Courseiva

CCNA Nse7 SD Wan Central Management Questions

32 questions · Nse7 SD Wan Central Management · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
Multi-Selectmedium

Which TWO methods can be used to update SD-WAN policies across all managed devices in FortiManager?

Select 2 answers
A.Using a CLI script to push updates
B.Modifying the SD-WAN template and installing the changes
C.Editing the individual FortiGate policy
D.Creating a new ADOM
E.Rebooting the FortiManager
AnswersA, B

A CLI script pushed through FortiManager runs the same configuration commands on every targeted managed device, updating SD-WAN policy entries in bulk. This satisfies the requirement to propagate changes across all devices without touching each firewall individually.

Why this answer

Option A is correct because FortiManager supports running CLI scripts (via Device Manager > Scripts) against managed FortiGates, allowing SD-WAN policy commands to be pushed to all devices in a single script execution. Option B is correct because SD-WAN policies are provisioned through SD-WAN templates in FortiManager, and modifying the template followed by an Install Wizard operation propagates the updated policy to all devices bound to that template. Option C is not the intended method since editing an individual FortiGate policy only affects that single device and does not centrally update policies across all managed devices.

Option D is incorrect because creating a new ADOM merely establishes a separate administrative domain and does not push any SD-WAN policy changes. Option E is incorrect because rebooting FortiManager does not modify or distribute SD-WAN policies to managed devices.

Exam trap

FORTINET-NSE7-SPECIALTY often tests centralized vs. per-device management — candidates pick 'editing the individual FortiGate policy' because it's the most direct-sounding action, missing that FortiManager's value is fleet-wide template/script pushes.

Practice this question →
2
MCQmedium

When configuring SD-WAN in FortiManager, why would you use 'Shared Objects'?

A.To increase the number of VDOMs supported
B.To allow FortiGates to share logs
C.To enable reuse of configuration elements across different templates
D.To create a site-to-site VPN
AnswerC

Shared Objects let one definition, such as an SD-WAN health check or SLA target, be referenced by many templates rather than duplicated. This satisfies the requirement to reuse configuration elements consistently across templates, so a single edit propagates everywhere.

Why this answer

Shared Objects in FortiManager are global or ADOM-level configuration objects (addresses, services, VIPs, security profiles, SD-WAN templates) that can be referenced by multiple policy packages, provisioning templates, and SD-WAN templates. This eliminates duplication and ensures consistency when the same object (e.g., an SD-WAN member interface or SLA target) must appear across many FortiGates or VDOMs. Because SD-WAN deployments typically span dozens of branches with identical object definitions, Shared Objects is the mechanism that makes template reuse practical.

Exam trap

FORTINET-NSE7-SPECIALTY often tests whether candidates confuse FortiManager's configuration-reuse constructs (Shared Objects, templates, policy packages) with operational features like logging (FortiAnalyzer) or VPN creation, so the trap is picking a plausible-sounding but functionally unrelated answer.

How to eliminate wrong answers

Option A is wrong because the number of VDOMs supported is a platform/licensing limit on the FortiGate itself, not something FortiManager Shared Objects can increase. Option B is wrong because log sharing between FortiGates is handled by FortiAnalyzer (or syslog/FAZ forwarding), not by FortiManager Shared Objects, which are configuration constructs. Option D is wrong because site-to-site VPNs are built with IPsec phase1/phase2 objects and VPN Manager or templates — Shared Objects merely store reusable definitions and do not create tunnels by themselves.

Practice this question →
3
MCQmedium

A network administrator needs to provision a new SD-WAN zone across 50 managed FortiGates using FortiManager. The administrator wants to minimize manual configuration and ensure that the SD-WAN settings remain consistent. Which FortiManager feature should be used to achieve this?

A.Configure SD-WAN directly on each FortiGate via CLI and then import the configuration into FortiManager.
B.Create a new policy package and manually add SD-WAN members to each FortiGate.
C.Use the SD-WAN Template feature in FortiManager to define a template and assign it to the managed FortiGates.
D.Utilize FortiManager's script feature to push SD-WAN configuration to all FortiGates.
AnswerC

SD-WAN Templates in FortiManager allow you to define SD-WAN settings once and apply them to multiple FortiGates, ensuring consistency and reducing manual effort. The template supports dynamic mapping of interfaces, zones, and health checks, and can be assigned to device groups or individual devices. This is the recommended method for scalable SD-WAN provisioning across many FortiGates.

Why this answer

SD-WAN Templates in FortiManager provide a centralized, reusable method to define SD-WAN settings and apply them to multiple FortiGates. They support dynamic mapping of interfaces and zones, ensuring consistency and reducing manual configuration. This approach is ideal for provisioning SD-WAN across many devices, as it simplifies management and enforces standardization.

Exam trap

The trap here is assuming that CLI scripts or manual configuration can achieve the same consistency and scalability as SD-WAN templates.

Practice this question →
4
MCQhard

What happens if you modify an SD-WAN template that is already applied to a FortiGate?

A.The changes take effect immediately without a push
B.The configuration status shows 'Modified' and requires an installation task
C.The FortiGate automatically pulls the new config
D.The FortiGate configuration is reverted
AnswerB

Editing an applied SD-WAN template marks the FortiGate's configuration status as 'Modified', because the device's running configuration no longer matches the last installed template revision. An explicit installation task must then push the updated template, satisfying the stem's requirement that changes are staged rather than applied automatically.

Why this answer

When you modify an SD-WAN template that is already applied to a FortiGate, FortiManager marks the device's configuration status as 'Modified' because the running configuration on the FortiGate no longer matches the template. The change is not pushed automatically; an administrator must run an installation task (or 'Install Wizard') to push the updated template to the FortiGate. This is consistent with FortiManager's staged change model.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the push-vs-pull misconception — candidates assume FortiGate pulls config like a DHCP client, but FortiManager is a push model requiring an explicit install task.

