Courseiva

CCNA Nse7 SD Wan Security Profiles Routing And Ipsec Questions

23 questions · Nse7 SD Wan Security Profiles Routing And Ipsec · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQmedium

An enterprise network uses ADVPN 2.0 with BGP running over IPsec tunnels. A spoke needs to initiate a shortcut tunnel to another spoke. Which FortiOS CLI command is used on the hub to verify the active shortcut tunnels and view the shortcut state information?

A.execute router clear bgp all
B.get system sdwan neighbor
C.diagnose vpn tunnel list
D.diagnose netlink interface list
AnswerC

On the hub, diagnose vpn tunnel list enumerates IPsec tunnels including ADVPN shortcut sessions, showing their names, selectors and state. This confirms which spoke-to-spoke shortcuts are currently established and active without inspecting individual security associations.

Why this answer

On FortiOS, 'diagnose vpn tunnel list' displays all active IPsec tunnels including ADVPN shortcut tunnels, showing their names, source/destination, and state. This is the standard command to confirm that a shortcut has been negotiated between spokes and to inspect its current status.

Exam trap

The trap is selecting commands that sound network-diagnostic (like netlink interface list or sdwan neighbor) when the question specifically asks about IPsec/ADVPN shortcut tunnel state, which only 'diagnose vpn tunnel list' surfaces.

How to eliminate wrong answers

Option A is wrong because 'execute router clear bgp all' clears BGP sessions — it is a disruptive reset command, not a verification command, and does not show tunnel state. Option B is wrong because 'get system sdwan neighbor' displays SD-WAN neighbor/health-check information, not IPsec tunnel or ADVPN shortcut state. Option D is wrong because 'diagnose netlink interface list' shows kernel-level interface information and does not enumerate IPsec tunnels or their shortcut status.

Practice this question →
2
MCQeasy

An administrator configures an SD-WAN rule with a 'Lowest Cost (SLA)' strategy. What determines the metric used by FortiOS to select the best interface when multiple links meet the SLA criteria?

A.The round-robin algorithm applied sequentially across all active links
B.The lowest physical port number on the FortiGate hardware
C.The lowest packet loss, jitter, or latency value measured by the health check among the qualifying links
D.The highest interface bandwidth capacity defined in the static route table
AnswerC

With Lowest Cost (SLA), FortiOS first filters members that satisfy the SLA targets, then ranks the survivors by their measured health-check metrics. Among qualifying links it picks the one reporting the lowest packet loss, jitter, or latency, so the metric is the live probe measurement rather than a static cost value.

Why this answer

With the 'Lowest Cost (SLA)' strategy, FortiOS first filters SD-WAN members to those currently meeting their SLA targets (latency, jitter, packet loss thresholds defined in the health check). Among the qualifying members, it selects the one with the lowest measured cost metric — typically the lowest latency, jitter, or packet loss value reported by the health check probes. This makes the selection dynamic and performance-driven rather than static.

Exam trap

The trap is assuming 'Lowest Cost' refers to monetary or bandwidth cost, when in FortiOS it refers to the lowest measured SLA metric (latency/jitter/loss) among links that already meet the SLA thresholds.

How to eliminate wrong answers

Option A is wrong because round-robin is a separate SD-WAN strategy (or a load-balancing method) that cycles through links without regard to SLA performance, not the 'Lowest Cost (SLA)' behavior. Option B is wrong because physical port numbering has no bearing on SD-WAN member selection — FortiOS does not use port order as a cost metric. Option D is wrong because interface bandwidth from the static route table is not the metric used by the SLA-based strategy; the health-check measurements (latency/jitter/loss) drive the decision.

Practice this question →
3
MCQmedium

An administrator implements BGP over SD-WAN tunnels to a cloud provider. The cloud provider requires BGP MD5 authentication on all peering sessions. Where is BGP MD5 authentication configured on the FortiGate?

A.Within the firewall policy authentication settings
B.Under the IPsec phase 1 interface advanced settings
C.Inside the SD-WAN health check probe configuration
D.Under the router bgp neighbor configuration block in the CLI
AnswerD

BGP MD5 authentication is set with the password parameter inside the neighbor block under config router bgp, applying to that specific peering session. This satisfies the cloud provider's requirement that every SD-WAN peering session authenticate.

Why this answer

BGP MD5 authentication is configured on the FortiGate under the BGP neighbor configuration in the CLI, using the command 'set password' within the 'config router bgp' and 'config neighbor' blocks. This sets the TCP MD5 signature option for the BGP session, which must match on both peers. It is not configured in firewall policies, IPsec Phase 1 settings, or SD-WAN health checks.

