FORTINET-NSE7-SPECIALTY Nse7 SD Wan System Configuration And Setup — 25 Questions

Question 1

Where do you configure the 'Gateway' IP address for an SD-WAN member?

Accepted Answer

Under Network > SD-WAN > SD-WAN Members.. The Gateway IP address for an SD-WAN member is configured under Network > SD-WAN > SD-WAN Members in FortiGate. This is where each member interface is defined with its gateway, priority, and other SD-WAN-specific parameters. The gateway here refers to the next-hop IP used for that SD-WAN member's traffic, which is essential for proper SD-WAN rule evaluation and health checks.

Answer

Under Firewall Policy.

Answer

Under Network > Static Routes.

Answer

Under System > Interfaces.

Question 2

Which of the following is required to successfully implement SD-WAN?

Accepted Answer

At least two physical interfaces.. SD-WAN fundamentally requires at least two WAN interfaces (members) so that traffic can be steered, load-balanced, or failed over between them. Without multiple members, there is no path selection to perform, so two physical interfaces is the minimum requirement.

Answer

A FortiManager instance.

Answer

A subscription to FortiGuard SD-WAN service.

Answer

An external load balancer.

Question 3

What is the default behavior when all SD-WAN members in a rule fail their SLA?

Accepted Answer

The traffic uses all members.. If all members fail the SLA, the default behavior is that the rule will use all members as if the SLA was met, unless configured otherwise.

Answer

The traffic is routed to the management interface.

Answer

The rule becomes inactive.

Answer

The traffic is dropped.

Question 4

Which CLI command displays the SD-WAN routing table?

Accepted Answer

get system sdwan neighbor. The command 'get system sdwan neighbor' shows the current routing status of SD-WAN members.

Answer

show system sdwan

Answer

get router info routing-table all

Answer

diagnose sys route list

Question 5

Which THREE of the following are valid strategies for SD-WAN rules?

Accepted Answer

Priority. In FortiGate SD-WAN, a rule's strategy determines how traffic is distributed across the selected members, and Priority (A) is valid because it sends all matching traffic through the highest-priority member that is up, failing over to the next member only when the preferred one becomes unavailable. Maximize Bandwidth (B) is also valid: it load-balances sessions across all eligible members in proportion to each link's measured bandwidth, so higher-capacity links carry more traffic. SLA Target (D) is valid because it selects members based on whether they meet the configured SLA criteria (latency, jitter, packet loss) from the SD-WAN health check, steering traffic only to links that satisfy the target. Load Balance (C) is not one of the SD-WAN rule strategies — the actual load-balancing strategies are Maximize Bandwidth and the default source-IP-based balancing, so a bare 'Load Balance' is not a selectable strategy. Round Robin (E) is likewise not a valid SD-WAN rule strategy in FortiOS; it is not offered as a strategy option for SD-WAN rules.

Answer

Load Balance

Answer

Round Robin

Question 6

Which THREE of the following are benefits of using SD-WAN?

Accepted Answer

Simplified WAN management through zones.. Option B is correct because SD-WAN controllers abstract WAN transport links into logical zones or virtual topologies, letting administrators apply consistent policies across all sites and providers from a single management plane instead of configuring each router individually. Option C is correct because SD-WAN continuously monitors link health (via BFD, IP SLA, or similar probes) and automatically reroutes traffic to a backup WAN link when latency, jitter, or packet loss crosses a threshold, providing automated failover without manual intervention. Option E is correct because SD-WAN's application-aware routing engine classifies traffic by application and steers each flow over the path that best meets its performance requirements (for example, sending VoIP over the lowest-latency link and bulk backup traffic over a cheaper broadband link) using policy-based dynamic path selection. Option A is not a benefit of SD-WAN because the technology is an overlay that operates over existing WAN transports and does not supply or install physical layer cabling. Option D is not a benefit of SD-WAN because automatic hardware replacement is a vendor support/RMA service, not a function of the SD-WAN software architecture.

Answer

Built-in physical layer cabling.

Answer

Automatic hardware replacement.

Question 7

Which TWO of the following are necessary to enable SD-WAN on a FortiGate?

Accepted Answer

Creating at least one SD-WAN rule.. Option B is correct because SD-WAN functionality on a FortiGate requires at least one SD-WAN rule (config system sdwan / config service) to define how traffic is steered across the member links; without a rule, no SD-WAN path selection or load balancing occurs. Option C is correct because the SD-WAN members must be added to an SD-WAN zone (config system sdwan, config zone, edit , set interface ) before rules can reference them, making zone membership a prerequisite for enabling SD-WAN. Option A is not required since Feature Visibility only controls GUI display of menus and does not enable the underlying SD-WAN feature. Option D is not required because SD-WAN does not depend on a FortiGuard database update. Option E is not required because BGP peering is an optional routing design choice, not a prerequisite for SD-WAN.

