FORTINET-NSE7-SPECIALTY Nse7 SD Wan Security Profiles Routing And Ipsec — All Questions With Answers

Question 1

A FortiGate device is configured with an SD-WAN rule utilizing a SLA rule for latency and packet loss. Security profiles including Deep Packet Inspection (DPI) SSL inspection and an Antivirus profile are applied to the firewall policy allowing this traffic. Users report intermittent connection drops on real-time UDP-based applications. Upon troubleshooting, the administrator notices that packet drops occur only when the SD-WAN rule dynamically steers traffic to a backup IPsec tunnel that has a smaller MTU. What is the most likely root cause and mitigation for this behavior?

Accepted Answer

Path MTU Discovery is failing because ICMP unreachable messages are blocked, and TCP MSS clamping is not adjusting the encapsulated IPsec packet size correctly. When SD-WAN steers traffic onto a backup IPsec tunnel with a smaller MTU, the original packet plus IPsec encapsulation (ESP/AH headers) exceeds the tunnel MTU. If ICMP 'fragmentation needed' messages are blocked and TCP MSS clamping is not applied to the IPsec-encapsulated traffic, PMTUD cannot correct the path MTU, so large UDP datagrams are silently dropped. The fix is to enable TCP MSS clamping on the IPsec interface/policy and allow ICMP unreachable so PMTUD works.

Answer

SD-WAN health check probes are overwhelming the IPsec tunnel bandwidth

Answer

The Antivirus proxy buffer is overflowing due to UDP streaming packets

Answer

The SSL inspection profile is attempting to decrypt UDP traffic, causing kernel panic and packet drops

Question 2

An administrator has configured BGP over multiple SD-WAN IPsec tunnels to provide redundant paths to a datacenter. However, asymmetric routing is causing stateful inspection drops on a secondary FortiGate firewall downstream. To ensure that BGP selects the preferred primary SD-WAN member consistently, which BGP attribute is best manipulated via a route-map applied to the BGP neighbor in FortiOS?

Accepted Answer

Local Preference. Local Preference is the BGP attribute used to influence outbound path selection within an autonomous system — higher values are preferred. Applying a route-map on the hub or neighbor that sets a higher local-preference on routes learned via the primary SD-WAN member ensures all iBGP speakers consistently prefer that path, eliminating the asymmetric routing that causes stateful inspection drops.

Answer

AS-PATH prepend

Answer

Cluster ID

Answer

Origin code

Question 3

An enterprise FortiGate is running SD-WAN with multiple internet breakouts. The administrator applies an Application Control security profile to the firewall policy. Some custom business applications are being incorrectly classified or blocked by the Application Control profile. To ensure SD-WAN can reliably steer this traffic using application signatures while preventing false positives, what is the recommended procedure?

Accepted Answer

Create a custom application signature override in the Application Control profile to correctly identify the traffic by port, IP, or pattern. When Application Control misclassifies custom business traffic, the correct fix is to create a custom application signature (or signature override) that matches the traffic by port, IP, or payload pattern, then reference it in the Application Control profile. This lets SD-WAN's application-based steering rules recognize the traffic correctly while the security profile still inspects it, avoiding both false positives and false negatives. The custom signature must be applied before SD-WAN rules evaluate the application ID, so the order of profile and policy matters.

Answer

Disable all security profiles on the SD-WAN interface zone

Answer

Configure static routes for the application servers and bypass SD-WAN rules completely

Answer

Switch the inspection mode from flow-based to proxy-based for all firewall policies

Question 4

An administrator configures an ADVPN 2.0 deployment between a FortiGate hub and multiple spokes using OSPF as the dynamic routing protocol. The spoke units need to establish direct shortcut tunnels dynamically. Which configuration step is mandatory on the hub to ensure that BGP or OSPF next-hop resolution works correctly for ADVPN shortcut creation?