How to eliminate wrong answers

Option A is wrong because FortiManager never pushes configuration changes to managed devices without an explicit installation task — changes are staged in the manager's database first. Option C is wrong because FortiGate does not pull configuration from FortiManager; FortiManager pushes configuration to FortiGate, and only when an install task is initiated. Option D is wrong because modifying a template does not revert the FortiGate's configuration — the device keeps running its current config until a new one is installed, and the 'Modified' status simply flags the drift.

Practice this question →
5
MCQmedium

In SD-WAN central management, what is the 'SD-WAN Zone' used for?

A.To define the physical port speed
B.To limit bandwidth for specific users
C.To group multiple SD-WAN members for logical policy routing
D.To isolate the SD-WAN traffic from the WAN
AnswerC

An SD-WAN zone groups multiple SD-WAN members so that policies and rules can reference the zone rather than individual interfaces. This satisfies the stem by enabling logical policy routing across members, simplifying configuration when links change.

Why this answer

The SD-WAN Zone is used to group multiple SD-WAN members (interfaces) into a logical entity for policy routing. This allows administrators to apply consistent routing policies and SLA profiles across all members in the zone, simplifying configuration and management.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the confusion between SD-WAN zones and other zoning concepts, leading candidates to select options about bandwidth limiting or isolation.

How to eliminate wrong answers

Option A is wrong because physical port speed is configured on the interface itself, not via the SD-WAN zone. Option B is wrong because bandwidth limiting for users is handled through traffic shaping or QoS policies, not the SD-WAN zone. Option D is wrong because isolating SD-WAN traffic from the WAN is not the purpose; the zone is about logical grouping for routing.

Practice this question →
6
MCQmedium

When viewing the SD-WAN Monitor in FortiManager, what information is provided for the 'Health Check' status?

A.The firmware version of the device
B.The number of active users
C.Latency, jitter, and packet loss metrics
D.The current IP address of the interface
AnswerC

The SD-WAN Monitor's Health Check view reports the live SLA measurements gathered by the health check probes: latency, jitter and packet loss per member, letting administrators confirm whether each link currently meets its configured SLA thresholds.

Why this answer

The SD-WAN Monitor in FortiManager displays Health Check status, which is derived from the SD-WAN health-check probes configured on the FortiGate. These probes measure latency, jitter, and packet loss for each member link, and FortiManager surfaces those metrics so administrators can see link quality centrally. This is the core purpose of the health-check status view.

Exam trap

FORTINET-NSE7-SPECIALTY often tests what SD-WAN health checks actually measure, and candidates confuse inventory data (firmware, IP) with the dynamic SLA metrics (latency, jitter, loss).

How to eliminate wrong answers

Option A is wrong because firmware version is device inventory information, not a health-check metric, and is shown elsewhere (Device Manager). Option B is wrong because active user counts are session/authentication data, not SD-WAN health-check output. Option D is wrong because the interface IP address is configuration/inventory data, not a dynamic health-check measurement.

Practice this question →
7
MCQmedium

How can you verify that an SD-WAN configuration change was successfully applied to a FortiGate via FortiManager?

A.By checking the FortiAnalyzer logs
B.By restarting the FortiGate
C.By checking the Device Manager installation status
D.By viewing the system dashboard of the FortiGate locally
AnswerC

Checking Device Manager installation status confirms whether FortiManager successfully pushed the configuration to the managed FortiGate. After installing policy changes, the installation status column reports success or failure per device, satisfying the stem's requirement to verify the change was applied. This reflects the actual push result, not merely a saved revision.

Why this answer

FortiManager's Device Manager displays the installation status of configuration changes pushed to managed FortiGates. After installing a policy package or SD-WAN configuration, the installation status column shows whether the change succeeded, failed, or is pending, along with any error details. This is the authoritative verification method.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the role separation between FortiManager (configuration management and install status) and FortiAnalyzer (logging/reporting), causing candidates to pick FortiAnalyzer logs when verifying configuration installation.

How to eliminate wrong answers

Option A is wrong because FortiAnalyzer is a logging and reporting platform — it does not track FortiManager installation status of configuration changes. Option B is wrong because restarting the FortiGate does not verify configuration installation and is disruptive; it also does not confirm the change was applied. Option D is wrong because the FortiGate's local system dashboard shows runtime status, not whether FortiManager successfully installed a specific configuration revision.

Practice this question →
8
Multi-Selecthard

Which THREE pieces of information are displayed in the SD-WAN Monitor in FortiManager?

Select 3 answers
A.Status of SD-WAN members
B.Latency, jitter, and packet loss
C.Interface bandwidth usage
D.System temperature of the FortiGate
E.The current username of the logged-in admin
AnswersA, B, C

The SD-WAN Monitor in FortiManager polls managed FortiGate devices and displays the live operational state of each SD-WAN member interface, satisfying the stem's requirement for member status. This includes per-link health, SLA probe results and up/down state, which administrators need to verify that WAN links are passing traffic as intended.

Why this answer

Option A is correct because the SD-WAN Monitor in FortiManager displays the operational status of each SD-WAN member (up/down/standby), which is essential for verifying link health. Option B is correct because the monitor shows the performance SLA metrics per member — latency, jitter, and packet loss — that FortiGate uses to steer traffic and trigger failover. Option C is correct because interface bandwidth usage (throughput in/out) per SD-WAN member is presented, allowing admins to see load and utilization across links.

Option D is not part of the SD-WAN Monitor; FortiGate system temperature is a hardware sensor value shown in device dashboards or SNMP monitoring, not SD-WAN monitoring. Option E is also unrelated, as the logged-in administrator's username is an administrative session detail, not SD-WAN telemetry.

Exam trap

The trap here is confusing SD-WAN performance monitoring with general device health monitoring; candidates may select system temperature or admin username because they appear in other FortiManager dashboards.

Practice this question →
9
Multi-Selectmedium

Which TWO of the following are benefits of using SD-WAN templates in FortiManager?

