NSE7_SDW System Configuration And Setup Practice Test 7 — 15 Questions

Question 1

You are setting up an SD-WAN configuration on a FortiGate. You want to ensure that the SD-WAN rules you create will be able to use the WAN interfaces. You have already configured the interfaces with IP addresses and default gateways. Which additional configuration object must you create to group the interfaces for use in SD-WAN rules?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An SD-WAN zone.. SD-WAN zones are the correct configuration object to group member interfaces for use in SD-WAN rules. They allow you to manage multiple WAN links as a single entity in rules, simplifying policy creation and enabling dynamic path selection based on performance SLAs.

Answer

A software switch.

Answer

A virtual domain (VDOM) for each WAN interface.

Answer

A link aggregation group (LAG).

Question 2

An SD-WAN rule uses the lowest-cost (SLA) strategy with two members, wan1 and wan2. wan1 has a lower configured cost than wan2, and both currently meet the SLA. A network engineer observes that all matching traffic egresses wan1. The engineer now wants traffic to prefer wan2 whenever wan2 meets the SLA, while still failing over to wan1 if wan2 degrades. What should the engineer change?

Accepted Answer

Set the rule strategy to priority and give wan2 a lower priority value than wan1. Preference between healthy members is expressed by the rule strategy. The lowest-cost strategy always favors the lower-cost member, so no cost or probe tuning produces a manual preference. Switching to the priority strategy and giving the desired member the lowest priority number makes it preferred while it passes the SLA, with automatic failover to the higher-numbered member.

Answer

Increase the cost value configured on wan2 above the cost on wan1

Answer

Add a Performance SLA probe on wan2 with a shorter probe interval than wan1

Answer

Lower the cost value configured on wan1 below the cost on wan2

Question 3

A network administrator is deploying SD-WAN on a FortiGate and needs to ensure that the SD-WAN zone can be referenced in firewall policies. Which configuration step is mandatory before the zone can be used in a policy?

Accepted Answer

Enable SD-WAN in Feature Visibility under System > Feature Visibility.. Before SD-WAN zones can be created or used in firewall policies, the SD-WAN feature must be enabled in System > Feature Visibility. This is a global setting that reveals the SD-WAN configuration menu. Without it, the administrator cannot define zones, members, or rules, and the zone will not appear as an option in policy interfaces.

Answer

Assign an IP address to the SD-WAN zone interface.

Answer

Create a static route pointing to the SD-WAN zone.

Answer

Configure a Performance SLA and bind it to the zone.

Question 4

A network administrator is configuring an SD-WAN rule to steer traffic from the internal network to a critical cloud application. The rule uses the 'SLA' strategy and references a Performance SLA that monitors latency and jitter. The administrator notices that traffic is intermittently being sent over a WAN link that does not meet the SLA thresholds. The Performance SLA is configured with a probe interval of 5 seconds and a failure threshold of 3. What is the most likely reason for this intermittent behavior?

Accepted Answer

The Performance SLA probe interval and failure threshold cause a delay in marking the member as out of SLA, allowing traffic to continue briefly after the threshold is exceeded.. The Performance SLA evaluates member health based on probe results. With a probe interval of 5 seconds and a failure threshold of 3, the member is only marked as out of SLA after three consecutive failed probes, which takes at least 15 seconds. During that period, the SD-WAN rule continues to consider the member as meeting the SLA and may route traffic over it. This delay causes intermittent use of a link that has actually breached the latency or jitter thresholds.

Answer

The SD-WAN rule is incorrectly configured with a manual priority that overrides the SLA status.

Answer

The Performance SLA is only applied to one member, so the other member's SLA status is unknown and defaults to in-SLA.

Answer

The SD-WAN rule is using the 'SLA' strategy, which only considers the first member that meets the SLA and does not re-evaluate until the member fails completely.

Question 5

You are configuring an SD-WAN rule to steer traffic to a business-critical application. The rule uses the 'Lowest Cost (SLA)' strategy with two members: a low-cost broadband link and an expensive MPLS link. The broadband link meets the SLA most of the time but occasionally experiences high latency. You want traffic to prefer the broadband link but fail over to MPLS when broadband violates the SLA. Which additional configuration is required to ensure the rule behaves as intended?

