NSE7_SDW Timed Practice Test 3 — 10 Questions

Question 1

A FortiGate is configured with two IPsec overlays in an SD-WAN zone. The administrator wants to ensure that return traffic from the remote subnet arrives on the same overlay that the original session used, but the remote gateway IP is the same on both overlays. Which SD-WAN member setting should be configured to achieve this?

10 minute time limit — choose an answer to begin.

Accepted Answer

Enable 'preserve-session-route' under the IPsec phase1-interface.. When multiple IPsec overlays terminate on the same remote gateway IP, the FortiGate cannot differentiate them by gateway alone. Enabling preserve-session-route on the IPsec phase1-interface forces the return traffic of a session to use the same tunnel that initiated it, ensuring symmetry. This is essential in SD-WAN deployments where multiple overlays exist and traffic must not be load-balanced across them for established sessions. The other options do not provide this per-session stickiness at the tunnel level.

Answer

Enable 'preserve-session-route' under the SD-WAN member interface.

Answer

Configure 'route-overlap' to allow multiple default routes over the same gateway.

Answer

Enable 'auto-discovery-forwarder' on the SD-WAN zone.

Question 2

A FortiGate is configured with an SD-WAN rule that steers traffic to an IPsec overlay tunnel. A security administrator needs to inspect the traffic with an IPS sensor before it egresses the tunnel. Where must the IPS sensor be applied so that it inspects traffic matching the SD-WAN rule?

Accepted Answer

In the firewall policy that permits the traffic and references the SD-WAN zone as the outgoing interface.. The firewall policy that permits the session is where UTM profiles such as IPS are enforced. Because the SD-WAN rule only chooses the egress member after the policy is matched, the policy must reference the SD-WAN zone as its outgoing interface. This way, any member selected by the rule inherits the same IPS inspection, ensuring consistent protection regardless of which tunnel carries the traffic.

Answer

Inside the SD-WAN rule definition, by enabling the 'security-profile' option and selecting the IPS sensor.

Answer

In the IPsec Phase 2 selector, by attaching the IPS sensor to the tunnel's proxy ID.

Answer

In the SD-WAN health-check definition, by binding the IPS sensor to the SLA probe.

Question 3

A network engineer is adding a new WAN link to an existing SD-WAN deployment on a FortiGate. The physical interface 'wan3' has been configured with an IP address and is up, but it does not appear in the list of available interfaces when the engineer tries to add it to an SD-WAN zone. Which action should the engineer take to resolve this?

Accepted Answer

Set the interface role to 'WAN' in the interface configuration.. For a physical interface to be available as an SD-WAN member, it must have its role set to 'WAN' in the interface configuration. This is a mandatory prerequisite in FortiOS. Once the role is set, the interface becomes selectable when adding members to an SD-WAN zone.

Answer

Assign the interface to a virtual WAN link (vwan) before adding it to the SD-WAN zone.

Answer

Ensure the interface is not used by any firewall policy.

Answer

Enable 'sdwan' on the interface under Network > Interfaces.

Question 4

A network engineer is adding a new physical interface to an existing SD-WAN zone on a FortiGate. The interface is currently used for management access. Which prerequisite must be met before the interface can be added to the SD-WAN zone?

Accepted Answer

The interface must have an IP address and be administratively up.. Before an interface can be added to an SD-WAN zone, it must have an IP address and be administratively up. These are fundamental requirements for the interface to function as an SD-WAN member. Other options describe global settings or optional features that are not prerequisites for zone membership.

Answer

The interface must have a performance SLA bound to it.

Answer

The interface must be assigned to a VDOM in NAT mode.

Answer

The interface must be part of a redundant interface pair.

Question 5

What happens if you modify an SD-WAN template that is already applied to a FortiGate?

Accepted Answer

The configuration status shows 'Modified' and requires an installation task. When you modify an SD-WAN template already applied to a FortiGate, FortiManager marks the device's configuration status as 'Modified', indicating the device is out of sync with the template. The changes are not pushed automatically; an administrator must run an installation task (Install Wizard or Install Device) to push the updated configuration to the FortiGate. This staged workflow prevents unintended immediate changes to production devices.

Answer

The changes take effect immediately without a push

Answer

The FortiGate automatically pulls the new config

Answer

The FortiGate configuration is reverted

Question 6

You are configuring an SD-WAN rule to route business-critical traffic. You want to ensure that the rule uses the best available link based on performance SLAs, and that it can fail over to a secondary link if the primary link's SLA is violated. Which two configuration elements are required to achieve this? (Choose two.)