Select 2 answers
A.Consistent SD-WAN policy application across devices
B.Automatic firmware upgrades
C.Automated log analysis
D.Direct access to the FortiGate CLI
E.Simplified configuration deployment for large branch deployments
AnswersA, E

Templates push one central SD-WAN definition to every assigned device, so rules, members and health checks stay identical. This removes per-device drift and satisfies the benefit of consistent SD-WAN policy application across devices, rather than relying on manually repeated CLI configuration on each FortiGate.

Why this answer

Option A is correct because SD-WAN templates in FortiManager let you define SD-WAN settings and policies once and apply them consistently across many managed FortiGates, ensuring uniform rules and reducing per-device drift. Option E is correct because these templates enable simplified, scalable configuration deployment for large branch environments by provisioning SD-WAN interfaces, members, and rules centrally instead of manually configuring each device. Option B is incorrect because firmware upgrades are handled by FortiManager's firmware management features, not SD-WAN templates.

Option C is incorrect because log analysis is provided by FortiAnalyzer, not by SD-WAN templates in FortiManager. Option D is incorrect because direct FortiGate CLI access is a separate administrative capability and is not a benefit of SD-WAN templates.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the confusion between FortiManager's SD-WAN templates and other management features like firmware upgrades or log analysis, causing candidates to select unrelated benefits.

Practice this question →
10
MCQeasy

Which interface can be used as an SD-WAN member in an SD-WAN template?

A.Physical ports, VLANs, and VPN tunnels
B.Only WAN physical ports
C.Only VLANs
D.Only loopback interfaces
AnswerA

Physical ports, VLANs and IPsec VPN tunnels all qualify as SD-WAN members within a FortiGate SD-WAN template, since membership requires only a routable interface with a gateway. This satisfies the stem's constraint by covering every supported member type, whereas omitting VLANs or tunnels would exclude valid overlay and segmented-link designs.

Why this answer

In Fortinet SD-WAN, an SD-WAN member interface can be any logical or physical interface that carries traffic and supports the necessary health-check and performance SLA monitoring. This includes physical ports (e.g., wan1, wan2), VLAN sub-interfaces (e.g., vlan10 on a physical port), and VPN tunnels (e.g., IPsec tunnels, ADVPN shortcuts). The SD-WAN template in FortiManager abstracts these members into a single virtual interface, allowing dynamic path selection based on link quality.

Therefore, option A correctly identifies the full set of supported interface types.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the misconception that SD-WAN members are restricted to physical WAN interfaces, but the exam expects you to know that VLANs and VPN tunnels are equally valid, as they are all routable and monitorable interfaces.

How to eliminate wrong answers

Option B is wrong because SD-WAN members are not limited to WAN physical ports; VLANs and VPN tunnels are equally valid and commonly used, especially in multi-VDOM or overlay designs. Option C is wrong because VLANs are only a subset; physical ports and VPN tunnels are also supported. Option D is wrong because loopback interfaces are not supported as SD-WAN members—they lack the ability to carry forwarded traffic and are typically used for management or BGP router-ID purposes, not for performance-based path selection.

Practice this question →
11
MCQhard

If an SD-WAN template contains a reference to an interface that does not exist on a target FortiGate, what occurs during the installation process?

A.The FortiGate automatically creates a dummy interface
B.The installation fails with a configuration error
C.The installation proceeds and ignores the missing interface
D.The FortiGate enters an 'Emergency' state
AnswerB

FortiManager validates template references against the target FortiGate's actual interface list before pushing configuration. A missing interface breaks that dependency check, so the install aborts with a configuration error rather than silently skipping or creating the object, satisfying the stem's scenario of a non-existent referenced interface.

Why this answer

If an SD-WAN template references an interface that does not exist on the target FortiGate, the installation fails with a configuration error. FortiManager validates the template against the device's actual interfaces during the install process; a missing interface cannot be resolved, so the push is aborted. The administrator must correct the template or the device's interface configuration.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the assumption that FortiManager will auto-create or ignore missing interfaces; in reality, installation fails, and candidates must know that template references must match existing device interfaces.

How to eliminate wrong answers

Option A is wrong because FortiGate does not automatically create dummy interfaces to satisfy template references; interfaces must exist or be created explicitly. Option C is wrong because the installation does not silently ignore missing interfaces — it fails to prevent an inconsistent config. Option D is wrong because the FortiGate does not enter an 'Emergency' state due to a template mismatch; it simply rejects the invalid config, and the install fails.

Practice this question →
12
MCQmedium

When using SD-WAN templates, how are SD-WAN rules ordered?

A.Top to bottom
B.Based on the creation date
C.By the interface speed
D.Randomly
AnswerA

SD-WAN rules in FortiManager templates are evaluated sequentially from the first entry downwards, so the topmost matching rule wins and later rules are skipped. This top-to-bottom precedence satisfies the stem's ordering constraint, letting administrators position specific traffic-steering rules above broader catch-all rules to control path selection deterministically.

Why this answer

SD-WAN rules in FortiManager (and on FortiGate) are evaluated top to bottom, and the first rule whose match criteria are satisfied is applied. Order therefore directly determines which path selection logic wins, making rule sequencing a critical design decision. This mirrors the behavior of firewall policies and other ordered rule sets.

Exam trap

The trap is assuming SD-WAN rules are ordered by some automatic criterion like speed or creation time, when the exam is testing that they are evaluated sequentially from top to bottom like firewall policies.

How to eliminate wrong answers

Option B is wrong because creation date is not used for ordering — rules can be reordered at any time regardless of when they were created. Option C is wrong because interface speed is a criterion a rule might match on, not the ordering mechanism. Option D is wrong because random ordering would make SD-WAN behavior non-deterministic and unmanageable, which is not how the system works.

Practice this question →
13
MCQmedium

Which object must be created before assigning a health check to an SD-WAN service rule in an SD-WAN template?