Exam trap

FORTINET-NSE7-SPECIALTY often tests where BGP authentication is configured, and candidates may incorrectly assume it is part of IPsec or firewall settings rather than a BGP neighbor parameter, leading them to choose the wrong option.

How to eliminate wrong answers

Option A is wrong because firewall policy authentication settings control user authentication for traffic passing through the firewall, not BGP session authentication. Option B is wrong because IPsec Phase 1 advanced settings deal with IKE authentication and encryption parameters, not BGP MD5. Option C is wrong because SD-WAN health check probes are used to monitor link quality and do not carry BGP authentication settings.

Practice this question →
4
Multi-Selecthard

An enterprise deploys ADVPN 2.0 with BGP and security profiles applied to traffic traversing the VPN overlay. Which THREE statements are correct regarding how security profiles and ADVPN 2.0 interact in FortiOS? (Choose three)

Select 3 answers
A.SSL inspection (DPI) applied on spoke firewall policies inspects decrypted traffic traversing the ADVPN shortcut tunnel
B.Security profiles can be centrally managed and pushed to spokes using FortiManager security profile templates
C.Firewall policies enforcing security profiles (such as Antivirus and IPS) must be configured on the spoke units because shortcut traffic flows directly between spokes without passing through the hub
D.ADVPN 2.0 automatically disables all firewall inspection profiles on shortcut interfaces to maximize throughput
E.The hub FortiGate inspects all data packets exchanged between spokes even after a direct shortcut tunnel is established
AnswersA, B, C

SSL inspection on spoke policies decrypts and inspects traffic traversing ADVPN shortcut tunnels, because shortcut tunnels terminate at the spoke's IPsec interface where the firewall policy and its security profiles apply. This satisfies the stem's constraint that security profiles govern overlay traffic, including dynamically established shortcuts rather than only the initial hub-and-spoke path.

Why this answer

Option C is correct because in ADVPN 2.0, once a spoke-to-spoke shortcut tunnel is established, data traffic flows directly between the spokes and no longer traverses the hub, so the spoke FortiGates must have firewall policies with security profiles (Antivirus, IPS, etc.) applied to inspect that shortcut traffic. Option A is correct because SSL inspection (deep packet inspection) configured on those spoke policies will decrypt and inspect the TLS traffic traversing the ADVPN shortcut tunnel, since the spoke is the enforcement point for the shortcut. Option B is correct because FortiManager security profile templates allow centralized creation and push of security profiles (AV, IPS, web filter, etc.) to managed spoke FortiGates, which is a standard way to keep consistent UTM enforcement across an ADVPN deployment.

Option D is incorrect because ADVPN 2.0 does not automatically disable firewall inspection profiles on shortcut interfaces; inspection is governed by the firewall policies and profiles the administrator configures. Option E is incorrect because after a shortcut is established, inter-spoke data traffic bypasses the hub entirely, so the hub cannot inspect those packets.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the misconception that the hub continues to inspect all traffic even after shortcut tunnels are established, or that security profiles are automatically disabled on shortcuts.

Practice this question →
5
Multi-Selecthard

An enterprise network uses OSPF over SD-WAN IPsec tunnels. The administrator notices that OSPF adjacency is constantly dropping over a specific backup SD-WAN member link due to intermittent packet loss. Which THREE configuration adjustments can improve OSPF stability over unstable SD-WAN IPsec links? (Choose three)

Select 3 answers
A.Configure OSPF network type as point-to-point on the IPsec tunnel interfaces to eliminate unnecessary DR/BDR elections
B.Enable OSPF graceful restart or helper mode on the FortiGate routers
C.Set the OSPF router ID to 0.0.0.0 on all branch spokes
D.Increase the OSPF hello interval and dead interval on the affected IPsec tunnel interfaces to tolerate temporary packet loss
E.Disable OSPF hello packets entirely and rely on static default routes
AnswersA, B, D

Point-to-point network type removes DR/BDR election and waiting timers on the IPsec tunnel, so intermittent loss cannot trigger adjacency resets through election churn. This directly addresses the instability caused by the backup link's packet loss.

