FORTINET-NSE7-SPECIALTY Nse7 SD Wan Security Profiles Routing And Ipsec Practice Test 2 — 15 Questions

Question 1

An administrator needs to inspect encrypted traffic traversing an SD-WAN IPsec tunnel using Deep Packet Inspection (DPI). What must be installed on the client endpoints or configured on the FortiGate to prevent browser trust warnings when using SSL/TLS full inspection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The FortiGate's self-signed CA certificate must be installed in the trusted root certificate store of the client endpoints. When using SSL Full Inspection (DPI), the FortiGate acts as a man-in-the-middle and re-signs certificates using a Certificate Authority (CA) certificate. This CA certificate must be installed and trusted on the client devices.

Answer

ADVPN 2.0 shortcut certificates must be exchanged between spokes

Answer

BGP MD5 authentication keys must match on both routers

Answer

A pre-shared key must be configured in the IPsec Phase 1 proposal

Question 2

A FortiGate device is running ADVPN 2.0 with OSPF. A spoke experiences transient routing loops when a shortcut tunnel tears down due to inactivity timeout. Which configuration adjustment on the FortiGate hub and spokes prevents these temporary routing blackholes or loops during shortcut teardown?

Accepted Answer

Adjust the administrative distance or use route redistribution filters with appropriate metrics so hub routes and shortcut routes do not conflict during teardown. When shortcuts time out, routes must cleanly transition back to the hub route without creating transient routing loops. Adjusting route redistribution metrics, using specific distance values, or configuring 'shortcut-routing' / route-map timers / asymmetric routing settings prevents loops. In FortiOS ADVPN, setting appropriate dead timers or using dynamic routing distance adjustments ensures the hub route has a predictable preference when the shortcut drops.

Answer

Disable OSPF on the spoke units and rely entirely on static default routes

Answer

Set the IPsec phase 1 lifetime to infinite to prevent shortcuts from timing out

Answer

Configure asymmetric routing bypass on all firewall policies

Question 3

An administrator configures an SD-WAN rule using the 'Volume' strategy across two IPsec tunnels with different bandwidth capacities (Tunnel A: 100 Mbps, Tunnel B: 50 Mbps). How does FortiOS distribute traffic across these members when using the Volume strategy?

Accepted Answer

Traffic is distributed proportionally based on the configured weight or bandwidth ratio of each member interface. The Volume strategy in SD-WAN distributes traffic proportional to the configured volume/weight (bandwidth capacity) of each member interface.

Answer

Traffic is balanced equally (50/50) regardless of interface capacity

Answer

Traffic is sent exclusively over Tunnel A until it reaches 100% packet loss, then fails over to Tunnel B

Answer

Traffic is steered strictly based on real-time latency measured by health checks

Question 4

An administrator wants to view the active SD-WAN rule hit counts and verify which traffic is matching a specific SD-WAN rule in FortiOS. Which command should be used?

Accepted Answer

diagnose sys sdwan service. To view runtime statistics and hit counts for SD-WAN rules, the command 'diagnose sys sdwan service' is used.

Answer

show system sdwan

Answer

execute router clear sdwan cache

Answer

get firewall policy statistics

Question 5

An enterprise network implements BGP over ADVPN. Spoke units advertise their local subnets to the hub via BGP. To prevent spokes from learning each other's subnets directly through the hub via regular BGP route propagation before an ADVPN shortcut is established (forcing them to route through the hub unnecessarily), or conversely, to optimize route distribution, what BGP feature is typically configured on the hub?

Accepted Answer

BGP Route Reflection configured on the hub with spoke routers set as clients. In BGP over ADVPN, Route Reflection is typically enabled on the hub so that spoke-to-spoke routes are reflected correctly, or next-hop behavior is manipulated. Wait, if we want spokes not to learn routes or to handle them correctly without full mesh, BGP Route Reflection (with no-client-to-client reflection if desired, or standard route reflection) is used. Alternatively, disabling next-hop-self or using peer groups. Let's look at the options. BGP Route Reflection on the hub allows the hub to reflect routes between spoke iBGP peers without requiring a full mesh iBGP session between every spoke.

Answer

BGP Multipath relaxing with maximum-paths set to 32

Answer

Static default route redistribution with aggregate-address suppression

Answer

BGP Confederation with each spoke acting as a separate autonomous system

Question 6

A FortiGate SD-WAN deployment uses a firewall policy with an Intrusion Prevention System (IPS) profile applied. After turning on IPS, administrators notice that throughput over an IPsec SD-WAN tunnel drops significantly. What is the primary reason for this throughput reduction, and how can it be mitigated?