Accepted Answer

Configure a Performance SLA and associate it with the SD-WAN rule.. The 'Lowest Cost (SLA)' strategy chooses the lowest-cost member that satisfies the SLA defined in a Performance SLA. The Performance SLA must be created separately and then referenced by the SD-WAN rule. Without it, the rule has no way to evaluate link health, so it may not fail over when the broadband link degrades. Associating a Performance SLA with appropriate thresholds ensures the rule dynamically selects the MPLS link when broadband violates the SLA.

Answer

Enable 'SLA Target' on the rule and specify the required latency threshold.

Answer

Set the broadband member's priority to a lower value than the MPLS member.

Answer

Set the MPLS member's cost to a lower value than the broadband member.

Question 6

You are setting up an SD-WAN zone and need to add two interfaces, port1 and port2. However, the FortiGate GUI does not allow you to add them to the zone. What is the most likely cause?

Accepted Answer

The interfaces are already assigned to another SD-WAN zone.. The most likely cause is that the interfaces are already members of another SD-WAN zone. FortiGate enforces that an interface can only belong to one SD-WAN zone at a time. To resolve this, you must remove the interfaces from the existing zone before adding them to the new one. Other options are either supported configurations or unrelated to zone membership.

Answer

The interfaces are configured with dynamic IP addresses.

Answer

The interfaces are not physical interfaces.

Answer

The interfaces have administrative distance set to 0.

Question 7

You are configuring an SD-WAN rule to route VoIP traffic. You want the rule to select the member with the best quality for voice, considering both latency and jitter. You have enabled Performance SLA on both WAN1 and WAN2, monitoring latency and jitter. You need to ensure the rule uses the appropriate strategy and that the SLA is correctly referenced. Which two actions must you perform to achieve this? (Choose two.)

Accepted Answer

Set the SD-WAN rule strategy to 'Best Quality'.. To route VoIP traffic based on both latency and jitter, set the SD-WAN rule strategy to 'Best Quality' and ensure the Performance SLA that monitors these metrics is assigned to the relevant SD-WAN members. This allows the SD-WAN engine to evaluate the quality of each link and select the best one for voice traffic.

Answer

Enable 'Link Health Monitor' on the SD-WAN rule.

Answer

Configure the Performance SLA to use HTTP probes to measure jitter.

Answer

Set the SD-WAN rule strategy to 'Lowest Latency'.

Question 8

You are deploying a new FortiGate SD-WAN solution with two WAN links: wan1 and wan2. You want SD-WAN rules to be able to select members based on performance SLAs, but you also need to ensure that the SD-WAN configuration is synchronized across a pair of FortiGates in an HA cluster. Which configuration step is required before you can create an SD-WAN rule that references wan1 and wan2?

Accepted Answer

Add wan1 and wan2 as SD-WAN members and assign them to an SD-WAN zone.. To use interfaces in SD-WAN rules, they must first be configured as SD-WAN members and placed into an SD-WAN zone. This membership is what allows the rule to select them and apply performance SLAs. Static routes, interface-level SD-WAN toggles, and SLAs do not replace this step.

Answer

Create a static route for each WAN interface and enable 'SD-WAN' in the route settings.

Answer

Configure a Performance SLA for each interface before adding them to SD-WAN.

Answer

Enable SD-WAN on each interface under Network > Interfaces.

Question 9

An engineer is configuring an SD-WAN rule that must load-balance traffic across two members based on the volume of traffic, but also must ensure that if one member's health check fails, traffic is redistributed to the remaining healthy member. Which strategy should be selected in the SD-WAN rule?

Accepted Answer

Maximize Bandwidth (SLA). The Maximize Bandwidth (SLA) strategy is designed to load-balance traffic across all SD-WAN members that meet the SLA, using their available bandwidth as the weight. It also automatically reroutes traffic if a member fails its health check. This satisfies both the load-balancing and resilience requirements described in the scenario.

Answer

SLA

Answer

Best Quality

Answer

Priority

Question 10

You are configuring an SD-WAN rule that must use a specific member interface only when its measured latency is below 50 ms, and otherwise fall back to another member. Which configuration element directly defines the latency threshold that the FortiGate evaluates for that member?

Accepted Answer

The SLA target configured in the Performance SLA. The latency limit that determines whether a member is considered healthy is stored as an SLA target inside the Performance SLA object. The SD-WAN rule then references that SLA, so the FortiGate compares live probe measurements against the configured threshold and removes members that exceed it from consideration. Static attributes such as link cost, priority, and probe interval influence selection or detection speed but never define the numeric latency boundary.

