FORTINET-NSE7-SPECIALTY Nse7 SD Wan Central Management — 20 Questions

Question 1

You are troubleshooting a scenario where an SD-WAN template is not pushing to a FortiGate. Which log file on the FortiManager is most useful to identify the specific CLI command causing the failure?

Accepted Answer

fmg_debug.log. The fmg_debug.log on FortiManager captures detailed debug output from FortiManager processes, including the specific CLI commands and API calls exchanged during template pushes and policy installs. When an SD-WAN template fails to push, this log shows the exact command that FortiManager attempted to send to the FortiGate and the error returned, making it the most useful file for pinpointing the failing CLI line.

Answer

fmg_event.log

Answer

fmg_audit.log

Answer

fmg_system.log

Question 2

Which menu path in FortiManager is used to define SD-WAN templates?

Accepted Answer

Device Manager > SD-WAN Template. SD-WAN templates are managed under the 'Policy & Objects' tab within the device configuration context.

Answer

System Settings > SD-WAN

Answer

Policy & Objects > Firewall Policy

Answer

Log View > SD-WAN

Question 3

Which THREE interface types are supported as SD-WAN members?

Accepted Answer

VLAN interfaces. VLAN interfaces (A) are supported as SD-WAN members because they are logical Layer 3 interfaces that can carry SD-WAN overlay traffic and participate in the SD-WAN zone like any routed interface. VPN tunnel interfaces (B) are valid SD-WAN members since they serve as the underlying transport tunnels (e.g., IPsec) over which SD-WAN overlays are built and monitored. Physical interfaces (E) are supported because they are the fundamental WAN/LAN ports that can be directly assigned to an SD-WAN zone and used for member links. Loopback interfaces (C) are not supported as SD-WAN members because they are host-only logical interfaces not designed to carry transit SD-WAN traffic, and aggregate interfaces (D) are excluded because SD-WAN membership is defined on individual member links rather than on a bonded aggregate.

Answer

Loopback interfaces

Answer

Aggregate interfaces

Question 4

What happens if you modify an SD-WAN template that is already applied to a FortiGate?

Accepted Answer

The configuration status shows 'Modified' and requires an installation task. When you modify an SD-WAN template that is already applied to a FortiGate, FortiManager marks the device's configuration status as 'Modified' because the running configuration on the FortiGate no longer matches the template. The change is not pushed automatically; an administrator must run an installation task (or 'Install Wizard') to push the updated template to the FortiGate. This is consistent with FortiManager's staged change model.

Answer

The changes take effect immediately without a push

Answer

The FortiGate automatically pulls the new config

Answer

The FortiGate configuration is reverted

Question 5

In SD-WAN central management, what is the 'SD-WAN Zone' used for?

Accepted Answer

To group multiple SD-WAN members for logical policy routing. The SD-WAN Zone is used to group multiple SD-WAN members (interfaces) into a logical entity for policy routing. This allows administrators to apply consistent routing policies and SLA profiles across all members in the zone, simplifying configuration and management.

Answer

To define the physical port speed

Answer

To limit bandwidth for specific users

Answer

To isolate the SD-WAN traffic from the WAN

Question 6

When using SD-WAN templates, how are SD-WAN rules ordered?

Accepted Answer

Top to bottom. SD-WAN rules in FortiManager (and on FortiGate) are evaluated top to bottom, and the first rule whose match criteria are satisfied is applied. Order therefore directly determines which path selection logic wins, making rule sequencing a critical design decision. This mirrors the behavior of firewall policies and other ordered rule sets.

Answer

Based on the creation date

Answer

By the interface speed

Answer

Randomly

Question 7

Which object must be created before assigning a health check to an SD-WAN service rule in an SD-WAN template?

Accepted Answer

An SD-WAN Health Check. In Fortinet SD-WAN, a health check must be defined as an SD-WAN Health Check object before it can be referenced in an SD-WAN service rule. The service rule uses the health check to monitor the status of the specified SLA targets (e.g., latency, jitter, packet loss) and to determine which member links are eligible for traffic steering. Without a preconfigured health check, the service rule has no monitoring mechanism to evaluate link quality, so the assignment cannot be made.

