Knowledge + Practice

CCNA Security Profiles Routing And Ipsec Questions

54 questions · Security Profiles Routing And Ipsec topic · All types, answers revealed

Practice these questions Exam hub All questions

1

MCQeasy

A network administrator needs to apply a security profile to traffic that matches a specific SD-WAN rule. The SD-WAN rule steers traffic out of two IPsec tunnels based on application detection. Where should the administrator apply the security profile?

A.In the firewall policy that includes the SD-WAN zone as the outgoing interface.

B.In the SD-WAN rule configuration under the 'Security Profile' section.

C.On each individual IPsec tunnel interface that is a member of the SD-WAN zone.

D.On the SD-WAN zone interface in the firewall policy that permits the traffic.

AnswerA

Security profiles are applied within firewall policies. When an SD-WAN rule steers traffic, the traffic is still matched by a firewall policy that includes the SD-WAN zone as the outgoing interface. The security profiles (such as antivirus, IPS, web filtering) are configured in that policy. This ensures that the profiles are applied to all traffic egressing via the SD-WAN zone, regardless of which member tunnel is selected.

Why this answer

Security profiles in FortiOS are applied within firewall policies. When using SD-WAN, the firewall policy that permits traffic must have the SD-WAN zone as the outgoing interface. The security profiles are then applied to the traffic as it exits through the zone.

This is the standard and recommended method, as it ensures consistent security inspection regardless of which SD-WAN member is chosen.

Exam trap

The trap here is thinking that security profiles can be applied directly to SD-WAN rules or interfaces, when in fact they are always applied in firewall policies.

Practice this question →

2

MCQmedium

An administrator is configuring an IPsec VPN tunnel between two FortiGates for SD-WAN. The administrator wants to ensure that the tunnel interface is not used for routing until the IPsec tunnel is fully established and the health check passes. Which configuration step should be taken?

A.Enable 'net-device' on the IPsec phase1-interface.

B.Configure the IPsec tunnel as a member of an SD-WAN zone and enable 'update-static-route' in the health check.

C.Enable 'auto-discovery-forwarder' on the IPsec phase1-interface.

D.Set the IPsec tunnel's 'distance' to a higher value than other routes.

AnswerB

By placing the IPsec tunnel in an SD-WAN zone and enabling update-static-route in the health check, FortiOS will dynamically add or remove a static route for the tunnel based on health check status. This ensures that the tunnel is only used for routing when the health check passes, meeting the requirement.

Why this answer

To ensure the IPsec tunnel is only used for routing when the health check passes, the tunnel should be part of an SD-WAN zone, and the health check must have update-static-route enabled. This causes FortiOS to install a static route only when the health check is successful, effectively gating routing on tunnel health.

Exam trap

The trap here is thinking that route preference or interface settings can conditionally control routing based on tunnel health, when the actual mechanism is the health check's update-static-route option combined with SD-WAN zone membership.

Practice this question →

3

Multi-Selectmedium

A FortiGate is configured with an SD-WAN rule that uses an SLA target and includes two IPsec tunnels. The administrator wants to ensure that security profiles are applied to traffic steered by this rule. Which two statements are correct regarding the enforcement of security profiles for SD-WAN traffic? (Choose two.)

Select 2 answers

A.The SD-WAN rule itself can directly reference a security profile, which is then applied to all member tunnels.

B.Security profiles must be configured in the firewall policy that permits the traffic and references the SD-WAN zone as the outgoing interface.

C.When the SD-WAN rule selects a member, the security profile configured on that member's interface is automatically applied.

D.If the firewall policy references the SD-WAN zone, the same security profiles are applied to traffic regardless of which member tunnel is chosen.

E.Security profiles are applied only after the SD-WAN rule selects the egress member, so the policy must reference the specific member interface.

AnswersB, D

The firewall policy is where UTM profiles are enforced. When the policy's outgoing interface is an SD-WAN zone, the profiles apply to all traffic steered by the rule, regardless of which member is selected. This is the correct place to attach antivirus, IPS, web filtering, and other profiles.

Why this answer

Security profiles for SD-WAN traffic are enforced in the firewall policy that permits the session. That policy must reference the SD-WAN zone as its outgoing interface, so the profiles apply uniformly to all member tunnels selected by the rule. SD-WAN rules themselves do not carry security profiles, and interfaces do not automatically apply profiles.

This design ensures consistent inspection regardless of which member is chosen.

Exam trap

The trap here is thinking that SD-WAN rules or member interfaces can hold security profiles, when enforcement is always in the firewall policy.

Practice this question →

4

MCQhard

An IPsec VPN tunnel used as an SD-WAN member is experiencing intermittent flapping due to DPD (Dead Peer Detection) timeout issues over a high-latency satellite link. How should the administrator adjust the Phase 1 IPsec settings on FortiOS to stabilize the tunnel without completely disabling failure detection?

A.Disable DPD entirely so the FortiGate never tears down the tunnel

B.Enable NP6/NP7 hardware offloading for Phase 1 SA renegotiation

C.Change the IPsec phase 1 mode from Main mode to Aggressive mode

D.Increase the DPD retry count and interval settings under the IPsec Phase 1 configuration

AnswerD

Raising the DPD retry count and interval lengthens the tolerance window before a peer is declared dead, absorbing satellite latency spikes so the tunnel stops flapping while failure detection remains active, unlike disabling DPD entirely.

Why this answer

DPD (Dead Peer Detection) uses periodic hello/ack probes to verify the remote peer is alive; if probes go unanswered within the configured retry count and interval, FortiOS tears down the Phase 1 SA. On a high-latency satellite link, the default interval (often 20s) and retry count (3) are too aggressive, so legitimate replies arrive after the timeout and the tunnel flaps. Increasing both the DPD interval and retry count under Phase 1 gives the peer more time to respond before the tunnel is declared dead, stabilizing the tunnel while keeping failure detection active.

Exam trap

NSE7_SDW often tests the misconception that DPD must be disabled to stop flapping, when the correct fix is tuning retry count and interval to match link latency.

How to eliminate wrong answers

Option A is wrong because disabling DPD entirely removes failure detection, so a truly dead peer would leave a black-hole tunnel that never reconverges, which the question explicitly forbids. Option B is wrong because NP6/NP7 offloading accelerates packet processing and IPsec throughput but has no effect on DPD probe timing or Phase 1 SA renegotiation timers. Option C is wrong because Aggressive mode only changes how Phase 1 identities are exchanged (fewer messages, no identity protection); it does not alter DPD interval/retry behavior and is generally discouraged for security reasons.

Practice this question →

5

Multi-Selecthard

An enterprise network uses OSPF over SD-WAN IPsec tunnels. The administrator notices that OSPF adjacency is constantly dropping over a specific backup SD-WAN member link due to intermittent packet loss. Which THREE configuration adjustments can improve OSPF stability over unstable SD-WAN IPsec links? (Choose three)

Select 3 answers

A.Configure OSPF network type as point-to-point on the IPsec tunnel interfaces to eliminate unnecessary DR/BDR elections

B.Enable OSPF graceful restart or helper mode on the FortiGate routers

C.Set the OSPF router ID to 0.0.0.0 on all branch spokes

D.Increase the OSPF hello interval and dead interval on the affected IPsec tunnel interfaces to tolerate temporary packet loss

E.Disable OSPF hello packets entirely and rely on static default routes

AnswersA, B, D

Point-to-point OSPF network type removes DR/BDR election and its timers, so a flapping backup IPsec link cannot trigger repeated adjacency resets from election churn. This directly addresses the intermittent packet loss constraint described in the stem.

Why this answer

Option A is correct because setting the OSPF network type to point-to-point on IPsec tunnel interfaces removes DR/BDR election overhead and reduces the number of OSPF protocol packets needed, which is ideal for a single neighbor across an SD-WAN tunnel and minimizes the impact of intermittent loss. Option B is correct because OSPF graceful restart (and helper mode on the neighbors) allows the router to restart or fail over its OSPF process without tearing down adjacencies and re-converging, which preserves stability when the backup link is flapping. Option D is correct because increasing the hello and dead intervals on the affected IPsec tunnel interfaces makes OSPF more tolerant of temporary packet loss, preventing the dead timer from expiring and dropping the adjacency during brief outages.

Option C is not valid because a router ID of 0.0.0.0 is not a usable OSPF router ID and would prevent OSPF from forming adjacencies. Option E is not valid because disabling OSPF hellos breaks neighbor detection and adjacency maintenance, and relying on static default routes does not provide the dynamic OSPF stability being sought.

Exam trap

NSE7_SDW often tests the misconception that any OSPF tweak helps stability — candidates must recognize that invalid router IDs and disabling hellos are destructive, while timer tuning and point-to-point are the legitimate stabilizers.

Practice this question →

6

MCQmedium

An administrator configures an SD-WAN rule that matches traffic to a specific destination subnet and sets the strategy to 'Lowest Cost (SLA)'. The rule includes two members: 'Tunnel-1' with cost 10 and 'Tunnel-2' with cost 20. Both tunnels pass their SLA health checks. Which tunnel will be selected for the traffic?

A.Traffic is load-balanced across both tunnels because both meet SLA.

B.Tunnel-1, because it has the lower cost and both meet SLA.

C.Tunnel-1 is selected only if its cost is lower than the other member's cost by at least 50%.

D.Tunnel-2, because a higher cost indicates a higher priority in the 'Lowest Cost (SLA)' strategy.

AnswerB

The 'Lowest Cost (SLA)' strategy selects the member with the lowest cost among those that meet the SLA health check. Since both tunnels pass SLA, Tunnel-1 with cost 10 is chosen over Tunnel-2 with cost 20. This strategy is designed to prefer the most cost-effective path while ensuring SLA compliance.

Why this answer

The 'Lowest Cost (SLA)' strategy chooses the member with the lowest cost that also passes its SLA health check. Since both tunnels meet SLA, the one with cost 10 is selected. This strategy does not load-balance or require a cost difference threshold.

It is commonly used to prefer a cheaper link while maintaining performance guarantees.

Exam trap

The trap here is assuming that higher cost means higher priority or that load balancing occurs when multiple members meet SLA.

Practice this question →

7

MCQeasy

An administrator is setting up an IPsec VPN tunnel between a FortiGate hub and a branch office FortiGate. The administrator wants to ensure that the branch office can access the internet through the hub's internet connection while also accessing resources at the headquarters. Which type of IPsec VPN configuration should the administrator use to achieve this?

A.Dial-up IPsec VPN with dynamic routing.

B.Site-to-site IPsec VPN with split tunneling enabled.

C.Site-to-site IPsec VPN with full tunneling and default route through the tunnel.

D.Remote access IPsec VPN with full tunneling.

AnswerC

A site-to-site IPsec VPN with full tunneling and a default route pointing through the tunnel ensures that all traffic from the branch, including internet-bound traffic, is sent to the hub. The hub then routes it to the internet. This configuration meets the requirement of accessing the internet through the hub while also accessing headquarters resources. It is commonly used for centralized internet access and security enforcement.

