FORTINET-NSE7-SPECIALTY Nse7 SD Wan Central Management — 10 Questions

Question 1

You are troubleshooting a scenario where an SD-WAN template is not pushing to a FortiGate. Which log file on the FortiManager is most useful to identify the specific CLI command causing the failure?

Accepted Answer

fmg_debug.log. The fmg_debug.log on FortiManager captures detailed debug output from FortiManager processes, including the specific CLI commands and API calls exchanged during template pushes and policy installs. When an SD-WAN template fails to push, this log shows the exact command that FortiManager attempted to send to the FortiGate and the error returned, making it the most useful file for pinpointing the failing CLI line.

Answer

fmg_event.log

Answer

fmg_audit.log

Answer

fmg_system.log

Question 2

Which menu path in FortiManager is used to define SD-WAN templates?

Accepted Answer

Device Manager > SD-WAN Template. SD-WAN templates are managed under the 'Policy & Objects' tab within the device configuration context.

Answer

System Settings > SD-WAN

Answer

Policy & Objects > Firewall Policy

Answer

Log View > SD-WAN

Question 3

Which THREE interface types are supported as SD-WAN members?

Accepted Answer

VLAN interfaces. VLAN interfaces (A) are supported as SD-WAN members because they are logical Layer 3 interfaces that can carry SD-WAN overlay traffic and participate in the SD-WAN zone like any routed interface. VPN tunnel interfaces (B) are valid SD-WAN members since they serve as the underlying transport tunnels (e.g., IPsec) over which SD-WAN overlays are built and monitored. Physical interfaces (E) are supported because they are the fundamental WAN/LAN ports that can be directly assigned to an SD-WAN zone and used for member links. Loopback interfaces (C) are not supported as SD-WAN members because they are host-only logical interfaces not designed to carry transit SD-WAN traffic, and aggregate interfaces (D) are excluded because SD-WAN membership is defined on individual member links rather than on a bonded aggregate.

Answer

Loopback interfaces

Answer

Aggregate interfaces

Question 4

What happens if you modify an SD-WAN template that is already applied to a FortiGate?

Accepted Answer

The configuration status shows 'Modified' and requires an installation task. When you modify an SD-WAN template that is already applied to a FortiGate, FortiManager marks the device's configuration status as 'Modified' because the running configuration on the FortiGate no longer matches the template. The change is not pushed automatically; an administrator must run an installation task (or 'Install Wizard') to push the updated template to the FortiGate. This is consistent with FortiManager's staged change model.

Answer

The changes take effect immediately without a push

Answer

The FortiGate automatically pulls the new config

Answer

The FortiGate configuration is reverted

Question 5

In SD-WAN central management, what is the 'SD-WAN Zone' used for?

Accepted Answer

To group multiple SD-WAN members for logical policy routing. The SD-WAN Zone is used to group multiple SD-WAN members (interfaces) into a logical entity for policy routing. This allows administrators to apply consistent routing policies and SLA profiles across all members in the zone, simplifying configuration and management.

Answer

To define the physical port speed

Answer

To limit bandwidth for specific users

Answer

To isolate the SD-WAN traffic from the WAN

Question 6

When using SD-WAN templates, how are SD-WAN rules ordered?

Accepted Answer

Top to bottom. SD-WAN rules in FortiManager (and on FortiGate) are evaluated top to bottom, and the first rule whose match criteria are satisfied is applied. Order therefore directly determines which path selection logic wins, making rule sequencing a critical design decision. This mirrors the behavior of firewall policies and other ordered rule sets.

Answer

Based on the creation date

Answer

By the interface speed

Answer

Randomly

Question 7

Which object must be created before assigning a health check to an SD-WAN service rule in an SD-WAN template?

Accepted Answer

An SD-WAN Health Check. In Fortinet SD-WAN, a health check must be defined as an SD-WAN Health Check object before it can be referenced in an SD-WAN service rule. The service rule uses the health check to monitor the status of the specified SLA targets (e.g., latency, jitter, packet loss) and to determine which member links are eligible for traffic steering. Without a preconfigured health check, the service rule has no monitoring mechanism to evaluate link quality, so the assignment cannot be made.

Answer

A routing protocol

Answer

A firewall address object

Answer

An SD-WAN Zone

Question 8

When creating an SD-WAN template, what must be defined before you can add an SD-WAN interface to the template?

Accepted Answer

Individual SD-WAN member interfaces. In FortiManager, an SD-WAN template requires the underlying SD-WAN member interfaces to be defined first, because the SD-WAN interface is a logical overlay that aggregates those physical or logical member links. Without member interfaces, there is nothing for the SD-WAN zone to bind to, so FortiManager will not allow you to add the SD-WAN interface to the template.

Answer

The SD-WAN health check probes

Answer

Global firewall policies

Answer

The virtual domain (VDOM) settings

Question 9

You are configuring SD-WAN templates in FortiManager. What is the primary purpose of using SD-WAN Central Management instead of configuring SD-WAN directly on individual FortiGates?

Accepted Answer

To enable SD-WAN template inheritance and synchronized policy updates across multiple managed devices. SD-WAN Central Management in FortiManager uses templates (e.g., SD-WAN Template, CLI Template) to define SD-WAN configuration once and inherit it across multiple managed FortiGates. This enables synchronized policy updates, consistent SLA/steering rules, and efficient bulk changes. It eliminates the need to manually configure each FortiGate's SD-WAN settings individually.

Answer

To perform local traffic analysis on the FortiGate only

Answer

To allow FortiGates to manage their own SD-WAN interfaces independently

Answer

To bypass the need for ADOMs

Question 10

How do you apply an SD-WAN template to multiple managed FortiGates simultaneously?

Accepted Answer

By assigning the template in the Device Manager tab. In FortiManager, SD-WAN templates are applied to multiple managed FortiGates by assigning the template in the Device Manager tab. This allows you to select multiple devices and push the SD-WAN template configuration simultaneously, ensuring consistent SD-WAN settings across all selected FortiGates. The Device Manager provides a centralized interface for bulk template assignment, which is the intended method for scaling SD-WAN deployments.

Answer

By manually editing each FortiGate config

Answer

Through individual CLI console sessions

Answer

By creating a global profile