Answer

A routing protocol

Answer

A firewall address object

Answer

An SD-WAN Zone

Question 8

When creating an SD-WAN template, what must be defined before you can add an SD-WAN interface to the template?

Accepted Answer

Individual SD-WAN member interfaces. In FortiManager, an SD-WAN template requires the underlying SD-WAN member interfaces to be defined first, because the SD-WAN interface is a logical overlay that aggregates those physical or logical member links. Without member interfaces, there is nothing for the SD-WAN zone to bind to, so FortiManager will not allow you to add the SD-WAN interface to the template.

Answer

The SD-WAN health check probes

Answer

Global firewall policies

Answer

The virtual domain (VDOM) settings

Question 9

You are configuring SD-WAN templates in FortiManager. What is the primary purpose of using SD-WAN Central Management instead of configuring SD-WAN directly on individual FortiGates?

Accepted Answer

To enable SD-WAN template inheritance and synchronized policy updates across multiple managed devices. SD-WAN Central Management in FortiManager uses templates (e.g., SD-WAN Template, CLI Template) to define SD-WAN configuration once and inherit it across multiple managed FortiGates. This enables synchronized policy updates, consistent SLA/steering rules, and efficient bulk changes. It eliminates the need to manually configure each FortiGate's SD-WAN settings individually.

Answer

To perform local traffic analysis on the FortiGate only

Answer

To allow FortiGates to manage their own SD-WAN interfaces independently

Answer

To bypass the need for ADOMs

Question 10

How do you apply an SD-WAN template to multiple managed FortiGates simultaneously?

Accepted Answer

By assigning the template in the Device Manager tab. In FortiManager, SD-WAN templates are applied to multiple managed FortiGates by assigning the template in the Device Manager tab. This allows you to select multiple devices and push the SD-WAN template configuration simultaneously, ensuring consistent SD-WAN settings across all selected FortiGates. The Device Manager provides a centralized interface for bulk template assignment, which is the intended method for scaling SD-WAN deployments.

Answer

By manually editing each FortiGate config

Answer

Through individual CLI console sessions

Answer

By creating a global profile

Question 11

Which feature in FortiManager allows you to monitor SD-WAN performance across all managed FortiGates?

Accepted Answer

Dashboard > SD-WAN Monitor. FortiManager's Dashboard includes an SD-WAN Monitor widget that aggregates SD-WAN performance data — link health, SLA status, jitter, latency, and packet loss — across all managed FortiGates in the ADOM. This gives administrators a single pane of glass to spot degraded links or failed SLAs fleet-wide. It pulls from the same health-check data the FortiGates generate for their SD-WAN rules.

Answer

Device Manager

Answer

Log View

Answer

Policy & Objects

Question 12

You want to standardize the SD-WAN configuration for 50 remote branch offices. Which FortiManager feature should you use?

Accepted Answer

SD-WAN Templates. SD-WAN Templates in FortiManager (D) are specifically designed to standardize SD-WAN configurations across multiple branch offices. They allow you to define SD-WAN settings, such as interface members, zones, and rules, in a template that can be applied to multiple FortiGates. This ensures consistency and simplifies management for large-scale deployments.

Answer

Policy Packages

Answer

Firmware Images

Answer

CLI Scripts

Question 13

If an SD-WAN template contains a reference to an interface that does not exist on a target FortiGate, what occurs during the installation process?

Accepted Answer

The installation fails with a configuration error. If an SD-WAN template references an interface that does not exist on the target FortiGate, the installation fails with a configuration error. FortiManager validates the template against the device's actual interfaces during the install process; a missing interface cannot be resolved, so the push is aborted. The administrator must correct the template or the device's interface configuration.

Answer

The FortiGate automatically creates a dummy interface

Answer

The installation proceeds and ignores the missing interface

Answer

The FortiGate enters an 'Emergency' state

Question 14

When configuring SD-WAN in FortiManager, why would you use 'Shared Objects'?

