FORTINET-NSE7-SPECIALTY Nse7 SD Wan Security Profiles Routing And Ipsec Practice Test 2 — 15 Questions

Question 1

When troubleshooting SD-WAN performance SLA packet loss, an administrator wants to view real-time latency, jitter, and packet loss statistics for individual health check members. Which CLI command should be executed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

diagnose sys sdwan health-check. The command 'diagnose sys sdwan health-check' displays real-time health check statistics for each SD-WAN member, including latency, jitter, packet loss, and SLA status. This is the correct CLI tool for troubleshooting performance SLA metrics on individual members.

Answer

get system interface physical

Answer

execute ping-server status

Answer

show system sdwan

Question 2

In an ADVPN 2.0 deployment, a hub unit uses BGP to advertise routes to spokes. When a spoke learns a prefix via BGP from the hub, what mechanism allows the spoke to automatically initiate an ADVPN shortcut tunnel directly to another spoke when traffic flows between them?

Accepted Answer

The FortiGate kernel detects traffic matching a dynamic BGP route over the IPsec interface and initiates an IKE shortcut negotiation with the target spoke. In ADVPN 2.0, the spoke learns a BGP route to a remote spoke's subnet via the hub. When traffic matches that route and is sent over the IPsec interface to the hub, the FortiGate kernel detects it and triggers an IKE shortcut negotiation directly with the target spoke, establishing a direct tunnel. This is the core ADVPN shortcut mechanism.

Answer

OSPF sends a special multicast hello packet across the hub to establish mesh point-to-point links

Answer

FortiManager pushes a dynamic static route to both spokes simultaneously

Answer

The Web Filtering profile intercepts the packet and redirects it via proxy to the destination spoke

Question 3

An administrator configures an SD-WAN rule with a 'Lowest Cost (SLA)' strategy. What determines the metric used by FortiOS to select the best interface when multiple links meet the SLA criteria?

Accepted Answer

The lowest packet loss, jitter, or latency value measured by the health check among the qualifying links. With the 'Lowest Cost (SLA)' strategy, FortiOS first filters SD-WAN members to those currently meeting their SLA targets (latency, jitter, packet loss thresholds defined in the health check). Among the qualifying members, it selects the one with the lowest measured cost metric — typically the lowest latency, jitter, or packet loss value reported by the health check probes. This makes the selection dynamic and performance-driven rather than static.

Answer

The round-robin algorithm applied sequentially across all active links

Answer

The lowest physical port number on the FortiGate hardware

Answer

The highest interface bandwidth capacity defined in the static route table

Question 4

When configuring an SD-WAN health check to monitor internet reachability using HTTP/HTTPS requests, which parameter defines the specific string the FortiGate expects to receive in the server response body to validate that the path is healthy?

Accepted Answer

http-match. The http-match parameter in an SD-WAN health check defines the exact string that the FortiGate searches for in the HTTP/HTTPS response body to confirm the probe succeeded. When the FortiGate sends an HTTP GET to the configured URL, it compares the returned payload against this string; a mismatch marks the SLA member as failed. This allows administrators to validate not just TCP reachability but actual application-layer health.

Answer

probe-packet-size

Answer

sla-break-time

Answer

server-response-timeout

Question 5

An administrator is troubleshooting an SD-WAN deployment where traffic matching an SD-WAN rule with a destination service object (e.g., HTTPS) is not being steered according to the SLA priority. Instead, it is always taking the default static route member. Upon checking the firewall policies, what is the most common reason why an SD-WAN rule fails to process application or service-based traffic matching?

Accepted Answer

The SD-WAN rules are evaluated sequentially from top to bottom; an earlier broad SD-WAN rule with matching source/destination IP addresses is intercepting the traffic before the service-specific rule is reached. SD-WAN rules are evaluated top-down in the order they appear in the rule list, and the first matching rule wins. If an earlier rule matches on broad source/destination IP criteria, it intercepts the traffic before the service-specific rule (e.g., HTTPS) is ever evaluated, so the service-based steering never applies. This is the most common cause of 'my SD-WAN rule isn't working' in FortiGate deployments.

