FORTINET-NSE7-SPECIALTY Nse7 SD Wan System Configuration And Setup — Timed 20 Questions

Question 1

What is the default behavior when all SD-WAN members in a rule fail their SLA?

Accepted Answer

The traffic uses all members.. If all members fail the SLA, the default behavior is that the rule will use all members as if the SLA was met, unless configured otherwise.

Answer

The traffic is routed to the management interface.

Answer

The rule becomes inactive.

Answer

The traffic is dropped.

Question 2

Which CLI command displays the SD-WAN routing table?

Accepted Answer

get system sdwan neighbor. The command 'get system sdwan neighbor' shows the current routing status of SD-WAN members.

Answer

show system sdwan

Answer

get router info routing-table all

Answer

diagnose sys route list

Question 3

When configuring an SD-WAN rule, what is the purpose of the 'Source' address field?

Accepted Answer

To match traffic based on the source IP or user.. The 'Source' field allows you to selectively apply SD-WAN rules based on specific traffic origins, such as a subnet or user group.

Answer

To define the gateway IP for the route.

Answer

To force traffic to a specific SD-WAN zone.

Answer

To determine which ISP the traffic exits through regardless of SLA.

Question 4

Which command is used to verify the current status of SD-WAN members and their SLA health from the CLI?

Accepted Answer

diagnose sys sdwan health-check. The command 'diagnose sys sdwan health-check' shows the status of configured health checks and member reachability.

Answer

show router info bgp

Answer

get system interface

Answer

get system sdwan member

Question 5

You are configuring a Performance SLA to monitor reachability to a SaaS application. Which parameter determines the threshold for an interface to be considered 'unhealthy' in the SD-WAN routing table?

Accepted Answer

Packet Loss Threshold. The 'threshold-alert' or the individual latency/jitter/packet loss thresholds within the Performance SLA configuration dictate when a member is marked failed.

Answer

Probe Mode

Answer

Sequence Number

Answer

Update Interval

Question 6

Which SD-WAN rule strategy should you choose if you want to distribute traffic across multiple interfaces based on their bandwidth weights?

Accepted Answer

Maximize Bandwidth (SLA). The 'Maximize Bandwidth' strategy allows traffic distribution based on the configured bandwidth weight for each interface.

Answer

Manual

Answer

Lowest Cost (SLA)

Answer

SLA Target

Question 7

An SD-WAN rule is configured with 'Lowest Cost (SLA)' strategy. If all members in the SLA meet the requirements, how does the FortiGate select the outgoing interface?

Accepted Answer

The member with the lowest interface cost value defined in the SD-WAN member configuration.. In 'Lowest Cost (SLA)' mode, the FortiGate selects the member with the lowest configured cost that meets the SLA requirements.

Answer

Round Robin

Answer

The interface with the highest bandwidth.

Answer

The interface that was most recently added to the zone.

Question 8

When using SD-WAN zones, what is the primary benefit of grouping multiple physical interfaces into a single zone?

Accepted Answer

It allows you to apply a single firewall policy to the entire group.. Zones allow you to reference a group of interfaces in a single firewall policy, simplifying the configuration.

Answer

It increases the throughput of individual physical links.

Answer

It prevents the need for performance SLAs.

Answer

It automatically enables load balancing between interfaces.

Question 9

You are deploying a new SD-WAN interface. What is the mandatory step before you can add an interface to an SD-WAN zone?

Accepted Answer

Remove all firewall policy, static route, and DHCP references from the interface.. Before an interface can be added to an SD-WAN zone, it must not have any existing references, such as being used in a firewall policy, static route, or DHCP server configuration.

Answer

Configure a performance SLA for that specific interface.

Answer

Assign a VLAN ID to the interface.

Answer

Enable SD-WAN on the global system settings.

Question 10

You have an SD-WAN rule with 'Priority' strategy. What happens if the highest priority member fails its SLA?

Accepted Answer

Traffic fails over to the member with the next highest priority value.. In 'Priority' strategy, if the highest priority member becomes unhealthy (SLA failure), the traffic automatically fails over to the next highest priority member.

