20+ practice questions focused on Security Profiles Routing And IPsec — one of the most tested topics on the NSE 7 - SD-WAN (NSE7_SDW) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Security Profiles Routing And IPsec PracticeAn administrator has configured BGP over multiple SD-WAN IPsec tunnels to provide redundant paths to a datacenter. However, asymmetric routing is causing stateful inspection drops on a secondary FortiGate firewall downstream. To ensure that BGP selects the preferred primary SD-WAN member consistently, which BGP attribute is best manipulated via a route-map applied to the BGP neighbor in FortiOS?
Explanation: Local Preference is the best BGP attribute to manipulate via a route-map applied to the BGP neighbor in FortiOS to ensure consistent primary path selection. Local Preference is used within an autonomous system to indicate the preferred exit point for outbound traffic. By setting a higher local preference on routes learned from the primary SD-WAN member, BGP will prefer that path. This attribute is propagated only within the local AS, making it ideal for influencing outbound path selection without affecting external peers.
A FortiGate device is configured with an SD-WAN rule utilizing a SLA rule for latency and packet loss. Security profiles including Deep Packet Inspection (DPI) SSL inspection and an Antivirus profile are applied to the firewall policy allowing this traffic. Users report intermittent connection drops on real-time UDP-based applications. Upon troubleshooting, the administrator notices that packet drops occur only when the SD-WAN rule dynamically steers traffic to a backup IPsec tunnel that has a smaller MTU. What is the most likely root cause and mitigation for this behavior?
Explanation: The most likely root cause is that Path MTU Discovery (PMTD) is failing because ICMP unreachable messages are blocked, and TCP MSS clamping is not correctly adjusting the encapsulated IPsec packet size. When traffic is steered to a backup IPsec tunnel with a smaller MTU, large UDP packets may exceed the tunnel MTU and be dropped if PMTUD cannot signal the need for fragmentation. The mitigation is to ensure ICMP unreachable messages are allowed and to configure TCP MSS clamping appropriately, though for UDP, adjusting the MTU or enabling fragmentation before encryption may be necessary.
An administrator configures an ADVPN 2.0 deployment between a FortiGate hub and multiple spokes using OSPF as the dynamic routing protocol. The spoke units need to establish direct shortcut tunnels dynamically. Which configuration step is mandatory on the hub to ensure that BGP or OSPF next-hop resolution works correctly for ADVPN shortcut creation?
Explanation: For ADVPN shortcuts to form, the spoke must be able to resolve the next-hop of the remote spoke's subnet to the remote spoke's public IP rather than to the hub. If the hub advertises routes with next-hop-self (BGP) or forces itself as the OSPF advertising router, spokes will always route through the hub and never trigger a shortcut. Disabling next-hop-self or adjusting OSPF so the original advertising router is preserved allows the spoke to see the true next hop and initiate an IKE shortcut.
An enterprise FortiGate is running SD-WAN with multiple internet breakouts. The administrator applies an Application Control security profile to the firewall policy. Some custom business applications are being incorrectly classified or blocked by the Application Control profile. To ensure SD-WAN can reliably steer this traffic using application signatures while preventing false positives, what is the recommended procedure?
Explanation: Creating a custom application signature override in the Application Control profile lets the administrator correct the misclassification by defining the traffic via port, IP, or pattern, so SD-WAN can reliably steer it using the corrected application signature. This preserves security inspection while eliminating false positives, which is the recommended Fortinet procedure for custom business apps.
An administrator configures an SD-WAN rule with a 'Lowest Cost (SLA)' strategy. What determines the metric used by FortiOS to select the best interface when multiple links meet the SLA criteria?
Explanation: When 'Lowest Cost (SLA)' strategy is selected, FortiOS uses the configured priority and weight, or the specific metric defined in the SLA parameters (such as lowest latency, jitter, or packet loss among those meeting the threshold). If multiple links meet the SLA thresholds, it selects based on priority and weight, or lowest cost based on the metric specified. Wait, Lowest Cost uses the cost assigned to the SD-WAN members or interface weights. Let's look at the options.
+15 more Security Profiles Routing And IPsec questions available
Practice all Security Profiles Routing And IPsec questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Security Profiles Routing And IPsec. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Security Profiles Routing And IPsec questions on the NSE7_SDW frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Security Profiles Routing And IPsec is tested as part of the NSE 7 - SD-WAN (NSE7_SDW) blueprint. Practicing with targeted Security Profiles Routing And IPsec questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free NSE7_SDW practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Security Profiles Routing And IPsec is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Security Profiles Routing And IPsec practice session with instant scoring and detailed explanations.
Start Security Profiles Routing And IPsec Practice →