NSE7_SDW System Configuration And Setup Practice Test 8 — 15 Questions

Question 1

An administrator is configuring SD-WAN on a FortiGate with two WAN interfaces: port1 and port2. They need to ensure that the SD-WAN can properly direct traffic based on application type and link performance. Which two configuration steps are required to enable application-based steering with SLA enforcement? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an SD-WAN zone and add port1 and port2 as members.. To enable application-based steering with SLA enforcement, the administrator must first create an SD-WAN zone and add the WAN interfaces as members. Then, a Performance SLA must be configured and applied to the zone to monitor link health. These two steps provide the foundation for SD-WAN rules to match applications and steer traffic based on SLA status. Without the zone, members cannot be managed collectively; without the SLA, there is no performance data to enforce.

Answer

Create a firewall policy that includes the SD-WAN zone as the outgoing interface and enable NAT.

Answer

Configure a static route for each WAN interface with the same distance.

Answer

Enable application control on the firewall policy that references the SD-WAN zone.

Question 2

You are deploying a new FortiGate for an SD-WAN branch. The branch uses a single physical WAN link that is delivered as a VLAN-tagged subinterface on port1 (VLAN ID 100). You want to add this link to an SD-WAN zone named 'virtual-wan-link'. Which configuration step must be completed before the VLAN subinterface can be selected as an SD-WAN member?

Accepted Answer

The VLAN subinterface must be created and have an IP address assigned.. An SD-WAN member can only reference an interface that already exists and has an IP address configured. For a VLAN-based WAN link, that means creating the VLAN subinterface under the physical interface and assigning it an IP address before adding it to the SD-WAN zone. Role labels, Performance SLA objects, and VDOM placement are not prerequisites for membership.

Answer

The VLAN subinterface must be placed in a separate VDOM that is dedicated to SD-WAN.

Answer

The VLAN subinterface must be added to a Performance SLA before it can join the SD-WAN zone.

Answer

The VLAN subinterface must be assigned a role of WAN in its interface configuration.

Question 3

You are configuring an SD-WAN rule for a branch office that must use the lowest-latency path for Microsoft 365 traffic. You have already created a Performance SLA named 'M365_SLA' that measures latency to several Microsoft 365 endpoints. You want the SD-WAN rule to select the member with the best latency among those that meet the SLA. Which SD-WAN rule strategy should you configure?

Accepted Answer

lowest-latency (SLA). For latency-sensitive applications such as Microsoft 365, the SD-WAN rule strategy must dynamically select the member with the lowest measured latency. The lowest-latency strategy uses the Performance SLA results to compare members and choose the one with the best latency, ensuring optimal user experience. Other strategies focus on cost, bandwidth, or static priority, which do not directly optimize for latency and may select a suboptimal path.

Answer

lowest-cost (SLA)

Answer

maximize-bandwidth (SLA)

Answer

priority (SLA)

Question 4

You are configuring a Performance SLA on a FortiGate to monitor the quality of two WAN links. You need to ensure that the SLA probe uses HTTP to check a specific URL and that it considers the link healthy only if the round-trip time is below 100 ms and packet loss is below 2%. Which two parameters must you configure in the Performance SLA? (Choose two.)

Accepted Answer

Configure the latency threshold to 100 ms and packet loss threshold to 2%.. To use HTTP for the SLA probe, you must set the protocol to HTTP and specify the URL. To enforce the health criteria, you must configure the latency threshold to 100 ms and the packet loss threshold to 2%. These two settings are directly required. Other options like update-static-route, probe interval, or jitter are not necessary to meet the stated monitoring conditions.

Answer

Enable 'update-static-route' to automatically adjust routing based on SLA.

Answer

Configure the SLA to use 'jitter' as the primary metric.

Answer

Set the probe interval to 100 ms to match the latency threshold.

Question 5

A security administrator needs to allow branch users to reach an internal application server through the SD-WAN overlay. The SD-WAN rule already matches the correct source and destination, and both members pass their Performance SLA checks. Traffic is still being dropped before it reaches the SD-WAN rule. Which configuration must the administrator verify?

Accepted Answer

The firewall policy that references the SD-WAN zone as its outgoing interface. SD-WAN rules only influence member selection for traffic that a firewall policy already permits and forwards out the SD-WAN zone. A missing or misordered policy that references the zone causes the drop, independent of rule matching or member health. Confirming the permitting policy and its placement resolves the issue.