Why this answer

To route all traffic, including internet-bound traffic, from the branch through the hub, a site-to-site IPsec VPN with full tunneling and a default route through the tunnel is required. This ensures that the branch uses the hub's internet connection while still accessing headquarters resources. Other options either do not route internet traffic through the hub or are not suitable for site-to-site connectivity.

Exam trap

The trap here is confusing split tunneling with full tunneling; split tunneling sends only specific traffic through the tunnel, not all internet traffic.

Practice this question →

8

MCQhard

A FortiGate is configured with an SD-WAN rule that uses a health check to monitor two IPsec tunnels. The health check is configured with a single ping probe to 8.8.8.8. The administrator notices that the SD-WAN rule fails over to the secondary tunnel even when the primary tunnel is up, but with high latency. The administrator wants the health check to consider latency and only fail over when latency exceeds a threshold. What should the administrator configure to achieve this?

A.Set the health check to use 'ping' with a larger packet size and configure 'sla' with packet loss threshold.

B.Enable 'sla' in the health check and set the latency threshold to the desired value.

C.Add a second ping probe to a different destination and enable 'sla' with latency threshold.

D.Configure the health check to use 'http' probe and set latency threshold in the SLA.

AnswerB

Enabling 'sla' in the health check and setting a latency threshold allows the FortiGate to monitor latency and trigger failover if the threshold is exceeded. This is the correct configuration to meet the requirement. The health check will continuously measure latency and compare it to the threshold, ensuring that failover occurs only when latency is too high. This directly addresses the issue of unnecessary failover due to high latency.

Why this answer

To make the health check consider latency and fail over only when latency exceeds a threshold, the administrator must enable SLA in the health check and set the latency threshold. This allows the FortiGate to monitor latency and trigger failover according to the configured threshold. Other options either do not enable latency monitoring or focus on different metrics.

Exam trap

The trap here is thinking that changing the probe type or adding probes automatically enables latency-based failover, when actually the SLA settings must be configured with the latency threshold.

Practice this question →

9

MCQeasy

An administrator needs to inspect encrypted traffic traversing an SD-WAN IPsec tunnel using Deep Packet Inspection (DPI). What must be installed on the client endpoints or configured on the FortiGate to prevent browser trust warnings when using SSL/TLS full inspection?

A.ADVPN 2.0 shortcut certificates must be exchanged between spokes

B.BGP MD5 authentication keys must match on both routers

C.The FortiGate's self-signed CA certificate must be installed in the trusted root certificate store of the client endpoints

D.A pre-shared key must be configured in the IPsec Phase 1 proposal

AnswerC

SSL/TLS full inspection makes the FortiGate re-sign traffic with its own CA certificate. Clients only trust that certificate if the FortiGate's CA certificate is installed in their trusted root store, otherwise browsers raise untrusted-certificate warnings.

Why this answer

To prevent browser trust warnings during SSL/TLS full inspection, the FortiGate's self-signed CA certificate must be installed in the trusted root certificate store of the client endpoints. When full inspection is enabled, the FortiGate acts as a man-in-the-middle, presenting its own certificate to the client. If the client does not trust the FortiGate's CA, the browser will display a warning.

Exam trap

NSE7_SDW often tests the misconception that SSL inspection trust is handled by IPsec or BGP settings, rather than by installing the CA certificate on endpoints.

How to eliminate wrong answers

Option A is wrong because ADVPN 2.0 shortcut certificates are used for IPsec tunnel authentication, not for SSL inspection trust. Option B is wrong because BGP MD5 authentication is for securing BGP sessions, not for certificate trust. Option D is wrong because a pre-shared key is used for IPsec Phase 1 authentication, not for SSL inspection.

Practice this question →

10

MCQhard

An administrator is troubleshooting an SD-WAN setup where traffic is not being routed through the preferred IPsec tunnel despite the tunnel being up and passing health checks. The administrator reviews the SD-WAN rule and notices that the rule is configured with the 'maximize-bandwidth (SLA)' strategy and includes two tunnels with different bandwidths. The administrator expects traffic to use the tunnel with higher bandwidth, but it is using the lower bandwidth tunnel. What could be the reason for this behavior?

A.The health check probes are not configured on the higher bandwidth tunnel, so it is not considered.

B.The SD-WAN rule is misconfigured; the 'maximize-bandwidth (SLA)' strategy always uses the tunnel with the lowest cost.

C.The higher bandwidth tunnel is not meeting the SLA criteria, so SD-WAN selects the lower bandwidth tunnel that meets SLA.

D.The SD-WAN rule is using the 'maximize-bandwidth (SLA)' strategy, but the higher bandwidth tunnel is in a different SD-WAN zone.

AnswerC

The 'maximize-bandwidth (SLA)' strategy selects the tunnel with the highest bandwidth among those that meet the SLA criteria. If the higher bandwidth tunnel is not meeting the SLA (e.g., due to latency, jitter, or packet loss), it is excluded from selection, and the lower bandwidth tunnel that meets SLA is used. This is the expected behavior and likely the reason for the observed routing. The administrator should check the SLA status of the higher bandwidth tunnel.

Why this answer

The 'maximize-bandwidth (SLA)' strategy selects the tunnel with the highest bandwidth that also meets the SLA criteria. If the higher bandwidth tunnel fails to meet SLA, it is excluded, and the next best tunnel that meets SLA is chosen. Therefore, the observed behavior is likely because the higher bandwidth tunnel is not meeting SLA.

The administrator should verify the SLA status and health check results for that tunnel.

Exam trap

The trap here is assuming that the 'maximize-bandwidth (SLA)' strategy always picks the highest bandwidth tunnel regardless of SLA, when in fact it only considers tunnels that meet SLA.

Practice this question →

11

MCQhard

A FortiGate is running SD-WAN with two IPsec tunnels to different data centers. The administrator wants to apply a Web Filtering profile only to HTTP/HTTPS traffic that is steered by a specific SD-WAN rule, while other traffic on the same tunnels remains unfiltered. Where should the Web Filtering profile be applied?

A.In the firewall policy that references the SD-WAN zone and matches the desired traffic, by enabling the Web Filtering profile in that policy.

B.On the IPsec Phase 1 configuration for each tunnel, by enabling 'set web-filter-profile'.

C.On the SD-WAN zone member interfaces in the firewall policy that matches the SD-WAN rule.

D.In the SD-WAN rule itself, by selecting the Web Filtering profile from the 'Security Profile' drop-down.

AnswerA

In FortiOS, security profiles are applied within firewall policies. To filter only traffic steered by a specific SD-WAN rule, you create or use a firewall policy that references the SD-WAN zone and matches the intended source, destination, and service. The SD-WAN rule determines the outgoing member, but the Web Filtering profile is enforced by the firewall policy. This achieves selective filtering without affecting other traffic.

Why this answer

Security profiles in FortiOS are enforced by firewall policies, not by SD-WAN rules or tunnel interfaces. To filter only the traffic handled by a specific SD-WAN rule, the administrator must ensure that traffic matches a firewall policy that references the SD-WAN zone and has the Web Filtering profile enabled. The SD-WAN rule then selects the outgoing member based on its criteria, while the firewall policy applies the security inspection.

Exam trap

The trap here is looking for a security profile setting inside the SD-WAN rule or on the tunnel interface, when FortiOS always applies security profiles through firewall policies.

Practice this question →

12

MCQhard

A FortiGate is configured with an IPsec VPN tunnel to a remote peer. The administrator wants to apply an IPS sensor to traffic traversing the tunnel. However, the IPS sensor must inspect traffic after decryption but before it is routed to the internal network. Where should the IPS sensor be applied?

A.On the internal LAN interface as an outgoing interface in a firewall policy.

B.In the IPsec phase 2 configuration as a proposal parameter.

C.On the physical WAN interface that carries the IPsec tunnel traffic.

D.On the IPsec tunnel interface as an incoming interface in a firewall policy.

AnswerD

Applying the IPS sensor to a firewall policy that uses the IPsec tunnel as the incoming interface ensures that traffic is inspected after decryption and before routing. This is the correct placement because the tunnel interface represents the decrypted traffic. The sensor will then inspect the clear-text packets as they enter the FortiGate from the tunnel.

Why this answer

To inspect decrypted traffic from an IPsec tunnel, the IPS sensor must be applied to a firewall policy where the tunnel interface is the incoming interface. This ensures inspection occurs after decryption and before routing to the internal network. Applying it on the physical interface would inspect encrypted packets, and other placements are either inefficient or impossible.

Exam trap

The trap here is thinking that IPS can inspect encrypted traffic on the physical interface or that it can be attached to IPsec phase 2 settings.

Practice this question →

13

MCQeasy

An administrator wants to route traffic from a specific source subnet through an SD-WAN zone that contains two member interfaces: a dedicated internet link and an MPLS link. The administrator needs to ensure that traffic from that subnet always uses the MPLS link when it is available, but falls back to the internet link if the MPLS link fails. Which SD-WAN rule configuration should be used?

A.Create an SD-WAN rule with the source subnet as the match criteria, set the strategy to 'Lowest Cost', and assign a lower cost to the MPLS link.

B.Create an SD-WAN rule with the source subnet as the match criteria, set the strategy to 'Best Quality', and enable 'SLA target' for the MPLS link only.

C.Create an SD-WAN rule with the source subnet as the match criteria, set the strategy to 'Manual', and order the MPLS interface first, then the internet interface.

D.Create an SD-WAN rule with the source subnet as the match criteria, set the strategy to 'Maximize Bandwidth', and enable 'SLA target' for both links.

AnswerC

The 'Manual' strategy allows the administrator to define the order of preference for member interfaces. By placing the MPLS interface first and the internet interface second, traffic will use MPLS when available and fall back to the internet link if MPLS fails, as determined by health checks.

Why this answer

The 'Manual' strategy in an SD-WAN rule allows explicit ordering of member interfaces. By listing the MPLS interface first, traffic will use it when it is available, and fall back to the internet interface if the MPLS link fails health checks. This meets the requirement of always using MPLS when available.

Exam trap

The trap here is assuming that 'Best Quality' or 'Lowest Cost' automatically prioritizes a specific link, when only 'Manual' provides deterministic ordering.

Practice this question →

14

Multi-Selecthard

An administrator configures an SD-WAN health check with multiple probes (e.g., ping and HTTP) to monitor a set of IPsec VPN tunnels. Which THREE criteria or settings govern how FortiOS determines whether an SD-WAN member has met or failed the performance SLA? (Choose three)

Select 3 answers

A.The BGP AS number assigned to the WAN interface gateway

B.The restoretime parameter, which specifies how many consecutive successful probes are required before restoring a failed member to healthy status

C.The physical cable length calculated in meters between the FortiGate and the nearest ISP switch

D.The failtime parameter, which dictates how many consecutive probe failures must occur before the member is marked as failed

E.Configured thresholds for latency, jitter, and packet loss that a member must remain under to be considered meeting the SLA

AnswersB, D, E

The restoretime setting defines how many consecutive successful probes must occur before FortiOS marks a failed SD-WAN member healthy again. This hysteresis prevents flapping, and it is one of the three criteria governing performance SLA state transitions.

