scenario questions

A network administrator needs to apply a security profile to traffic that matches a specific SD-WAN rule. The SD-WAN rule steers traffic out of two IPsec tunnels based on application detection. Where should the administrator apply the security profile?

What happens if you modify an SD-WAN template that is already applied to a FortiGate?

An administrator is configuring an IPsec VPN tunnel between two FortiGates for SD-WAN. The administrator wants to ensure that the tunnel interface is not used for routing until the IPsec tunnel is fully established and the health check passes. Which configuration step should be taken?

You are configuring an SD-WAN rule to steer traffic to a business-critical application. The rule uses the 'Lowest Cost (SLA)' strategy with two members: a low-cost broadband link and an expensive MPLS link. The broadband link meets the SLA most of the time but occasionally experiences high latency. You want traffic to prefer the broadband link but fail over to MPLS when broadband violates the SLA. Which additional configuration is required to ensure the rule behaves as intended?

An administrator is configuring SD-WAN on a FortiGate with two WAN interfaces: port1 and port2. They need to ensure that the SD-WAN can properly direct traffic based on application type and link performance. Which two configuration steps are required to enable application-based steering with SLA enforcement? (Choose two.)

When configuring SD-WAN in FortiManager, why would you use 'Shared Objects'?

A FortiGate is configured with an SD-WAN rule that uses an SLA target and includes two IPsec tunnels. The administrator wants to ensure that security profiles are applied to traffic steered by this rule. Which two statements are correct regarding the enforcement of security profiles for SD-WAN traffic? (Choose two.)

You are setting up an SD-WAN zone and need to add two interfaces, port1 and port2. However, the FortiGate GUI does not allow you to add them to the zone. What is the most likely cause?

A FortiGate has two SD-WAN members, wan1 and wan2, both in the same zone. The administrator wants sessions that already use wan1 to remain on wan1 even if wan2 becomes the preferred member due to better SLA results, while new sessions should follow the preferred member. Which setting controls this behavior?

How do you apply an SD-WAN template to multiple managed FortiGates simultaneously?

An IPsec VPN tunnel used as an SD-WAN member is experiencing intermittent flapping due to DPD (Dead Peer Detection) timeout issues over a high-latency satellite link. How should the administrator adjust the Phase 1 IPsec settings on FortiOS to stabilize the tunnel without completely disabling failure detection?

An administrator has configured an SD-WAN template in FortiManager and applied it to a FortiGate. Later, the administrator modifies the template by adding a new SD-WAN zone and a new performance SLA. What happens when the administrator installs the modified template to the FortiGate?

Which TWO of the following can be used as a 'Source' in an SD-WAN rule?

A network administrator manages 80 FortiGate devices in FortiManager. The company wants to ensure that all devices use the same SD-WAN health check settings for a critical business application, but each device has a different WAN IP address. Which FortiManager feature should the administrator use to meet this requirement?

An administrator is configuring an SD-WAN template in FortiManager for a hub-and-spoke topology. The administrator wants to ensure that the SD-WAN rules can dynamically select the best path based on performance. Which two components must be configured within the SD-WAN template to achieve this? (Choose two.)

You are deploying a new FortiGate SD-WAN solution with two WAN links: wan1 and wan2. You want SD-WAN rules to be able to select members based on performance SLAs, but you also need to ensure that the SD-WAN configuration is synchronized across a pair of FortiGates in an HA cluster. Which configuration step is required before you can create an SD-WAN rule that references wan1 and wan2?

You are configuring an SD-WAN rule that must use a specific member interface only when its measured latency is below 50 ms, and otherwise fall back to another member. Which configuration element directly defines the latency threshold that the FortiGate evaluates for that member?

What is the purpose of the 'Inbound' interface setting in an SD-WAN rule?

An administrator needs to configure an SD-WAN rule that load-balances traffic across two WAN links based on the volume of traffic, ensuring that both links are utilized proportionally to their configured weights. Which SD-WAN rule strategy should be selected?

An administrator is configuring an SD-WAN template in FortiManager for a new branch deployment. The template will include multiple SD-WAN members and a performance SLA that monitors the health of these members. Which two statements about the relationship between SD-WAN templates and health check objects are true? (Choose two.)

A network administrator is using FortiManager to manage SD-WAN templates for multiple FortiGates. They need to ensure that a specific health check, which monitors a critical cloud application, is used by all SD-WAN rules across all templates. What is the most efficient way to achieve this in FortiManager?

Which THREE of the following are valid strategies for SD-WAN rules?

A network engineer is configuring an SD-WAN template in FortiManager for a group of branch FortiGates. The engineer needs to define health checks that monitor the performance of WAN links. Which two health check protocols are supported in FortiManager SD-WAN templates? (Choose two.)

You are deploying a new SD-WAN topology and must ensure that SD-WAN rules can distinguish business-critical traffic from bulk traffic. Which two rule match conditions can you configure to classify traffic for this purpose? (Choose two.)

A FortiGate is deployed in an SD-WAN environment with two WAN links: port1 (static, 100 Mbps) and port2 (DHCP, 50 Mbps). The administrator wants SD-WAN rules to automatically prefer port1 for all traffic unless its measured latency exceeds 150 ms, in which case traffic should fail over to port2. Which configuration element must be defined and referenced by the SD-WAN rule to achieve this behavior?

You are configuring an SD-WAN member for an IPsec tunnel that terminates on a remote FortiGate. The tunnel interface is named 'vpn_to_dc'. You want the SD-WAN member to be usable and to be monitored by a Performance SLA. Which two configuration elements must be present for this member to function correctly in the SD-WAN zone? (Choose two.)

You are building a new SD-WAN template in FortiManager to push to 40 branch FortiGates. The template must define two SD-WAN zones, the member interfaces, and the Performance SLA health checks, but the branch WAN IP addresses differ per site and must not be part of the template. Which FortiManager object type should you use to package the shared SD-WAN configuration?