Why this answer

Option A is correct because configuring the OSPF network type as point-to-point on the IPsec tunnel interfaces removes the DR/BDR election process, which is unnecessary on a tunnel that connects only two routers and whose election churn can cause adjacency resets during packet loss. Option B is correct because enabling OSPF graceful restart (and helper mode on the neighbor) allows a restarting or flapping router to keep forwarding traffic and preserve adjacencies without tearing down and relearning routes, which directly improves stability over intermittent SD-WAN links. Option D is correct because increasing the hello and dead intervals makes OSPF more tolerant of temporary packet loss, since the dead interval is typically 4x the hello interval and a longer timer prevents the adjacency from being declared down during brief outages.

Option C is incorrect because a router ID of 0.0.0.0 is invalid for OSPF and would prevent the router from forming adjacencies or participating in the OSPF domain. Option E is incorrect because OSPF relies on hello packets to discover and maintain neighbors; disabling them would break adjacency formation and force reliance on static routes, which is not an OSPF stability adjustment.

Exam trap

FORTINET-NSE7-SPECIALTY often tests whether candidates know that OSPF router ID 0.0.0.0 is invalid and that disabling hellos breaks OSPF — both are distractors that sound plausible but violate protocol fundamentals.

Practice this question →
6
MCQhard

A FortiGate device is running ADVPN 2.0 with OSPF. A spoke experiences transient routing loops when a shortcut tunnel tears down due to inactivity timeout. Which configuration adjustment on the FortiGate hub and spokes prevents these temporary routing blackholes or loops during shortcut teardown?

A.Disable OSPF on the spoke units and rely entirely on static default routes
B.Adjust the administrative distance or use route redistribution filters with appropriate metrics so hub routes and shortcut routes do not conflict during teardown
C.Set the IPsec phase 1 lifetime to infinite to prevent shortcuts from timing out
D.Configure asymmetric routing bypass on all firewall policies
AnswerB

During shortcut teardown, the hub-advertised route and the withdrawn shortcut route can briefly coexist with equal preference, causing loops or blackholes. Raising administrative distance or applying redistribution filters with distinct metrics ensures the hub path is preferred deterministically until the shortcut is fully removed.

Why this answer

ADVPN 2.0 shortcut tunnels are dynamically created direct spoke-to-spoke IPsec tunnels, and when they tear down due to inactivity, the routing table must reconverge so traffic falls back to the hub. If OSPF metrics or administrative distances cause the hub-learned route and the shortcut route to conflict during teardown, transient loops or blackholes occur. Adjusting administrative distance or using redistribution filters with appropriate metrics ensures the hub route is preferred only when the shortcut is gone, preventing the race condition.

Exam trap

FORTINET-NSE7-SPECIALTY often tests whether candidates understand that ADVPN shortcut teardown is a routing convergence problem, not a tunnel-lifetime problem — the trap is picking 'infinite phase 1 lifetime' or 'disable OSPF' instead of metric/administrative-distance tuning.

How to eliminate wrong answers

Option A is wrong because disabling OSPF on spokes and relying on static default routes eliminates dynamic routing entirely, which breaks ADVPN's ability to advertise shortcuts and defeats the purpose of the architecture. Option C is wrong because setting IPsec phase 1 lifetime to infinite does not prevent shortcut inactivity timeouts — those are controlled by separate idle-timeout and shortcut-related settings, and an infinite lifetime would create stale SAs rather than solve the routing race. Option D is wrong because asymmetric routing bypass is a firewall policy setting that allows return traffic on a different path; it does not address OSPF route convergence or the metric conflict during shortcut teardown.

Practice this question →
7
MCQmedium

In an ADVPN 2.0 deployment, a hub unit uses BGP to advertise routes to spokes. When a spoke learns a prefix via BGP from the hub, what mechanism allows the spoke to automatically initiate an ADVPN shortcut tunnel directly to another spoke when traffic flows between them?

A.The FortiGate kernel detects traffic matching a dynamic BGP route over the IPsec interface and initiates an IKE shortcut negotiation with the target spoke
B.OSPF sends a special multicast hello packet across the hub to establish mesh point-to-point links
C.FortiManager pushes a dynamic static route to both spokes simultaneously
D.The Web Filtering profile intercepts the packet and redirects it via proxy to the destination spoke
AnswerA

The FortiGate kernel monitors traffic egressing the ADVPN IPsec interface and matching a BGP-learned route; this triggers an IKE negotiation directly with the destination spoke, establishing the shortcut. This satisfies the requirement for automatic, traffic-driven shortcut initiation without hub involvement in the data path.

