NSE7_SDW Practice Questions

Question 1

When using SD-WAN templates, which option allows you to manage different ISPs on different branches within the same template?

Accepted Answer

Dynamic Mapping. Dynamic mapping allows you to associate the 'WAN' member in the template to 'port1' on one branch and 'wan1' on another.

Answer

Global Objects

Answer

Device Groups

Answer

SD-WAN Rules

Question 2

Which interface can be used as an SD-WAN member in an SD-WAN template?

Accepted Answer

Physical ports, VLANs, and VPN tunnels. Any physical or logical (VPN tunnel) interface can be added as an SD-WAN member.

Answer

Only WAN physical ports

Answer

Only VLANs

Answer

Only loopback interfaces

Question 3

How do you apply an SD-WAN template to multiple managed FortiGates simultaneously?

Accepted Answer

By assigning the template in the Device Manager tab. In the Device Manager tab, you can assign an SD-WAN template to multiple devices by selecting them and applying the template.

Answer

By manually editing each FortiGate config

Answer

Through individual CLI console sessions

Answer

By creating a global profile

Question 4

You want to standardize the SD-WAN configuration for 50 remote branch offices. Which FortiManager feature should you use?

Accepted Answer

SD-WAN Templates. SD-WAN templates are specifically designed for mass deployment of standardized configurations.

Answer

Policy Packages

Answer

Firmware Images

Answer

CLI Scripts

Question 5

When configuring SD-WAN in FortiManager, why would you use 'Shared Objects'?

Accepted Answer

To enable reuse of configuration elements across different templates. Shared objects allow you to define parameters like health check servers once and reuse them across multiple templates, simplifying updates.

Answer

To increase the number of VDOMs supported

Answer

To allow FortiGates to share logs

Answer

To create a site-to-site VPN

Question 6

An administrator implements BGP over SD-WAN tunnels to a cloud provider. The cloud provider requires BGP MD5 authentication on all peering sessions. Where is BGP MD5 authentication configured on the FortiGate?

Accepted Answer

Under the router bgp neighbor configuration block in the CLI. BGP authentication passwords (such as MD5) are configured within the BGP neighbor configuration under router bgp in the FortiOS CLI.

Answer

Within the firewall policy authentication settings

Answer

Under the IPsec phase 1 interface advanced settings

Answer

Inside the SD-WAN health check probe configuration

Question 7

If an SD-WAN template contains a reference to an interface that does not exist on a target FortiGate, what occurs during the installation process?

Accepted Answer

The installation fails with a configuration error. The installation will fail during the pre-check or push validation phase because the dependency is missing.

Answer

The FortiGate automatically creates a dummy interface

Answer

The installation proceeds and ignores the missing interface

Answer

The FortiGate enters an 'Emergency' state

Question 8

Which object must be created before assigning a health check to an SD-WAN service rule in an SD-WAN template?

Accepted Answer

An SD-WAN Health Check. Health checks must be defined within the template configuration to be usable in SD-WAN rules.

Answer

A routing protocol

Answer

A firewall address object

Answer

An SD-WAN Zone

Question 9

What is required before FortiManager can display SD-WAN monitoring data?

Accepted Answer

The FortiGate must be sending logs to FortiManager. FortiManager must be configured to receive logs from the FortiGate, and 'Log to FortiManager' must be enabled on the FortiGate.

Answer

The FortiGate must have a cloud license

Answer

The FortiGate must be running a specific firmware

Answer

The FortiGate must be in Transparent mode

Question 10

When viewing the SD-WAN Monitor in FortiManager, what information is provided for the 'Health Check' status?

Accepted Answer

Latency, jitter, and packet loss metrics. The monitor shows the latency, jitter, and packet loss for every configured health check probe on the monitored device.

Answer

The firmware version of the device

Answer

The number of active users

Answer

The current IP address of the interface

Question 11

You are troubleshooting a scenario where an SD-WAN template is not pushing to a FortiGate. Which log file on the FortiManager is most useful to identify the specific CLI command causing the failure?

Accepted Answer

fmg_debug.log. The fmg_debug.log or the task monitor logs show the specific CLI commands being pushed and the FortiGate response.

Answer

fmg_event.log

Answer

fmg_audit.log

Answer

fmg_system.log

Question 12

In an ADVPN 2.0 deployment, a hub unit uses BGP to advertise routes to spokes. When a spoke learns a prefix via BGP from the hub, what mechanism allows the spoke to automatically initiate an ADVPN shortcut tunnel directly to another spoke when traffic flows between them?

Accepted Answer

The FortiGate kernel detects traffic matching a dynamic BGP route over the IPsec interface and initiates an IKE shortcut negotiation with the target spoke. ADVPN shortcuts are triggered when traffic matches a shortcut trigger mechanism. In ADVPN 2.0, IPsec phase 1 shortcut settings ('set advpn shortcut') and dynamic routing protocols working together allow the kernel to generate shortcut requests when traffic hits the phase 1 interface.

Answer

OSPF sends a special multicast hello packet across the hub to establish mesh point-to-point links

Answer

FortiManager pushes a dynamic static route to both spokes simultaneously

Answer

The Web Filtering profile intercepts the packet and redirects it via proxy to the destination spoke

Question 13

When creating an SD-WAN template, what must be defined before you can add an SD-WAN interface to the template?

Accepted Answer

Individual SD-WAN member interfaces. You must define the member interfaces within the template before referencing them in SD-WAN zones or rules.

Answer

The SD-WAN health check probes

Answer

Global firewall policies

Answer

The virtual domain (VDOM) settings

Question 14

During SD-WAN template deployment, what is the role of 'Dynamic Mapping'?

Accepted Answer

To map a single template object to different physical settings on different devices. Dynamic mapping allows you to map a single template object to different physical values (like interface names) on different FortiGate devices.

Answer

To automate firmware updates

Answer

To monitor bandwidth usage

Answer

To dynamically change the SD-WAN rule based on time

Answer

To calculate the latency of paths

Question 15

Which TWO criteria can be used in SD-WAN rules to select an outgoing interface?

Accepted Answer

Source and destination address. Rules use criteria like source/destination address, services, and application signatures to steer traffic.

Answer

The name of the administrator

Answer

System temperature

Answer

Device serial number

NSE 7 - SD-WAN (NSE7_SDW) NSE7_SDW practice test

Three ways to study

Study NSE7_SDW by domain

Study NSE7_SDW by topic

Central Management practice questions

Security Profiles Routing And IPsec practice questions

System Configuration And Setup practice questions

NSE7_SDW fundamentals practice questions

NSE7_SDW scenario practice questions

NSE7_SDW troubleshooting practice questions

NSE 7 - SD-WAN (NSE7_SDW) practice questions