FORTINET-NSE7-SPECIALTY Nse7 SD Wan System Configuration And Setup Practice Test 2 — 15 Questions

Question 1

When using SD-WAN zones, what is the primary benefit of grouping multiple physical interfaces into a single zone?

Accepted Answer

It allows you to apply a single firewall policy to the entire group.. Grouping multiple physical interfaces into a single SD-WAN zone allows you to apply a single firewall policy to the entire group, simplifying management and ensuring consistent security policies across all member interfaces. This is the primary benefit because it reduces administrative overhead and ensures that policies are uniformly enforced. While SD-WAN zones can also facilitate load balancing and failover, those are features of the SD-WAN rules applied to the zone, not the primary purpose of grouping interfaces.

Answer

It increases the throughput of individual physical links.

Answer

It prevents the need for performance SLAs.

Answer

It automatically enables load balancing between interfaces.

Question 2

You are deploying a new SD-WAN interface. What is the mandatory step before you can add an interface to an SD-WAN zone?

Accepted Answer

Remove all firewall policy, static route, and DHCP references from the interface.. Before an interface can be added to an SD-WAN zone, FortiOS requires that the interface have no existing references — specifically, it must not be referenced by firewall policies, static routes, or DHCP server configurations. This is because SD-WAN zones take over the interface's role in routing and policy, and leftover references cause conflicts or install failures. Removing those references is the mandatory prerequisite.

Answer

Configure a performance SLA for that specific interface.

Answer

Assign a VLAN ID to the interface.

Answer

Enable SD-WAN on the global system settings.

Question 3

You have an SD-WAN rule with 'Priority' strategy. What happens if the highest priority member fails its SLA?

Accepted Answer

Traffic fails over to the member with the next highest priority value.. With the 'Priority' strategy in an SD-WAN rule, members are ranked by their configured priority value, and the FortiGate actively uses the highest-priority member that meets its SLA. When that member fails its SLA health check, the rule automatically fails over to the next-highest-priority member that is still within SLA, preserving connectivity. This is the defining behavior of the Priority strategy — strict ordered failover rather than load distribution.

Answer

Traffic is dropped.

Answer

The FortiGate enters an error state.

Answer

Traffic is load balanced across all remaining members.

Question 4

Which protocol is NOT a valid option for Performance SLA probes?

Accepted Answer

UDP Broadcast. UDP Broadcast is not a valid protocol for Performance SLA probes in FortiGate SD-WAN. Valid probe protocols include TCP Echo, HTTP, HTTPS, ICMP, and others, but UDP Broadcast is not among them because SLA probes require a response to measure latency, jitter, and packet loss, which broadcast does not provide.

Answer

TCP Echo

Answer

HTTP

Answer

ICMP

Question 5

What is the effect of changing the 'Hold-down' timer in a Performance SLA?

Accepted Answer

It prevents route flapping by delaying the transition back to an 'up' state.. The Hold-down timer in a Performance SLA specifies how long the SLA remains in a down state before it is allowed to transition back to up, even after probes succeed again. This delay prevents rapid flapping between up and down states when link quality is marginal, stabilizing SD-WAN rule decisions. It is a hysteresis mechanism, not a probe frequency or failure threshold.

Answer

It changes the frequency of the probes.

Answer

It sets the maximum number of failed probes allowed.

Answer

It determines the timeout duration for a single probe.

Question 6

You are troubleshooting an issue where traffic is not using an SD-WAN rule despite meeting criteria. What is the most likely cause?

Accepted Answer

A higher-priority SD-WAN rule is matching the traffic first.. SD-WAN rules are evaluated in order, and the first matching rule is applied. If a higher-priority rule matches the traffic first, the intended rule will not be used even if its criteria are met. This is the most likely cause when the rule itself is enabled and correctly configured.

Answer

The SD-WAN rule is disabled.

Answer

The Performance SLA has timed out.

Answer

The interface is not in an SD-WAN zone.

Question 7

You are using 'SLA Target' as your strategy. What happens if multiple members meet the SLA?

Accepted Answer

The system selects the member with the best performance (e.g., lowest latency).. With the SLA Target strategy, FortiGate selects the member that best meets the SLA criteria — typically the one with the lowest latency or best overall quality among those that satisfy the SLA. It is a quality-based selection, not a first-match or bandwidth-based one.

Answer

The system selects the first member in the list.

Answer

The system selects the one with the highest bandwidth capacity.

Answer

Traffic is sent through all of them simultaneously.

Question 8

What is the purpose of the 'Inbound' interface setting in an SD-WAN rule?