Why this answer

In ADVPN 2.0, the spoke learns a BGP route to a remote spoke's subnet via the hub. When traffic matches that route and is sent over the IPsec interface to the hub, the FortiGate kernel detects it and triggers an IKE shortcut negotiation directly with the target spoke, establishing a direct tunnel. This is the core ADVPN shortcut mechanism.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the data-plane trigger for ADVPN shortcuts, tempting candidates with control-plane mechanisms like OSPF or FortiManager pushes that do not initiate shortcuts.

How to eliminate wrong answers

Option B is wrong because OSPF multicast hellos are not used to establish ADVPN shortcuts; ADVPN uses BGP and IKE. Option C is wrong because FortiManager does not push dynamic static routes to establish shortcuts; shortcut establishment is data-plane triggered. Option D is wrong because Web Filtering is a security profile, not a routing or tunnel establishment mechanism.

Practice this question →
8
Multi-Selectmedium

An administrator applies security profiles (Antivirus, Web Filtering, and IPS) to traffic steered by an SD-WAN rule. Performance issues arise. Which TWO methods can the administrator use to optimize inspection performance without completely disabling security? (Choose two)

Select 2 answers
A.Switch the inspection mode from proxy-based to flow-based where supported, allowing hardware offloading (NP6/NP7) to accelerate packet processing
B.Set the IPsec Phase 1 encryption algorithm to DES to speed up decryptions
C.Configure security profile exemptions or antivirus inspection overrides for trusted internal subnets or latency-sensitive VoIP traffic
D.Disable all SSL inspection globally across the entire FortiGate device
E.Remove the SD-WAN virtual interface from all firewall zones
AnswersA, C

Flow-based inspection permits FortiOS to offload sessions to NP6/NP7 processors, whereas proxy-based mode forces traffic through the CPU. This satisfies the constraint of retaining Antivirus, Web Filtering and IPS while restoring throughput on SD-WAN-steered traffic.

Why this answer

Option A is correct because switching from proxy-based to flow-based inspection where the FortiGate model supports it allows traffic to be accelerated by network processors (NP6/NP7) via hardware offloading, which dramatically reduces CPU load and latency while still applying Antivirus, Web Filtering, and IPS security. Option C is correct because configuring security profile exemptions or antivirus inspection overrides for trusted internal subnets or latency-sensitive VoIP traffic lets the administrator bypass heavy inspection only for specific low-risk or delay-sensitive flows, preserving security for the rest of the traffic. Option B is wrong because DES is a weak, deprecated cipher that does not meaningfully improve IPsec performance and would degrade security rather than optimize inspection.

Option D is wrong because disabling SSL inspection globally removes a critical security control and does not address the SD-WAN inspection performance issue in a targeted way. Option E is wrong because removing the SD-WAN virtual interface from all firewall zones would break the SD-WAN routing and policy enforcement entirely, not optimize inspection.

Exam trap

FORTINET-NSE7-SPECIALTY often tests performance-vs-security tradeoffs — candidates pick 'disable SSL inspection' or 'disable profiles' as the fix, missing that flow-based offload and scoped exemptions preserve security while restoring performance.

Practice this question →
9
MCQeasy

When configuring an SD-WAN health check to monitor internet reachability using HTTP/HTTPS requests, which parameter defines the specific string the FortiGate expects to receive in the server response body to validate that the path is healthy?

A.probe-packet-size
B.sla-break-time
C.http-match
D.server-response-timeout
AnswerC

The http-match parameter specifies the literal string FortiGate searches for in the HTTP or HTTPS response body; the health check only marks the path alive when that string is present, satisfying the stem's requirement to validate reachability by matching expected response content.

Why this answer

The http-match parameter in an SD-WAN health check defines the exact string that the FortiGate searches for in the HTTP/HTTPS response body to confirm the probe succeeded. When the FortiGate sends an HTTP GET to the configured URL, it compares the returned payload against this string; a mismatch marks the SLA member as failed. This allows administrators to validate not just TCP reachability but actual application-layer health.

Exam trap

The trap here is confusing the response-content validator (http-match) with timing or sizing parameters (server-response-timeout, probe-packet-size) that also appear in the health-check CLI — candidates often pick the timeout parameter thinking it validates the response.

How to eliminate wrong answers

Option A is wrong because probe-packet-size controls the size of the ICMP/echo payload used in ping-based health checks, not the expected HTTP response content. Option B is wrong because sla-break-time is the number of consecutive failed probes (or time window) before the SLA is considered violated, not a response-matching string. Option D is wrong because server-response-timeout defines how long the FortiGate waits for a reply before declaring the probe failed, not what content it expects to see.