Answer

Enabling SD-WAN in the Feature Visibility menu.

Answer

Updating the FortiGuard database.

Answer

Configuring a BGP peer.

Question 8

Which TWO of the following occur when a member is removed from an SD-WAN zone?

Accepted Answer

The interface can then be used for other configurations like static routes.. Option B is correct because once an interface is removed from an SD-WAN zone, it is no longer bound to the zone's virtual-wan-link configuration, so it becomes a normal interface that can be referenced by other features such as static routes, DHCP, or firewall policies. Option E is correct because SD-WAN rules reference zone members by interface; when a member is removed from the zone, any SD-WAN rule that still lists that interface as a source or destination member must be updated to remove it, otherwise the rule references a non-member interface. Option A is incorrect because removing a member from an SD-WAN zone does not trigger a FortiGate reboot. Option C is incorrect because the interface does not automatically become a WAN port; its role is determined by its own configuration, not by zone membership. Option D is incorrect because firewall policies referencing the zone are not deleted; they may become invalid or need adjustment, but FortiOS does not automatically remove them.

Answer

The FortiGate restarts automatically.

Answer

The interface automatically reverts to a WAN port.

Answer

All firewall policies referencing the zone are deleted.

Question 9

You are configuring an SD-WAN rule on a FortiGate running FortiOS 7.0. The rule uses the 'Maximize Bandwidth (SLA)' strategy with two members in the same zone: WAN1 and WAN2. You want traffic to use both links simultaneously only when both meet the configured Performance SLA. Which configuration is required to achieve this?

Accepted Answer

Enable 'load-balance' in the SD-WAN rule and set the strategy to 'Maximize Bandwidth (SLA)'.. The 'Maximize Bandwidth (SLA)' strategy is designed to load-balance traffic across all SLA-compliant members. Enabling the 'load-balance' option ensures that traffic is distributed across multiple links when they meet the SLA, maximizing bandwidth utilization. This configuration allows both WAN1 and WAN2 to be used simultaneously only when both satisfy the Performance SLA.

Answer

Set the strategy to 'Priority' and assign equal priority to both members.

Answer

Configure a separate SD-WAN rule for each member and enable 'load-balance' in both rules.

Answer

Set the strategy to 'Lowest Cost (SLA)' and configure both members with equal cost.

Question 10

You are configuring an SD-WAN rule on a FortiGate running FortiOS 7.0 to steer traffic for a critical application. You want the rule to select the member with the lowest latency that also meets the SLA, and if multiple members meet the SLA, you want to use the one with the lowest cost. Which strategy should you select?

Accepted Answer

Lowest Latency (SLA). The 'Lowest Latency (SLA)' strategy chooses the member with the lowest latency that satisfies the SLA. When multiple members meet the SLA, it uses cost as a tiebreaker to select the most cost-effective path. This aligns perfectly with the need to prioritize latency and then cost. Other strategies either ignore latency or do not select a single best member based on these criteria.

Answer

Priority

Answer

Lowest Cost (SLA)

Answer

Maximize Bandwidth (SLA)

Question 11

When configuring an SD-WAN rule, what is the purpose of the 'Source' address field?

Accepted Answer

To match traffic based on the source IP or user.. The Source address field in an SD-WAN rule is used to match traffic based on the source IP address or user identity, allowing the rule to apply only to specific sources. This is part of the rule's matching criteria, alongside destination and service, to determine which traffic is steered by the SD-WAN rule. It does not define gateway IPs or force zones.

Answer

To define the gateway IP for the route.

Answer

To force traffic to a specific SD-WAN zone.

Answer

To determine which ISP the traffic exits through regardless of SLA.

Question 12

Which command is used to verify the current status of SD-WAN members and their SLA health from the CLI?

Accepted Answer

diagnose sys sdwan health-check. The command 'diagnose sys sdwan health-check' displays the current SLA health status of each SD-WAN member, including latency, jitter, packet loss, and up/down state per health-check. It is the primary CLI tool for verifying SD-WAN member SLA status in real time.

Answer

show router info bgp

Answer

get system interface

Answer

get system sdwan member

Question 13

You are configuring a Performance SLA to monitor reachability to a SaaS application. Which parameter determines the threshold for an interface to be considered 'unhealthy' in the SD-WAN routing table?

Accepted Answer

Packet Loss Threshold. The Packet Loss Threshold in a Performance SLA defines the maximum acceptable percentage of lost probes before the member is marked unhealthy. When packet loss exceeds this threshold (along with latency and jitter thresholds), the SD-WAN engine disqualifies the member from the routing table.