An enterprise network uses OSPF over SD-WAN IPsec tunnels. The administrator notices that OSPF adjacency is constantly dropping over a specific backup SD-WAN member link due to intermittent packet loss. Which THREE configuration adjustments can improve OSPF stability over unstable SD-WAN IPsec links? (Choose three)

An administrator is configuring an SD-WAN member on a FortiGate. The member's interface has a default gateway of 192.168.1.1, but the ISP requires that all traffic from this member be sent to a next-hop of 192.168.1.254 instead. Which SD-WAN member setting should the administrator configure to meet this requirement?

A company has an SD-WAN deployment with three members: port1 (MPLS), port2 (Broadband), and port3 (LTE). The administrator wants to ensure that business-critical traffic uses port1 whenever it meets the SLA, but if port1 fails the SLA, traffic should use port2. If both port1 and port2 fail, traffic should use port3. Which SD-WAN rule strategy should be used to achieve this?

You need to ensure that VoIP traffic stays on the interface with the lowest jitter. Which strategy should you use?

An administrator configures an SD-WAN rule that matches traffic to a specific destination subnet and sets the strategy to 'Lowest Cost (SLA)'. The rule includes two members: 'Tunnel-1' with cost 10 and 'Tunnel-2' with cost 20. Both tunnels pass their SLA health checks. Which tunnel will be selected for the traffic?

An administrator is creating an SD-WAN template in FortiManager. The template will be used to provision multiple FortiGates. The administrator wants to define a health check that uses ICMP probes to monitor the primary WAN link. Which FortiManager object must be configured within the SD-WAN template to achieve this?

An administrator is setting up an IPsec VPN tunnel between a FortiGate hub and a branch office FortiGate. The administrator wants to ensure that the branch office can access the internet through the hub's internet connection while also accessing resources at the headquarters. Which type of IPsec VPN configuration should the administrator use to achieve this?

A network engineer is designing an SD-WAN rule that must steer real-time voice traffic to the member with the best measured quality rather than a fixed link. The rule will use Performance SLA results to make the decision. Which two Performance SLA configuration elements directly influence whether a member is considered healthy for this voice rule? (Choose two.)

An administrator wants an SD-WAN rule to select the member with the best measured quality for Microsoft 365 traffic, and also to ensure that if the best member degrades, traffic moves to the next-best member without manual intervention. The rule must continuously evaluate all eligible members. Which strategy satisfies these requirements?

When configuring SD-WAN services in a template, what does the 'Performance SLA' setting determine?

An administrator has configured an SD-WAN template in FortiManager and applied it to a FortiGate. Later, the administrator needs to add a new VLAN interface as an SD-WAN member. Where should this change be made to ensure it is reflected in the FortiManager-managed configuration?

An SD-WAN rule is configured with 'Lowest Cost (SLA)' strategy. If all members in the SLA meet the requirements, how does the FortiGate select the outgoing interface?

A network administrator is configuring an SD-WAN template in FortiManager. The template includes multiple SD-WAN rules that reference different Performance SLAs. The administrator wants to ensure that if a link fails an SLA, traffic is automatically routed to another link that meets the SLA. Which SD-WAN rule strategy should be used to achieve this?

A FortiGate is configured with an SD-WAN rule that uses a health check to monitor two IPsec tunnels. The health check is configured with a single ping probe to 8.8.8.8. The administrator notices that the SD-WAN rule fails over to the secondary tunnel even when the primary tunnel is up, but with high latency. The administrator wants the health check to consider latency and only fail over when latency exceeds a threshold. What should the administrator configure to achieve this?

An administrator is configuring an SD-WAN template in FortiManager. The template includes a performance SLA that monitors two health checks: one for latency and one for packet loss. Which FortiManager object must be referenced in the SD-WAN template to define these health checks?

You are configuring an SD-WAN rule that must load-balance traffic across two WAN links while guaranteeing that both links meet a 100 ms latency SLA. Which strategy should you select for the rule?

An administrator has just created an SD-WAN template in FortiManager and assigned it to a policy package for 30 branch FortiGates. Before installing, the administrator wants to verify how the SD-WAN members, zones, and performance SLA settings will look on a specific FortiGate without affecting the production configuration. Which FortiManager feature should the administrator use?

An administrator needs to inspect encrypted traffic traversing an SD-WAN IPsec tunnel using Deep Packet Inspection (DPI). What must be installed on the client endpoints or configured on the FortiGate to prevent browser trust warnings when using SSL/TLS full inspection?

An administrator is troubleshooting an SD-WAN setup where traffic is not being routed through the preferred IPsec tunnel despite the tunnel being up and passing health checks. The administrator reviews the SD-WAN rule and notices that the rule is configured with the 'maximize-bandwidth (SLA)' strategy and includes two tunnels with different bandwidths. The administrator expects traffic to use the tunnel with higher bandwidth, but it is using the lower bandwidth tunnel. What could be the reason for this behavior?

A FortiGate is running SD-WAN with two IPsec tunnels to different data centers. The administrator wants to apply a Web Filtering profile only to HTTP/HTTPS traffic that is steered by a specific SD-WAN rule, while other traffic on the same tunnels remains unfiltered. Where should the Web Filtering profile be applied?

A FortiGate is configured with an IPsec VPN tunnel to a remote peer. The administrator wants to apply an IPS sensor to traffic traversing the tunnel. However, the IPS sensor must inspect traffic after decryption but before it is routed to the internal network. Where should the IPS sensor be applied?

A network administrator is adding a new WAN interface to an existing SD-WAN deployment. The interface is currently not referenced by any SD-WAN zone. What is the required first step before the interface can be used as an SD-WAN member?

An administrator wants to route traffic from a specific source subnet through an SD-WAN zone that contains two member interfaces: a dedicated internet link and an MPLS link. The administrator needs to ensure that traffic from that subnet always uses the MPLS link when it is available, but falls back to the internet link if the MPLS link fails. Which SD-WAN rule configuration should be used?

You are troubleshooting a scenario where an SD-WAN template is not pushing to a FortiGate. Which log file on the FortiManager is most useful to identify the specific CLI command causing the failure?