Answer

Traffic is dropped.

Answer

The FortiGate enters an error state.

Answer

Traffic is load balanced across all remaining members.

Question 11

Where do you configure the 'Gateway' IP address for an SD-WAN member?

Accepted Answer

Under Network > SD-WAN > SD-WAN Members.. The gateway for an SD-WAN member is configured within the SD-WAN member settings menu.

Answer

Under Firewall Policy.

Answer

Under Network > Static Routes.

Answer

Under System > Interfaces.

Question 12

Which protocol is NOT a valid option for Performance SLA probes?

Accepted Answer

UDP Broadcast. FortiGate supports ping (ICMP), TCP echo, HTTP, and Two-Way Active Measurement Protocol (TWAMP).

Answer

TCP Echo

Answer

HTTP

Answer

ICMP

Question 13

What is the effect of changing the 'Hold-down' timer in a Performance SLA?

Accepted Answer

It prevents route flapping by delaying the transition back to an 'up' state.. The 'Hold-down' timer defines how long an interface must remain healthy after a failure before it is considered 'up' again, preventing route flapping.

Answer

It changes the frequency of the probes.

Answer

It sets the maximum number of failed probes allowed.

Answer

It determines the timeout duration for a single probe.

Question 14

You are troubleshooting an issue where traffic is not using an SD-WAN rule despite meeting criteria. What is the most likely cause?

Accepted Answer

A higher-priority SD-WAN rule is matching the traffic first.. SD-WAN rules are evaluated top-down. If a higher-priority rule matches the traffic, the lower-priority rule will never be reached.

Answer

The SD-WAN rule is disabled.

Answer

The Performance SLA has timed out.

Answer

The interface is not in an SD-WAN zone.

Question 15

You are using 'SLA Target' as your strategy. What happens if multiple members meet the SLA?

Accepted Answer

The system selects the member with the best performance (e.g., lowest latency).. When multiple members meet the SLA in 'SLA Target' mode, the FortiGate uses the member with the best performance metric (e.g., lowest latency).

Answer

The system selects the first member in the list.

Answer

The system selects the one with the highest bandwidth capacity.

Answer

Traffic is sent through all of them simultaneously.

Question 16

Which of the following is required to successfully implement SD-WAN?

Accepted Answer

At least two physical interfaces.. At least two interfaces are typically required to make SD-WAN selection meaningful, though one is technically possible.

Answer

A FortiManager instance.

Answer

A subscription to FortiGuard SD-WAN service.

Answer

An external load balancer.

Question 17

What is the purpose of the 'Inbound' interface setting in an SD-WAN rule?

Accepted Answer

To restrict the rule to traffic originating from a specific interface.. Inbound interface matching allows you to apply SD-WAN logic based on the traffic's ingress interface, providing more specific traffic steering.

Answer

To enable reverse path forwarding checks.

Answer

To define the WAN gateway.

Answer

To specify the egress interface.

Question 18

Where are SD-WAN zones managed in the FortiGate GUI?

Accepted Answer

Network > SD-WAN > SD-WAN Zones.. SD-WAN zones are created and managed under the Network > SD-WAN menu.

Answer

Interface > Physical Interfaces.

Answer

System > Network > Zones.

Answer

Firewall > Policy > Objects.

Question 19

What is the impact of checking the 'Interface Preference' box in an SD-WAN rule?

Accepted Answer

It overrides the SLA strategy selection.. Interface preference forces the rule to prioritize specific interfaces over others, even if SLA metrics might suggest otherwise.

Answer

It enables failover to the default gateway.

Answer

It enables load balancing across interfaces.

Answer

It increases the probe frequency.

Question 20

When configuring an SD-WAN rule for a specific application, how does the FortiGate identify the traffic?

Accepted Answer

By using the Application Control database.. The FortiGate uses the Application Control engine or specific destination IP/port objects to classify traffic for SD-WAN rules.

Answer

By analyzing the packet payload size.

Answer

By looking at the source MAC address.

Answer

By forcing traffic through a specific VLAN.