Accepted Answer

To restrict the rule to traffic originating from a specific interface.. The 'Inbound' interface setting in an SD-WAN rule specifies the incoming interface for traffic that the rule should match. It restricts the rule to traffic originating from a specific interface, allowing granular control over which traffic is subject to the SD-WAN rule. This is useful when you want to apply different SD-WAN strategies based on the source of the traffic, such as traffic from the LAN versus traffic from a VPN tunnel.

Answer

To enable reverse path forwarding checks.

Answer

To define the WAN gateway.

Answer

To specify the egress interface.

Question 9

Where are SD-WAN zones managed in the FortiGate GUI?

Accepted Answer

Network > SD-WAN > SD-WAN Zones.. SD-WAN zones are configured and managed under Network > SD-WAN > SD-WAN Zones in the FortiGate GUI. This is where administrators create the SD-WAN zone, add member interfaces (physical, IPsec, VLAN), and define the virtual WAN link used by SD-WAN rules and static routes.

Answer

Interface > Physical Interfaces.

Answer

System > Network > Zones.

Answer

Firewall > Policy > Objects.

Question 10

What is the impact of checking the 'Interface Preference' box in an SD-WAN rule?

Accepted Answer

It overrides the SLA strategy selection.. Checking 'Interface Preference' in an SD-WAN rule forces the rule to use the explicitly selected interface(s) rather than letting the SLA strategy dynamically pick the best-performing member. This effectively overrides the SLA-based path selection for that rule, so traffic egresses the preferred interface even if another member has better SLA metrics. It is used when a specific link must be used for policy, compliance, or cost reasons.

Answer

It enables failover to the default gateway.

Answer

It enables load balancing across interfaces.

Answer

It increases the probe frequency.

Question 11

When configuring an SD-WAN rule for a specific application, how does the FortiGate identify the traffic?

Accepted Answer

By using the Application Control database.. FortiGate SD-WAN rules match traffic to applications using the Application Control signature database, which identifies applications by inspecting packet contents (DPI) rather than by static IP/port. When you select an 'Application' or 'Application Category' in an SD-WAN rule, the FortiGate leverages the same IPS/App-Ctrl engine signatures to classify the flow. This allows dynamic identification of SaaS and cloud apps whose IPs and ports change frequently.

Answer

By analyzing the packet payload size.

Answer

By looking at the source MAC address.

Answer

By forcing traffic through a specific VLAN.

Question 12

When setting up a Performance SLA, what is the 'Participant' setting?

Accepted Answer

The SD-WAN member that originates the probe.. In a FortiGate Performance SLA, the 'Participant' setting specifies which SD-WAN member (interface) originates the health check probes. Each member that should be monitored must be added as a participant, and the SLA measures latency, jitter, and packet loss from that member to the configured server.

Answer

The monitoring interval.

Answer

The user group assigned to the probe.

Answer

The destination IP address.

Question 13

What is the maximum number of members allowed in a single SD-WAN zone?

Accepted Answer

Depends on the model, but generally limited by system resources.. The maximum number of members in a single SD-WAN zone is not a fixed hard-coded number; it depends on the FortiGate model and is ultimately bounded by available system resources such as memory and CPU. Fortinet does not publish a universal cap like 4 or 8, and different platforms support different scales. Therefore the correct answer is the model/resource-dependent option.

Answer

8

Answer

2

Answer

4

Question 14

You need to ensure that VoIP traffic stays on the interface with the lowest jitter. Which strategy should you use?

Accepted Answer

SLA Target. FortiGate SD-WAN's SLA Target strategy selects the member link that best meets a defined SLA target (latency, jitter, packet loss) for the specified traffic, making it the correct choice for keeping VoIP on the lowest-jitter interface. Unlike Lowest Cost, SLA Target prioritizes SLA compliance over cost, which is exactly what latency-sensitive VoIP requires.

Answer

Load Balance

Answer

Lowest Cost (SLA)

Answer

Manual

Question 15

What is the purpose of the 'Gateway' override in an SD-WAN member configuration?

Accepted Answer

To specify a manual gateway for the SD-WAN member.. The 'Gateway' override in an SD-WAN member configuration lets you manually specify the next-hop gateway IP address for that member interface. This is needed when the interface is on a subnet where the default gateway cannot be auto-detected, or when you want to force traffic through a specific next-hop (for example, a secondary router). It overrides the automatically learned gateway for that SD-WAN member.

Answer

To force the use of a secondary ISP.

Answer

To bypass the firewall policy.

Answer

To enable load balancing.