A network administrator is managing an SD-WAN deployment with multiple FortiGates using FortiManager. The administrator needs to ensure that all SD-WAN health checks are consistent across all devices and that any changes to the health check parameters are automatically propagated. Which FortiManager object should the administrator use to achieve this?

Which TWO criteria can be used in SD-WAN rules to select an outgoing interface?

A network administrator at a large enterprise uses FortiManager to manage 120 FortiGates. The security team wants to enforce a consistent SD-WAN configuration across all branches, but the branches have different WAN link counts and interface names. The administrator wants to avoid manually editing each device's configuration. Which FortiManager feature should the administrator use to create a reusable SD-WAN configuration that can adapt to each device's interface names?

An administrator is troubleshooting an SD-WAN template deployment in FortiManager. The template fails to install on a managed FortiGate. Which two actions should the administrator take to identify the cause? (Choose two.)

An administrator configures an SD-WAN health check with multiple probes (e.g., ping and HTTP) to monitor a set of IPsec VPN tunnels. Which THREE criteria or settings govern how FortiOS determines whether an SD-WAN member has met or failed the performance SLA? (Choose three)

An engineer is configuring a new SD-WAN deployment on a FortiGate running FortiOS 7.2. The SD-WAN zone named 'virtual-wan-link' already exists with two members, but the engineer needs to add a third member that is a VLAN sub-interface named 'WAN3_VLAN'. After adding the interface to the zone, traffic still does not traverse the new member. What is the most likely reason?

When using SD-WAN zones, what is the primary benefit of grouping multiple physical interfaces into a single zone?

During SD-WAN template deployment, what is the role of 'Dynamic Mapping'?

You are preparing a FortiGate for SD-WAN and need to verify that the underlying system settings will support SD-WAN rule processing and health monitoring. Which two configuration items must be present for SD-WAN to function? (Choose two.)

Which TWO items must be configured within an SD-WAN template for SD-WAN traffic steering to work?

Which TWO configuration changes require a push from FortiManager to the FortiGate?

An administrator wants to ensure that an SD-WAN rule only selects a member if its measured latency is below 100 ms and packet loss is below 2%. Which SD-WAN feature should be configured to enforce these thresholds?

When configuring an SD-WAN rule, what is the purpose of the 'Source' address field?

An administrator wants to view the active SD-WAN rule hit counts and verify which traffic is matching a specific SD-WAN rule in FortiOS. Which command should be used?

Which THREE pieces of information are displayed in the SD-WAN Monitor in FortiManager?

An administrator is reviewing the SD-WAN configuration in FortiManager after applying a template to several FortiGates. They notice that one FortiGate has a different SD-WAN rule order than the others. What is the most likely reason for this discrepancy?

An engineer is configuring an SD-WAN member on a FortiGate to use a static gateway that differs from the interface's detected next-hop. Which CLI configuration correctly applies this override?

You are troubleshooting an SD-WAN deployment where a rule configured for VoIP traffic is not being matched. The rule uses a Performance SLA named 'VoIP_SLA' and is set to use the lowest-latency strategy. You have verified that the traffic matches the source and destination criteria, and that the SLA is up on both members. However, the traffic is still using the default route instead of the SD-WAN rule. What is the most likely cause?

An enterprise network uses ADVPN 2.0 with BGP running over IPsec tunnels. A spoke needs to initiate a shortcut tunnel to another spoke. Which FortiOS CLI command is used on the hub to verify the active shortcut tunnels and view the shortcut state information?

A network engineer is deploying a new SD-WAN on a FortiGate. The design requires a single overlay tunnel that carries multiple VLANs between the branch and the hub, and each VLAN must be mapped to its own SD-WAN zone so that different SD-WAN rules can steer traffic per VLAN. Which configuration element must the engineer create on the overlay interface to support this design?

An administrator has an SD-WAN template applied to 30 FortiGates via FortiManager. The template includes a performance SLA named 'Critical_SLA' that monitors two WAN links. The administrator needs to change the SLA's probe interval from 500ms to 1000ms without affecting other settings. After modifying the template, what must the administrator do to propagate the change to all managed FortiGates?

An administrator is configuring an SD-WAN template in FortiManager. The template will be used to deploy SD-WAN to multiple branch FortiGates. Which two statements about SD-WAN templates in FortiManager are true? (Choose two.)

An administrator configures an SD-WAN rule with an SLA target that includes latency, jitter, and packet loss. The rule uses the 'lowest cost (SLA)' strategy. Both tunnels meet the SLA, but one tunnel has a lower configured cost. How does FortiOS select the egress interface for a new session?

When troubleshooting SD-WAN performance SLA packet loss, an administrator wants to view real-time latency, jitter, and packet loss statistics for individual health check members. Which CLI command should be executed?

A network administrator is deploying a new FortiGate for SD-WAN and needs to verify that the FortiGate has the required license to use SD-WAN features. Which license is required to enable SD-WAN on a FortiGate?

An administrator configures an IPsec VPN tunnel between two FortiGates for SD-WAN use. The tunnel is up, but traffic from the local subnet 10.10.10.0/24 to the remote subnet 10.20.20.0/24 is not passing. The administrator verifies that the Phase 2 selectors are configured with the correct local and remote subnets. What is the most likely cause?

An administrator has an SD-WAN template in FortiManager that is assigned to a managed FortiGate. The FortiGate is currently offline. The administrator modifies the template and installs the configuration. What happens to the FortiGate when it comes back online?

When configuring advanced IPsec VPN tunnels to act as members of an SD-WAN zone, which TWO configuration parameters on the FortiGate are critical for ensuring proper IPsec tunnel operation and traffic steering? (Choose two)

A FortiGate is configured with an SD-WAN zone containing two members: 'wan1' (static IP, gateway 203.0.113.1) and 'wan2' (DHCP, learned gateway 198.51.100.1). You need to verify the current SD-WAN member health and the measured latency, jitter, and packet loss for each member from the CLI. Which command displays the live SD-WAN health-check results for all members?