Accepted Answer

Disable next-hop-self on the hub's BGP neighbor configuration or adjust OSPF interface settings so the advertising router is not forced as the next hop. For ADVPN 2.0 shortcut tunnels to form, the spoke must be able to resolve the next hop of the remote spoke's subnet to the remote spoke's public IP (or the shortcut tunnel IP) rather than back through the hub. If the hub advertises routes with next-hop-self (BGP) or forces itself as the advertising router/next hop (OSPF), spokes will always forward traffic through the hub and never trigger a shortcut. Disabling next-hop-self on the hub's BGP neighbors, or adjusting OSPF so the hub is not forced as the next hop, allows the spoke to see the true next hop and initiate the ADVPN shortcut.

Answer

Enable split-horizon globally within the OSPF routing process

Answer

Enable exchange-interface in the hub's OSPF interface configuration

Answer

Configure a static blackhole route for all spoke subnets on the hub

Question 5

An enterprise deploys BGP over SD-WAN with multiple MPLS and broadband connections. A route-map is applied to incoming BGP updates on the FortiGate to set a specific weight for routes learned over the MPLS interface. Why is the 'weight' attribute particularly effective in this FortiOS SD-WAN and BGP integration scenario?

Accepted Answer

Weight is evaluated first in the BGP best-path selection algorithm on FortiOS, allowing local preference override without altering global AS path attributes. In FortiOS BGP, the weight attribute is a Cisco-style, locally significant value evaluated first in the best-path selection algorithm — before local preference, AS path, and other attributes. Setting a higher weight on routes learned over the MPLS interface ensures those routes are preferred without modifying globally propagated attributes like AS path or local preference, which keeps the change local to the FortiGate.

Answer

Weight replaces the need for SD-WAN SLA rules by performing layer 7 packet inspection

Answer

Weight automatically adjusts the SD-WAN health check probe frequency based on route stability

Answer

Weight is propagated to all iBGP peers, ensuring cluster-wide path synchronization

Question 6

An administrator configures an IPsec tunnel template for ADVPN 2.0 on a FortiGate hub. Which specific Phase 1 configuration parameter must be enabled to support dynamic shortcut creation between spokes in ADVPN 2.0?

Accepted Answer

set net-device enable. In ADVPN 2.0, the hub must have 'set net-device enable' on the IPsec Phase 1 interface so that the FortiGate can install dynamic shortcut routes and forward traffic between spokes over the tunnel interface. Without net-device enabled, the tunnel is treated as a point-to-point interface and the hub cannot properly route spoke-to-spoke shortcut traffic. This parameter is what allows the ADVPN shortcut negotiation to function at the routing layer.

Answer

set mode aggressive

Answer

set dhcp-interception enable

Answer

set pfs-group modp1024

Question 7

An enterprise network implements BGP over ADVPN. Spoke units advertise their local subnets to the hub via BGP. To prevent spokes from learning each other's subnets directly through the hub via regular BGP route propagation before an ADVPN shortcut is established (forcing them to route through the hub unnecessarily), or conversely, to optimize route distribution, what BGP feature is typically configured on the hub?

Accepted Answer

BGP Route Reflection configured on the hub with spoke routers set as clients. In a hub-and-spoke ADVPN topology, spokes peer with the hub but not with each other. BGP route reflection on the hub allows the hub to reflect routes learned from one spoke to other spokes without requiring a full iBGP mesh, which is the standard design for distributing spoke subnets while controlling propagation. This lets the hub act as the route reflector and spokes as clients, so shortcut establishment can be triggered by traffic while route distribution remains centralized and manageable.

Answer

BGP Multipath relaxing with maximum-paths set to 32

Answer

Static default route redistribution with aggregate-address suppression

Answer

BGP Confederation with each spoke acting as a separate autonomous system

Question 8

An administrator configures an SD-WAN rule to route guest Wi-Fi traffic out of a secondary broadband internet connection. However, guest users are still able to access internal corporate subnets that are routed over the primary IPsec VPN tunnel. What configuration is missing or incorrect?