Practice this question →
10
MCQeasy

When troubleshooting SD-WAN performance SLA packet loss, an administrator wants to view real-time latency, jitter, and packet loss statistics for individual health check members. Which CLI command should be executed?

A.diagnose sys sdwan health-check
B.get system interface physical
C.execute ping-server status
D.show system sdwan
AnswerA

`diagnose sys sdwan health-check` reports per-member SLA metrics, including latency, jitter and packet loss, for each configured health check. It directly satisfies the stem's requirement for real-time statistics on individual health check members, unlike interface-level or session-level diagnostics that aggregate or omit SLA measurements.

Why this answer

The command 'diagnose sys sdwan health-check' displays real-time health check statistics for each SD-WAN member, including latency, jitter, packet loss, and SLA status. This is the correct CLI tool for troubleshooting performance SLA metrics on individual members.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the difference between configuration commands ('show system sdwan') and diagnostic commands ('diagnose sys sdwan health-check'), causing candidates to pick a show command when real-time performance statistics are required.

How to eliminate wrong answers

Option B is wrong because 'get system interface physical' shows interface physical status (link up/down, speed), not SD-WAN health check performance metrics. Option C is wrong because 'execute ping-server status' is not a valid FortiGate command for SD-WAN health check statistics. Option D is wrong because 'show system sdwan' displays the SD-WAN configuration, not real-time performance SLA statistics like latency, jitter, and packet loss.

Practice this question →
11
MCQeasy

An administrator wants to apply a Web Filtering security profile to traffic that is being dynamically steered via an SD-WAN rule. Where must this security profile be enforced in FortiOS?

A.Inside the firewall policy that matches the traffic being steered by the SD-WAN rule
B.Directly inside the SD-WAN rule configuration under the advanced settings tab
C.Globally under the system settings as an SD-WAN overlay inspection profile
D.Within the IPsec tunnel phase 2 security association settings
AnswerA

SD-WAN rules only select the egress member; they do not inspect payload. Web Filtering must therefore sit in the firewall policy that matches the steered traffic, so the profile is applied after the SD-WAN rule chooses the egress interface.

Why this answer

In FortiOS, SD-WAN rules only control path selection (which outgoing interface to use) and do not themselves apply security profiles. Security profiles such as Web Filtering must be enforced in the firewall policy that matches the traffic, because the firewall policy is where UTM/security inspection is applied after the SD-WAN rule has chosen the egress path. Therefore, the Web Filtering profile must be attached to the firewall policy that handles the steered traffic.

Exam trap

The trap is assuming that because SD-WAN rules 'steer' traffic, they also inspect it; candidates may look for a security profile option inside the SD-WAN rule, but FortiOS separates path selection (SD-WAN rule) from security enforcement (firewall policy).

How to eliminate wrong answers

Option B is wrong because SD-WAN rule configuration in FortiOS does not include a security profile section; SD-WAN rules only define matching criteria, priority, and interface selection, not UTM inspection. Option C is wrong because there is no global 'SD-WAN overlay inspection profile' setting in FortiOS; security profiles are applied per firewall policy, not globally to SD-WAN. Option D is wrong because IPsec tunnel phase 2 SA settings define encryption and authentication parameters for the tunnel, not application-layer security profiles like Web Filtering.

Practice this question →
12
MCQmedium

An administrator configures an SD-WAN rule using the 'Volume' strategy across two IPsec tunnels with different bandwidth capacities (Tunnel A: 100 Mbps, Tunnel B: 50 Mbps). How does FortiOS distribute traffic across these members when using the Volume strategy?

A.Traffic is balanced equally (50/50) regardless of interface capacity
B.Traffic is sent exclusively over Tunnel A until it reaches 100% packet loss, then fails over to Tunnel B
C.Traffic is distributed proportionally based on the configured weight or bandwidth ratio of each member interface
D.Traffic is steered strictly based on real-time latency measured by health checks
AnswerC

The Volume strategy balances sessions according to each member's configured weight, so Tunnel A at 100 Mbps receives roughly twice the traffic of Tunnel B at 50 Mbps. Distribution is proportional to the weight or bandwidth ratio rather than equal or purely latency-based.

Why this answer

The Volume strategy in FortiOS SD-WAN distributes sessions across member interfaces in proportion to each member's configured weight (or bandwidth-derived weight). With Tunnel A at 100 Mbps and Tunnel B at 50 Mbps, FortiOS sends roughly two-thirds of traffic over Tunnel A and one-third over Tunnel B, matching the 2:1 capacity ratio. This prevents overloading the lower-capacity link while maximizing aggregate throughput.