Why this answer

Option B is correct because the restoretime setting in an SD-WAN health check defines how many consecutive successful probes must occur before a previously failed member is returned to healthy status, preventing flapping. Option D is correct because the failtime parameter specifies the number of consecutive probe failures required before FortiOS marks the SD-WAN member as failed and removes it from SLA compliance. Option E is correct because the health check's configured thresholds for latency, jitter, and packet loss are the actual performance SLA criteria that each probe result is compared against to decide whether the member meets the SLA.

Option A is incorrect because the BGP AS number is a routing attribute unrelated to SD-WAN health check SLA evaluation. Option C is incorrect because physical cable length is not a parameter FortiOS uses in SD-WAN performance SLA determination.

Exam trap

NSE7_SDW often tests the confusion between failtime and restoretime, or candidates mistakenly select routing attributes (BGP AS, cable length) as SLA criteria instead of the actual threshold and counter parameters.

Practice this question →

15

MCQeasy

An administrator wants to ensure that an SD-WAN rule only selects a member if its measured latency is below 100 ms and packet loss is below 2%. Which SD-WAN feature should be configured to enforce these thresholds?

A.SLA health check with latency and packet loss thresholds.

B.Traffic shaping policy with guaranteed bandwidth.

C.SD-WAN rule priority with manual cost values.

D.IPsec phase 2 proposal with perfect forward secrecy.

AnswerA

SLA health checks in FortiOS SD-WAN allow administrators to define performance thresholds such as latency, jitter, and packet loss. When an SD-WAN rule references an SLA health check, the rule only considers members that meet those thresholds. This is the correct feature to enforce the specified latency and packet loss limits.

Why this answer

SLA health checks are the SD-WAN feature designed to monitor performance metrics like latency, jitter, and packet loss. By configuring thresholds in an SLA health check and associating it with an SD-WAN rule, the rule will only select members that meet the criteria. Other features like priority, cost, or traffic shaping do not provide dynamic threshold enforcement.

Exam trap

The trap here is assuming that priority or cost settings can enforce performance thresholds, when only SLA health checks provide dynamic monitoring.

Practice this question →

16

MCQeasy

An administrator wants to view the active SD-WAN rule hit counts and verify which traffic is matching a specific SD-WAN rule in FortiOS. Which command should be used?

A.show system sdwan

B.execute router clear sdwan cache

C.get firewall policy statistics

D.diagnose sys sdwan service

AnswerD

The diagnose sys sdwan service command lists each SD-WAN service rule with its hit counters, showing which rules traffic is matching. This directly satisfies the requirement to view active rule hit counts and verify traffic matching a specific rule.

Why this answer

The command 'diagnose sys sdwan service' displays the SD-WAN service rules along with their hit counts and the sessions currently matching each rule, making it the correct tool to verify which traffic is hitting a specific rule. It is a diagnostic command run from the FortiGate CLI that exposes the internal SD-WAN service table. Other commands either show configuration, clear caches, or display firewall policy statistics that do not map to SD-WAN rule matching.

Exam trap

NSE7_SDW often tests whether candidates confuse firewall policy statistics with SD-WAN rule hit counts, or pick a 'show' command when the diagnostic command is required to see live matching sessions.

How to eliminate wrong answers

Option A is wrong because 'show system sdwan' is not the correct FortiOS syntax for inspecting SD-WAN service rules and hit counts; configuration is viewed via 'config system sdwan' or 'show full-configuration system sdwan'. Option B is wrong because 'execute router clear sdwan cache' clears cached SD-WAN routing decisions rather than displaying rule hit counts. Option C is wrong because 'get firewall policy statistics' shows per-firewall-policy counters, not SD-WAN rule hit counts, which are tracked separately in the SD-WAN service table.

Practice this question →

17

MCQmedium

An enterprise network uses ADVPN 2.0 with BGP running over IPsec tunnels. A spoke needs to initiate a shortcut tunnel to another spoke. Which FortiOS CLI command is used on the hub to verify the active shortcut tunnels and view the shortcut state information?

A.execute router clear bgp all

B.get system sdwan neighbor

C.diagnose vpn tunnel list

D.diagnose netlink interface list

AnswerC

`diagnose vpn tunnel list` enumerates all IPsec tunnels on the hub, including ADVPN shortcut tunnels, showing their names, source and destination addresses, and state. This directly satisfies the stem's requirement to verify active shortcuts and view shortcut state information, whereas other commands lack this per-tunnel IPsec visibility.

Why this answer

The command 'diagnose vpn tunnel list' on the hub displays all active IPsec tunnels, including ADVPN shortcut tunnels established between spokes. It shows tunnel names, source/destination IPs, and state information, allowing the administrator to verify that shortcut tunnels are up and active. This is the standard FortiOS diagnostic command for inspecting IPsec tunnel status in ADVPN deployments.

Exam trap

NSE7_SDW often tests the distinction between commands that show routing/BGP information versus those that show IPsec tunnel state; candidates may confuse 'get system sdwan neighbor' with tunnel verification.

How to eliminate wrong answers

Option A is wrong because 'execute router clear bgp all' clears BGP routing table entries and does not display tunnel state information. Option B is wrong because 'get system sdwan neighbor' shows SD-WAN neighbor status, not IPsec shortcut tunnel details. Option D is wrong because 'diagnose netlink interface list' lists network interfaces at the kernel level and does not provide IPsec tunnel state or shortcut information.

Practice this question →

18

MCQhard

An administrator configures an SD-WAN rule with an SLA target that includes latency, jitter, and packet loss. The rule uses the 'lowest cost (SLA)' strategy. Both tunnels meet the SLA, but one tunnel has a lower configured cost. How does FortiOS select the egress interface for a new session?

A.It selects the tunnel with the lowest jitter because jitter is the most important SLA metric.

B.It selects the tunnel with the best measured latency, regardless of configured cost.

C.It load-balances sessions across both tunnels because both meet the SLA.

D.It selects the tunnel with the lowest cost among those that meet the SLA.

AnswerD

The 'lowest cost (SLA)' strategy first filters members that satisfy the SLA criteria, then chooses the one with the lowest configured cost. If both meet the SLA, the lower-cost tunnel is selected. This provides a deterministic preference for cost while ensuring quality thresholds are met.

Why this answer

The 'lowest cost (SLA)' strategy evaluates members against the SLA criteria first. Members that meet all thresholds are eligible. Among those, FortiOS selects the member with the lowest configured cost.

If multiple members share the same cost, further tie-breaking may occur, but cost is the primary differentiator. This ensures that quality requirements are met while optimizing for cost.

Exam trap

The trap here is confusing 'lowest cost (SLA)' with a strategy that selects the best-performing member or load-balances across all SLA-compliant links.

Practice this question →

19

MCQeasy

When troubleshooting SD-WAN performance SLA packet loss, an administrator wants to view real-time latency, jitter, and packet loss statistics for individual health check members. Which CLI command should be executed?

A.diagnose sys sdwan health-check

B.get system interface physical

C.execute ping-server status

D.show system sdwan

AnswerA

The diagnose sys sdwan health-check command displays per-member SLA statistics, including latency, jitter and packet loss, for each configured health check. It directly satisfies the requirement to inspect real-time performance of individual health check members.

Why this answer

The command 'diagnose sys sdwan health-check' displays real-time performance SLA statistics for SD-WAN health check members, including latency, jitter, and packet loss. It is the correct tool to troubleshoot SLA violations and monitor link quality. This command provides per-member details essential for diagnosing SD-WAN performance issues.

Exam trap

NSE7_SDW often tests the difference between configuration display commands (like 'show system sdwan') and diagnostic commands that show real-time statistics; candidates may pick the former for troubleshooting.

How to eliminate wrong answers

Option B is wrong because 'get system interface physical' shows physical interface status and configuration, not SD-WAN health check statistics. Option C is wrong because 'execute ping-server status' is not a valid FortiOS command for SD-WAN health checks. Option D is wrong because 'show system sdwan' displays SD-WAN configuration, not real-time performance metrics.

Practice this question →

20

MCQmedium

An administrator configures an IPsec VPN tunnel between two FortiGates for SD-WAN use. The tunnel is up, but traffic from the local subnet 10.10.10.0/24 to the remote subnet 10.20.20.0/24 is not passing. The administrator verifies that the Phase 2 selectors are configured with the correct local and remote subnets. What is the most likely cause?

A.The Phase 2 proposal encryption and authentication algorithms do not match between peers.

B.The SD-WAN rule is not configured to use the IPsec tunnel as a member.

C.There is no firewall policy allowing traffic from the local subnet to the remote subnet over the IPsec tunnel.

D.The remote gateway's Phase 1 configuration is missing the local subnet in the interesting traffic selector.

AnswerC

In FortiOS, even if an IPsec tunnel is up, traffic will not pass without a firewall policy that permits the source, destination, and service, and that includes the IPsec tunnel as an outgoing interface. This is a common oversight when configuring SD-WAN with IPsec.

Why this answer

For traffic to traverse an IPsec tunnel in FortiOS, a firewall policy must explicitly allow it, referencing the tunnel interface as the outbound interface. Even with correct Phase 2 selectors and an established tunnel, without a policy, packets are dropped. This is a frequent misconfiguration in SD-WAN deployments.

Exam trap

The trap here is assuming that a successfully established IPsec tunnel automatically permits traffic without a corresponding firewall policy.

Practice this question →

21

Multi-Selectmedium

When configuring advanced IPsec VPN tunnels to act as members of an SD-WAN zone, which TWO configuration parameters on the FortiGate are critical for ensuring proper IPsec tunnel operation and traffic steering? (Choose two)

Select 2 answers

A.Ensure the IPsec interface is added to an SD-WAN zone and assigned a valid virtual IP/interface configuration

B.Disable NAT traversal (NAT-T) globally on all IPsec phase 1 tunnels

C.Configure the IPsec tunnel mode as dialup server on all participating branch spokes

D.Set the IPsec phase 1 authentication method strictly to RSA certificates only, disabling pre-shared keys

E.Configure Phase 2 selectors to match the exact source and destination subnets, or use 0.0.0.0/0 for route-based VPN flexibility

AnswersA, E

Adding the IPsec interface to an SD-WAN zone lets the FortiGate treat the tunnel as a member interface, enabling health checks and steering rules. Without a valid interface and IP configuration, the tunnel cannot participate in zone-based path selection, breaking SD-WAN operation.