A.An SD-WAN Health Check
B.A routing protocol
C.A firewall address object
D.An SD-WAN Zone
AnswerA

An SD-WAN health check object must exist first, because the service rule references it by name to determine link quality and steer traffic. This satisfies the stem's prerequisite ordering before assignment within the SD-WAN template.

Why this answer

In Fortinet SD-WAN, a health check must be defined as an SD-WAN Health Check object before it can be referenced in an SD-WAN service rule. The service rule uses the health check to monitor the status of the specified SLA targets (e.g., latency, jitter, packet loss) and to determine which member links are eligible for traffic steering. Without a preconfigured health check, the service rule has no monitoring mechanism to evaluate link quality, so the assignment cannot be made.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the dependency order of SD-WAN configuration objects, and candidates may mistakenly believe that an SD-WAN zone or routing protocol is required before assigning a health check, when in fact the health check object itself must be created first.

How to eliminate wrong answers

Option B is wrong because a routing protocol (e.g., BGP, OSPF) is used for dynamic route exchange and is not a prerequisite for assigning a health check to an SD-WAN service rule; SD-WAN health checks operate independently of routing protocols. Option C is wrong because a firewall address object defines IP addresses or subnets for policy matching and has no role in SD-WAN health monitoring or service rule configuration. Option D is wrong because an SD-WAN zone is a logical grouping of interfaces that can be used in SD-WAN rules, but it is not required specifically for assigning a health check; the health check object itself must exist first.

Practice this question →
14
MCQmedium

When creating an SD-WAN template, what must be defined before you can add an SD-WAN interface to the template?

A.Individual SD-WAN member interfaces
B.The SD-WAN health check probes
C.Global firewall policies
D.The virtual domain (VDOM) settings
AnswerA

An SD-WAN interface is a logical overlay aggregating physical links, so FortiManager cannot build it until the underlying member interfaces exist. Defining those individual SD-WAN member interfaces first gives the template the concrete members it references, satisfying the prerequisite before the SD-WAN interface can be added.

Why this answer

In FortiManager, an SD-WAN template requires the underlying SD-WAN member interfaces to be defined first, because the SD-WAN interface is a logical overlay that aggregates those physical or logical member links. Without member interfaces, there is nothing for the SD-WAN zone to bind to, so FortiManager will not allow you to add the SD-WAN interface to the template.

Exam trap

The trap is that candidates assume health checks or firewall policies are prerequisites, when in fact the SD-WAN interface is a logical construct that must reference concrete member interfaces before it can exist.

How to eliminate wrong answers

Option B is wrong because health check probes are configured as part of the SD-WAN configuration but are not a prerequisite for adding the SD-WAN interface itself — they are defined after or alongside the SD-WAN interface. Option C is wrong because global firewall policies are unrelated to the SD-WAN template creation sequence and are configured separately. Option D is wrong because VDOM settings are an administrative scoping construct, not a dependency for adding an SD-WAN interface to a template.

Practice this question →
15
MCQeasy

What is required before FortiManager can display SD-WAN monitoring data?

A.The FortiGate must have a cloud license
B.The FortiGate must be sending logs to FortiManager
C.The FortiGate must be running a specific firmware
D.The FortiGate must be in Transparent mode
AnswerB

FortiManager renders SD-WAN monitoring from the log messages FortiGates forward, not from live telemetry or API polling. Without those logs arriving, the SD-WAN dashboards and SLA widgets stay empty. Enabling log forwarding to FortiManager therefore satisfies the prerequisite the stem asks about.

Why this answer

FortiManager displays SD-WAN monitoring data by receiving logs from the FortiGate. The FortiGate must be configured to send logs to FortiManager, typically via the 'log fortianalyzer' or 'log fortimanager' settings. Without logs, FortiManager has no data to display for SD-WAN monitoring, such as performance SLAs, link status, and traffic statistics.

Exam trap

The trap is assuming that FortiManager automatically collects SD-WAN data without explicit log configuration; candidates might overlook the need for the FortiGate to send logs.

How to eliminate wrong answers

Option A is wrong because a cloud license is not required for SD-WAN monitoring; FortiManager can monitor on-premises FortiGates without cloud licenses. Option C is wrong because while a specific firmware version may be needed for certain features, the fundamental requirement is log sending, not just firmware. Option D is wrong because Transparent mode is unrelated to SD-WAN monitoring; FortiGates can be in NAT/route mode and still send logs.

Practice this question →
16
MCQhard

If you modify a shared SD-WAN health check object that is referenced by ten different templates, what happens to the FortiGates?

A.All FortiGates using those templates will be affected after an install
B.The FortiGates will automatically revert to the old settings
C.The health check will be disabled on all devices
D.Only the templates are updated, not the FortiGates
AnswerA

Shared health check objects are referenced, not copied, by templates. Editing the object changes the definition held centrally, so every FortiGate bound to those ten templates receives the updated SLA parameters at the next policy install, altering member selection and failover behaviour network-wide.

Why this answer

In FortiManager, SD-WAN health check objects are shared objects that can be referenced by multiple templates. When you modify a shared object, the change is stored in the ADOM and must be installed to the managed FortiGates. After the install, all FortiGates using templates that reference that health check will receive the updated configuration.

Exam trap

The trap is assuming that modifying a shared object only affects the template definition and not the devices; in FortiManager, shared objects propagate to all devices that reference them after an install.

How to eliminate wrong answers

Option B is wrong because FortiGates do not automatically revert to old settings; they retain the last installed configuration until a new install pushes changes. Option C is wrong because modifying a health check does not disable it; it updates its parameters (e.g., interval, failtime) and the object remains active. Option D is wrong because templates are not the final target; the change must be installed to the FortiGates, and all devices referencing the object are affected.

Practice this question →
17
MCQhard

During SD-WAN template deployment, what is the role of 'Dynamic Mapping'?

A.To map a single template object to different physical settings on different devices
B.To automate firmware updates
C.To monitor bandwidth usage
D.To dynamically change the SD-WAN rule based on time
E.To calculate the latency of paths
AnswerA

Dynamic Mapping lets one template object resolve to different physical interfaces or settings per device, so a single template fits heterogeneous hardware. This satisfies the stem's requirement to map one object across differing device configurations.