Answer

IPsec VPN phase 2 selectors must be set to 0.0.0.0/0 for service-based rules to evaluate

Answer

The firewall policy containing the traffic has SSL inspection disabled, preventing service-based identification

Answer

The FortiGate kernel requires hardware acceleration (NP7) to be disabled for service-based SD-WAN rules to function

Question 6

An administrator implements BGP over SD-WAN tunnels to a cloud provider. The cloud provider requires BGP MD5 authentication on all peering sessions. Where is BGP MD5 authentication configured on the FortiGate?

Accepted Answer

Under the router bgp neighbor configuration block in the CLI. BGP MD5 authentication is configured on the FortiGate under the BGP neighbor configuration in the CLI, using the command 'set password' within the 'config router bgp' and 'config neighbor' blocks. This sets the TCP MD5 signature option for the BGP session, which must match on both peers. It is not configured in firewall policies, IPsec Phase 1 settings, or SD-WAN health checks.

Answer

Within the firewall policy authentication settings

Answer

Under the IPsec phase 1 interface advanced settings

Answer

Inside the SD-WAN health check probe configuration

Question 7

An administrator needs to inspect encrypted traffic traversing an SD-WAN IPsec tunnel using Deep Packet Inspection (DPI). What must be installed on the client endpoints or configured on the FortiGate to prevent browser trust warnings when using SSL/TLS full inspection?

Accepted Answer

The FortiGate's self-signed CA certificate must be installed in the trusted root certificate store of the client endpoints. When the FortiGate performs SSL/TLS full inspection, it acts as a man-in-the-middle, re-signing every server certificate with its own CA certificate. For browsers and applications to trust the re-signed certificates without warnings, the FortiGate's inspection CA certificate must be imported into the trusted root certificate store of every client endpoint. This is the standard requirement for any full DPI deployment, whether over SD-WAN IPsec tunnels or direct internet paths.

Answer

ADVPN 2.0 shortcut certificates must be exchanged between spokes

Answer

BGP MD5 authentication keys must match on both routers

Answer

A pre-shared key must be configured in the IPsec Phase 1 proposal

Question 8

A FortiGate device is running ADVPN 2.0 with OSPF. A spoke experiences transient routing loops when a shortcut tunnel tears down due to inactivity timeout. Which configuration adjustment on the FortiGate hub and spokes prevents these temporary routing blackholes or loops during shortcut teardown?

Accepted Answer

Adjust the administrative distance or use route redistribution filters with appropriate metrics so hub routes and shortcut routes do not conflict during teardown. ADVPN 2.0 shortcut tunnels are dynamically created direct spoke-to-spoke IPsec tunnels, and when they tear down due to inactivity, the routing table must reconverge so traffic falls back to the hub. If OSPF metrics or administrative distances cause the hub-learned route and the shortcut route to conflict during teardown, transient loops or blackholes occur. Adjusting administrative distance or using redistribution filters with appropriate metrics ensures the hub route is preferred only when the shortcut is gone, preventing the race condition.

Answer

Disable OSPF on the spoke units and rely entirely on static default routes

Answer

Set the IPsec phase 1 lifetime to infinite to prevent shortcuts from timing out

Answer

Configure asymmetric routing bypass on all firewall policies

Question 9

An administrator configures an SD-WAN rule using the 'Volume' strategy across two IPsec tunnels with different bandwidth capacities (Tunnel A: 100 Mbps, Tunnel B: 50 Mbps). How does FortiOS distribute traffic across these members when using the Volume strategy?