Why this answer

Option A is correct because an IPsec interface must be a member of the SD-WAN zone to participate in SD-WAN path selection and traffic steering; the interface also needs a valid IP/virtual interface configuration so the zone can reference it as a member and apply SD-WAN rules to it. Option E is correct because Phase 2 selectors define the traffic that the IPsec SA protects: matching the exact source/destination subnets ensures only intended traffic is encrypted, while 0.0.0.0/0 selectors are commonly used for route-based VPNs so routing and SD-WAN rules, rather than narrow proxy IDs, determine which traffic enters the tunnel. Option B is wrong because NAT-T (UDP encapsulation on port 4500) is often required for IPsec to traverse NAT devices and should not be globally disabled.

Option C is wrong because not all participating spokes should be dialup servers; typically the hub is the dialup server and spokes are dialup clients, or all are static peers. Option D is wrong because restricting Phase 1 authentication to RSA certificates only is not required for SD-WAN membership and would unnecessarily break pre-shared-key deployments.

Exam trap

NSE7_SDW often tests the specific configuration steps to integrate IPsec tunnels into SD-WAN; candidates may overlook the need for Phase 2 selector flexibility or incorrectly think NAT-T must be disabled.

Practice this question →

22

Multi-Selectmedium

An administrator is troubleshooting BGP route propagation over SD-WAN IPsec tunnels where a branch office is not receiving specific routes from the datacenter hub. Which TWO CLI commands on the FortiGate are most useful for diagnosing BGP peering and advertised route issues? (Choose two)

Select 2 answers

A.execute ipsec tunnel list

B.diagnose sys sdwan member

C.get system interface physical

D.get router info bgp neighbors advertised-routes

E.get router info bgp summary

AnswersD, E

Correct. This command displays the routes being advertised by the FortiGate to a specific BGP neighbor.

Why this answer

Option D, 'get router info bgp neighbors advertised-routes', is correct because it shows exactly which prefixes the local FortiGate is advertising to a specific BGP neighbor, directly revealing whether the missing branch routes are being sent out the IPsec-over-SD-WAN peering. Option E, 'get router info bgp summary', is correct because it verifies the BGP session state (Established vs. Active/Idle), uptime, and prefix counters per neighbor, confirming whether the peering across the SD-WAN IPsec tunnel is actually up before investigating route contents.

Option A, 'execute ipsec tunnel list', only lists IPsec tunnel status and does not expose BGP peering or route advertisement details. Option B, 'diagnose sys sdwan member', reports SD-WAN member health and SLA metrics, not BGP neighbor or prefix information. Option C, 'get system interface physical', merely displays physical interface configuration/status and is unrelated to BGP route propagation.

Exam trap

NSE7_SDW often tests whether candidates pick interface/tunnel-status commands instead of BGP-specific commands — the trap is confusing 'tunnel is up' with 'BGP routes are propagating'.

Practice this question →

23

MCQeasy

An administrator is configuring an SD-WAN rule to route VoIP traffic over the MPLS link, which has lower latency. The administrator wants to ensure that if the MPLS link fails the SLA for latency, the traffic is automatically routed over the internet VPN. Which SD-WAN strategy should be used to achieve this?

A.Lowest Cost (SLA)

B.Maximize Bandwidth (SLA)

C.Lowest Latency (SLA)

D.Manual

AnswerC

Lowest Latency (SLA) selects the member with the lowest latency among those that meet the SLA. This directly matches the requirement to route VoIP over the link with the lowest latency (MPLS) and automatically fail over to the next best member (internet VPN) if MPLS fails the SLA. It is the most appropriate strategy for latency-sensitive traffic like VoIP.

Why this answer

Lowest Latency (SLA) is designed to select the member with the lowest latency that also meets the SLA. This ensures VoIP traffic uses the MPLS link when it meets the latency SLA, and if it fails, the rule automatically selects the next member (internet VPN) that meets the SLA. This strategy provides the desired automatic failover based on latency.

Exam trap

The trap here is choosing Lowest Cost (SLA) because it also considers SLA, but it optimizes for cost, not latency, which is the key requirement for VoIP.

Practice this question →

24

MCQeasy

An administrator configures a static route where the gateway is an SD-WAN zone instead of a specific IP address. How does FortiOS process this SD-WAN static route?

A.The FortiGate drops the packet because static routes require a valid IP address gateway

B.The FortiOS SD-WAN engine intercepts the route lookup and applies SD-WAN rules to dynamically select the best member interface based on performance SLAs

C.The packet is forwarded exclusively through the physical interface with the lowest index number

D.Traffic is load-balanced equally across all physical interfaces in the FortiGate chassis using round-robin

AnswerB

FortiOS treats an SD-WAN zone as a route gateway by intercepting the route lookup, then applying SD-WAN rules to choose the member interface dynamically. Selection is driven by performance SLA measurements, satisfying the requirement for SLA-based path selection rather than a fixed next hop.

Why this answer

FortiOS supports SD-WAN static routes where the gateway is an SD-WAN zone rather than a next-hop IP. When such a route matches, the SD-WAN engine takes over the route lookup and applies SD-WAN rules (SLA-based, priority-based, or load-balance) to select the best member interface dynamically based on measured performance against configured SLAs.

Exam trap

The trap is assuming static routes always need an IP next-hop — candidates pick 'drop' or 'lowest interface index,' but FortiOS uniquely allows SD-WAN zones as gateways to trigger dynamic path selection.

How to eliminate wrong answers

Option A is wrong because FortiOS explicitly supports SD-WAN zones as route gateways — it does not require a literal IP next-hop for SD-WAN routes. Option C is wrong because interface index number has no role in SD-WAN path selection; selection is driven by SD-WAN rules and SLA health checks, not by interface enumeration order. Option D is wrong because SD-WAN does not default to round-robin across all interfaces — load balancing only occurs if a load-balance strategy is explicitly configured in the SD-WAN rule.

Practice this question →

25

MCQhard

A FortiGate is configured with an SD-WAN rule that steers traffic based on application control. The administrator applies a security profile (Antivirus and IPS) to the SD-WAN zone. However, they notice that traffic matching the SD-WAN rule is not being inspected by the security profiles. What is the most likely reason?

A.The SD-WAN rule is using the 'volume' strategy, which disables security inspection.

B.The security profiles are applied to the wrong policy; the SD-WAN rule is referenced in a policy that does not have security profiles enabled.

C.The SD-WAN rule is configured with the 'pass-through' action, which bypasses security inspection.

D.Security profiles cannot be applied to SD-WAN zones; they must be applied to the individual member interfaces.

AnswerB

In FortiOS, SD-WAN rules are used within firewall policies. The security profiles must be applied to the firewall policy that references the SD-WAN rule. If the policy that matches the traffic does not have security profiles enabled, inspection will not occur. Even if profiles are applied to the SD-WAN zone, the policy must also have them. This is the most likely cause.

Why this answer

Security profiles are applied to firewall policies, not directly to SD-WAN rules. When traffic matches an SD-WAN rule, it is processed by the firewall policy that contains that rule. If that policy lacks security profiles, no inspection occurs.

Even if profiles are configured on the SD-WAN zone, they must also be enabled on the policy. Therefore, the most likely reason is that the policy referencing the SD-WAN rule does not have security profiles enabled.

Exam trap

The trap here is assuming that applying security profiles to the SD-WAN zone automatically inspects all traffic, when in fact the firewall policy must also have the profiles enabled.

Practice this question →

26

MCQmedium

A network administrator is configuring an IPsec VPN tunnel between a FortiGate hub and a spoke. The administrator wants to ensure that the spoke can dynamically learn routes from the hub and also advertise its local subnets. Which routing protocol is most commonly used in Fortinet SD-WAN deployments to achieve this?

A.IS-IS

AnswerC

BGP is the routing protocol most commonly used in Fortinet SD-WAN deployments to exchange routes between hub and spoke over IPsec tunnels. It is scalable, supports policy-based routing, and integrates well with ADVPN for dynamic shortcut tunnels. BGP allows the spoke to advertise its local subnets to the hub and learn hub routes, facilitating dynamic routing. Its flexibility and widespread use in SD-WAN make it the preferred choice. This is the correct answer.

Why this answer

In Fortinet SD-WAN deployments, BGP is the de facto routing protocol for dynamic route exchange between hub and spoke over IPsec tunnels. It provides scalability, policy control, and seamless integration with ADVPN for on-demand tunnels. BGP enables spokes to advertise their local subnets and learn hub routes, which is essential for dynamic routing in SD-WAN.

While OSPF and other protocols are supported, BGP is the most commonly used and recommended for this purpose.

Exam trap

The trap here is assuming that any dynamic routing protocol works equally well; BGP is specifically favored in Fortinet SD-WAN for its scalability and ADVPN integration.

Practice this question →

27

MCQmedium

A network administrator has deployed SD-WAN with two IPsec overlays and one internet breakout on a FortiGate. The administrator wants to ensure that traffic from a specific source subnet uses the VPN overlay for a business-critical application, while all other traffic follows the default route. The SD-WAN rule must also verify that the overlay meets an SLA for jitter. Which SD-WAN configuration object should the administrator use to define the source subnet and application criteria?

A.Policy route with destination and service objects, and an outgoing interface of the SD-WAN zone

B.SD-WAN zone with a preferred member and a priority-based selection

C.SD-WAN service rule with match criteria specifying source address and application, and an SLA target

D.Static route with a gateway pointing to the SD-WAN zone and a priority value

AnswerC

SD-WAN service rules (also called SD-WAN rules) allow matching on source address, destination, application, and other criteria. By defining a service rule with the source subnet and application, and attaching an SLA target referencing a health check, the FortiGate steers matching traffic over members that meet the jitter SLA. This is the standard method to implement application-aware routing with SLA enforcement.

Why this answer

The SD-WAN service rule is the correct construct because it supports matching on source address, application, and other criteria, and can reference an SLA target that uses health-check results to select the best member. This allows the administrator to steer the business-critical application over the overlay only when it meets the jitter SLA, while other traffic follows the default route.

Exam trap

The trap here is assuming that an SD-WAN zone or a static route can perform application-aware, SLA-based steering, when only a service rule can match on application and enforce SLA targets.

Practice this question →

28

MCQeasy

A network administrator is deploying SD-WAN with IPsec tunnels and wants to ensure that if a tunnel goes down, traffic is automatically redirected to another member. The administrator has configured two IPsec tunnels in the same SD-WAN zone and a health check for each. Which SD-WAN rule configuration ensures that traffic uses the tunnel with the lowest latency and fails over when the primary tunnel fails the health check?

A.Set the strategy to 'Maximize Bandwidth' and enable load balancing across both tunnels.

B.Set the strategy to 'Best Quality' and reference a health check with latency SLA.

C.Set the strategy to 'Manual' and assign priority values to each member.

D.Set the strategy to 'Lowest Cost' and configure cost values on each member.

AnswerB

Best Quality strategy selects the member with the best quality metric, such as lowest latency, among those that meet SLA targets. When the primary tunnel fails the health check, it is marked out-of-SLA and the other member is chosen. This matches the requirement for lowest latency selection and automatic failover based on health check results.