Answer

Probe Mode

Answer

Sequence Number

Answer

Update Interval

Question 14

Which SD-WAN rule strategy should you choose if you want to distribute traffic across multiple interfaces based on their bandwidth weights?

Accepted Answer

Maximize Bandwidth (SLA). The 'Maximize Bandwidth (SLA)' strategy selects SD-WAN members that meet the SLA and then distributes traffic across them proportionally to their configured bandwidth weights. This is the strategy designed to aggregate and load-balance traffic based on link capacity, making it the correct choice when you want weighted distribution by bandwidth.

Answer

Manual

Answer

Lowest Cost (SLA)

Answer

SLA Target

Question 15

An SD-WAN rule is configured with 'Lowest Cost (SLA)' strategy. If all members in the SLA meet the requirements, how does the FortiGate select the outgoing interface?

Accepted Answer

The member with the lowest interface cost value defined in the SD-WAN member configuration.. With the 'Lowest Cost (SLA)' strategy, FortiGate first filters SD-WAN members to those that meet the SLA targets (latency, jitter, packet loss). Among the qualifying members, it then selects the member with the lowest configured interface cost value in the SD-WAN member configuration. This is a two-stage decision: SLA eligibility first, then cost-based tie-breaking.

Answer

Round Robin

Answer

The interface with the highest bandwidth.

Answer

The interface that was most recently added to the zone.

Question 16

When using SD-WAN zones, what is the primary benefit of grouping multiple physical interfaces into a single zone?

Accepted Answer

It allows you to apply a single firewall policy to the entire group.. Grouping multiple physical interfaces into a single SD-WAN zone allows you to apply a single firewall policy to the entire group, simplifying management and ensuring consistent security policies across all member interfaces. This is the primary benefit because it reduces administrative overhead and ensures that policies are uniformly enforced. While SD-WAN zones can also facilitate load balancing and failover, those are features of the SD-WAN rules applied to the zone, not the primary purpose of grouping interfaces.

Answer

It increases the throughput of individual physical links.

Answer

It prevents the need for performance SLAs.

Answer

It automatically enables load balancing between interfaces.

Question 17

You are deploying a new SD-WAN interface. What is the mandatory step before you can add an interface to an SD-WAN zone?

Accepted Answer

Remove all firewall policy, static route, and DHCP references from the interface.. Before an interface can be added to an SD-WAN zone, FortiOS requires that the interface have no existing references — specifically, it must not be referenced by firewall policies, static routes, or DHCP server configurations. This is because SD-WAN zones take over the interface's role in routing and policy, and leftover references cause conflicts or install failures. Removing those references is the mandatory prerequisite.

Answer

Configure a performance SLA for that specific interface.

Answer

Assign a VLAN ID to the interface.

Answer

Enable SD-WAN on the global system settings.

Question 18

You have an SD-WAN rule with 'Priority' strategy. What happens if the highest priority member fails its SLA?

Accepted Answer

Traffic fails over to the member with the next highest priority value.. With the 'Priority' strategy in an SD-WAN rule, members are ranked by their configured priority value, and the FortiGate actively uses the highest-priority member that meets its SLA. When that member fails its SLA health check, the rule automatically fails over to the next-highest-priority member that is still within SLA, preserving connectivity. This is the defining behavior of the Priority strategy — strict ordered failover rather than load distribution.

Answer

Traffic is dropped.

Answer

The FortiGate enters an error state.

Answer

Traffic is load balanced across all remaining members.

Question 19

Which protocol is NOT a valid option for Performance SLA probes?

Accepted Answer

UDP Broadcast. UDP Broadcast is not a valid protocol for Performance SLA probes in FortiGate SD-WAN. Valid probe protocols include TCP Echo, HTTP, HTTPS, ICMP, and others, but UDP Broadcast is not among them because SLA probes require a response to measure latency, jitter, and packet loss, which broadcast does not provide.

Answer

TCP Echo

Answer

HTTP

Answer

ICMP

Question 20

What is the effect of changing the 'Hold-down' timer in a Performance SLA?

Accepted Answer

It prevents route flapping by delaying the transition back to an 'up' state.. The Hold-down timer in a Performance SLA specifies how long the SLA remains in a down state before it is allowed to transition back to up, even after probes succeed again. This delay prevents rapid flapping between up and down states when link quality is marginal, stabilizing SD-WAN rule decisions. It is a hysteresis mechanism, not a probe frequency or failure threshold.

Answer

It changes the frequency of the probes.

Answer

It sets the maximum number of failed probes allowed.

Answer

It determines the timeout duration for a single probe.