An administrator is using FortiManager to manage an SD-WAN deployment. The administrator needs to add a new SD-WAN member to an existing template that is already assigned to 20 FortiGates. After modifying the template, what must the administrator do to apply the change to all managed devices?

An administrator is troubleshooting BGP route propagation over SD-WAN IPsec tunnels where a branch office is not receiving specific routes from the datacenter hub. Which TWO CLI commands on the FortiGate are most useful for diagnosing BGP peering and advertised route issues? (Choose two)

An administrator has created an SD-WAN template in FortiManager and applied it to a group of FortiGates. Later, they need to modify the template to add a new health check. What is the most efficient way to update all managed devices with this change?

Which TWO of the following are benefits of using SD-WAN templates in FortiManager?

A network administrator manages 30 FortiGate devices in FortiManager. The administrator wants to ensure that all devices use the same SD-WAN health check settings for a specific SLA target. Which FortiManager object should the administrator configure to achieve this?

Which THREE factors can affect the 'Performance SLA' logic in an SD-WAN template?

Which THREE of the following criteria are used for SD-WAN rule traffic matching?

An administrator is configuring an SD-WAN rule to route VoIP traffic over the MPLS link, which has lower latency. The administrator wants to ensure that if the MPLS link fails the SLA for latency, the traffic is automatically routed over the internet VPN. Which SD-WAN strategy should be used to achieve this?

You are configuring an SD-WAN rule for a branch office that must use the lowest-latency path for Microsoft 365 traffic. You have already created a Performance SLA named 'M365_SLA' that measures latency to several Microsoft 365 endpoints. You want the SD-WAN rule to select the member with the best latency among those that meet the SLA. Which SD-WAN rule strategy should you configure?

Where do you configure the 'Gateway' IP address for an SD-WAN member?

An SD-WAN rule uses the lowest-cost (SLA) strategy with two members, wan1 and wan2. wan1 has a lower configured cost than wan2, and both currently meet the SLA. A network engineer observes that all matching traffic egresses wan1. The engineer now wants traffic to prefer wan2 whenever wan2 meets the SLA, while still failing over to wan1 if wan2 degrades. What should the engineer change?

A network administrator is using FortiManager to manage a large SD-WAN deployment. They need to create a new SD-WAN template that will be applied to multiple FortiGates. The administrator wants to ensure that the template can be easily modified in the future without having to manually update each device. Which FortiManager object should they use to define the SD-WAN template?

When setting up a Performance SLA, what is the 'Participant' setting?

You are configuring an SD-WAN rule to load-balance traffic across three WAN links. You want to ensure that the rule uses all available links while respecting the SLA status of each member. Which strategy should you select?

You are troubleshooting an SD-WAN deployment where a rule configured with the 'Best Quality' strategy is not selecting the expected member. The Performance SLA shows that member1 has lower latency and jitter than member2, yet traffic is using member2. Which factor should you verify first?

An administrator configures a static route where the gateway is an SD-WAN zone instead of a specific IP address. How does FortiOS process this SD-WAN static route?

A FortiGate is configured with an SD-WAN rule that steers traffic based on application control. The administrator applies a security profile (Antivirus and IPS) to the SD-WAN zone. However, they notice that traffic matching the SD-WAN rule is not being inspected by the security profiles. What is the most likely reason?

A network engineer is adding a new physical interface to an existing SD-WAN zone on a FortiGate. The interface is currently used for management access. Which prerequisite must be met before the interface can be added to the SD-WAN zone?

You are deploying an SD-WAN solution with two WAN links: port1 (primary) and port2 (secondary). You need to ensure that when port1 fails its Performance SLA, the FortiGate automatically removes it from the SD-WAN zone until it recovers. Which configuration step is required to achieve this behavior?

A network administrator is configuring an IPsec VPN tunnel between a FortiGate hub and a spoke. The administrator wants to ensure that the spoke can dynamically learn routes from the hub and also advertise its local subnets. Which routing protocol is most commonly used in Fortinet SD-WAN deployments to achieve this?

You are configuring an SD-WAN rule to route VoIP traffic. You want the rule to select the member with the best quality for voice, considering both latency and jitter. You have enabled Performance SLA on both WAN1 and WAN2, monitoring latency and jitter. You need to ensure the rule uses the appropriate strategy and that the SLA is correctly referenced. Which two actions must you perform to achieve this? (Choose two.)

When using SD-WAN templates, how are SD-WAN rules ordered?

You are troubleshooting an issue where traffic is not using an SD-WAN rule despite meeting criteria. What is the most likely cause?

A network engineer is configuring an SD-WAN rule to route VoIP traffic. The requirement is to always use the member with the lowest jitter, even if other members have higher bandwidth. The engineer wants to avoid manual priority configuration. Which SD-WAN strategy should be selected for this rule?

An administrator is using FortiManager to deploy an SD-WAN configuration to a new FortiGate. The administrator wants to ensure that the SD-WAN member interfaces are correctly associated with the physical interfaces on the device. Which FortiManager feature allows the administrator to define the mapping between logical SD-WAN interfaces and physical interfaces?

A company uses FortiManager to manage SD-WAN configurations for 50 branch offices. The administrator needs to update the SD-WAN rules across all branches to include a new application category for SaaS traffic. The update must be applied consistently and with minimal administrative effort. Which two actions should the administrator take to achieve this? (Choose two.)

A company uses FortiManager to manage 100 FortiGates. They have an SD-WAN template applied to all devices. The administrator modifies a health check within the template to change the probe interval from 500ms to 1000ms. After saving the template, they want to push the change to all managed FortiGates. What must the administrator do to ensure the updated health check is applied to all devices?

A network administrator is deploying SD-WAN on a FortiGate and needs to ensure that the SD-WAN zone can be referenced in firewall policies. Which configuration step is mandatory before the zone can be used in a policy?

You are deploying an SD-WAN rule that must prioritize VoIP traffic over the best available link based on real-time performance. You have configured a Performance SLA with strict latency and jitter thresholds. Which SD-WAN rule strategy ensures that VoIP traffic uses the link with the lowest jitter that meets the SLA?