Answer

The MTU value configured on each SD-WAN member interface

Answer

The administrative distance of the static routes toward each member

Answer

The probe frequency of the Performance SLA attached to the rule

Question 6

An administrator wants an SD-WAN rule to select the member with the best measured quality for Microsoft 365 traffic, and also to ensure that if the best member degrades, traffic moves to the next-best member without manual intervention. The rule must continuously evaluate all eligible members. Which strategy satisfies these requirements?

Accepted Answer

Best quality. Best quality evaluates every in-SLA member using the Performance SLA measurements and steers traffic to the member currently offering the best value for the monitored metric. Because the comparison repeats as new probe results arrive, a member that degrades is automatically bypassed in favor of the next-best healthy member. Strategies such as manual, lowest cost, and maximize bandwidth either ignore live quality or optimize for a different objective.

Answer

Manual

Answer

Lowest cost

Answer

Maximize bandwidth

Question 7

A FortiGate is configured with an SD-WAN zone containing two members: 'wan1' (static IP, gateway 203.0.113.1) and 'wan2' (DHCP, learned gateway 198.51.100.1). You need to verify the current SD-WAN member health and the measured latency, jitter, and packet loss for each member from the CLI. Which command displays the live SD-WAN health-check results for all members?

Accepted Answer

diagnose sys sdwan health-check. Live SD-WAN health data is exposed through the health-check diagnose command, which reports each Performance SLA's state and the per-member latency, jitter, and packet-loss values. Member and service commands show configuration and rule selection respectively, while 'get' shows only static configuration. To confirm measured SLA values, the health-check output is the correct source.

Answer

get system sdwan health-check

Answer

diagnose sys sdwan member

Answer

diagnose sys sdwan service

Question 8

You are configuring an SD-WAN rule that uses the 'lowest-cost (SLA)' strategy. You have three members: wan1 (cost 10), wan2 (cost 20), and wan3 (cost 30). All have Performance SLAs configured. Currently, wan1 and wan2 meet their SLAs, but wan3 does not. Which member will be selected for traffic matching this rule?

Accepted Answer

wan1, because it has the lowest cost and meets the SLA.. With lowest-cost (SLA) strategy, the FortiGate selects the member with the lowest cost that also meets its Performance SLA. wan1 has the lowest cost and meets SLA, so it is chosen. wan2 meets SLA but has a higher cost, and wan3 fails SLA so it is excluded. The rule does not require all members to meet SLA; it only needs at least one eligible member.

Answer

wan3, because it has the highest cost and thus the highest priority.

Answer

No member, because wan3 fails its SLA and the rule requires all members to meet SLA.

Answer

wan2, because it has the next lowest cost after wan1.

Question 9

An SD-WAN rule is configured with the Best Quality strategy and includes two members: WAN1 and WAN2. The Performance SLA for both members is set to monitor latency, jitter, and packet loss. The SLA thresholds are latency 100 ms, jitter 20 ms, and packet loss 1%. Currently, WAN1 has latency 80 ms, jitter 10 ms, and packet loss 0.5%; WAN2 has latency 90 ms, jitter 25 ms, and packet loss 0.2%. Both members are up. Which member will be selected by the Best Quality strategy?

Accepted Answer

WAN1, because it meets all SLA thresholds while WAN2 exceeds the jitter threshold.. The Best Quality strategy selects the member that meets all SLA thresholds and has the best overall quality. WAN1 satisfies latency, jitter, and packet loss thresholds, while WAN2 violates the jitter threshold. Therefore, WAN2 is excluded, and WAN1 is chosen as the only compliant member.

Answer

WAN2, because it has lower packet loss than WAN1, which is the most important metric.

Answer

WAN2, because it has the lowest latency among the members that meet the packet loss threshold.

Answer

Neither member will be selected because both must meet all SLA thresholds for any to be chosen.

Question 10

A network engineer is designing an SD-WAN rule that must steer real-time voice traffic to the member with the best measured quality rather than a fixed link. The rule will use Performance SLA results to make the decision. Which two Performance SLA configuration elements directly influence whether a member is considered healthy for this voice rule? (Choose two.)

Accepted Answer

The latency, jitter, and packet-loss thresholds defined in the SLA. A Performance SLA decides member health by probing designated targets and comparing results to configured thresholds. The targets determine what is measured, and the latency, jitter, and packet-loss limits determine whether the measurements pass. Together they directly govern whether the voice rule sees a member as healthy and eligible for selection.

