FORTINET-NSE7-SPECIALTY Nse7 SD Wan Central Management Practice Test 2 — 15 Questions

Question 1

When viewing the SD-WAN Monitor in FortiManager, what information is provided for the 'Health Check' status?

Accepted Answer

Latency, jitter, and packet loss metrics. The SD-WAN Monitor in FortiManager displays Health Check status, which is derived from the SD-WAN health-check probes configured on the FortiGate. These probes measure latency, jitter, and packet loss for each member link, and FortiManager surfaces those metrics so administrators can see link quality centrally. This is the core purpose of the health-check status view.

Answer

The firmware version of the device

Answer

The number of active users

Answer

The current IP address of the interface

Question 2

During SD-WAN template deployment, what is the role of 'Dynamic Mapping'?

Accepted Answer

To map a single template object to different physical settings on different devices. Dynamic Mapping in SD-WAN template deployment allows a single template object (like an interface or SD-WAN rule) to be mapped to different physical settings on different devices. This enables flexibility when deploying the same template to multiple FortiGates with varying interface names or configurations. It uses variables and metadata to adapt the template to each device's specifics.

Answer

To automate firmware updates

Answer

To monitor bandwidth usage

Answer

To dynamically change the SD-WAN rule based on time

Answer

To calculate the latency of paths

Question 3

Which interface can be used as an SD-WAN member in an SD-WAN template?

Accepted Answer

Physical ports, VLANs, and VPN tunnels. In Fortinet SD-WAN, an SD-WAN member interface can be any logical or physical interface that carries traffic and supports the necessary health-check and performance SLA monitoring. This includes physical ports (e.g., wan1, wan2), VLAN sub-interfaces (e.g., vlan10 on a physical port), and VPN tunnels (e.g., IPsec tunnels, ADVPN shortcuts). The SD-WAN template in FortiManager abstracts these members into a single virtual interface, allowing dynamic path selection based on link quality. Therefore, option A correctly identifies the full set of supported interface types.

Answer

Only WAN physical ports

Answer

Only VLANs

Answer

Only loopback interfaces

Question 4

You have a large SD-WAN deployment. Why would you use a 'Centralized Policy' in FortiManager instead of local policies?

Accepted Answer

To enforce global security and traffic routing policies consistently across multiple sites. A Centralized Policy in FortiManager (typically via Global Policy or ADOM-level shared policy packages) enforces consistent security and SD-WAN routing rules across many sites. It ensures that all managed FortiGates receive the same baseline policy, reducing configuration drift and administrative overhead. This is essential for large SD-WAN deployments where uniform enforcement is required.

Answer

To eliminate the need for logs

Answer

To reduce the CPU load on the FortiGate

Answer

To allow local admins to override global policies

Question 5

When configuring SD-WAN services in a template, what does the 'Performance SLA' setting determine?

Accepted Answer

The criteria for path selection based on link quality. The Performance SLA setting in an SD-WAN template defines the health-check parameters — probe type, target, interval, and thresholds for latency, jitter, and packet loss — that determine whether a member link is considered alive and how it ranks for path selection. SD-WAN rules then use these SLA results to steer traffic to the best-quality link. It is fundamentally a link-quality criterion, not a bandwidth or port-priority setting.

Answer

The physical port priority

Answer

The maximum bandwidth allowed

Answer

The number of tunnels created

Question 6

When using SD-WAN templates, which option allows you to manage different ISPs on different branches within the same template?

Accepted Answer

Dynamic Mapping. Dynamic Mapping in SD-WAN templates lets you bind template variables to per-device values, so the same template can reference different ISP interfaces (e.g., wan1 vs. wan2, or different ISP names) on different branches. When the template is installed, FortiManager resolves each variable against the device's metadata, producing branch-specific SD-WAN configurations from one template. This is the mechanism Fortinet designed specifically for multi-ISP, multi-branch template reuse.

Answer

Global Objects

Answer

Device Groups

Answer

SD-WAN Rules

Question 7

If you modify a shared SD-WAN health check object that is referenced by ten different templates, what happens to the FortiGates?

Accepted Answer

All FortiGates using those templates will be affected after an install. In FortiManager, SD-WAN health check objects are shared objects that can be referenced by multiple templates. When you modify a shared object, the change is stored in the ADOM and must be installed to the managed FortiGates. After the install, all FortiGates using templates that reference that health check will receive the updated configuration.

Answer

The FortiGates will automatically revert to the old settings

Answer

The health check will be disabled on all devices

Answer

Only the templates are updated, not the FortiGates

Question 8

Which TWO of the following are benefits of using SD-WAN templates in FortiManager?

Accepted Answer

Consistent SD-WAN policy application across devices. Option A is correct because SD-WAN templates in FortiManager let you define SD-WAN settings and policies once and apply them consistently across many managed FortiGates, ensuring uniform rules and reducing per-device drift. Option E is correct because these templates enable simplified, scalable configuration deployment for large branch environments by provisioning SD-WAN interfaces, members, and rules centrally instead of manually configuring each device. Option B is incorrect because firmware upgrades are handled by FortiManager's firmware management features, not SD-WAN templates. Option C is incorrect because log analysis is provided by FortiAnalyzer, not by SD-WAN templates in FortiManager. Option D is incorrect because direct FortiGate CLI access is a separate administrative capability and is not a benefit of SD-WAN templates.

Answer

Automatic firmware upgrades

Answer

Automated log analysis

Answer

Direct access to the FortiGate CLI

Question 9

What is required before FortiManager can display SD-WAN monitoring data?

Accepted Answer

The FortiGate must be sending logs to FortiManager. FortiManager displays SD-WAN monitoring data by receiving logs from the FortiGate. The FortiGate must be configured to send logs to FortiManager, typically via the 'log fortianalyzer' or 'log fortimanager' settings. Without logs, FortiManager has no data to display for SD-WAN monitoring, such as performance SLAs, link status, and traffic statistics.