An engineer is configuring an SD-WAN rule that must load-balance traffic across two members based on the volume of traffic, but also must ensure that if one member's health check fails, traffic is redistributed to the remaining healthy member. Which strategy should be selected in the SD-WAN rule?

Which TWO of the following can cause an SD-WAN member to be marked as 'down' in an SLA?

A network administrator has deployed SD-WAN with two IPsec overlays and one internet breakout on a FortiGate. The administrator wants to ensure that traffic from a specific source subnet uses the VPN overlay for a business-critical application, while all other traffic follows the default route. The SD-WAN rule must also verify that the overlay meets an SLA for jitter. Which SD-WAN configuration object should the administrator use to define the source subnet and application criteria?

You have a large SD-WAN deployment. Why would you use a 'Centralized Policy' in FortiManager instead of local policies?

A network administrator is deploying SD-WAN with IPsec tunnels and wants to ensure that if a tunnel goes down, traffic is automatically redirected to another member. The administrator has configured two IPsec tunnels in the same SD-WAN zone and a health check for each. Which SD-WAN rule configuration ensures that traffic uses the tunnel with the lowest latency and fails over when the primary tunnel fails the health check?

An administrator implements BGP over SD-WAN tunnels to a cloud provider. The cloud provider requires BGP MD5 authentication on all peering sessions. Where is BGP MD5 authentication configured on the FortiGate?

Which THREE of the following are parameters that can be monitored in a Performance SLA?

A network engineer is adding two WAN links to a new SD-WAN deployment on a FortiGate. The interfaces are already configured with IP addresses and default gateways. What must be done before these interfaces can participate in SD-WAN rules?

A security administrator needs to allow branch users to reach an internal application server through the SD-WAN overlay. The SD-WAN rule already matches the correct source and destination, and both members pass their Performance SLA checks. Traffic is still being dropped before it reaches the SD-WAN rule. Which configuration must the administrator verify?

If you modify a shared SD-WAN health check object that is referenced by ten different templates, what happens to the FortiGates?

A company has an SD-WAN template in FortiManager that is assigned to 50 FortiGates. The template includes a health check object named 'HC1' that monitors a server at 10.0.0.1. The administrator modifies 'HC1' to monitor 10.0.0.2 instead. After the change, the administrator notices that some FortiGates still show the old server IP in their running configuration. What is the most likely reason for this discrepancy?

When configuring an SD-WAN rule for a specific application, how does the FortiGate identify the traffic?

What is the default behavior when all SD-WAN members in a rule fail their SLA?

You are deploying a new FortiGate for an SD-WAN branch. The branch uses a single physical WAN link that is delivered as a VLAN-tagged subinterface on port1 (VLAN ID 100). You want to add this link to an SD-WAN zone named 'virtual-wan-link'. Which configuration step must be completed before the VLAN subinterface can be selected as an SD-WAN member?

An administrator is configuring an SD-WAN rule that uses the 'SLA' strategy with two members: a primary MPLS link and a backup LTE link. The SLA target is latency < 100 ms and packet loss < 1%. The administrator notices that when the MPLS link fails the SLA, traffic is not failing over to LTE. What could be the cause?

You have an SD-WAN zone named 'virtual-wan-link' with members 'wan1' and 'wan2'. You notice that a member interface is administratively up and has a valid IP address, but it is not appearing as a selectable member when you edit the SD-WAN member list. Which condition most likely explains why the interface cannot be added?

You are configuring an SD-WAN rule to route business-critical traffic (HTTP and HTTPS) over the best available link based on lowest latency. You have two members in the SD-WAN zone: WAN1 and WAN2. You create a Performance SLA named 'Latency-SLA' that monitors 8.8.8.8 using ICMP probes with a threshold of 150 ms. You apply this SLA to both members. In the SD-WAN rule, you set the strategy to 'Lowest Latency' and select the SLA. After applying the configuration, you notice that HTTP traffic is still using WAN1 even though WAN2 has lower latency according to the SLA monitor. What is the most likely cause?

Which SD-WAN rule strategy should you choose if you want to distribute traffic across multiple interfaces based on their bandwidth weights?

A FortiGate SD-WAN deployment uses a firewall policy with an Intrusion Prevention System (IPS) profile applied. After turning on IPS, administrators notice that throughput over an IPsec SD-WAN tunnel drops significantly. What is the primary reason for this throughput reduction, and how can it be mitigated?

You are preparing a FortiGate for SD-WAN deployment and need to confirm that the device supports the required features. Which FortiGate hardware or virtual platform characteristic is required to use SD-WAN on FortiOS 7.x?

An administrator is configuring an SD-WAN template in FortiManager. They want to ensure that the template can be applied to FortiGates with different interface names. Which feature in FortiManager allows mapping template interface references to actual device interfaces?

A FortiGate is configured with an SD-WAN rule that uses a health check to monitor an IPsec tunnel. The health check is configured with a ping probe to a remote IP. The administrator notices that the tunnel is marked as down even though the remote IP is reachable via the tunnel. What is a possible cause?

An administrator is configuring an SD-WAN rule to route traffic from a specific source subnet to a destination subnet over a preferred IPsec tunnel. The administrator wants to ensure that if the preferred tunnel fails, traffic automatically switches to a backup tunnel. Which SD-WAN rule configuration is required to achieve this?

An administrator configures an SD-WAN rule using the 'Volume' strategy across two IPsec tunnels with different bandwidth capacities (Tunnel A: 100 Mbps, Tunnel B: 50 Mbps). How does FortiOS distribute traffic across these members when using the Volume strategy?

An administrator is configuring BGP over SD-WAN IPsec tunnels between a headquarters FortiGate and branch FortiGates. Which TWO configuration steps are required to ensure robust and stable dynamic routing over the SD-WAN IPsec tunnels? (Choose two)

You are adding a new physical interface to an existing SD-WAN deployment. Which step must be completed before the interface can be referenced by an SD-WAN rule?