Why this answer

Dynamic Mapping in SD-WAN template deployment allows a single template object (like an interface or SD-WAN rule) to be mapped to different physical settings on different devices. This enables flexibility when deploying the same template to multiple FortiGates with varying interface names or configurations. It uses variables and metadata to adapt the template to each device's specifics.

Exam trap

The trap is confusing Dynamic Mapping with dynamic SD-WAN rules or performance monitoring; candidates might think it's about changing rules dynamically, but it's about mapping template objects to device-specific settings.

How to eliminate wrong answers

Option B is wrong because automating firmware updates is unrelated to Dynamic Mapping; that is handled by FortiManager's firmware management features. Option C is wrong because monitoring bandwidth usage is a function of SD-WAN monitoring, not mapping. Option D is wrong because dynamically changing SD-WAN rules based on time is handled by SD-WAN rules with schedules, not Dynamic Mapping.

Option E is wrong because calculating latency is part of SD-WAN performance SLAs, not mapping.

Practice this question →
18
MCQmedium

When using SD-WAN templates, which option allows you to manage different ISPs on different branches within the same template?

A.Dynamic Mapping
B.Global Objects
C.Device Groups
D.SD-WAN Rules
AnswerA

Dynamic Mapping lets a single SD-WAN template assign interfaces per branch based on variables such as interface role or ISP, rather than fixed names. This satisfies the stem's constraint of managing different ISPs across branches within one template.

Why this answer

Dynamic Mapping in SD-WAN templates lets you bind template variables to per-device values, so the same template can reference different ISP interfaces (e.g., wan1 vs. wan2, or different ISP names) on different branches. When the template is installed, FortiManager resolves each variable against the device's metadata, producing branch-specific SD-WAN configurations from one template. This is the mechanism Fortinet designed specifically for multi-ISP, multi-branch template reuse.

Exam trap

FORTINET-NSE7-SPECIALTY often tests template-reuse mechanisms — candidates confuse Device Groups (organizational) or SD-WAN Rules (traffic steering) with Dynamic Mapping (per-device variable substitution), which is the only option that actually varies ISPs per branch within one template.

How to eliminate wrong answers

Option B is wrong because Global Objects are shared address/service objects (firewall addresses, VIPs, etc.) used across policies — they don't map template placeholders to per-device interface values. Option C is wrong because Device Groups are a FortiManager organizational construct for grouping managed devices for policy assignment; they don't resolve per-branch ISP differences inside a single SD-WAN template. Option D is wrong because SD-WAN Rules define traffic-steering logic (which traffic uses which member), not the mapping of template variables to per-device ISP interfaces.

Practice this question →
19
Multi-Selectmedium

Which TWO of these are valid SD-WAN health check protocols?

Select 2 answers
A.SSH
B.FTP
C.HTTP
D.Ping
E.SNMP
AnswersC, D

HTTP health checks actively request a URL and validate the response, confirming application-layer reachability rather than mere IP connectivity. This satisfies the stem's requirement for a valid SD-WAN health check protocol, since FortiGate SD-WAN supports HTTP alongside ICMP, TCP, UDP-echo, DNS, and TWAMP as health check types.

Why this answer

HTTP (option C) is a valid SD-WAN health check protocol because SD-WAN controllers and edges can send HTTP GET requests to a target URL and evaluate the response code or latency to determine whether an application path is healthy. Ping (option D) is also valid because SD-WAN health checks commonly use ICMP echo requests to measure reachability, latency, jitter, and packet loss toward a specified destination. These two are the standard probe types supported for SD-WAN SLA/health-check configuration, alongside others like TCP and DNS in some implementations.

SSH (option A) is a remote management/shell protocol, not a health-check probe. FTP (option B) is a file-transfer protocol and is not used for periodic path health monitoring. SNMP (option E) is a management/monitoring protocol for polling device metrics, not a probe type used to validate SD-WAN path health.

Exam trap

FORTINET-NSE7-SPECIALTY often tests which protocols are valid SD-WAN health checks, tempting candidates with common network protocols like SSH, FTP, or SNMP that are not supported for this purpose.

Practice this question →
20
MCQmedium

When configuring SD-WAN services in a template, what does the 'Performance SLA' setting determine?

A.The physical port priority
B.The maximum bandwidth allowed
C.The number of tunnels created
D.The criteria for path selection based on link quality
AnswerD

Performance SLA defines the thresholds—latency, jitter, packet loss—against which FortiGate probes each WAN link, so SD-WAN rules can select paths meeting the required quality. This directly satisfies the stem's constraint: determining the criteria for path selection based on link quality.

Why this answer

The Performance SLA setting in an SD-WAN template defines the health-check parameters — probe type, target, interval, and thresholds for latency, jitter, and packet loss — that determine whether a member link is considered alive and how it ranks for path selection. SD-WAN rules then use these SLA results to steer traffic to the best-quality link. It is fundamentally a link-quality criterion, not a bandwidth or port-priority setting.

Exam trap

FORTINET-NSE7-SPECIALTY often tests whether candidates conflate SLA (quality thresholds) with bandwidth or priority settings, so the trap is choosing an answer that describes capacity or port preference instead of link-quality-based path selection.

How to eliminate wrong answers

Option A is wrong because physical port priority is set on the interface/member configuration (e.g., priority or cost values), not by the Performance SLA. Option B is wrong because maximum bandwidth is controlled by traffic shaping, bandwidth limits on interfaces, or SD-WAN rule bandwidth settings — the SLA measures quality, not capacity. Option C is wrong because the number of tunnels is determined by the SD-WAN member and VPN configuration, not by the SLA, which only evaluates existing links.

Practice this question →
21
Multi-Selectmedium

Which TWO criteria can be used in SD-WAN rules to select an outgoing interface?