Accepted Answer

The firewall policy permitting traffic from the Guest Wi-Fi interface to the internal VPN interface lacks proper security profile enforcement or is missing a deny rule blocking inter-zone access. The SD-WAN rule only controls egress path selection; it does not implicitly block guest-to-internal traffic. If a firewall policy permits Guest Wi-Fi → internal VPN interface (or an implicit inter-zone allow exists), guest users can still reach corporate subnets. The correct fix is to ensure the policy from Guest Wi-Fi to the internal zone either enforces the required security profiles or, more commonly, is replaced/blocked by an explicit deny rule so inter-zone access is not permitted.

Answer

The SD-WAN health check probe is not monitoring the corporate subnet gateway

Answer

The IPsec Phase 2 security association selectors include the guest subnet range

Answer

The SD-WAN rule priority for the internal VPN interface is set higher than the broadband interface

Question 9

An administrator troubleshoots an ADVPN 2.0 deployment where dynamic shortcut tunnels fail to establish between branch spokes. Which THREE diagnostic steps or log checks should the administrator perform on the FortiGate hub or spoke to isolate the issue? (Choose three)

Accepted Answer

Check 'diagnose vpn tunnel list' to verify if dynamic shortcut child security associations are being created. Option A is correct because 'diagnose vpn tunnel list' shows all IPsec tunnels including dynamic shortcut child SAs, so the administrator can confirm whether the ADVPN shortcut negotiation actually produced child SAs between spokes. Option C is correct because enabling IKE real-time debugging with 'diagnose vpn ike log-filter' lets the administrator inspect the IKEv2 negotiation messages (proposals, nonces, traffic selectors) exchanged between spokes to pinpoint where shortcut setup fails. Option E is correct because 'get router info routing-table database' reveals the dynamic shortcut routes that ADVPN injects when traffic matches the phase 1 interface, verifying whether the hub propagated the shortcut route and the spoke installed it. Option B is not relevant because SD-WAN rule hit counts are unrelated to ADVPN shortcut tunnel establishment and zero hits globally would not isolate the shortcut failure. Option D is incorrect and destructive because formatting the internal flash would erase configuration and logs rather than diagnose corrupted ADVPN certificates, which should be checked with certificate and IKE debugging commands instead.

Answer

Check the firewall policy statistics to ensure SD-WAN rules have zero hit counts globally

Answer

Execute 'execute format disk' to reset the internal flash storage and clear corrupted ADVPN certificates

Question 10

An administrator is configuring SD-WAN rules with performance SLAs. Which TWO strategies are available in FortiOS when configuring an SD-WAN rule based on SLA metrics? (Choose two)

Accepted Answer

Lowest Cost (SLA). Option A, Lowest Cost (SLA), is correct because FortiOS SD-WAN rules support a strategy that selects the member with the lowest cost among those that currently meet the configured performance SLA, allowing cost-based preference while still honoring latency, jitter, and packet-loss thresholds. Option B, Priority, is correct because FortiOS also offers a priority-based strategy in which SD-WAN members are ordered by their configured priority and the highest-priority member that satisfies the SLA is chosen, with lower-priority members used as fallback. The other options do not belong: Round-Robin DNS Load Balancing is a DNS-based distribution method, not an SD-WAN SLA strategy; Dynamic BGP AS-Prepending is a routing policy technique for influencing BGP path selection, not a FortiOS SD-WAN rule strategy; and Static Flow-Hashing is a load-balancing/hashing method for distributing flows, not one of the SLA-based SD-WAN strategies in FortiOS.