Why this answer

Best Quality strategy evaluates the health check SLA and selects the member with the best quality metric, typically latency, among those that meet the SLA. If the primary tunnel fails the health check, it becomes ineligible, and the rule automatically fails over to the next best member. This provides both lowest-latency selection and automatic failover, unlike Manual, Lowest Cost, or Maximize Bandwidth strategies.

Exam trap

The trap here is confusing Lowest Cost with Best Quality, assuming that cost reflects latency, when cost is a static value and does not consider real-time health check metrics.

Practice this question →

29

MCQmedium

An administrator implements BGP over SD-WAN tunnels to a cloud provider. The cloud provider requires BGP MD5 authentication on all peering sessions. Where is BGP MD5 authentication configured on the FortiGate?

A.Within the firewall policy authentication settings

B.Under the IPsec phase 1 interface advanced settings

C.Inside the SD-WAN health check probe configuration

D.Under the router bgp neighbor configuration block in the CLI

AnswerD

FortiGate applies BGP MD5 authentication per neighbour using the set password command inside the config router bgp neighbour block, which the cloud provider's peering requirement demands. This CLI location binds the shared secret to each specific peering session.

Why this answer

BGP MD5 authentication is configured per neighbor under the 'config router bgp' → 'config neighbor' block using the 'set password' command. This applies TCP MD5 signature authentication to the BGP peering session, which the cloud provider requires for all peering sessions.

Exam trap

NSE7_SDW often tests the misconception that BGP authentication is configured at the IPsec or firewall policy level, when in fact it is a per-neighbor BGP setting under the router configuration.

How to eliminate wrong answers

Option A is wrong because firewall policy authentication settings control user authentication for traffic passing through the FortiGate, not BGP session authentication. Option B is wrong because IPsec phase 1 advanced settings configure IKE parameters like DH groups and proposals, not BGP MD5. Option C is wrong because SD-WAN health check probes use ICMP, HTTP, or TCP echo to monitor link quality; they do not configure BGP authentication.

Practice this question →

30

MCQhard

An administrator is configuring an SD-WAN rule that uses the 'SLA' strategy with two members: a primary MPLS link and a backup LTE link. The SLA target is latency < 100 ms and packet loss < 1%. The administrator notices that when the MPLS link fails the SLA, traffic is not failing over to LTE. What could be the cause?

A.The LTE member is configured with a higher priority than MPLS.

B.The SLA target is configured with 'packet-loss' but not 'latency'.

C.The health check for the MPLS member is not assigned to the SD-WAN rule.

D.The SD-WAN rule is configured with 'load-balance' mode instead of 'SLA'.

AnswerC

For the SLA strategy to trigger failover, the SD-WAN rule must reference a health check that monitors the members. If the health check is not assigned to the rule, the FortiGate cannot evaluate the SLA criteria and will not detect that MPLS has failed the SLA. Consequently, no failover occurs. Assigning the correct health check to the rule is essential for SLA-based steering. This is the correct cause because without it, the rule has no SLA data to act upon.

Why this answer

In an SD-WAN rule using the SLA strategy, the rule must be linked to a health check that monitors the member links. The health check provides the performance metrics (latency, jitter, packet loss) used to evaluate the SLA targets. If no health check is assigned to the rule, the FortiGate lacks the data to determine SLA compliance, so it cannot trigger failover.

Assigning the appropriate health check resolves the issue, ensuring that when MPLS violates the SLA, traffic is steered to LTE.

Exam trap

The trap here is assuming that creating a health check is sufficient; it must be explicitly referenced in the SD-WAN rule for SLA enforcement.

Practice this question →

31

MCQmedium

A FortiGate SD-WAN deployment uses a firewall policy with an Intrusion Prevention System (IPS) profile applied. After turning on IPS, administrators notice that throughput over an IPsec SD-WAN tunnel drops significantly. What is the primary reason for this throughput reduction, and how can it be mitigated?

A.IPS requires proxy-based inspection, which permanently disables IPsec hardware acceleration

B.IPS inspection requires intensive CPU processing for packet payload analysis, which can be optimized by using flow-based inspection mode and ensuring hardware offloading is active where supported

C.IPS blocks all IPsec AH/ESP headers, forcing fallback to unencrypted GRE tunnels

D.The IPS database size exceeds the IPsec Phase 2 buffer limit

AnswerB

IPS performs deep packet payload inspection, which consumes significant CPU cycles per packet, reducing throughput through the IPsec tunnel. Switching to flow-based inspection and enabling hardware offloading where the platform supports it shifts that processing load, restoring tunnel performance while retaining IPS coverage.

Why this answer

Enabling IPS on a FortiGate forces each packet's payload to be inspected against the IPS signature database, which is CPU-intensive. When IPS is applied to traffic traversing an IPsec SD-WAN tunnel, the added deep inspection work reduces throughput because packets must be reassembled and scanned before encryption/decryption offload can complete. Mitigation is to use flow-based inspection (which inspects packets as they stream rather than buffering full content) and to ensure NPU/hardware offloading is active where the platform supports it.

Exam trap

NSE7_SDW often tests the misconception that IPS inherently disables IPsec acceleration or requires proxy mode — candidates must know that flow-based IPS plus hardware offload is the correct optimization path.

How to eliminate wrong answers

Option A is wrong because IPS does not require proxy-based inspection — FortiGate supports both flow-based and proxy-based IPS, and proxy mode does not 'permanently disable' IPsec hardware acceleration. Option C is wrong because IPS does not block AH/ESP headers; IPsec ESP traffic is decapsulated before IPS inspection, and there is no forced fallback to GRE. Option D is wrong because IPS database size has no relationship to an 'IPsec Phase 2 buffer limit' — Phase 2 negotiates SAs and selectors, not signature storage.

Practice this question →

32

MCQhard

A FortiGate is configured with an SD-WAN rule that uses a health check to monitor an IPsec tunnel. The health check is configured with a ping probe to a remote IP. The administrator notices that the tunnel is marked as down even though the remote IP is reachable via the tunnel. What is a possible cause?

A.The health check is configured with 'security-mode' set to 'none', allowing probes to bypass the tunnel.

B.The health check's probe is using the wrong source interface, causing the probe to be sent outside the tunnel.

C.The health check is configured with 'protocol' set to 'ping' but the remote IP does not respond to ICMP.

D.The health check's source IP is not specified, so it uses the outgoing interface's IP, which is not routable over the tunnel.

AnswerB

If the health check probe is configured to use a source interface that is not the tunnel interface, the probe traffic may be routed outside the tunnel, failing to reach the remote IP. This would cause the health check to mark the tunnel down even though the remote IP is reachable via the tunnel. Specifying the correct source interface (the tunnel interface) is crucial.

Why this answer

A health check probe must be sent through the correct interface to accurately test the tunnel. If the probe's source interface is misconfigured, the probe may bypass the tunnel and fail, causing the tunnel to be marked down despite being operational. Ensuring the health check uses the tunnel interface as the source is essential.

Exam trap

The trap here is assuming that any reachability issue is due to the remote end not responding, when the actual problem could be that the health check probe itself is not being sent through the correct interface.

Practice this question →

33

MCQeasy

An administrator is configuring an SD-WAN rule to route traffic from a specific source subnet to a destination subnet over a preferred IPsec tunnel. The administrator wants to ensure that if the preferred tunnel fails, traffic automatically switches to a backup tunnel. Which SD-WAN rule configuration is required to achieve this?

A.Configure the rule with a single interface and enable 'failover' in the rule settings.

B.Configure the rule with a single interface and rely on the FortiGate's routing table to fail over.

C.Configure the rule with multiple interfaces and associate a health check that includes both interfaces.

D.Configure the rule with multiple interfaces and set the strategy to 'lowest-cost'.

AnswerC

To achieve automatic failover, the SD-WAN rule must include both the preferred and backup interfaces. A health check must be associated with the rule to monitor the status of these interfaces. If the preferred interface fails the health check, the rule will use the backup interface. This is the standard configuration for failover in SD-WAN.

Why this answer

The correct answer is to configure the rule with multiple interfaces and associate a health check that includes both interfaces. This allows the SD-WAN rule to monitor the health of each interface and automatically switch to the backup if the preferred interface fails. Health checks are essential for dynamic failover in SD-WAN.

Exam trap

The trap here is thinking that simply adding multiple interfaces enables failover; a health check must be associated to trigger the failover based on link status.

Practice this question →

34

MCQmedium

An administrator configures an SD-WAN rule using the 'Volume' strategy across two IPsec tunnels with different bandwidth capacities (Tunnel A: 100 Mbps, Tunnel B: 50 Mbps). How does FortiOS distribute traffic across these members when using the Volume strategy?

A.Traffic is balanced equally (50/50) regardless of interface capacity

B.Traffic is sent exclusively over Tunnel A until it reaches 100% packet loss, then fails over to Tunnel B

C.Traffic is distributed proportionally based on the configured weight or bandwidth ratio of each member interface

D.Traffic is steered strictly based on real-time latency measured by health checks

AnswerC

Volume strategy balances traffic by byte count, distributing sessions proportionally to each member's configured weight or bandwidth ratio. With Tunnel A at 100 Mbps and Tunnel B at 50 Mbps, FortiOS assigns roughly twice the volume to Tunnel A, satisfying the stem's differing-capacity constraint rather than equalising per-session load.

Why this answer

The Volume strategy in FortiOS SD-WAN distributes traffic across members proportionally based on the configured weight or bandwidth ratio of each interface. With Tunnel A at 100 Mbps and Tunnel B at 50 Mbps, traffic is split roughly 2:1, not equally. This ensures that higher-capacity links carry more traffic, optimizing utilization.

Exam trap

NSE7_SDW often tests confusion between SD-WAN load-balancing strategies, and candidates mistakenly assume Volume balances equally or reacts to latency like other strategies.

How to eliminate wrong answers

Option A is wrong because equal 50/50 balancing is characteristic of a load-balance strategy, not Volume. Option B is wrong because sending traffic exclusively over one tunnel until failure describes a primary/backup or failover configuration, not Volume. Option D is wrong because latency-based steering is used by the Lowest Latency or Best Quality strategies, not Volume.

Practice this question →

35

Multi-Selectmedium

An administrator is configuring BGP over SD-WAN IPsec tunnels between a headquarters FortiGate and branch FortiGates. Which TWO configuration steps are required to ensure robust and stable dynamic routing over the SD-WAN IPsec tunnels? (Choose two)

Select 2 answers

A.Set the BGP administrative distance to 255 to disable all routing updates

B.Configure BGP neighbors using the loopback interface IP addresses or tunnel specific IP addresses rather than physical interface IPs

C.Enable BGP graceful restart or adjust keepalive and holddown timers to accommodate potential latency spikes and failover delays on WAN links

D.Configure static default routes on all BGP neighbors pointing to the null0 interface

E.Disable IPsec phase 2 encryption to allow BGP plaintext hello packets to pass through without encapsulation overhead

AnswersB, C

Peering BGP sessions to loopback or tunnel-specific addresses decouples routing adjacencies from physical interface state, so a single WAN link failure does not tear down the session. This satisfies the requirement for robust dynamic routing across multiple SD-WAN IPsec tunnels.