Select 2 answers
A.The name of the administrator
B.System temperature
C.Device serial number
D.Source and destination address
E.Application or service type
AnswersD, E

Source and destination address are both matchable criteria within SD-WAN rules, letting policy steer traffic by endpoint identity. This satisfies the stem's requirement for interface selection criteria, since FortiGate SD-WAN rules evaluate source and destination IP objects to choose the outgoing member.

Why this answer

Option D (Source and destination address) is correct because SD-WAN rules commonly match traffic by source and/or destination IP address (and often subnet or address objects) to steer flows out a specific WAN interface. Option E (Application or service type) is correct because SD-WAN policies use application identification (e.g., via application signatures or ISDB) and service/port definitions to route traffic based on the recognized application or service. The administrator name (A) is not a traffic-matching criterion for interface selection, system temperature (B) is a hardware health metric not used in SD-WAN rule matching, and device serial number (C) identifies the device itself rather than classifying traffic for outbound interface selection.

Exam trap

The trap is selecting criteria that are not traffic-related (like administrator name or device serial number) as valid SD-WAN rule matching options; candidates must remember that SD-WAN rules match on traffic attributes, not administrative or hardware identifiers.

Practice this question →
22
MCQeasy

How do you apply an SD-WAN template to multiple managed FortiGates simultaneously?

A.By manually editing each FortiGate config
B.By assigning the template in the Device Manager tab
C.Through individual CLI console sessions
D.By creating a global profile
AnswerB

Assigning the template in Device Manager pushes the configuration to every selected managed FortiGate at once, satisfying the requirement to apply it to multiple devices simultaneously. Device Manager supports bulk template assignment across FortiGates in the same ADOM, avoiding per-device manual configuration.

Why this answer

In FortiManager, SD-WAN templates are applied to multiple managed FortiGates by assigning the template in the Device Manager tab. This allows you to select multiple devices and push the SD-WAN template configuration simultaneously, ensuring consistent SD-WAN settings across all selected FortiGates. The Device Manager provides a centralized interface for bulk template assignment, which is the intended method for scaling SD-WAN deployments.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the misconception that SD-WAN templates must be applied individually or through CLI, when in fact FortiManager's Device Manager supports bulk assignment for efficiency.

How to eliminate wrong answers

Option A is wrong because manually editing each FortiGate config is time-consuming, error-prone, and does not leverage FortiManager's centralized management capabilities. Option C is wrong because using individual CLI console sessions requires per-device configuration and lacks the automation and consistency of template assignment. Option D is wrong because creating a global profile is not the correct mechanism for applying SD-WAN templates; global profiles are used for other policy objects, not for SD-WAN template assignment.

Practice this question →
23
MCQeasy

Which feature in FortiManager allows you to monitor SD-WAN performance across all managed FortiGates?

A.Device Manager
B.Log View
C.Dashboard > SD-WAN Monitor
D.Policy & Objects
AnswerC

Dashboard > SD-WAN Monitor aggregates performance metrics from every managed FortiGate, satisfying the requirement to monitor SD-WAN across all devices from one console. It presents per-member link health, latency, jitter and packet loss centrally, rather than requiring per-device inspection.

Why this answer

FortiManager's Dashboard includes an SD-WAN Monitor widget that aggregates SD-WAN performance data — link health, SLA status, jitter, latency, and packet loss — across all managed FortiGates in the ADOM. This gives administrators a single pane of glass to spot degraded links or failed SLAs fleet-wide. It pulls from the same health-check data the FortiGates generate for their SD-WAN rules.

Exam trap

FORTINET-NSE7-SPECIALTY often tests whether candidates know which FortiManager pane provides which function, so the trap is confusing configuration panes (Device Manager, Policy & Objects) with the monitoring pane (Dashboard > SD-WAN Monitor).

How to eliminate wrong answers

Option A is wrong because Device Manager is used to add, organize, and manage FortiGate devices (and their configuration), not to visualize SD-WAN performance metrics. Option B is wrong because Log View displays raw log messages (traffic, event, security) and is not an aggregated SD-WAN performance dashboard. Option D is wrong because Policy & Objects is where firewall policies, addresses, and SD-WAN rules are defined, not where performance is monitored.

Practice this question →
24
MCQmedium

You are configuring SD-WAN templates in FortiManager. What is the primary purpose of using SD-WAN Central Management instead of configuring SD-WAN directly on individual FortiGates?

A.To perform local traffic analysis on the FortiGate only
B.To allow FortiGates to manage their own SD-WAN interfaces independently
C.To bypass the need for ADOMs
D.To enable SD-WAN template inheritance and synchronized policy updates across multiple managed devices
AnswerD

Central Management pushes a single SD-WAN template to many FortiGates, so inheritance propagates interface, member and health-check settings consistently. Editing the template updates every managed device at once, satisfying the stem's requirement for synchronised policy across the estate rather than per-device configuration drift.

Why this answer

SD-WAN Central Management in FortiManager uses templates (e.g., SD-WAN Template, CLI Template) to define SD-WAN configuration once and inherit it across multiple managed FortiGates. This enables synchronized policy updates, consistent SLA/steering rules, and efficient bulk changes. It eliminates the need to manually configure each FortiGate's SD-WAN settings individually.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the misconception that SD-WAN central management is about local analysis or bypassing ADOMs; the core benefit is template inheritance and synchronized updates across many devices.

How to eliminate wrong answers

Option A is wrong because local traffic analysis on the FortiGate is not the purpose of central management; FortiManager centralizes configuration, not local analysis. Option B is wrong because central management is the opposite of letting FortiGates manage their own SD-WAN independently — it enforces template-driven consistency. Option C is wrong because ADOMs are still required for organizing devices and policies; SD-WAN central management does not bypass ADOMs, it operates within them.

Practice this question →
25
MCQmedium

What is the benefit of using 'SD-WAN Zones' in templates when managing 100+ branches?