Answer

The FortiGate must have a cloud license

Answer

The FortiGate must be running a specific firmware

Answer

The FortiGate must be in Transparent mode

Question 10

How can you verify that an SD-WAN configuration change was successfully applied to a FortiGate via FortiManager?

Accepted Answer

By checking the Device Manager installation status. FortiManager's Device Manager displays the installation status of configuration changes pushed to managed FortiGates. After installing a policy package or SD-WAN configuration, the installation status column shows whether the change succeeded, failed, or is pending, along with any error details. This is the authoritative verification method.

Answer

By checking the FortiAnalyzer logs

Answer

By restarting the FortiGate

Answer

By viewing the system dashboard of the FortiGate locally

Question 11

Which TWO items must be configured within an SD-WAN template for SD-WAN traffic steering to work?

Accepted Answer

SD-WAN Members. Option B (SD-WAN Members) is correct because traffic steering requires the physical or logical WAN interfaces (and their gateways/links) to be declared as SD-WAN members so the SD-WAN engine knows which links are eligible to carry traffic and can measure their SLA performance. Option C (SD-WAN Rules) is correct because the steering policy itself is defined in SD-WAN rules, which match traffic by criteria such as source/destination, application, or internet service and then select the preferred member (or SLA-based strategy) to forward it. Together, members define the available paths and rules define how traffic is distributed across them, which is exactly what SD-WAN traffic steering needs. Option A (DHCP server settings) is not required for steering, since DHCP only provides address assignment and is unrelated to path selection. Option D (VLAN tagging) is not mandatory, as VLANs are a Layer 2 segmentation mechanism and steering operates on SD-WAN member links and rules. Option E (Local users) is not required, because local user accounts are for administrative authentication and have no role in SD-WAN traffic steering.

Answer

DHCP server settings

Answer

VLAN tagging

Answer

Local users

Question 12

Which THREE pieces of information are displayed in the SD-WAN Monitor in FortiManager?

Accepted Answer

Status of SD-WAN members. Option A is correct because the SD-WAN Monitor in FortiManager displays the operational status of each SD-WAN member (up/down/standby), which is essential for verifying link health. Option B is correct because the monitor shows the performance SLA metrics per member — latency, jitter, and packet loss — that FortiGate uses to steer traffic and trigger failover. Option C is correct because interface bandwidth usage (throughput in/out) per SD-WAN member is presented, allowing admins to see load and utilization across links. Option D is not part of the SD-WAN Monitor; FortiGate system temperature is a hardware sensor value shown in device dashboards or SNMP monitoring, not SD-WAN monitoring. Option E is also unrelated, as the logged-in administrator's username is an administrative session detail, not SD-WAN telemetry.

Answer

System temperature of the FortiGate

Answer

The current username of the logged-in admin

Question 13

Which TWO of these are valid SD-WAN health check protocols?

Accepted Answer

HTTP. HTTP (option C) is a valid SD-WAN health check protocol because SD-WAN controllers and edges can send HTTP GET requests to a target URL and evaluate the response code or latency to determine whether an application path is healthy. Ping (option D) is also valid because SD-WAN health checks commonly use ICMP echo requests to measure reachability, latency, jitter, and packet loss toward a specified destination. These two are the standard probe types supported for SD-WAN SLA/health-check configuration, alongside others like TCP and DNS in some implementations. SSH (option A) is a remote management/shell protocol, not a health-check probe. FTP (option B) is a file-transfer protocol and is not used for periodic path health monitoring. SNMP (option E) is a management/monitoring protocol for polling device metrics, not a probe type used to validate SD-WAN path health.

Answer

SSH

Answer

FTP

Answer

SNMP

Question 14

Which THREE tasks are required to successfully deploy SD-WAN via FortiManager?

Accepted Answer

Installing the configuration to the devices. Option B is correct because deploying SD-WAN through FortiManager requires first creating an SD-WAN template (via the SD-WAN Manager/template wizard) that defines the SD-WAN members, zones, and related settings to be pushed to the FortiGates. Option E is correct because the created SD-WAN template must be assigned to the target managed FortiGates so FortiManager knows which devices should receive the SD-WAN configuration. Option A is correct because after the template is created and assigned, the configuration must be installed to the devices so the SD-WAN settings are actually pushed and activated on the FortiGates. Option C is not required, since a hard factory reset is not a prerequisite for SD-WAN deployment via FortiManager and would unnecessarily wipe the device. Option D is also not required, as existing firewall policies do not need to be deleted; SD-WAN can be deployed alongside or integrated with existing policies.

Answer

Performing a hard factory reset on the FortiGate

Answer

Deleting all existing firewall policies

Question 15

Which TWO methods can be used to update SD-WAN policies across all managed devices in FortiManager?

Accepted Answer

Using a CLI script to push updates. Option A is correct because FortiManager supports running CLI scripts (via Device Manager > Scripts) against managed FortiGates, allowing SD-WAN policy commands to be pushed to all devices in a single script execution. Option B is correct because SD-WAN policies are provisioned through SD-WAN templates in FortiManager, and modifying the template followed by an Install Wizard operation propagates the updated policy to all devices bound to that template. Option C is not the intended method since editing an individual FortiGate policy only affects that single device and does not centrally update policies across all managed devices. Option D is incorrect because creating a new ADOM merely establishes a separate administrative domain and does not push any SD-WAN policy changes. Option E is incorrect because rebooting FortiManager does not modify or distribute SD-WAN policies to managed devices.

Answer

Editing the individual FortiGate policy

Answer

Creating a new ADOM

Answer

Rebooting the FortiManager