Why this answer

Option B is correct because peering BGP over loopback or tunnel-specific IP addresses (rather than physical WAN interface IPs) ties the session to the SD-WAN overlay, so the BGP session survives physical link changes and failover events since the tunnel/loopback address remains reachable regardless of which underlying WAN link carries the IPsec traffic. Option C is correct because WAN links and IPsec tunnels can experience latency spikes and reconvergence delays during failover; enabling BGP graceful restart or tuning keepalive/holddown timers prevents the session from flapping and dropping routes unnecessarily during those transient conditions. Option A is wrong because setting administrative distance to 255 makes the BGP routes unusable (never installed in the routing table), which disables dynamic routing rather than stabilizing it.

Option D is wrong because static default routes pointing to null0 would black-hole traffic and are not a BGP-over-SD-WAN requirement. Option E is wrong because disabling IPsec Phase 2 encryption breaks the secure tunnel and is not needed for BGP, which is encapsulated inside the tunnel anyway.

Exam trap

NSE7_SDW often tests the misconception that BGP over IPsec requires disabling encryption or that physical interface peering is sufficient — candidates miss that loopback/tunnel peering and timer tuning are the actual requirements for stability.

Practice this question →

36

MCQeasy

A network administrator is configuring a static route on a FortiGate to direct traffic to a remote subnet through an IPsec VPN tunnel. The tunnel interface is named 'VPN_Tunnel'. Which of the following is the correct way to configure the static route?

A.Set the destination to the remote subnet, the gateway to the remote public IP, and the interface to the WAN interface.

B.Set the destination to the remote subnet, the gateway to the local public IP, and the interface to the WAN interface.

C.Set the destination to the remote subnet, the gateway to the VPN tunnel's remote IP, and the interface to 'VPN_Tunnel'.

D.Set the destination to the remote subnet, the gateway to 0.0.0.0, and the interface to 'VPN_Tunnel'.

AnswerD

In a route-based IPsec VPN, the static route should specify the remote subnet as the destination, 0.0.0.0 as the gateway (since the tunnel interface handles the next-hop), and the tunnel interface as the outgoing interface. This directs traffic for the remote subnet into the tunnel. This is the standard configuration for route-based VPNs in FortiOS.

Why this answer

For a route-based IPsec VPN, the static route must direct traffic to the remote subnet through the tunnel interface. The correct configuration uses the remote subnet as destination, 0.0.0.0 as gateway, and the tunnel interface as the outgoing interface. This ensures that traffic is encrypted and sent through the tunnel.

Other configurations would either bypass the tunnel or send traffic unencrypted.

Exam trap

The trap here is assuming that the gateway should be the remote IP or the WAN interface, but for route-based VPNs, the gateway is typically 0.0.0.0 and the interface is the tunnel.

Practice this question →

37

MCQhard

An administrator is troubleshooting an SD-WAN deployment where traffic matching an SD-WAN rule with a destination service object (e.g., HTTPS) is not being steered according to the SLA priority. Instead, it is always taking the default static route member. Upon checking the firewall policies, what is the most common reason why an SD-WAN rule fails to process application or service-based traffic matching?

A.IPsec VPN phase 2 selectors must be set to 0.0.0.0/0 for service-based rules to evaluate

B.The SD-WAN rules are evaluated sequentially from top to bottom; an earlier broad SD-WAN rule with matching source/destination IP addresses is intercepting the traffic before the service-specific rule is reached

C.The firewall policy containing the traffic has SSL inspection disabled, preventing service-based identification

D.The FortiGate kernel requires hardware acceleration (NP7) to be disabled for service-based SD-WAN rules to function

AnswerB

SD-WAN rules are evaluated top-down, and the first matching rule wins. A broader earlier rule matching the same source and destination IP addresses captures the traffic before the service-specific HTTPS rule is evaluated, so steering falls back to the default static route member.

Why this answer

SD-WAN rules are evaluated in order from top to bottom, and the first matching rule is applied. If a broad rule (e.g., matching any source/destination or all services) appears above a more specific service-based rule, it will intercept the traffic and prevent the service-specific rule from being evaluated. This is the most common misconfiguration causing service-based SD-WAN rules to be bypassed.

Exam trap

NSE7_SDW often tests the sequential evaluation of SD-WAN rules, tricking candidates into overlooking rule order and blaming other features like SSL inspection or hardware acceleration.

How to eliminate wrong answers

Option A is wrong because IPsec phase 2 selectors do not need to be 0.0.0.0/0 for service-based SD-WAN rules to function; selectors define which traffic is encrypted, not how SD-WAN rules match. Option C is wrong because SSL inspection is not required for SD-WAN service-based rules; these rules match on application signatures or service objects, which can be identified without deep inspection. Option D is wrong because hardware acceleration (NP7) is not a requirement for service-based SD-WAN rules; disabling it would degrade performance and is not a standard troubleshooting step.

Practice this question →

38

MCQmedium

An administrator has configured an SD-WAN rule to steer traffic based on the "maximize bandwidth (SLA)" strategy. The rule uses two IPsec tunnels: one with 100 Mbps and one with 50 Mbps. The administrator expects traffic to be load-balanced proportionally to the bandwidth. However, all traffic is going through the 100 Mbps tunnel. What is the most likely reason?

A.The SD-WAN rule's priority is set to 1 for the 100 Mbps tunnel and 2 for the 50 Mbps tunnel.

B.The 50 Mbps tunnel is configured with a higher cost, causing it to be less preferred.

C.The "maximize bandwidth" strategy requires equal bandwidth links to load-balance.

D.The 50 Mbps tunnel is not meeting the SLA criteria, so it is excluded.

AnswerD

If the 50 Mbps tunnel fails to meet the SLA (e.g., latency, jitter, or packet loss thresholds), it will be marked as out-of-SLA and not used for traffic steering. This would cause all traffic to use the 100 Mbps tunnel, which meets the SLA. Checking the health check status of the 50 Mbps tunnel is essential.

Why this answer

The "maximize bandwidth" strategy distributes traffic across links based on their available bandwidth, but only if they meet the SLA. If the 50 Mbps tunnel is not meeting the SLA, it is excluded, and all traffic goes to the 100 Mbps tunnel. The administrator should verify the health check status and SLA targets for the 50 Mbps tunnel.

Exam trap

The trap here is assuming that unequal bandwidth links cannot be load-balanced, when actually the issue is likely SLA failure on the lower-bandwidth link.

Practice this question →

39

MCQeasy

An administrator is configuring an IPsec VPN tunnel that will be used as an SD-WAN member. The tunnel must be able to carry multicast traffic for OSPF. Which IPsec Phase 2 configuration parameter must be enabled to support this requirement?

A.Enable 'Diffie-Hellman Group 14' in Phase 2.

B.Enable 'Multicast' in Phase 2.

C.Enable 'Auto-negotiate' in Phase 2.

D.Enable 'Replay Detection' in Phase 2.

AnswerB

The 'Multicast' option in Phase 2 enables the IPsec tunnel to carry multicast and broadcast traffic. This is required for routing protocols like OSPF that use multicast hellos. Without it, the tunnel will drop multicast packets, preventing OSPF adjacencies from forming over the VPN.

Why this answer

To carry multicast traffic such as OSPF hellos over an IPsec tunnel, the Phase 2 configuration must have the 'Multicast' option enabled. This allows the tunnel to encapsulate and forward multicast and broadcast packets, which are otherwise blocked by default. Enabling this is essential for dynamic routing protocols to operate over IPsec.

Exam trap

The trap here is confusing security or negotiation settings with traffic type permissions; only the 'Multicast' setting in Phase 2 controls whether multicast packets are allowed through the tunnel.

Practice this question →

40

MCQeasy

When configuring an SD-WAN health check to monitor internet reachability using HTTP/HTTPS requests, which parameter defines the specific string the FortiGate expects to receive in the server response body to validate that the path is healthy?

A.probe-packet-size

B.sla-break-time

C.http-match

D.server-response-timeout

AnswerC

The http-match parameter specifies the exact string the FortiGate searches for in the HTTP or HTTPS response body; a match confirms the path is healthy. This satisfies the stem's requirement for validating internet reachability via response content.

Why this answer

The http-match parameter in an SD-WAN health check defines the specific string that the FortiGate expects to find in the HTTP/HTTPS response body to consider the path healthy. This allows the firewall to validate not just reachability but also that the correct application or service is responding. It is a key configuration for application-aware health checks.

Exam trap

NSE7_SDW often tests the specific parameters of SD-WAN health checks; candidates may confuse http-match with other timeout or size parameters, forgetting that it is the only one that validates response content.

How to eliminate wrong answers

Option A is wrong because probe-packet-size defines the size of the probe packet, not the expected response content. Option B is wrong because sla-break-time is the duration for which an SLA must be violated before the link is considered out of SLA, not related to response body matching. Option D is wrong because server-response-timeout specifies how long to wait for a response, not what content to expect.

Practice this question →

41

MCQmedium

In an ADVPN 2.0 deployment, a hub unit uses BGP to advertise routes to spokes. When a spoke learns a prefix via BGP from the hub, what mechanism allows the spoke to automatically initiate an ADVPN shortcut tunnel directly to another spoke when traffic flows between them?

A.The FortiGate kernel detects traffic matching a dynamic BGP route over the IPsec interface and initiates an IKE shortcut negotiation with the target spoke

B.OSPF sends a special multicast hello packet across the hub to establish mesh point-to-point links

C.FortiManager pushes a dynamic static route to both spokes simultaneously

D.The Web Filtering profile intercepts the packet and redirects it via proxy to the destination spoke

AnswerA

The kernel performs a route lookup on the first packet, sees the destination reachable via a BGP-learned dynamic route pointing at the IPsec overlay, and triggers an IKE shortcut negotiation to the target spoke's tunnel IP, establishing the direct spoke-to-spoke path.

Why this answer

In ADVPN, when a spoke receives a BGP route from the hub pointing to another spoke's subnet, the route's next-hop resolves over the IPsec tunnel. When the spoke's kernel sees traffic destined for that prefix, it triggers the ADVPN shortcut logic: the spoke initiates an IKE negotiation directly with the target spoke to build a dynamic shortcut tunnel, bypassing the hub for that traffic. This is the core ADVPN 'shortcut' behavior.

Exam trap

The trap is assuming a control-plane push (FortiManager or OSPF) creates the shortcut — in reality, ADVPN shortcuts are data-plane triggered by the FortiGate kernel seeing traffic for a remote spoke prefix.