Accepted Answer

IPS inspection requires intensive CPU processing for packet payload analysis, which can be optimized by using flow-based inspection mode and ensuring hardware offloading is active where supported. IPS inspection performs deep packet inspection and signature matching, which is CPU-intensive. While NP6/NP7 hardware offloading accelerates IPsec encryption, full content inspection like IPS typically requires CPU processing unless offloaded or optimized. Using flow-based inspection or hardware offloading settings where supported helps mitigate performance impact.

Answer

IPS requires proxy-based inspection, which permanently disables IPsec hardware acceleration

Answer

IPS blocks all IPsec AH/ESP headers, forcing fallback to unencrypted GRE tunnels

Answer

The IPS database size exceeds the IPsec Phase 2 buffer limit

Question 7

An administrator configures an SD-WAN rule to route guest Wi-Fi traffic out of a secondary broadband internet connection. However, guest users are still able to access internal corporate subnets that are routed over the primary IPsec VPN tunnel. What configuration is missing or incorrect?

Accepted Answer

The firewall policy permitting traffic from the Guest Wi-Fi interface to the internal VPN interface lacks proper security profile enforcement or is missing a deny rule blocking inter-zone access. SD-WAN rules route internet or specific traffic based on criteria, but traffic between zones (like Guest Wi-Fi to Corporate LAN) is governed by firewall policies. If a firewall policy permits traffic from Guest Wi-Fi directly to Corporate LAN, it bypasses SD-WAN rules because SD-WAN rules only evaluate traffic matching egress SD-WAN zones/interfaces specified by the rule or routing table lookup. To prevent guest traffic from reaching internal subnets, the firewall policy must block or restrict that inter-zone traffic.

Answer

The SD-WAN health check probe is not monitoring the corporate subnet gateway

Answer

The IPsec Phase 2 security association selectors include the guest subnet range

Answer

The SD-WAN rule priority for the internal VPN interface is set higher than the broadband interface

Question 8

An administrator configures a static route where the gateway is an SD-WAN zone instead of a specific IP address. How does FortiOS process this SD-WAN static route?

Accepted Answer

The FortiOS SD-WAN engine intercepts the route lookup and applies SD-WAN rules to dynamically select the best member interface based on performance SLAs. When a static route points to an SD-WAN zone as its gateway, the FortiOS routing table delegates the packet forwarding decision to the SD-WAN engine, which then evaluates SD-WAN rules to select the best member interface.

Answer

The FortiGate drops the packet because static routes require a valid IP address gateway

Answer

The packet is forwarded exclusively through the physical interface with the lowest index number

Answer

Traffic is load-balanced equally across all physical interfaces in the FortiGate chassis using round-robin

Question 9

An administrator is configuring BGP over SD-WAN IPsec tunnels between a headquarters FortiGate and branch FortiGates. Which TWO configuration steps are required to ensure robust and stable dynamic routing over the SD-WAN IPsec tunnels? (Choose two)

Accepted Answer

Configure BGP neighbors using the loopback interface IP addresses or tunnel specific IP addresses rather than physical interface IPs. Robust BGP over SD-WAN requires configuring the BGP router ID, setting up appropriate timers or neighbor relationships, and ensuring that the underlying SD-WAN members and IPsec tunnels allow routing protocol traffic. Additionally, managing BGP timers or enabling graceful restart helps maintain stability during brief IPsec reconnections.

Answer

Set the BGP administrative distance to 255 to disable all routing updates

Answer

Configure static default routes on all BGP neighbors pointing to the null0 interface

Answer

Disable IPsec phase 2 encryption to allow BGP plaintext hello packets to pass through without encapsulation overhead

Question 10

An administrator troubleshoots an ADVPN 2.0 deployment where dynamic shortcut tunnels fail to establish between branch spokes. Which THREE diagnostic steps or log checks should the administrator perform on the FortiGate hub or spoke to isolate the issue? (Choose three)

Accepted Answer

Check 'diagnose vpn tunnel list' to verify if dynamic shortcut child security associations are being created. Troubleshooting ADVPN shortcut failures requires checking IPsec status, IKE exchanges, routing table entries, and network device creation. Valid diagnostic steps include checking IKE daemon output, verifying IPsec tunnel status, and inspecting routing table entries for shortcut triggers.