Accepted Answer

To enable reuse of configuration elements across different templates. Shared Objects in FortiManager are global or ADOM-level configuration objects (addresses, services, VIPs, security profiles, SD-WAN templates) that can be referenced by multiple policy packages, provisioning templates, and SD-WAN templates. This eliminates duplication and ensures consistency when the same object (e.g., an SD-WAN member interface or SLA target) must appear across many FortiGates or VDOMs. Because SD-WAN deployments typically span dozens of branches with identical object definitions, Shared Objects is the mechanism that makes template reuse practical.

Answer

To increase the number of VDOMs supported

Answer

To allow FortiGates to share logs

Answer

To create a site-to-site VPN

Question 15

What is the benefit of using 'SD-WAN Zones' in templates when managing 100+ branches?

Accepted Answer

They allow for easier mapping to physical ports across different hardware models. SD-WAN Zones in FortiManager templates allow administrators to define logical zones that map to physical ports consistently across different FortiGate hardware models. This abstraction simplifies template deployment to 100+ branches because the same template can be applied regardless of the specific port layout on each device.

Answer

They allow for multiple internet service providers

Answer

They automatically configure static routes

Answer

They increase the speed of the internet connection

Question 16

When viewing the SD-WAN Monitor in FortiManager, what information is provided for the 'Health Check' status?

Accepted Answer

Latency, jitter, and packet loss metrics. The SD-WAN Monitor in FortiManager displays Health Check status, which is derived from the SD-WAN health-check probes configured on the FortiGate. These probes measure latency, jitter, and packet loss for each member link, and FortiManager surfaces those metrics so administrators can see link quality centrally. This is the core purpose of the health-check status view.

Answer

The firmware version of the device

Answer

The number of active users

Answer

The current IP address of the interface

Question 17

During SD-WAN template deployment, what is the role of 'Dynamic Mapping'?

Accepted Answer

To map a single template object to different physical settings on different devices. Dynamic Mapping in SD-WAN template deployment allows a single template object (like an interface or SD-WAN rule) to be mapped to different physical settings on different devices. This enables flexibility when deploying the same template to multiple FortiGates with varying interface names or configurations. It uses variables and metadata to adapt the template to each device's specifics.

Answer

To automate firmware updates

Answer

To monitor bandwidth usage

Answer

To dynamically change the SD-WAN rule based on time

Answer

To calculate the latency of paths

Question 18

Which interface can be used as an SD-WAN member in an SD-WAN template?

Accepted Answer

Physical ports, VLANs, and VPN tunnels. In Fortinet SD-WAN, an SD-WAN member interface can be any logical or physical interface that carries traffic and supports the necessary health-check and performance SLA monitoring. This includes physical ports (e.g., wan1, wan2), VLAN sub-interfaces (e.g., vlan10 on a physical port), and VPN tunnels (e.g., IPsec tunnels, ADVPN shortcuts). The SD-WAN template in FortiManager abstracts these members into a single virtual interface, allowing dynamic path selection based on link quality. Therefore, option A correctly identifies the full set of supported interface types.

Answer

Only WAN physical ports

Answer

Only VLANs

Answer

Only loopback interfaces

Question 19

You have a large SD-WAN deployment. Why would you use a 'Centralized Policy' in FortiManager instead of local policies?

Accepted Answer

To enforce global security and traffic routing policies consistently across multiple sites. A Centralized Policy in FortiManager (typically via Global Policy or ADOM-level shared policy packages) enforces consistent security and SD-WAN routing rules across many sites. It ensures that all managed FortiGates receive the same baseline policy, reducing configuration drift and administrative overhead. This is essential for large SD-WAN deployments where uniform enforcement is required.

Answer

To eliminate the need for logs

Answer

To reduce the CPU load on the FortiGate

Answer

To allow local admins to override global policies

Question 20

When configuring SD-WAN services in a template, what does the 'Performance SLA' setting determine?

Accepted Answer

The criteria for path selection based on link quality. The Performance SLA setting in an SD-WAN template defines the health-check parameters — probe type, target, interval, and thresholds for latency, jitter, and packet loss — that determine whether a member link is considered alive and how it ranks for path selection. SD-WAN rules then use these SLA results to steer traffic to the best-quality link. It is fundamentally a link-quality criterion, not a bandwidth or port-priority setting.

Answer

The physical port priority

Answer

The maximum bandwidth allowed

Answer

The number of tunnels created