An administrator is using FortiManager to manage SD-WAN configurations for multiple FortiGates. They need to update the SD-WAN template to change the health check target for all devices. After modifying the template, they want to ensure the changes are pushed to all managed FortiGates efficiently. Which action should they take in FortiManager?

You want to standardize the SD-WAN configuration for 50 remote branch offices. Which FortiManager feature should you use?

What is required before FortiManager can display SD-WAN monitoring data?

A network administrator is using FortiManager to manage SD-WAN configurations for multiple FortiGates. The administrator wants to define a health check that will be used across several SD-WAN templates and needs to ensure that any changes to this health check are automatically propagated to all templates that reference it. Which FortiManager object should the administrator create?

A network administrator is configuring a static route on a FortiGate to direct traffic to a remote subnet through an IPsec VPN tunnel. The tunnel interface is named 'VPN_Tunnel'. Which of the following is the correct way to configure the static route?

Where are SD-WAN zones managed in the FortiGate GUI?

An administrator needs to deploy an SD-WAN template to a FortiGate that has two WAN interfaces: wan1 and wan2. The template includes an SD-WAN rule that load-balances traffic across both interfaces. During installation, the administrator receives an error that the interface mapping is incomplete. What is the most likely cause?

You are configuring an SD-WAN rule to route traffic to a critical SaaS application. You want the rule to select the best link based on multiple performance metrics: latency, jitter, and packet loss. You have created a Performance SLA that monitors these metrics. Which SD-WAN rule strategy should you use to achieve this?

An administrator is troubleshooting an SD-WAN deployment where traffic matching an SD-WAN rule with a destination service object (e.g., HTTPS) is not being steered according to the SLA priority. Instead, it is always taking the default static route member. Upon checking the firewall policies, what is the most common reason why an SD-WAN rule fails to process application or service-based traffic matching?

What is the purpose of the 'Gateway' override in an SD-WAN member configuration?

An administrator has configured an SD-WAN rule to steer traffic based on the "maximize bandwidth (SLA)" strategy. The rule uses two IPsec tunnels: one with 100 Mbps and one with 50 Mbps. The administrator expects traffic to be load-balanced proportionally to the bandwidth. However, all traffic is going through the 100 Mbps tunnel. What is the most likely reason?

An administrator is configuring an IPsec VPN tunnel that will be used as an SD-WAN member. The tunnel must be able to carry multicast traffic for OSPF. Which IPsec Phase 2 configuration parameter must be enabled to support this requirement?

You are deploying a new SD-WAN interface. What is the mandatory step before you can add an interface to an SD-WAN zone?

An administrator is using FortiManager to manage an SD-WAN deployment with 80 FortiGates. The SD-WAN template includes a health check that pings the destination '8.8.8.8' every 500ms. The administrator notices that some branches have high latency to that destination, causing unnecessary failovers. The administrator wants to change the health check destination to a regional server with lower latency for each branch. However, the branches are in different geographic regions. What is the most efficient way to customize the health check destination per region without creating multiple templates?

A Performance SLA bound to an SD-WAN zone is configured with a 200 ms latency threshold and a 5% packet-loss threshold. A member reports 180 ms latency but 8% packet loss. What is the member's SLA state, and how does it affect rule selection?

An administrator has created an SD-WAN template in FortiManager and applied it to a FortiGate. The administrator then modifies the template to add a new SD-WAN rule that directs traffic from a specific subnet to a new overlay interface. After installing the policy package, the administrator notices that the rule is not taking effect on the FortiGate. What is the most likely reason?

When configuring an SD-WAN health check to monitor internet reachability using HTTP/HTTPS requests, which parameter defines the specific string the FortiGate expects to receive in the server response body to validate that the path is healthy?

In an ADVPN 2.0 deployment, a hub unit uses BGP to advertise routes to spokes. When a spoke learns a prefix via BGP from the hub, what mechanism allows the spoke to automatically initiate an ADVPN shortcut tunnel directly to another spoke when traffic flows between them?

A network engineer is creating an SD-WAN template in FortiManager. They want to define a health check that monitors the quality of an internet link by sending HTTP requests to a specific URL. Which configuration element in the SD-WAN template should they use to accomplish this?

An administrator is configuring an IPsec VPN tunnel between two FortiGate devices for SD-WAN. The administrator wants to ensure that the tunnel interface can be used in SD-WAN rules and that the tunnel is established only when the underlying physical interface is up. Which IPsec Phase 1 configuration parameter is required to bind the tunnel to a specific outgoing interface?

A network administrator wants to ensure that IPsec traffic between two FortiGate SD-WAN members is encrypted with a specific set of algorithms. The administrator configures Phase 2 selectors on both peers. Which Phase 2 parameter must match on both ends for the tunnel to come up?

Which TWO of the following steps are required to correctly configure a Performance SLA?

An administrator is configuring an SD-WAN template in FortiManager. The template includes a performance SLA that monitors two health checks: one for latency and one for jitter. The administrator wants the SD-WAN rule to select the member with the lowest latency. Which FortiManager configuration element must be used to achieve this?

An administrator is using FortiManager 7.2 to manage SD-WAN templates across 150 FortiGates. They need to ensure that when a template is updated, the changes are propagated efficiently and that the FortiGates maintain high availability. The administrator wants to use the 'Install Wizard' to push the updated template. Which two statements are true about installing an SD-WAN template with the Install Wizard in this scenario? (Choose two.)

Which command is used to verify the current status of SD-WAN members and their SLA health from the CLI?

You are configuring SD-WAN on a FortiGate that will be managed by FortiManager. You want to ensure that the SD-WAN configuration is consistent across multiple devices and that changes can be deployed centrally. Which action must you take in FortiManager to support SD-WAN configuration?

A network administrator is using FortiManager to manage SD-WAN configurations for multiple FortiGates. The administrator wants to ensure that all devices use the same health check server IP address for their SD-WAN performance SLAs. Where in FortiManager should the administrator define this shared health check server?

A network engineer is using FortiManager to manage SD-WAN templates for multiple FortiGates. They need to ensure that a specific SD-WAN rule is only applied to branch offices that have a specific tag. Which FortiManager feature should they use?