Answer

Round-Robin DNS Load Balancing

Answer

Dynamic BGP AS-Prepending

Answer

Static Flow-Hashing

Question 11

An administrator has an SD-WAN rule that steers traffic to a destination subnet through a VPN overlay zone containing two IPsec tunnels. The rule uses the 'Lowest Cost (SLA)' strategy, and both members are within their SLA. The administrator notices that all sessions are using the same tunnel, and wants FortiOS to distribute new sessions across both members while still respecting SLA. Which configuration change should the administrator make?

Accepted Answer

Change the rule strategy to 'Maximize Bandwidth (SLA)' so FortiOS load-balances sessions across all SLA-compliant members.. Because both overlay members satisfy the SLA, the desired behavior is per-session distribution across them. FortiOS only load-balances across SLA-compliant members when the rule uses the Maximize Bandwidth (SLA) strategy; Lowest Cost (SLA) deliberately selects the single best-cost member for all matching sessions. Switching the strategy changes selection behavior without altering SLA enforcement or the member set.

Answer

Configure the two IPsec tunnels as members of a redundant interface and reference that interface in the SD-WAN rule.

Answer

Enable 'preserve-session-route' on the SD-WAN rule to allow symmetric session distribution.

Answer

Add a second SD-WAN rule with the same destination and a higher priority, and reference the second tunnel.

Question 12

A FortiGate is configured with an IPsec VPN tunnel that is a member of an SD-WAN zone. The administrator applies a Web Filter security profile to an SD-WAN rule that steers HTTP traffic from the internal network to the internet through that zone. Users report that some malicious sites are not blocked, even though the profile is correctly configured and licensed. What is the most likely cause?

Accepted Answer

Security profiles cannot be applied to SD-WAN rules; they must be applied to the firewall policy that permits the traffic.. SD-WAN rules control path selection, not security inspection. FortiOS applies Web Filter and other security profiles through firewall policies. If the profile is attached only to the SD-WAN rule, the traffic may be steered correctly but never inspected, producing inconsistent blocking. The fix is to attach the Web Filter profile to the firewall policy that permits the traffic through the SD-WAN zone.

Answer

Web Filtering requires SSL inspection to be enabled on the SD-WAN rule for all categories to be blocked.

Answer

The SD-WAN zone must be referenced in a separate 'security-profile' CLI section before profiles take effect.

Answer

The IPsec tunnel must have 'inspection-mode' enabled for security profiles to inspect decrypted traffic.

Question 13

An enterprise network uses ADVPN 2.0 with BGP running over IPsec tunnels. A spoke needs to initiate a shortcut tunnel to another spoke. Which FortiOS CLI command is used on the hub to verify the active shortcut tunnels and view the shortcut state information?

Accepted Answer

diagnose vpn tunnel list. On FortiOS, 'diagnose vpn tunnel list' displays all active IPsec tunnels including ADVPN shortcut tunnels, showing their names, source/destination, and state. This is the standard command to confirm that a shortcut has been negotiated between spokes and to inspect its current status.

Answer

execute router clear bgp all

Answer

get system sdwan neighbor

Answer

diagnose netlink interface list

Question 14

An administrator wants to apply a Web Filtering security profile to traffic that is being dynamically steered via an SD-WAN rule. Where must this security profile be enforced in FortiOS?

Accepted Answer

Inside the firewall policy that matches the traffic being steered by the SD-WAN rule. In FortiOS, SD-WAN rules only control path selection (which outgoing interface to use) and do not themselves apply security profiles. Security profiles such as Web Filtering must be enforced in the firewall policy that matches the traffic, because the firewall policy is where UTM/security inspection is applied after the SD-WAN rule has chosen the egress path. Therefore, the Web Filtering profile must be attached to the firewall policy that handles the steered traffic.

Answer

Directly inside the SD-WAN rule configuration under the advanced settings tab

Answer

Globally under the system settings as an SD-WAN overlay inspection profile

Answer

Within the IPsec tunnel phase 2 security association settings

Question 15

An IPsec VPN tunnel used as an SD-WAN member is experiencing intermittent flapping due to DPD (Dead Peer Detection) timeout issues over a high-latency satellite link. How should the administrator adjust the Phase 1 IPsec settings on FortiOS to stabilize the tunnel without completely disabling failure detection?