A.They allow for multiple internet service providers
B.They automatically configure static routes
C.They increase the speed of the internet connection
D.They allow for easier mapping to physical ports across different hardware models
AnswerD

SD-WAN Zones abstract logical overlays from physical interfaces, so a single template maps to varied port layouts across hardware models. This satisfies the 100+ branch constraint: one zone definition deploys consistently regardless of each site's device, eliminating per-model port remapping and template duplication.

Why this answer

SD-WAN Zones in FortiManager templates allow administrators to define logical zones that map to physical ports consistently across different FortiGate hardware models. This abstraction simplifies template deployment to 100+ branches because the same template can be applied regardless of the specific port layout on each device.

Exam trap

FORTINET-NSE7-SPECIALTY often tests whether candidates confuse SD-WAN Zones with SD-WAN rules or multiple ISP support — the key benefit is hardware-agnostic port mapping in templates.

How to eliminate wrong answers

Option A is wrong because multiple internet service providers are supported by SD-WAN itself (multiple WAN links), not specifically by SD-WAN Zones — zones are about logical grouping and port mapping. Option B is wrong because SD-WAN Zones do not automatically configure static routes; routing is configured separately via SD-WAN rules and static routes. Option C is wrong because SD-WAN Zones do not increase internet connection speed — they provide logical abstraction and traffic steering, not bandwidth amplification.

Practice this question →
26
Multi-Selecthard

Which THREE factors can affect the 'Performance SLA' logic in an SD-WAN template?

Select 3 answers
A.Packet loss threshold
B.The firmware version of the FortiGate
C.Jitter threshold
D.The number of active VPN tunnels
E.Latency threshold
AnswersA, C, E

Packet loss threshold is one of the measured SLA criteria: FortiOS compares the health check's observed loss against this configured value to decide whether an SD-WAN member is within or outside the SLA, triggering member removal from the SLA-compliant set.

Why this answer

The Performance SLA logic in an SD-WAN template is driven by the SLA criteria defined for each member link, and those criteria are the three measured metrics: packet loss threshold (A), jitter threshold (C), and latency threshold (E). Each of these thresholds is configured inside the Performance SLA object (e.g., set packet-loss-threshold, set jitter-threshold, set latency-threshold) and determines whether a link is considered within or out of SLA, which in turn influences SD-WAN rule selection and failover. Packet loss (A) is correct because exceeding the configured loss percentage marks the link as violating the SLA.

Jitter (C) is correct because exceeding the configured jitter value in milliseconds marks the link as violating the SLA. Latency (E) is correct because exceeding the configured latency value in milliseconds marks the link as violating the SLA. The FortiGate firmware version (B) does not define SLA thresholds, and the number of active VPN tunnels (D) is a topology/state condition, not a Performance SLA metric, so neither belongs here.

Exam trap

The trap is including non-metric factors like firmware version or tunnel count — candidates may think any variable affecting SD-WAN is part of SLA, but Performance SLA is strictly about latency, jitter, and packet loss thresholds.

Practice this question →
27
MCQmedium

You want to standardize the SD-WAN configuration for 50 remote branch offices. Which FortiManager feature should you use?

A.Policy Packages
B.Firmware Images
C.CLI Scripts
D.SD-WAN Templates
AnswerD

SD-WAN Templates in FortiManager centralise overlay, member, and health-check definitions, then assign them across all 50 branches as a single reusable object. This satisfies the standardisation constraint directly, since per-device CLI edits are eliminated and every branch inherits identical SD-WAN settings from one template.

Why this answer

SD-WAN Templates in FortiManager (D) are specifically designed to standardize SD-WAN configurations across multiple branch offices. They allow you to define SD-WAN settings, such as interface members, zones, and rules, in a template that can be applied to multiple FortiGates. This ensures consistency and simplifies management for large-scale deployments.

Exam trap

Candidates might choose CLI Scripts because they are familiar with scripting, but the question asks for a FortiManager feature specifically for SD-WAN standardization, which is SD-WAN Templates.

How to eliminate wrong answers

Option A is wrong because Policy Packages are used to manage firewall policies, not specifically SD-WAN configurations; while they can include SD-WAN rules, they are not the primary feature for standardizing SD-WAN. Option B is wrong because Firmware Images are used to manage firmware versions, not configuration. Option C is wrong because CLI Scripts can be used to push configurations, but they are not as structured or scalable as SD-WAN Templates for this purpose.

Practice this question →
28
MCQhard

You have a large SD-WAN deployment. Why would you use a 'Centralized Policy' in FortiManager instead of local policies?

A.To eliminate the need for logs
B.To enforce global security and traffic routing policies consistently across multiple sites
C.To reduce the CPU load on the FortiGate
D.To allow local admins to override global policies
AnswerB

A Centralized Policy in FortiManager is authored once and pushed to every managed device, so security and routing rules stay identical across the whole SD-WAN estate. This removes per-site drift and manual local configuration, which is the constraint a large deployment imposes.

Why this answer

A Centralized Policy in FortiManager (typically via Global Policy or ADOM-level shared policy packages) enforces consistent security and SD-WAN routing rules across many sites. It ensures that all managed FortiGates receive the same baseline policy, reducing configuration drift and administrative overhead. This is essential for large SD-WAN deployments where uniform enforcement is required.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the misconception that centralized policy reduces device CPU or allows local overrides; the real benefit is consistent, scalable enforcement across many devices.

How to eliminate wrong answers

Option A is wrong because centralized policy does not eliminate logging; logging is still generated locally and can be sent to FortiAnalyzer or syslog. Option C is wrong because centralized policy management does not reduce FortiGate CPU load — the FortiGate still processes the same policies; the benefit is operational consistency, not performance. Option D is wrong because centralized policies are designed to enforce global rules, not to allow local admins to override them; local override would defeat the purpose of centralization.

Practice this question →
29
MCQhard

An administrator has applied an SD-WAN template to a FortiGate managed by FortiManager. Later, the administrator modifies the template by adding a new SD-WAN member and installing the configuration. What is the expected outcome on the FortiGate?