An administrator applies security profiles (Antivirus, Web Filtering, and IPS) to traffic steered by an SD-WAN rule. Performance issues arise. Which TWO methods can the administrator use to optimize inspection performance without completely disabling security? (Choose two)

An administrator configures an SD-WAN rule that uses the 'maximize bandwidth (SLA)' strategy across three IPsec overlays. A security profile group containing IPS and Application Control is applied to the firewall policy that references the SD-WAN zone. Users report that some sessions are being re-evaluated mid-stream and reset when a health check fails. Which FortiOS behavior explains the resets?

An administrator wants to apply a Web Filtering security profile to traffic that is being dynamically steered via an SD-WAN rule. Where must this security profile be enforced in FortiOS?

How can you verify that an SD-WAN configuration change was successfully applied to a FortiGate via FortiManager?

A network engineer is configuring an SD-WAN template in FortiManager for a new branch office. The branch has two internet links: one via DHCP and one via static IP. The engineer wants to ensure that the SD-WAN rule prefers the static link for business-critical traffic but can fail over to the DHCP link if the static link's performance degrades. Which SD-WAN template component should the engineer configure to define the performance thresholds that trigger failover?

An administrator troubleshoots a scenario where traffic matching an application-based SD-WAN rule is bypassing the preferred high-speed MPLS tunnel and taking the backup broadband tunnel instead. Which THREE factors should the administrator check to resolve this routing discrepancy? (Choose three)

An administrator is configuring an SD-WAN rule to route VoIP traffic over the MPLS link and all other traffic over the internet link. The administrator wants to ensure that VoIP traffic is prioritized and that the rule only selects the MPLS link if it meets specific latency and jitter thresholds. Which SD-WAN configuration should be used?

An administrator is configuring an SD-WAN rule that must ensure business-critical traffic always uses the best path based on measured latency and jitter, while also allowing the rule to fail over to a secondary link if the primary link's SLA is violated. The rule includes three members: wan1, wan2, and wan3. Which two actions must be performed to achieve this? (Choose two.)

A FortiGate is configured with two IPsec overlays in an SD-WAN zone. The administrator wants to ensure that return traffic from the remote subnet arrives on the same overlay that the original session used, but the remote gateway IP is the same on both overlays. Which SD-WAN member setting should be configured to achieve this?

A FortiGate is configured with an SD-WAN rule that steers traffic to an IPsec overlay tunnel. A security administrator needs to inspect the traffic with an IPS sensor before it egresses the tunnel. Where must the IPS sensor be applied so that it inspects traffic matching the SD-WAN rule?

A network engineer is adding a new WAN link to an existing SD-WAN deployment on a FortiGate. The physical interface 'wan3' has been configured with an IP address and is up, but it does not appear in the list of available interfaces when the engineer tries to add it to an SD-WAN zone. Which action should the engineer take to resolve this?

Which object must be created before assigning a health check to an SD-WAN service rule in an SD-WAN template?

An administrator has an SD-WAN template in FortiManager that is already assigned to a managed FortiGate. The administrator edits the template to change the SD-WAN zone membership of an interface from 'virtual-wan-link' to a custom zone named 'overlay'. After saving the template, what must the administrator do to push this change to the FortiGate?

You are configuring an SD-WAN rule to route business-critical traffic. You want to ensure that the rule uses the best available link based on performance SLAs, and that it can fail over to a secondary link if the primary link's SLA is violated. Which two configuration elements are required to achieve this? (Choose two.)

Which THREE of the following are benefits of using SD-WAN?

An administrator configures an SD-WAN rule that steers Microsoft 365 traffic over the IPsec tunnel 'MPLS-VPN' and sets the rule's 'Priority' to 1. A second SD-WAN rule for the same traffic exists, but its 'Priority' is 10. Which statement accurately describes how FortiOS evaluates these rules?

An administrator is setting up a new SD-WAN deployment on a FortiGate. They have two interfaces, port1 and port2, that will be part of the SD-WAN. They want to group these interfaces into a single SD-WAN zone named 'virtual-wan-link' to simplify rule configuration. Which step is required before adding the interfaces to the SD-WAN zone?

A network administrator is using FortiManager to manage an SD-WAN deployment. They want to create a new SD-WAN template that includes a health check for the 'MPLS' interface. Where in the FortiManager GUI should the administrator navigate to create this template?

An SD-WAN rule is configured with the Best Quality strategy and includes two members: WAN1 and WAN2. The Performance SLA for both members is set to monitor latency, jitter, and packet loss. The SLA thresholds are latency 100 ms, jitter 20 ms, and packet loss 1%. Currently, WAN1 has latency 80 ms, jitter 10 ms, and packet loss 0.5%; WAN2 has latency 90 ms, jitter 25 ms, and packet loss 0.2%. Both members are up. Which member will be selected by the Best Quality strategy?

Which TWO methods can be used to update SD-WAN policies across all managed devices in FortiManager?

An administrator is troubleshooting an IPsec VPN tunnel that is part of an SD-WAN zone. The tunnel is up, but SD-WAN health checks are failing, causing the tunnel to be marked as down. The administrator verifies that the Phase 2 selectors include the health check server's IP address. What is the next most likely cause to investigate?

A company uses FortiManager to manage 200 FortiGates with SD-WAN enabled. The administrator needs to update the SD-WAN health check settings for all branches to use a new server IP. The health check is referenced by a single SD-WAN template that is assigned to all branches. After modifying the health check object in FortiManager, what must the administrator do to apply the changes to all FortiGates?

An administrator is creating an SD-WAN template in FortiManager and needs to define the member interfaces. Which FortiManager object is used to group these interfaces for the SD-WAN configuration?

In SD-WAN central management, what is the 'SD-WAN Zone' used for?

What is the impact of checking the 'Interface Preference' box in an SD-WAN rule?

You are configuring a Performance SLA to monitor reachability to a SaaS application. Which parameter determines the threshold for an interface to be considered 'unhealthy' in the SD-WAN routing table?