Answer

The priority value assigned to the SD-WAN member

Answer

The link-cost value of the SD-WAN member

Answer

The health-check interval configured on the member interface

Question 11

A company has an SD-WAN deployment with three members: port1 (MPLS), port2 (Broadband), and port3 (LTE). The administrator wants to ensure that business-critical traffic uses port1 whenever it meets the SLA, but if port1 fails the SLA, traffic should use port2. If both port1 and port2 fail, traffic should use port3. Which SD-WAN rule strategy should be used to achieve this?

Accepted Answer

Priority. The 'Priority' strategy is designed for active/standby failover based on SLA status. The administrator assigns a priority value to each member; lower values indicate higher priority. The SD-WAN rule will select the highest-priority member that meets the referenced Performance SLA. If that member fails the SLA, the next priority member is chosen. This provides the exact behavior described: port1 preferred, then port2, then port3, all conditional on SLA compliance.

Answer

Lowest Cost

Answer

Best Quality

Answer

Maximize Bandwidth

Question 12

You are troubleshooting an SD-WAN deployment where a rule configured with the 'Best Quality' strategy is not selecting the expected member. The Performance SLA shows that member1 has lower latency and jitter than member2, yet traffic is using member2. Which factor should you verify first?

Accepted Answer

Check whether the SD-WAN rule is placed above a conflicting rule in the rule list.. SD-WAN rules are processed sequentially, and the first rule that matches the traffic is used. If an earlier rule matches the same traffic, it will dictate member selection, potentially overriding the intended 'Best Quality' rule. Therefore, checking rule order is the logical first step. Other factors like cost or SLA algorithm are not relevant to the 'Best Quality' strategy, which selects the member with the best measured performance.

Answer

Confirm that member1 has a lower cost than member2.

Answer

Ensure that the Performance SLA is configured with the 'Best Quality' algorithm.

Answer

Verify that the 'Best Quality' strategy is supported on the FortiGate model.

Question 13

You are configuring an SD-WAN rule to route business-critical traffic. You want to ensure that the rule uses the best available link based on performance SLAs, and that it can fail over to a secondary link if the primary link's SLA is violated. Which two configuration elements are required to achieve this? (Choose two.)

Accepted Answer

Set the rule's strategy to 'SLA' and specify the SLA targets.. To route based on SLA and fail over when the SLA is violated, you must configure Performance SLAs on the members and use the 'SLA' strategy in the rule, specifying the SLA targets. This enables the rule to monitor link health and switch to a secondary link when the primary fails to meet the SLA.

Answer

Configure a static route with equal distance for both WAN links.

Answer

Set the rule's strategy to 'Lowest Cost' and assign costs to each member.

Answer

Enable 'Link Health Monitor' on the SD-WAN zone.

Question 14

An engineer is troubleshooting an SD-WAN rule that is not steering traffic as expected. The rule is configured with the 'Lowest Cost (SLA)' strategy and includes two members: member1 (cost 10) and member2 (cost 20). Both members are passing their SLA health checks. However, all traffic is going out member1, and member2 is not used. What is the most likely explanation?

Accepted Answer

The 'Lowest Cost (SLA)' strategy always selects the member with the lowest cost and does not load-balance, so member2 is only used if member1 fails its SLA.. The Lowest Cost (SLA) strategy selects the healthy member with the lowest cost. It does not load-balance; it is designed to prefer the cheapest path that meets the SLA. Since member1 has a lower cost and is healthy, it is always chosen. Member2 remains idle unless member1 fails its SLA. This is the intended behavior, not a misconfiguration.

Answer

Member2 is not being used because its health check is failing, even though it appears to be passing in the GUI.

Answer

Member2 is not being used because it is not included in the SD-WAN rule, even though it is in the zone.

Answer

Member2 is not being used because its cost is higher than member1's, and the strategy requires equal costs for load balancing.

Question 15

A network engineer is adding two WAN links to a new SD-WAN deployment on a FortiGate. The interfaces are already configured with IP addresses and default gateways. What must be done before these interfaces can participate in SD-WAN rules?

Accepted Answer

Assign each interface to an SD-WAN zone. Before an interface can be used by SD-WAN rules, it must be a member of an SD-WAN zone. Creating the zone and adding the physical or logical interfaces is what registers them with the SD-WAN feature set. Other settings such as asymmetric routing, VLAN tagging, or static routes affect forwarding behavior but do not perform the membership step that makes the interface selectable in rules.

Answer

Convert each interface to a VLAN subinterface

Answer

Enable asymmetric routing on each interface

Answer

Configure a static route for each interface in the SD-WAN routing table