Accepted Answer

Traffic is distributed proportionally based on the configured weight or bandwidth ratio of each member interface. The Volume strategy in FortiOS SD-WAN distributes sessions across member interfaces in proportion to each member's configured weight (or bandwidth-derived weight). With Tunnel A at 100 Mbps and Tunnel B at 50 Mbps, FortiOS sends roughly two-thirds of traffic over Tunnel A and one-third over Tunnel B, matching the 2:1 capacity ratio. This prevents overloading the lower-capacity link while maximizing aggregate throughput.

Answer

Traffic is balanced equally (50/50) regardless of interface capacity

Answer

Traffic is sent exclusively over Tunnel A until it reaches 100% packet loss, then fails over to Tunnel B

Answer

Traffic is steered strictly based on real-time latency measured by health checks

Question 10

An administrator wants to view the active SD-WAN rule hit counts and verify which traffic is matching a specific SD-WAN rule in FortiOS. Which command should be used?

Accepted Answer

diagnose sys sdwan service. The command `diagnose sys sdwan service` is the correct choice because it displays the SD-WAN service table, which includes each rule's hit count and the list of matching traffic flows. This command provides real-time statistics on which sessions are being steered by specific SD-WAN rules, allowing administrators to verify rule effectiveness. It is the primary diagnostic tool for SD-WAN rule monitoring in FortiOS.

Answer

show system sdwan

Answer

execute router clear sdwan cache

Answer

get firewall policy statistics

Question 11

A FortiGate SD-WAN deployment uses a firewall policy with an Intrusion Prevention System (IPS) profile applied. After turning on IPS, administrators notice that throughput over an IPsec SD-WAN tunnel drops significantly. What is the primary reason for this throughput reduction, and how can it be mitigated?

Accepted Answer

IPS inspection requires intensive CPU processing for packet payload analysis, which can be optimized by using flow-based inspection mode and ensuring hardware offloading is active where supported. IPS inspection is CPU-intensive because it analyzes packet payloads against signature databases, which reduces throughput on IPsec tunnels. Mitigation includes using flow-based inspection (which is less resource-intensive than proxy-based) and ensuring hardware offloading (NPU/CP) is active where supported, so encrypted traffic can be accelerated.

Answer

IPS requires proxy-based inspection, which permanently disables IPsec hardware acceleration

Answer

IPS blocks all IPsec AH/ESP headers, forcing fallback to unencrypted GRE tunnels

Answer

The IPS database size exceeds the IPsec Phase 2 buffer limit

Question 12

An administrator configures a static route where the gateway is an SD-WAN zone instead of a specific IP address. How does FortiOS process this SD-WAN static route?

Accepted Answer

The FortiOS SD-WAN engine intercepts the route lookup and applies SD-WAN rules to dynamically select the best member interface based on performance SLAs. When a static route's gateway is an SD-WAN zone, FortiOS treats it as an SD-WAN route and invokes the SD-WAN engine during route lookup. The engine evaluates the configured SD-WAN rules and health-check SLAs to dynamically select the best member interface for the traffic, rather than using a fixed next-hop IP. This enables performance-based routing and failover without changing the static route.

Answer

The FortiGate drops the packet because static routes require a valid IP address gateway

Answer

The packet is forwarded exclusively through the physical interface with the lowest index number

Answer

Traffic is load-balanced equally across all physical interfaces in the FortiGate chassis using round-robin

Question 13

An administrator is configuring BGP over SD-WAN IPsec tunnels between a headquarters FortiGate and branch FortiGates. Which TWO configuration steps are required to ensure robust and stable dynamic routing over the SD-WAN IPsec tunnels? (Choose two)

Accepted Answer

Configure BGP neighbors using the loopback interface IP addresses or tunnel specific IP addresses rather than physical interface IPs. Option B is correct because peering BGP over loopback or tunnel-specific IP addresses decouples the BGP session from any single physical WAN link, so the session stays up when an individual SD-WAN member link flaps and traffic can be steered across remaining IPsec tunnels. Option C is correct because WAN latency spikes and failover delays can exceed default BGP keepalive (60s) and hold-down (180s) timers, causing session resets; enabling graceful restart or tuning these timers preserves routing state and prevents unnecessary reconvergence during transient SD-WAN events. Option A is wrong because administrative distance 255 makes the route unusable and does not disable BGP updates; it would break routing rather than stabilize it. Option D is wrong because static default routes to null0 would blackhole traffic and are not a BGP-over-SD-WAN requirement. Option E is wrong because disabling IPsec Phase 2 encryption would break the IPsec tunnel and is not needed for BGP, which is encapsulated inside the tunnel.