When creating an SD-WAN template, what must be defined before you can add an SD-WAN interface to the template?

Which interface can be used as an SD-WAN member in an SD-WAN template?

You have an SD-WAN rule with 'Priority' strategy. What happens if the highest priority member fails its SLA?

What is the effect of changing the 'Hold-down' timer in a Performance SLA?

You are configuring SD-WAN templates in FortiManager. What is the primary purpose of using SD-WAN Central Management instead of configuring SD-WAN directly on individual FortiGates?

An enterprise deploys BGP over SD-WAN with multiple MPLS and broadband connections. A route-map is applied to incoming BGP updates on the FortiGate to set a specific weight for routes learned over the MPLS interface. Why is the 'weight' attribute particularly effective in this FortiOS SD-WAN and BGP integration scenario?

An administrator is creating an SD-WAN template in FortiManager to be applied to multiple FortiGate devices. The administrator wants to ensure that the template can be reused across devices with different WAN interface names. Which configuration element in the SD-WAN template allows the use of variables for interface names?

A network administrator is troubleshooting an SD-WAN deployment managed by FortiManager. The administrator notices that after installing an SD-WAN template, some FortiGates are not using the expected health check server. The administrator verifies that the template is correctly configured with the health check server IP. What is the most likely cause for the discrepancy?

An administrator is configuring an SD-WAN template in FortiManager. The template includes multiple health checks that monitor the performance of different WAN links. The administrator wants to ensure that if a health check fails, the SD-WAN rule automatically redirects traffic to another member. Which component of the SD-WAN template is responsible for defining the action taken when a health check fails?

A network engineer is configuring an SD-WAN template in FortiManager. They want to define a performance SLA that monitors the quality of two WAN links using HTTP probes to a specific server. Which FortiManager object should they configure to define the HTTP probe parameters?

You are configuring an SD-WAN rule that uses the 'lowest-cost (SLA)' strategy. You have three members: wan1 (cost 10), wan2 (cost 20), and wan3 (cost 30). All have Performance SLAs configured. Currently, wan1 and wan2 meet their SLAs, but wan3 does not. Which member will be selected for traffic matching this rule?

An engineer needs to configure an SD-WAN rule that sends traffic out the member with the lowest latency for a specific application, but also wants the rule to automatically fail over to the next-best member if the primary member's latency exceeds a threshold. Which SD-WAN strategy and configuration should be used?

When viewing the SD-WAN Monitor in FortiManager, what information is provided for the 'Health Check' status?

A network administrator is configuring an SD-WAN rule to steer traffic from the internal network to a critical cloud application. The rule uses the 'SLA' strategy and references a Performance SLA that monitors latency and jitter. The administrator notices that traffic is intermittently being sent over a WAN link that does not meet the SLA thresholds. The Performance SLA is configured with a probe interval of 5 seconds and a failure threshold of 3. What is the most likely reason for this intermittent behavior?

A network engineer is using FortiManager to manage a FortiGate that already has a local SD-WAN configuration. The engineer wants to transition to centralized management by assigning an SD-WAN template to the device. After the template is assigned and installed, what is the effect on the existing local SD-WAN settings?

You are configuring a Performance SLA on a FortiGate to monitor the quality of two WAN links. You need to ensure that the SLA probe uses HTTP to check a specific URL and that it considers the link healthy only if the round-trip time is below 100 ms and packet loss is below 2%. Which two parameters must you configure in the Performance SLA? (Choose two.)

An administrator is validating a new SD-WAN deployment before going live. The design requires that the FortiGate detect link degradation before users notice it and that failover decisions be based on measured path quality rather than physical link state. Which two configuration elements are required to meet these goals? (Choose two.)

An administrator is configuring a new SD-WAN rule to steer traffic based on application signatures. The administrator wants to ensure that the rule only matches traffic for Microsoft Teams and prioritizes it over other traffic. Which SD-WAN rule configuration should be used?

An engineer is troubleshooting an SD-WAN rule that is not steering traffic as expected. The rule is configured with the 'Lowest Cost (SLA)' strategy and includes two members: member1 (cost 10) and member2 (cost 20). Both members are passing their SLA health checks. However, all traffic is going out member1, and member2 is not used. What is the most likely explanation?

If an SD-WAN template contains a reference to an interface that does not exist on a target FortiGate, what occurs during the installation process?

Which THREE tasks are required to successfully deploy SD-WAN via FortiManager?

A network administrator is using FortiManager to manage a large SD-WAN deployment. The administrator needs to create a new SD-WAN template that will be used by several FortiGates. The template must include a health check that uses HTTP to monitor a specific server. Which FortiManager object type should the administrator configure first to define the HTTP health check before adding it to the SD-WAN template?

You are setting up an SD-WAN configuration on a FortiGate. You want to ensure that the SD-WAN rules you create will be able to use the WAN interfaces. You have already configured the interfaces with IP addresses and default gateways. Which additional configuration object must you create to group the interfaces for use in SD-WAN rules?

A network engineer is creating a new SD-WAN template in FortiManager. The template will be used to configure SD-WAN on several FortiGate devices. The engineer wants to define a health check that monitors the latency to a specific server using ICMP. Which configuration object should the engineer create first?

A network administrator is setting up an SD-WAN rule to steer traffic to a SaaS application. The rule uses a performance SLA that monitors the SaaS application's IP address. The administrator wants the SD-WAN rule to prefer the member with the lowest latency. Which SD-WAN rule strategy should be selected?

A network administrator is troubleshooting an SD-WAN deployment managed by FortiManager. They notice that a specific SD-WAN rule is not being enforced on a FortiGate, even though the template was installed successfully. The rule uses a performance SLA to select the best path. What is the most likely cause?

A network administrator is managing a FortiManager that has provisioned an SD-WAN template to a group of managed FortiGates. The administrator needs to verify that each FortiGate is actually running the intended SD-WAN configuration and that no device is out of sync. Which FortiManager workflow should the administrator use to compare the intended SD-WAN template configuration against the running configuration on each managed device?