Accepted Answer

Increase the DPD retry count and interval settings under the IPsec Phase 1 configuration. Increasing the DPD retry count and interval under IPsec Phase 1 settings allows the FortiGate to tolerate longer delays before declaring the peer dead. On high-latency satellite links, packets may take longer to arrive, causing false DPD timeouts. By adjusting these parameters, the tunnel remains stable while still detecting genuine failures, as DPD is not disabled.

Answer

Disable DPD entirely so the FortiGate never tears down the tunnel

Answer

Enable NP6/NP7 hardware offloading for Phase 1 SA renegotiation

Answer

Change the IPsec phase 1 mode from Main mode to Aggressive mode

Question 16

When troubleshooting SD-WAN performance SLA packet loss, an administrator wants to view real-time latency, jitter, and packet loss statistics for individual health check members. Which CLI command should be executed?

Accepted Answer

diagnose sys sdwan health-check. The command 'diagnose sys sdwan health-check' displays real-time health check statistics for each SD-WAN member, including latency, jitter, packet loss, and SLA status. This is the correct CLI tool for troubleshooting performance SLA metrics on individual members.

Answer

get system interface physical

Answer

execute ping-server status

Answer

show system sdwan

Question 17

In an ADVPN 2.0 deployment, a hub unit uses BGP to advertise routes to spokes. When a spoke learns a prefix via BGP from the hub, what mechanism allows the spoke to automatically initiate an ADVPN shortcut tunnel directly to another spoke when traffic flows between them?

Accepted Answer

The FortiGate kernel detects traffic matching a dynamic BGP route over the IPsec interface and initiates an IKE shortcut negotiation with the target spoke. In ADVPN 2.0, the spoke learns a BGP route to a remote spoke's subnet via the hub. When traffic matches that route and is sent over the IPsec interface to the hub, the FortiGate kernel detects it and triggers an IKE shortcut negotiation directly with the target spoke, establishing a direct tunnel. This is the core ADVPN shortcut mechanism.

Answer

OSPF sends a special multicast hello packet across the hub to establish mesh point-to-point links

Answer

FortiManager pushes a dynamic static route to both spokes simultaneously

Answer

The Web Filtering profile intercepts the packet and redirects it via proxy to the destination spoke

Question 18

An administrator configures an SD-WAN rule with a 'Lowest Cost (SLA)' strategy. What determines the metric used by FortiOS to select the best interface when multiple links meet the SLA criteria?

Accepted Answer

The lowest packet loss, jitter, or latency value measured by the health check among the qualifying links. With the 'Lowest Cost (SLA)' strategy, FortiOS first filters SD-WAN members to those currently meeting their SLA targets (latency, jitter, packet loss thresholds defined in the health check). Among the qualifying members, it selects the one with the lowest measured cost metric — typically the lowest latency, jitter, or packet loss value reported by the health check probes. This makes the selection dynamic and performance-driven rather than static.

Answer

The round-robin algorithm applied sequentially across all active links

Answer

The lowest physical port number on the FortiGate hardware

Answer

The highest interface bandwidth capacity defined in the static route table

Question 19

When configuring an SD-WAN health check to monitor internet reachability using HTTP/HTTPS requests, which parameter defines the specific string the FortiGate expects to receive in the server response body to validate that the path is healthy?

Accepted Answer

http-match. The http-match parameter in an SD-WAN health check defines the exact string that the FortiGate searches for in the HTTP/HTTPS response body to confirm the probe succeeded. When the FortiGate sends an HTTP GET to the configured URL, it compares the returned payload against this string; a mismatch marks the SLA member as failed. This allows administrators to validate not just TCP reachability but actual application-layer health.