Answer

Check the firewall policy statistics to ensure SD-WAN rules have zero hit counts globally

Answer

Execute 'execute format disk' to reset the internal flash storage and clear corrupted ADVPN certificates

Question 11

An enterprise network uses OSPF over SD-WAN IPsec tunnels. The administrator notices that OSPF adjacency is constantly dropping over a specific backup SD-WAN member link due to intermittent packet loss. Which THREE configuration adjustments can improve OSPF stability over unstable SD-WAN IPsec links? (Choose three)

Accepted Answer

Configure OSPF network type as point-to-point on the IPsec tunnel interfaces to eliminate unnecessary DR/BDR elections. To stabilize OSPF over unstable WAN links, adjusting OSPF hello and dead intervals, configuring OSPF dead-drop or fast-hello settings carefully, or utilizing passive interfaces/MD5 authentication correctly helps. Furthermore, ensuring that OSPF timers match and are relaxed prevents unnecessary adjacency drops.

Answer

Set the OSPF router ID to 0.0.0.0 on all branch spokes

Answer

Disable OSPF hello packets entirely and rely on static default routes

Question 12

An administrator applies security profiles (Antivirus, Web Filtering, and IPS) to traffic steered by an SD-WAN rule. Performance issues arise. Which TWO methods can the administrator use to optimize inspection performance without completely disabling security? (Choose two)

Accepted Answer

Switch the inspection mode from proxy-based to flow-based where supported, allowing hardware offloading (NP6/NP7) to accelerate packet processing. Optimizing security profile performance while maintaining inspection includes switching inspection mode to flow-based where appropriate, tuning antivirus/IPS settings to bypass heavy file types or exempt trusted IPs, and leveraging hardware acceleration.

Answer

Set the IPsec Phase 1 encryption algorithm to DES to speed up decryptions

Answer

Disable all SSL inspection globally across the entire FortiGate device

Answer

Remove the SD-WAN virtual interface from all firewall zones

Question 13

An administrator is configuring SD-WAN rules with performance SLAs. Which TWO strategies are available in FortiOS when configuring an SD-WAN rule based on SLA metrics? (Choose two)

Accepted Answer

Lowest Cost (SLA). FortiOS SD-WAN rule strategies include Lowest Cost (SLA), Max Bandwidth, Service-ID, Volume, and Priority. Among these, Priority and Lowest Cost (SLA) are standard strategy options utilizing SLA performance metrics.

Answer

Round-Robin DNS Load Balancing

Answer

Dynamic BGP AS-Prepending

Answer

Static Flow-Hashing

Question 14

An administrator troubleshoots a scenario where traffic matching an application-based SD-WAN rule is bypassing the preferred high-speed MPLS tunnel and taking the backup broadband tunnel instead. Which THREE factors should the administrator check to resolve this routing discrepancy? (Choose three)

Accepted Answer

Inspect the member priorities and weights configured within the specific SD-WAN rule. When an SD-WAN rule bypasses preferred paths, potential causes include SLA health check failure (the preferred link fails the SLA threshold), incorrect rule evaluation order (an earlier rule matches first), or interface priority/weight settings within the rule. Checking these three areas is standard practice.

Answer

Verify the FortiGate factory default administrator password is changed

Answer

Check the physical layer OSI Model cable category connected to the FortiGate port

Question 15

When configuring advanced IPsec VPN tunnels to act as members of an SD-WAN zone, which TWO configuration parameters on the FortiGate are critical for ensuring proper IPsec tunnel operation and traffic steering? (Choose two)

Accepted Answer

Ensure the IPsec interface is added to an SD-WAN zone and assigned a valid virtual IP/interface configuration. When configuring IPsec tunnels for SD-WAN, setting the interface as a member of an SD-WAN zone and ensuring correct Phase 2 selectors or mode-cfg / routing settings are essential. Specifically, setting the interface to allow traffic, defining appropriate Phase 2 selectors or using 0.0.0.0/0 with route-based VPNs, and assigning it to an SD-WAN zone are critical.

Answer

Disable NAT traversal (NAT-T) globally on all IPsec phase 1 tunnels

Answer

Configure the IPsec tunnel mode as dialup server on all participating branch spokes

Answer

Set the IPsec phase 1 authentication method strictly to RSA certificates only, disabling pre-shared keys