Answer

Set the BGP administrative distance to 255 to disable all routing updates

Answer

Configure static default routes on all BGP neighbors pointing to the null0 interface

Answer

Disable IPsec phase 2 encryption to allow BGP plaintext hello packets to pass through without encapsulation overhead

Question 14

An enterprise network uses OSPF over SD-WAN IPsec tunnels. The administrator notices that OSPF adjacency is constantly dropping over a specific backup SD-WAN member link due to intermittent packet loss. Which THREE configuration adjustments can improve OSPF stability over unstable SD-WAN IPsec links? (Choose three)

Accepted Answer

Configure OSPF network type as point-to-point on the IPsec tunnel interfaces to eliminate unnecessary DR/BDR elections. Option A is correct because configuring the OSPF network type as point-to-point on the IPsec tunnel interfaces removes the DR/BDR election process, which is unnecessary on a tunnel that connects only two routers and whose election churn can cause adjacency resets during packet loss. Option B is correct because enabling OSPF graceful restart (and helper mode on the neighbor) allows a restarting or flapping router to keep forwarding traffic and preserve adjacencies without tearing down and relearning routes, which directly improves stability over intermittent SD-WAN links. Option D is correct because increasing the hello and dead intervals makes OSPF more tolerant of temporary packet loss, since the dead interval is typically 4x the hello interval and a longer timer prevents the adjacency from being declared down during brief outages. Option C is incorrect because a router ID of 0.0.0.0 is invalid for OSPF and would prevent the router from forming adjacencies or participating in the OSPF domain. Option E is incorrect because OSPF relies on hello packets to discover and maintain neighbors; disabling them would break adjacency formation and force reliance on static routes, which is not an OSPF stability adjustment.

Answer

Set the OSPF router ID to 0.0.0.0 on all branch spokes

Answer

Disable OSPF hello packets entirely and rely on static default routes

Question 15

An administrator applies security profiles (Antivirus, Web Filtering, and IPS) to traffic steered by an SD-WAN rule. Performance issues arise. Which TWO methods can the administrator use to optimize inspection performance without completely disabling security? (Choose two)

Accepted Answer

Switch the inspection mode from proxy-based to flow-based where supported, allowing hardware offloading (NP6/NP7) to accelerate packet processing. Option A is correct because switching from proxy-based to flow-based inspection where the FortiGate model supports it allows traffic to be accelerated by network processors (NP6/NP7) via hardware offloading, which dramatically reduces CPU load and latency while still applying Antivirus, Web Filtering, and IPS security. Option C is correct because configuring security profile exemptions or antivirus inspection overrides for trusted internal subnets or latency-sensitive VoIP traffic lets the administrator bypass heavy inspection only for specific low-risk or delay-sensitive flows, preserving security for the rest of the traffic. Option B is wrong because DES is a weak, deprecated cipher that does not meaningfully improve IPsec performance and would degrade security rather than optimize inspection. Option D is wrong because disabling SSL inspection globally removes a critical security control and does not address the SD-WAN inspection performance issue in a targeted way. Option E is wrong because removing the SD-WAN virtual interface from all firewall zones would break the SD-WAN routing and policy enforcement entirely, not optimize inspection.

Answer

Set the IPsec Phase 1 encryption algorithm to DES to speed up decryptions

Answer

Disable all SSL inspection globally across the entire FortiGate device

Answer

Remove the SD-WAN virtual interface from all firewall zones