Answer

probe-packet-size

Answer

sla-break-time

Answer

server-response-timeout

Question 20

An administrator is troubleshooting an SD-WAN deployment where traffic matching an SD-WAN rule with a destination service object (e.g., HTTPS) is not being steered according to the SLA priority. Instead, it is always taking the default static route member. Upon checking the firewall policies, what is the most common reason why an SD-WAN rule fails to process application or service-based traffic matching?

Accepted Answer

The SD-WAN rules are evaluated sequentially from top to bottom; an earlier broad SD-WAN rule with matching source/destination IP addresses is intercepting the traffic before the service-specific rule is reached. SD-WAN rules are evaluated top-down in the order they appear in the rule list, and the first matching rule wins. If an earlier rule matches on broad source/destination IP criteria, it intercepts the traffic before the service-specific rule (e.g., HTTPS) is ever evaluated, so the service-based steering never applies. This is the most common cause of 'my SD-WAN rule isn't working' in FortiGate deployments.

Answer

IPsec VPN phase 2 selectors must be set to 0.0.0.0/0 for service-based rules to evaluate

Answer

The firewall policy containing the traffic has SSL inspection disabled, preventing service-based identification

Answer

The FortiGate kernel requires hardware acceleration (NP7) to be disabled for service-based SD-WAN rules to function

FORTINET-NSE7-SPECIALTY Nse7 SD Wan Security Profiles Routing And Ipsec — All Questions With Answers

An administrator configures an IPsec tunnel template for ADVPN 2.0 on a FortiGate hub. Which specific Phase 1 configuration parameter must be enabled to support dynamic shortcut creation between spokes in ADVPN 2.0?

An administrator configures an SD-WAN rule to route guest Wi-Fi traffic out of a secondary broadband internet connection. However, guest users are still able to access internal corporate subnets that are routed over the primary IPsec VPN tunnel. What configuration is missing or incorrect?

An administrator troubleshoots an ADVPN 2.0 deployment where dynamic shortcut tunnels fail to establish between branch spokes. Which THREE diagnostic steps or log checks should the administrator perform on the FortiGate hub or spoke to isolate the issue? (Choose three)

An administrator is configuring SD-WAN rules with performance SLAs. Which TWO strategies are available in FortiOS when configuring an SD-WAN rule based on SLA metrics? (Choose two)

An enterprise network uses ADVPN 2.0 with BGP running over IPsec tunnels. A spoke needs to initiate a shortcut tunnel to another spoke. Which FortiOS CLI command is used on the hub to verify the active shortcut tunnels and view the shortcut state information?

An administrator wants to apply a Web Filtering security profile to traffic that is being dynamically steered via an SD-WAN rule. Where must this security profile be enforced in FortiOS?

When troubleshooting SD-WAN performance SLA packet loss, an administrator wants to view real-time latency, jitter, and packet loss statistics for individual health check members. Which CLI command should be executed?

In an ADVPN 2.0 deployment, a hub unit uses BGP to advertise routes to spokes. When a spoke learns a prefix via BGP from the hub, what mechanism allows the spoke to automatically initiate an ADVPN shortcut tunnel directly to another spoke when traffic flows between them?

An administrator configures an SD-WAN rule with a 'Lowest Cost (SLA)' strategy. What determines the metric used by FortiOS to select the best interface when multiple links meet the SLA criteria?

When configuring an SD-WAN health check to monitor internet reachability using HTTP/HTTPS requests, which parameter defines the specific string the FortiGate expects to receive in the server response body to validate that the path is healthy?

An administrator implements BGP over SD-WAN tunnels to a cloud provider. The cloud provider requires BGP MD5 authentication on all peering sessions. Where is BGP MD5 authentication configured on the FortiGate?

An administrator needs to inspect encrypted traffic traversing an SD-WAN IPsec tunnel using Deep Packet Inspection (DPI). What must be installed on the client endpoints or configured on the FortiGate to prevent browser trust warnings when using SSL/TLS full inspection?

