NSE7_SDW Security Profiles Routing And IPsec Practice Question
When configuring advanced IPsec VPN tunnels to act as members of an SD-WAN zone, which TWO configuration parameters on the FortiGate are critical for ensuring proper IPsec tunnel operation and traffic steering? (Choose two)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ensure the IPsec interface is added to an SD-WAN zone and assigned a valid virtual IP/interface configuration
When configuring IPsec tunnels for SD-WAN, setting the interface as a member of an SD-WAN zone and ensuring correct Phase 2 selectors or mode-cfg / routing settings are essential. Specifically, setting the interface to allow traffic, defining appropriate Phase 2 selectors or using 0.0.0.0/0 with route-based VPNs, and assigning it to an SD-WAN zone are critical.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Ensure the IPsec interface is added to an SD-WAN zone and assigned a valid virtual IP/interface configuration
Why this is correct
Correct. IPsec interfaces must be added to an SD-WAN zone to participate in SD-WAN rules.
- ✗
Disable NAT traversal (NAT-T) globally on all IPsec phase 1 tunnels
Why it's wrong here
Disabling NAT-T would break IPsec tunnels traversing NAT devices.
- ✗
Configure the IPsec tunnel mode as dialup server on all participating branch spokes
Why it's wrong here
Branch spokes act as dialup clients connecting to a hub server, not dialup servers themselves.
- ✗
Set the IPsec phase 1 authentication method strictly to RSA certificates only, disabling pre-shared keys
Why it's wrong here
Pre-shared keys are commonly and successfully used in SD-WAN IPsec tunnels.
- ✓
Configure Phase 2 selectors to match the exact source and destination subnets, or use 0.0.0.0/0 for route-based VPN flexibility
Why this is correct
Correct. Route-based IPsec VPNs used in SD-WAN typically use 0.0.0.0/0 Phase 2 selectors to allow dynamic routing and flexible SD-WAN steering.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
About these practice questions
One of 92 original NSE7_SDW practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Fortinet exam blueprint
This NSE7_SDW practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7_SDW exam.