A.The FortiGate rejects the template update because SD-WAN members cannot be added after initial deployment.
B.The template update fails because the new member conflicts with an existing interface on the FortiGate.
C.The new SD-WAN member is added, but existing SD-WAN rules are reset to default.
D.The FortiGate receives the updated template, and the new SD-WAN member is added without affecting other settings.
AnswerD

When an SD-WAN template is modified and installed, FortiManager pushes the updated configuration to the FortiGate. The new member is added to the SD-WAN zone, and other settings remain intact unless they were also changed in the template. This incremental update ensures minimal disruption. The FortiGate merges the template changes with its existing configuration, preserving unrelated settings.

Why this answer

Modifying an SD-WAN template and installing the configuration results in an incremental update to the FortiGate. The new SD-WAN member is added, and existing settings are preserved unless explicitly changed in the template. This allows administrators to adapt SD-WAN configurations dynamically without disrupting other functionality.

Exam trap

The trap here is thinking that modifying a template resets all SD-WAN rules or that members cannot be added later.

Practice this question →
30
Multi-Selecthard

Which THREE tasks are required to successfully deploy SD-WAN via FortiManager?

Select 3 answers
A.Installing the configuration to the devices
B.Creating an SD-WAN template
C.Performing a hard factory reset on the FortiGate
D.Deleting all existing firewall policies
E.Assigning the template to managed FortiGates
AnswersA, B, E

Installing the configuration pushes the SD-WAN policy from FortiManager to the managed FortiGate devices, completing the deployment workflow. Without this step, the SD-WAN templates and rules remain staged in the manager only, so the devices never receive the configuration required to establish SD-WAN overlays and steer traffic.

Why this answer

Option B is correct because deploying SD-WAN through FortiManager requires first creating an SD-WAN template (via the SD-WAN Manager/template wizard) that defines the SD-WAN members, zones, and related settings to be pushed to the FortiGates. Option E is correct because the created SD-WAN template must be assigned to the target managed FortiGates so FortiManager knows which devices should receive the SD-WAN configuration. Option A is correct because after the template is created and assigned, the configuration must be installed to the devices so the SD-WAN settings are actually pushed and activated on the FortiGates.

Option C is not required, since a hard factory reset is not a prerequisite for SD-WAN deployment via FortiManager and would unnecessarily wipe the device. Option D is also not required, as existing firewall policies do not need to be deleted; SD-WAN can be deployed alongside or integrated with existing policies.

Exam trap

The trap is thinking that SD-WAN deployment via FortiManager requires disruptive actions like factory reset or deleting policies; candidates may overcomplicate the process, but the essential steps are template creation, assignment, and installation.

Practice this question →
31
Multi-Selectmedium

Which TWO items must be configured within an SD-WAN template for SD-WAN traffic steering to work?

Select 2 answers
A.DHCP server settings
B.SD-WAN Members
C.SD-WAN Rules
D.VLAN tagging
E.Local users
AnswersB, C

SD-WAN members define the participating interfaces and their roles, which traffic steering requires to identify viable egress paths. Without members configured in the template, rules have no interfaces to steer across, so this satisfies the stem's requirement for steering to function.

Why this answer

Option B (SD-WAN Members) is correct because traffic steering requires the physical or logical WAN interfaces (and their gateways/links) to be declared as SD-WAN members so the SD-WAN engine knows which links are eligible to carry traffic and can measure their SLA performance. Option C (SD-WAN Rules) is correct because the steering policy itself is defined in SD-WAN rules, which match traffic by criteria such as source/destination, application, or internet service and then select the preferred member (or SLA-based strategy) to forward it. Together, members define the available paths and rules define how traffic is distributed across them, which is exactly what SD-WAN traffic steering needs.

Option A (DHCP server settings) is not required for steering, since DHCP only provides address assignment and is unrelated to path selection. Option D (VLAN tagging) is not mandatory, as VLANs are a Layer 2 segmentation mechanism and steering operates on SD-WAN member links and rules. Option E (Local users) is not required, because local user accounts are for administrative authentication and have no role in SD-WAN traffic steering.

Exam trap

The trap is selecting unrelated interface features like DHCP or VLAN tagging; Fortinet exams test that you know SD-WAN Members and SD-WAN Rules are the two mandatory building blocks for steering.

Practice this question →
32
Multi-Selectmedium

Which TWO configuration changes require a push from FortiManager to the FortiGate?

Select 2 answers
A.Changes to the log settings on the FortiGate local GUI
B.Changes to an SD-WAN template
C.Updating a firewall policy package
D.Adding a new user to the FortiGate local database
E.Changing the FortiManager admin password
AnswersB, C

SD-WAN templates are metadata objects stored centrally on FortiManager, not locally on the FortiGate. The device holds no native SD-WAN template configuration, so any template edit must be installed to the managed FortiGate via a push, satisfying the stem's requirement for changes requiring FortiManager-to-FortiGate installation.

Why this answer

Options B and C are correct because they are FortiManager-managed objects that must be installed/pushed to the FortiGate to take effect: an SD-WAN template (B) is a central VPN/SD-WAN configuration object in FortiManager that is assigned to a managed device and requires a push (install) to apply the template settings, and a firewall policy package (C) is the core policy configuration managed in FortiManager that must be installed to the FortiGate for the policies to become active. In contrast, changes made directly on the FortiGate local GUI such as log settings (A) and adding a local user to the FortiGate local database (D) are local device changes that do not require a FortiManager push, and changing the FortiManager admin password (E) is a FortiManager administrative setting that has no relation to pushing configuration to a FortiGate.

Exam trap

The trap is assuming any configuration change requires a FortiManager push — local device changes and FortiManager system settings do not, so candidates must distinguish managed objects from local or FortiManager-only settings.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Nse7 SD Wan Central Management questions.

Start 20-question session
CCNA Nse7 SD Wan Central Management Questions | Courseiva