration options are unavailable, so the zone cannot be created.

Answer

Assign static IP addresses to both interfaces.

Answer

Create a firewall address object for each interface's subnet.

Answer

Configure each interface as a VLAN subinterface with a unique VLAN ID.

Question 15

An engineer is configuring a new SD-WAN deployment on a FortiGate running FortiOS 7.2. The SD-WAN zone named 'virtual-wan-link' already exists with two members, but the engineer needs to add a third member that is a VLAN sub-interface named 'WAN3_VLAN'. After adding the interface to the zone, traffic still does not traverse the new member. What is the most likely reason?

Accepted Answer

The VLAN interface does not have a gateway configured or the next-hop gateway is unreachable, causing the member to be marked as down by the health check.. Adding an interface to an SD-WAN zone does not automatically make it usable. The member must have a working next-hop gateway and pass the Performance SLA health check. If the gateway is missing or unreachable, the member remains down and the SD-WAN rule will not select it. Verifying the gateway and SLA status is the first troubleshooting step.

Answer

The VLAN interface was added to the zone but is not configured as a member of the SD-WAN rule, so it is not eligible for selection.

Answer

The VLAN interface must be assigned an IP address and have an administrative distance lower than the existing members before it can be used in the zone.

Answer

The VLAN interface is not referenced in any firewall policy, so the FortiGate cannot forward traffic through it.