A FortiGate device is running ADVPN 2.0 with OSPF. A spoke experiences transient routing loops when a shortcut tunnel tears down due to inactivity timeout. Which configuration adjustment on the FortiGate hub and spokes prevents these temporary routing blackholes or loops during shortcut teardown?

An administrator configures an SD-WAN rule using the 'Volume' strategy across two IPsec tunnels with different bandwidth capacities (Tunnel A: 100 Mbps, Tunnel B: 50 Mbps). How does FortiOS distribute traffic across these members when using the Volume strategy?

An administrator wants to view the active SD-WAN rule hit counts and verify which traffic is matching a specific SD-WAN rule in FortiOS. Which command should be used?

An administrator configures a static route where the gateway is an SD-WAN zone instead of a specific IP address. How does FortiOS process this SD-WAN static route?

An administrator is configuring BGP over SD-WAN IPsec tunnels between a headquarters FortiGate and branch FortiGates. Which TWO configuration steps are required to ensure robust and stable dynamic routing over the SD-WAN IPsec tunnels? (Choose two)

An administrator applies security profiles (Antivirus, Web Filtering, and IPS) to traffic steered by an SD-WAN rule. Performance issues arise. Which TWO methods can the administrator use to optimize inspection performance without completely disabling security? (Choose two)

An administrator troubleshoots a scenario where traffic matching an application-based SD-WAN rule is bypassing the preferred high-speed MPLS tunnel and taking the backup broadband tunnel instead. Which THREE factors should the administrator check to resolve this routing discrepancy? (Choose three)

When configuring advanced IPsec VPN tunnels to act as members of an SD-WAN zone, which TWO configuration parameters on the FortiGate are critical for ensuring proper IPsec tunnel operation and traffic steering? (Choose two)

An enterprise deploys ADVPN 2.0 with BGP and security profiles applied to traffic traversing the VPN overlay. Which THREE statements are correct regarding how security profiles and ADVPN 2.0 interact in FortiOS? (Choose three)

An administrator is troubleshooting BGP route propagation over SD-WAN IPsec tunnels where a branch office is not receiving specific routes from the datacenter hub. Which TWO CLI commands on the FortiGate are most useful for diagnosing BGP peering and advertised route issues? (Choose two)

An administrator configures an SD-WAN health check with multiple probes (e.g., ping and HTTP) to monitor a set of IPsec VPN tunnels. Which THREE criteria or settings govern how FortiOS determines whether an SD-WAN member has met or failed the performance SLA? (Choose three)

FORTINET-NSE7-SPECIALTY Nse7 SD Wan Security Profiles Routing And Ipsec — All Questions With Answers

An administrator configures an IPsec tunnel template for ADVPN 2.0 on a FortiGate hub. Which specific Phase 1 configuration parameter must be enabled to support dynamic shortcut creation between spokes in ADVPN 2.0?

An administrator configures an SD-WAN rule to route guest Wi-Fi traffic out of a secondary broadband internet connection. However, guest users are still able to access internal corporate subnets that are routed over the primary IPsec VPN tunnel. What configuration is missing or incorrect?

An administrator troubleshoots an ADVPN 2.0 deployment where dynamic shortcut tunnels fail to establish between branch spokes. Which THREE diagnostic steps or log checks should the administrator perform on the FortiGate hub or spoke to isolate the issue? (Choose three)

An administrator is configuring SD-WAN rules with performance SLAs. Which TWO strategies are available in FortiOS when configuring an SD-WAN rule based on SLA metrics? (Choose two)

An enterprise network uses ADVPN 2.0 with BGP running over IPsec tunnels. A spoke needs to initiate a shortcut tunnel to another spoke. Which FortiOS CLI command is used on the hub to verify the active shortcut tunnels and view the shortcut state information?