Accepted Answer

Set the rule's strategy to 'SLA' and specify the SLA targets.. To route based on SLA and fail over when the SLA is violated, you must configure Performance SLAs on the members and use the 'SLA' strategy in the rule, specifying the SLA targets. This enables the rule to monitor link health and switch to a secondary link when the primary fails to meet the SLA.

Answer

Configure a static route with equal distance for both WAN links.

Answer

Set the rule's strategy to 'Lowest Cost' and assign costs to each member.

Answer

Enable 'Link Health Monitor' on the SD-WAN zone.

Question 7

Which THREE of the following are benefits of using SD-WAN?

Accepted Answer

Simplified WAN management through zones.. Option B is correct because SD-WAN controllers abstract WAN transport links into logical zones (e.g., VPN zones, service zones), letting administrators apply consistent policy and routing across many sites from a single management plane instead of configuring each device individually. Option C is correct because SD-WAN continuously monitors link health (via BFD, IP SLA, or similar probes) and automatically reroutes traffic to a backup WAN link—LTE, broadband, or MPLS—when the primary link degrades or fails, without manual intervention. Option E is correct because SD-WAN's application-aware routing engine classifies traffic by application and steers it over the path with the best measured performance (latency, jitter, packet loss), enforcing policies such as sending VoIP over the lowest-latency link. Option A does not belong because SD-WAN is a software overlay/control technology and does not provide or install physical layer cabling. Option D does not belong because automatic hardware replacement is a vendor support/logistics function, not a capability of the SD-WAN software itself.

Answer

Built-in physical layer cabling.

Answer

Automatic hardware replacement.

Question 8

An administrator configures an SD-WAN rule that steers Microsoft 365 traffic over the IPsec tunnel 'MPLS-VPN' and sets the rule's 'Priority' to 1. A second SD-WAN rule for the same traffic exists, but its 'Priority' is 10. Which statement accurately describes how FortiOS evaluates these rules?

Accepted Answer

The rule with Priority 1 is evaluated first; if its SLA health check fails, the rule with Priority 10 is evaluated next.. SD-WAN rules are processed in ascending priority order. The rule with the lowest priority number is evaluated first; if its SLA health check fails, FortiOS moves to the next rule. This design provides deterministic failover. The other options misstate the direction of priority or incorrectly describe parallel evaluation, which is not how FortiOS SD-WAN rule processing works.

Answer

Both rules are evaluated simultaneously, and traffic is load-balanced across the tunnels defined in each rule.

Answer

The rule with Priority 1 is applied only if the rule with Priority 10 is disabled or deleted.

Answer

The rule with Priority 10 is evaluated first because a higher numeric value indicates a higher precedence in FortiOS SD-WAN.

Question 9

Where are SD-WAN zones managed in the FortiGate GUI?

Accepted Answer

Network > SD-WAN > SD-WAN Zones.. In FortiGate's GUI, SD-WAN zones are configured under Network > SD-WAN > SD-WAN Zones. This is where administrators create and manage the logical zones that group SD-WAN member interfaces for policy and steering decisions. The SD-WAN Zones page is distinct from the general interface and zone configuration pages.

Answer

Interface > Physical Interfaces.

Answer

System > Network > Zones.

Answer

Firewall > Policy > Objects.

Question 10

An administrator is setting up a new SD-WAN deployment on a FortiGate. They have two interfaces, port1 and port2, that will be part of the SD-WAN. They want to group these interfaces into a single SD-WAN zone named 'virtual-wan-link' to simplify rule configuration. Which step is required before adding the interfaces to the SD-WAN zone?

Accepted Answer

Enable SD-WAN on the FortiGate under System > Feature Visibility.. In FortiOS, the SD-WAN feature is not enabled by default in the GUI. The administrator must first enable it under System > Feature Visibility. After that, they can create an SD-WAN zone and add member interfaces. This step is mandatory regardless of interface type or addressing. Without enabling the feature, the SD-WAN configuration options are unavailable, so the zone cannot be created.

Answer

Assign static IP addresses to both interfaces.

Answer

Create a firewall address object for each interface's subnet.

Answer

Configure each interface as a VLAN subinterface with a unique VLAN ID.