How to eliminate wrong answers

Option B is wrong because OSPF multicast hellos are not the ADVPN shortcut mechanism; ADVPN uses BGP (or RIP) route exchange plus IKE, and OSPF is not the trigger for shortcut establishment in this scenario. Option C is wrong because FortiManager does not push dynamic static routes to spokes to create shortcuts; shortcut tunnels are negotiated on-demand by the FortiGates themselves based on traffic. Option D is wrong because Web Filtering is a security profile for inspecting HTTP/HTTPS traffic and has nothing to do with establishing IPsec shortcut tunnels.

Practice this question →

42

MCQhard

An administrator is configuring an IPsec VPN tunnel between two FortiGate devices for SD-WAN. The administrator wants to ensure that the tunnel interface can be used in SD-WAN rules and that the tunnel is established only when the underlying physical interface is up. Which IPsec Phase 1 configuration parameter is required to bind the tunnel to a specific outgoing interface?

A.interface

B.psksecret

C.remote-gw

D.local-gw

AnswerA

In IPsec Phase 1 configuration, the 'interface' parameter specifies the outgoing physical interface that the tunnel will use. Setting this ensures the tunnel is established only when that interface is up and binds the tunnel to it. This is essential for SD-WAN because it allows the tunnel to be associated with a specific member, enabling proper health checks and steering.

Why this answer

The 'interface' parameter in IPsec Phase 1 explicitly binds the tunnel to a specific outgoing interface. This ensures the tunnel uses only that interface and is established only when it is up, which is critical for SD-WAN member association and health checking. Other parameters like local-gw or remote-gw do not provide this binding.

Exam trap

The trap here is confusing local-gw with interface; local-gw only selects the source IP, not the outgoing interface, so it does not bind the tunnel to a specific physical link.

Practice this question →

43

MCQeasy

A network administrator wants to ensure that IPsec traffic between two FortiGate SD-WAN members is encrypted with a specific set of algorithms. The administrator configures Phase 2 selectors on both peers. Which Phase 2 parameter must match on both ends for the tunnel to come up?

A.The Phase 2 replay window size, which must be set to the same value on both peers.

B.The Phase 2 proposal, including encryption and authentication algorithms.

C.The Phase 2 key lifetime, which must be identical in seconds on both peers.

D.The Phase 2 local and remote subnets, which must be mirrored exactly on both peers.

AnswerB

Phase 2 proposals must match on both peers for the IPsec SA to establish. If the encryption or authentication algorithms differ, the tunnel will fail to negotiate. In SD-WAN overlays, ensuring consistent Phase 2 proposals across all members prevents intermittent tunnel failures. This is a fundamental IPsec requirement and applies regardless of SD-WAN configuration.

Why this answer

For an IPsec Phase 2 SA to establish, the proposal—encryption and authentication algorithms—must match on both peers. Other parameters like key lifetime, selectors, and replay window are either locally significant or must be complementary rather than identical. In SD-WAN deployments, consistent Phase 2 proposals across all overlay members prevent negotiation failures and ensure stable tunnels.

Administrators should verify proposals when troubleshooting tunnel establishment issues.

Exam trap

The trap here is assuming that all Phase 2 parameters must be identical, when only the proposal algorithms must match; selectors must be complementary, and lifetime/replay window are not strictly required to match.

Practice this question →

44

Multi-Selectmedium

An administrator applies security profiles (Antivirus, Web Filtering, and IPS) to traffic steered by an SD-WAN rule. Performance issues arise. Which TWO methods can the administrator use to optimize inspection performance without completely disabling security? (Choose two)

Select 2 answers

A.Switch the inspection mode from proxy-based to flow-based where supported, allowing hardware offloading (NP6/NP7) to accelerate packet processing

B.Set the IPsec Phase 1 encryption algorithm to DES to speed up decryptions

C.Configure security profile exemptions or antivirus inspection overrides for trusted internal subnets or latency-sensitive VoIP traffic

D.Disable all SSL inspection globally across the entire FortiGate device

E.Remove the SD-WAN virtual interface from all firewall zones

AnswersA, C

Flow-based inspection, where supported, permits NP6/NP7 hardware offloading of session traffic, moving packet processing off the CPU. This preserves Antivirus, Web Filtering and IPS enforcement while reducing the inspection overhead causing the SD-WAN performance issues.

Why this answer

Option A is correct because switching from proxy-based to flow-based inspection allows supported FortiGate models to use hardware acceleration (NP6/NP7 processors) for packet processing, which significantly reduces latency and improves throughput while still applying the security profiles. Option C is correct because configuring security profile exemptions or antivirus inspection overrides for trusted internal subnets or latency-sensitive VoIP traffic reduces the volume of traffic subjected to deep inspection, thereby optimizing performance without fully disabling security. Option B is incorrect because DES is a weak, deprecated encryption algorithm and would not meaningfully speed up IPsec decryption; it also degrades security rather than optimizing inspection.

Option D is incorrect because disabling SSL inspection globally removes a critical security control entirely, which violates the requirement to avoid completely disabling security. Option E is incorrect because removing the SD-WAN virtual interface from all firewall zones would break the SD-WAN routing and security policy enforcement, not optimize inspection performance.

Exam trap

NSE7_SDW often tests the misconception that security and performance are mutually exclusive — candidates jump to 'disable inspection' options instead of recognizing granular optimizations like flow-based mode and profile exemptions.

Practice this question →

45

MCQhard

An administrator configures an SD-WAN rule that uses the 'maximize bandwidth (SLA)' strategy across three IPsec overlays. A security profile group containing IPS and Application Control is applied to the firewall policy that references the SD-WAN zone. Users report that some sessions are being re-evaluated mid-stream and reset when a health check fails. Which FortiOS behavior explains the resets?

A.IPS and Application Control cannot be applied to SD-WAN zones; the profiles are silently ignored, and the resets are caused by the missing inspection.

B.When an SLA member fails, FortiOS re-runs the SD-WAN rule and may steer existing sessions to a different member, causing the security profile to re-inspect and reset sessions that cannot be re-evaluated.

C.The 'maximize bandwidth (SLA)' strategy ignores SLA health checks and only uses link capacity, so when a member saturates, IPS drops packets and resets the session.

D.The security profile group is applied to the SD-WAN zone, but FortiOS requires profiles to be bound to each member interface individually; the zone-level binding causes mid-stream resets.

AnswerB

SD-WAN rules with SLA targets can trigger session re-evaluation when a member's SLA fails. If the rule allows re-evaluation, FortiOS may move existing flows to another member; stateful security profiles like IPS and Application Control cannot always preserve state across members, so sessions can be reset. Disabling re-evaluation or using session-pickup-aware settings mitigates this.

Why this answer

SD-WAN rules that monitor SLA can trigger re-evaluation of existing sessions when a member's SLA degrades or fails. If the rule permits re-evaluation, FortiOS may move flows to a different member. Stateful security profiles such as IPS and Application Control may not be able to maintain inspection state across members, leading to session resets.

Administrators can control this by disabling re-evaluation for sensitive rules or by designing SLA thresholds that avoid frequent flapping, ensuring stable session steering.

Exam trap

The trap here is believing that applying security profiles to an SD-WAN zone is unsupported or that profile binding is per-member, when the actual cause is session re-evaluation during SLA failure.

Practice this question →

46

MCQeasy

An administrator wants to apply a Web Filtering security profile to traffic that is being dynamically steered via an SD-WAN rule. Where must this security profile be enforced in FortiOS?

A.Inside the firewall policy that matches the traffic being steered by the SD-WAN rule

B.Directly inside the SD-WAN rule configuration under the advanced settings tab

C.Globally under the system settings as an SD-WAN overlay inspection profile

D.Within the IPsec tunnel phase 2 security association settings

AnswerA

SD-WAN rules only steer traffic; they cannot apply security profiles. The profile must sit in the firewall policy that matches the steered traffic, because that policy performs the UTM inspection after the SD-WAN rule selects the egress member.

Why this answer

In FortiOS, security profiles such as Web Filtering are enforced by the firewall policy that matches the traffic, not by the SD-WAN rule itself. SD-WAN rules only determine the outgoing interface or path; they do not apply security inspection. Therefore, the Web Filtering profile must be attached to the firewall policy that permits and steers the traffic via the SD-WAN rule.

Exam trap

NSE7_SDW often tests the misconception that security profiles can be applied directly within SD-WAN rules, confusing the forwarding plane with the security inspection plane.

How to eliminate wrong answers

Option B is wrong because SD-WAN rules do not have an advanced settings tab for security profiles; they only define path selection criteria. Option C is wrong because there is no global SD-WAN overlay inspection profile in FortiOS; security profiles are applied per firewall policy. Option D is wrong because IPsec Phase 2 settings define encryption and authentication parameters, not security inspection profiles.

Practice this question →

47

Multi-Selecthard

An administrator troubleshoots a scenario where traffic matching an application-based SD-WAN rule is bypassing the preferred high-speed MPLS tunnel and taking the backup broadband tunnel instead. Which THREE factors should the administrator check to resolve this routing discrepancy? (Choose three)

Select 3 answers

A.Verify the FortiGate factory default administrator password is changed

B.Check the physical layer OSI Model cable category connected to the FortiGate port

C.Inspect the member priorities and weights configured within the specific SD-WAN rule

D.Verify whether the preferred MPLS member is failing the configured performance SLA thresholds, causing the SD-WAN engine to disqualify it

E.Check the sequence order of the SD-WAN rules; an earlier rule might be matching the traffic first

AnswersC, D, E

Member priority and weight determine which tunnel the SD-WAN rule selects among qualified members; a misconfigured weight can rank broadband above MPLS. Checking these satisfies the discrepancy by confirming the rule's own selection logic, not just tunnel health.

Why this answer

Option C is correct because SD-WAN rule member priorities and weights directly determine which member is preferred; if the MPLS member has a lower priority or weight than the broadband member, traffic will be steered to broadband. Option D is correct because the SD-WAN engine continuously probes members against the configured performance SLA (e.g., latency, jitter, packet loss); if MPLS fails those thresholds, it is marked ineligible and the next-best member (broadband) is selected. Option E is correct because SD-WAN rules are evaluated top-down by sequence order, so an earlier rule matching the same application/traffic could override the intended rule and send traffic out the broadband tunnel.

Option A is irrelevant because changing the default admin password is a hardening step unrelated to SD-WAN path selection. Option B is irrelevant because cable category is a physical-layer attribute that does not influence SD-WAN rule matching or member eligibility decisions.

Exam trap

NSE7_SDW often tests the misconception that SD-WAN member selection is purely static (priority/weight only), causing candidates to overlook SLA health-check disqualification and rule sequence order as the real cause of unexpected failover.

Practice this question →

48

MCQmedium

An administrator is configuring an SD-WAN rule to route VoIP traffic over the MPLS link and all other traffic over the internet link. The administrator wants to ensure that VoIP traffic is prioritized and that the rule only selects the MPLS link if it meets specific latency and jitter thresholds. Which SD-WAN configuration should be used?