Answer

The DSCP marking applied to the voice traffic by the firewall policy

Answer

The administrative distance of the default route on each member

Answer

The source interface selected for the SLA probes

Question 11

You are preparing a FortiGate for SD-WAN and need to verify that the underlying system settings will support SD-WAN rule processing and health monitoring. Which two configuration items must be present for SD-WAN to function? (Choose two.)

Accepted Answer

A Performance SLA if health-based steering is required. A functional SD-WAN configuration requires member interfaces organized into at least one SD-WAN zone, and it requires a Performance SLA whenever steering or failover depends on link health. Multi-VDOM mode, BGP peering, and IPsec overlays are design choices that add capabilities or segmentation but are not mandatory for SD-WAN rules and health monitoring to work on a FortiGate.

Answer

A VDOM operating in multi-VDOM mode

Answer

BGP configured between the FortiGate and each WAN provider

Answer

An IPsec tunnel to a remote hub for every member link

Question 12

You are configuring an SD-WAN member for an IPsec tunnel that terminates on a remote FortiGate. The tunnel interface is named 'vpn_to_dc'. You want the SD-WAN member to be usable and to be monitored by a Performance SLA. Which two configuration elements must be present for this member to function correctly in the SD-WAN zone? (Choose two.)

Accepted Answer

The IPsec tunnel interface must be up and have an IP address assigned.. An SD-WAN member requires an existing, addressed interface, so the IPsec tunnel must be up with an IP address. To be monitored, the Performance SLA must include that member so probes are sent across the tunnel. Cost, priority, routing via the zone, and unique zone naming are design choices or optional attributes, not prerequisites for the member to function and be health-checked.

Answer

The member must be assigned a cost value and a priority value in its SD-WAN member configuration.

Answer

The tunnel must be configured with a unique SD-WAN zone name that differs from the physical WAN zone.

Answer

A static route to the remote subnet must point to the SD-WAN zone rather than the tunnel interface directly.

Question 13

A network engineer is configuring an SD-WAN rule to route VoIP traffic. The requirement is to always use the member with the lowest jitter, even if other members have higher bandwidth. The engineer wants to avoid manual priority configuration. Which SD-WAN strategy should be selected for this rule?

Accepted Answer

Best Quality. The Best Quality strategy automatically selects the SD-WAN member that meets the SLA and has the best quality metrics, including the lowest jitter. This aligns with the requirement to always use the member with the lowest jitter for VoIP traffic without manual intervention. Other strategies focus on cost, bandwidth, or manual priority.

Answer

Maximize Bandwidth (SLA)

Answer

Priority

Answer

Lowest Cost (SLA)

Question 14

A FortiGate has two SD-WAN members, wan1 and wan2, both in the same zone. The administrator wants sessions that already use wan1 to remain on wan1 even if wan2 becomes the preferred member due to better SLA results, while new sessions should follow the preferred member. Which setting controls this behavior?

Accepted Answer

The 'Preserve session' or sticky session option in the SD-WAN rule. Session preservation, commonly configured as a sticky-session option within the SD-WAN rule, keeps established flows bound to their current member while allowing new sessions to be placed on the currently preferred member. The rule's strategy, member link cost, and probe interval all influence which member is preferred or how quickly changes are detected, but none of them controls whether existing sessions are migrated.

Answer

The member's link cost value

Answer

The SD-WAN rule's strategy

Answer

The Performance SLA probe interval

Question 15

You are configuring SD-WAN on a FortiGate that will be managed by FortiManager. You want to ensure that the SD-WAN configuration is consistent across multiple devices and that changes can be deployed centrally. Which action must you take in FortiManager to support SD-WAN configuration?

Accepted Answer

Use the SD-WAN template in FortiManager.. FortiManager's SD-WAN template is designed for centralized configuration of SD-WAN settings. It allows you to define members, zones, performance SLAs, and rules once and assign them to multiple FortiGates. This ensures consistency and simplifies deployment. Other options do not provide the centralized SD-WAN configuration capability required.

Answer

Enable 'Central Management' on each FortiGate under System > Settings.

Answer

Install a 'SD-WAN' license on the FortiGate.

Answer

Create a firewall policy on FortiManager that references SD-WAN zones.