An administrator wants to apply a Web Filtering security profile to traffic that is being dynamically steered via an SD-WAN rule. Where must this security profile be enforced in FortiOS?

When troubleshooting SD-WAN performance SLA packet loss, an administrator wants to view real-time latency, jitter, and packet loss statistics for individual health check members. Which CLI command should be executed?

In an ADVPN 2.0 deployment, a hub unit uses BGP to advertise routes to spokes. When a spoke learns a prefix via BGP from the hub, what mechanism allows the spoke to automatically initiate an ADVPN shortcut tunnel directly to another spoke when traffic flows between them?

An administrator configures an SD-WAN rule with a 'Lowest Cost (SLA)' strategy. What determines the metric used by FortiOS to select the best interface when multiple links meet the SLA criteria?

When configuring an SD-WAN health check to monitor internet reachability using HTTP/HTTPS requests, which parameter defines the specific string the FortiGate expects to receive in the server response body to validate that the path is healthy?

An administrator implements BGP over SD-WAN tunnels to a cloud provider. The cloud provider requires BGP MD5 authentication on all peering sessions. Where is BGP MD5 authentication configured on the FortiGate?

An administrator needs to inspect encrypted traffic traversing an SD-WAN IPsec tunnel using Deep Packet Inspection (DPI). What must be installed on the client endpoints or configured on the FortiGate to prevent browser trust warnings when using SSL/TLS full inspection?

A FortiGate device is running ADVPN 2.0 with OSPF. A spoke experiences transient routing loops when a shortcut tunnel tears down due to inactivity timeout. Which configuration adjustment on the FortiGate hub and spokes prevents these temporary routing blackholes or loops during shortcut teardown?

An administrator configures an SD-WAN rule using the 'Volume' strategy across two IPsec tunnels with different bandwidth capacities (Tunnel A: 100 Mbps, Tunnel B: 50 Mbps). How does FortiOS distribute traffic across these members when using the Volume strategy?

An administrator wants to view the active SD-WAN rule hit counts and verify which traffic is matching a specific SD-WAN rule in FortiOS. Which command should be used?

An administrator configures a static route where the gateway is an SD-WAN zone instead of a specific IP address. How does FortiOS process this SD-WAN static route?

An administrator is configuring BGP over SD-WAN IPsec tunnels between a headquarters FortiGate and branch FortiGates. Which TWO configuration steps are required to ensure robust and stable dynamic routing over the SD-WAN IPsec tunnels? (Choose two)

An administrator applies security profiles (Antivirus, Web Filtering, and IPS) to traffic steered by an SD-WAN rule. Performance issues arise. Which TWO methods can the administrator use to optimize inspection performance without completely disabling security? (Choose two)

An administrator troubleshoots a scenario where traffic matching an application-based SD-WAN rule is bypassing the preferred high-speed MPLS tunnel and taking the backup broadband tunnel instead. Which THREE factors should the administrator check to resolve this routing discrepancy? (Choose three)

When configuring advanced IPsec VPN tunnels to act as members of an SD-WAN zone, which TWO configuration parameters on the FortiGate are critical for ensuring proper IPsec tunnel operation and traffic steering? (Choose two)

An enterprise deploys ADVPN 2.0 with BGP and security profiles applied to traffic traversing the VPN overlay. Which THREE statements are correct regarding how security profiles and ADVPN 2.0 interact in FortiOS? (Choose three)

An administrator is troubleshooting BGP route propagation over SD-WAN IPsec tunnels where a branch office is not receiving specific routes from the datacenter hub. Which TWO CLI commands on the FortiGate are most useful for diagnosing BGP peering and advertised route issues? (Choose two)

An administrator configures an SD-WAN health check with multiple probes (e.g., ping and HTTP) to monitor a set of IPsec VPN tunnels. Which THREE criteria or settings govern how FortiOS determines whether an SD-WAN member has met or failed the performance SLA? (Choose three)