A.Create an SD-WAN rule with the 'volume' strategy, assigning a higher weight to the MPLS link for VoIP traffic.

B.Create an SD-WAN rule with the 'priority' strategy, setting the MPLS link as the highest priority for VoIP traffic.

C.Create an SD-WAN rule with the 'SLA' strategy, referencing a health check that monitors latency and jitter on the MPLS link, and set the rule to match VoIP traffic.

D.Create an SD-WAN rule with the 'manual' strategy, explicitly selecting the MPLS link for VoIP traffic.

AnswerC

Using the 'SLA' strategy allows the SD-WAN rule to evaluate the health check's latency and jitter measurements against configured thresholds. If the MPLS link meets the SLA, VoIP traffic is routed over it. If not, the rule can fail over to another link if configured. This ensures that VoIP traffic only uses the MPLS link when it meets quality requirements.

Why this answer

The 'SLA' strategy is designed to route traffic based on health check metrics such as latency and jitter. By referencing a health check that monitors these metrics on the MPLS link, the SD-WAN rule can ensure that VoIP traffic is only sent over the MPLS link when it meets the specified thresholds. If the thresholds are not met, the rule can fail over to another link, maintaining call quality.

Exam trap

The trap here is assuming that the 'priority' strategy can enforce quality thresholds, when in fact it only considers link priority and up/down status, not SLA metrics.

Practice this question →

49

MCQmedium

A FortiGate is configured with two IPsec overlays in an SD-WAN zone. The administrator wants to ensure that return traffic from the remote subnet arrives on the same overlay that the original session used, but the remote gateway IP is the same on both overlays. Which SD-WAN member setting should be configured to achieve this?

A.Enable 'preserve-session-route' under the SD-WAN member interface.

B.Configure 'route-overlap' to allow multiple default routes over the same gateway.

C.Enable 'preserve-session-route' under the IPsec phase1-interface.

D.Enable 'auto-discovery-forwarder' on the SD-WAN zone.

AnswerC

Enabling preserve-session-route under the IPsec phase1-interface ensures that when a session is established over a specific IPsec tunnel, return traffic is forced back through that same tunnel, even if multiple tunnels share the same remote gateway IP. This setting maintains session stickiness at the tunnel level, preventing asymmetric routing. It is the correct solution because it directly addresses the requirement to keep return traffic on the originating overlay, which is critical when remote gateways are identical.

Why this answer

When multiple IPsec overlays terminate on the same remote gateway IP, the FortiGate cannot differentiate them by gateway alone. Enabling preserve-session-route on the IPsec phase1-interface forces the return traffic of a session to use the same tunnel that initiated it, ensuring symmetry. This is essential in SD-WAN deployments where multiple overlays exist and traffic must not be load-balanced across them for established sessions.

The other options do not provide this per-session stickiness at the tunnel level.

Exam trap

The trap here is confusing session stickiness features (like preserve-session-route) with route-overlap or ADVPN forwarding, which do not enforce return path symmetry for identical remote gateways.

Practice this question →

50

MCQmedium

A FortiGate is configured with an SD-WAN rule that steers traffic to an IPsec overlay tunnel. A security administrator needs to inspect the traffic with an IPS sensor before it egresses the tunnel. Where must the IPS sensor be applied so that it inspects traffic matching the SD-WAN rule?

A.In the firewall policy that permits the traffic and references the SD-WAN zone as the outgoing interface.

B.Inside the SD-WAN rule definition, by enabling the 'security-profile' option and selecting the IPS sensor.

C.In the IPsec Phase 2 selector, by attaching the IPS sensor to the tunnel's proxy ID.

D.In the SD-WAN health-check definition, by binding the IPS sensor to the SLA probe.

AnswerA

Security profiles are enforced in the firewall policy that matches the session, and the SD-WAN rule only selects the egress member after policy lookup. Applying the IPS sensor in that policy ensures inspection occurs before the selected tunnel carries the packet. The SD-WAN zone is referenced as the outgoing interface, so all members inherit the same inspection.

Why this answer

The firewall policy that permits the session is where UTM profiles such as IPS are enforced. Because the SD-WAN rule only chooses the egress member after the policy is matched, the policy must reference the SD-WAN zone as its outgoing interface. This way, any member selected by the rule inherits the same IPS inspection, ensuring consistent protection regardless of which tunnel carries the traffic.

Exam trap

The trap here is assuming that security profiles can be attached directly to an SD-WAN rule or its members rather than to the firewall policy that references the SD-WAN zone.

Practice this question →

51

MCQmedium

An administrator configures an SD-WAN rule that steers Microsoft 365 traffic over the IPsec tunnel 'MPLS-VPN' and sets the rule's 'Priority' to 1. A second SD-WAN rule for the same traffic exists, but its 'Priority' is 10. Which statement accurately describes how FortiOS evaluates these rules?

A.Both rules are evaluated simultaneously, and traffic is load-balanced across the tunnels defined in each rule.

B.The rule with Priority 1 is applied only if the rule with Priority 10 is disabled or deleted.

C.The rule with Priority 10 is evaluated first because a higher numeric value indicates a higher precedence in FortiOS SD-WAN.

D.The rule with Priority 1 is evaluated first; if its SLA health check fails, the rule with Priority 10 is evaluated next.

AnswerD

FortiOS evaluates SD-WAN rules in ascending priority order. The rule with Priority 1 is checked first. If its associated SLA health check fails, that rule is skipped and the next rule (Priority 10) is evaluated, allowing fallback to a secondary path. This matches the intended design of priority-based rule ordering.

Why this answer

SD-WAN rules are processed in ascending priority order. The rule with the lowest priority number is evaluated first; if its SLA health check fails, FortiOS moves to the next rule. This design provides deterministic failover.

The other options misstate the direction of priority or incorrectly describe parallel evaluation, which is not how FortiOS SD-WAN rule processing works.

Exam trap

The trap here is assuming that a higher numeric priority value means higher precedence, when FortiOS actually evaluates lower numbers first.

Practice this question →

52

MCQhard

An administrator is troubleshooting an IPsec VPN tunnel that is part of an SD-WAN zone. The tunnel is up, but SD-WAN health checks are failing, causing the tunnel to be marked as down. The administrator verifies that the Phase 2 selectors include the health check server's IP address. What is the next most likely cause to investigate?

A.The tunnel interface is not added to the SD-WAN zone.

B.The SD-WAN health check is configured with the wrong protocol (e.g., HTTP instead of ping).

C.The health check server is not reachable via the tunnel due to missing route.

D.The IPsec tunnel's Phase 1 proposal does not match the remote gateway.

AnswerC

Even if the Phase 2 selectors are correct, the FortiGate must have a route to the health check server pointing to the tunnel interface. If the route is missing or incorrect, the probe packets will not be sent through the tunnel, and health checks will fail. This is a common oversight in SD-WAN deployments, especially when using dynamic routing or multiple paths.

Why this answer

After verifying Phase 2 selectors, the next most likely cause for SD-WAN health check failure on an up tunnel is a missing route to the health check server. Without a route, the probes cannot reach the server, and the health check fails. The other options are either contradicted by the scenario (tunnel up) or less likely given the context.

Ensuring proper routing is essential for health checks to traverse the tunnel.

Exam trap

The trap here is focusing on IPsec parameters like Phase 1 or selectors, while overlooking the underlying routing requirement for health check probes to reach the server through the tunnel.

Practice this question →

53

MCQhard

An enterprise deploys BGP over SD-WAN with multiple MPLS and broadband connections. A route-map is applied to incoming BGP updates on the FortiGate to set a specific weight for routes learned over the MPLS interface. Why is the 'weight' attribute particularly effective in this FortiOS SD-WAN and BGP integration scenario?

A.Weight replaces the need for SD-WAN SLA rules by performing layer 7 packet inspection

B.Weight automatically adjusts the SD-WAN health check probe frequency based on route stability

C.Weight is evaluated first in the BGP best-path selection algorithm on FortiOS, allowing local preference override without altering global AS path attributes

D.Weight is propagated to all iBGP peers, ensuring cluster-wide path synchronization

AnswerC

Weight is FortiOS-proprietary and evaluated before local preference in the BGP best-path algorithm, so tagging MPLS-learned routes with a higher weight forces their selection locally. This satisfies the stem's constraint: influencing path choice on this FortiGate without altering AS-path or other attributes propagated to peers.

Why this answer

In FortiOS BGP, the weight attribute is evaluated first in the best-path selection algorithm, before local preference and other attributes. Setting a higher weight on routes learned from the MPLS interface makes those routes preferred locally without affecting other routers, since weight is local to the FortiGate and not propagated in BGP updates. This allows granular, per-device control in an SD-WAN environment.

Exam trap

NSE7_SDW often tests whether candidates mistakenly believe weight is propagated to peers or replaces SD-WAN SLA mechanisms, rather than recognizing it as a local, first-evaluated BGP attribute.

How to eliminate wrong answers

Option A is wrong because weight does not perform layer 7 inspection or replace SD-WAN SLA rules; it is a BGP path attribute. Option B is wrong because weight does not adjust health check probe frequency; SLA probe intervals are configured separately. Option D is wrong because weight is not propagated to iBGP peers; it is a local, non-transitive attribute, so it cannot ensure cluster-wide synchronization.

Practice this question →

54

MCQeasy

An administrator is configuring a new SD-WAN rule to steer traffic based on application signatures. The administrator wants to ensure that the rule only matches traffic for Microsoft Teams and prioritizes it over other traffic. Which SD-WAN rule configuration should be used?

A.Create a rule with 'internet-service' set to Microsoft Teams and enable 'sla'.

B.Set the rule's 'dst' to the Microsoft Teams IP addresses and enable 'priority'.

C.Configure a rule with 'src' as the internal subnet and 'dst' as 'all', then apply a web filter profile.

D.Use an application-based SD-WAN rule and select the Microsoft Teams application signature.

AnswerD

An application-based SD-WAN rule allows the administrator to select specific application signatures, such as Microsoft Teams, from the application database. This ensures that traffic is matched based on deep packet inspection of the application, which is accurate and dynamic. The rule can then be prioritized by placing it above other rules or by setting a higher priority. This is the correct method to steer Microsoft Teams traffic specifically.

Why this answer

To steer traffic based on application, the SD-WAN rule must use the application-based matching capability. FortiOS includes an application database with signatures for thousands of applications, including Microsoft Teams. By creating an SD-WAN rule that specifies the Microsoft Teams application, the FortiGate can identify and steer that traffic accordingly.

The rule can be prioritized by ordering it before other rules or by using the priority setting. This method is accurate and dynamic, unlike static IP or ISDB approaches.

Exam trap

The trap here is relying on IP addresses or ISDB entries for application steering, which are less accurate than application signatures that inspect the actual traffic.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Security Profiles Routing And Ipsec questions.

Start 20-question session