Exam trap

The trap is assuming Volume means equal distribution or that it uses real-time performance metrics — candidates confuse Volume (weight-based) with Lowest Cost/SLA (latency-based) strategies.

How to eliminate wrong answers

Option A is wrong because Volume is not a round-robin or equal-cost strategy — it explicitly uses weights to bias distribution. Option B is wrong because that describes a primary/standby or failover-only behavior, not Volume load balancing. Option D is wrong because latency-based steering is the job of the Lowest Cost (SLA) or Maximize Bandwidth (SLA) strategies, which use health-check metrics rather than static weights.

Practice this question →
13
MCQeasy

An administrator wants to view the active SD-WAN rule hit counts and verify which traffic is matching a specific SD-WAN rule in FortiOS. Which command should be used?

A.show system sdwan
B.execute router clear sdwan cache
C.get firewall policy statistics
D.diagnose sys sdwan service
AnswerD

The diagnose sys sdwan service command lists each SD-WAN rule with its member interfaces, health status and cumulative hit counts, letting the administrator confirm exactly which rule matched specific traffic. It is the direct CLI method for verifying rule matching in FortiOS.

Why this answer

The command `diagnose sys sdwan service` is the correct choice because it displays the SD-WAN service table, which includes each rule's hit count and the list of matching traffic flows. This command provides real-time statistics on which sessions are being steered by specific SD-WAN rules, allowing administrators to verify rule effectiveness. It is the primary diagnostic tool for SD-WAN rule monitoring in FortiOS.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the confusion between configuration display commands (like `show system sdwan`) and diagnostic commands that provide runtime statistics (like `diagnose sys sdwan service`), so candidates must distinguish between viewing settings and viewing operational data.

How to eliminate wrong answers

Option A is wrong because `show system sdwan` only displays the SD-WAN configuration (such as members, zones, and health-check settings) and does not provide any hit counts or active session information. Option B is wrong because `execute router clear sdwan cache` clears the SD-WAN cache, which resets state and does not show statistics; it is used for troubleshooting by forcing re-evaluation, not for viewing hit counts. Option C is wrong because `get firewall policy statistics` shows hit counts for firewall policies, not for SD-WAN rules; while firewall policies may reference SD-WAN, the statistics are per-policy, not per-SD-WAN-rule, and do not show which traffic matches a specific SD-WAN rule.

Practice this question →
14
Multi-Selecthard

An administrator troubleshoots a scenario where traffic matching an application-based SD-WAN rule is bypassing the preferred high-speed MPLS tunnel and taking the backup broadband tunnel instead. Which THREE factors should the administrator check to resolve this routing discrepancy? (Choose three)

Select 3 answers
A.Verify the FortiGate factory default administrator password is changed
B.Check the physical layer OSI Model cable category connected to the FortiGate port
C.Inspect the member priorities and weights configured within the specific SD-WAN rule
D.Verify whether the preferred MPLS member is failing the configured performance SLA thresholds, causing the SD-WAN engine to disqualify it
E.Check the sequence order of the SD-WAN rules; an earlier rule might be matching the traffic first
AnswersC, D, E

Member priority and weight inside the SD-WAN rule determine which member the engine selects for matching traffic. If the MPLS member carries a lower priority or unsuitable weight, the rule steers traffic to broadband despite the preferred tunnel being available.

Why this answer

Option C is correct because within an SD-WAN rule the member priorities and weights determine which member is preferred; if the MPLS member has a lower priority value or weight than the broadband member, the SD-WAN engine will steer matching traffic to broadband instead. Option D is correct because SD-WAN performance SLAs (e.g., latency, jitter, packet loss thresholds) continuously probe each member, and if the MPLS member fails the SLA it is marked ineligible and traffic falls back to the next qualified member such as the broadband tunnel. Option E is correct because SD-WAN rules are evaluated top-down by sequence order, so an earlier rule matching the same application-based criteria can intercept the traffic and send it out the broadband member before the intended rule is reached.

Option A is not relevant because the factory default admin password has no bearing on SD-WAN member selection or tunnel routing. Option B is not relevant because the physical cable category affects link capability, not the SD-WAN engine's rule-based path selection between an MPLS and broadband member.

Exam trap

FORTINET-NSE7-SPECIALTY often tests whether candidates understand that SD-WAN member selection is driven by SLA health, rule sequence, and member priority — not by physical cabling or unrelated security settings.

Practice this question →
15
MCQhard

An IPsec VPN tunnel used as an SD-WAN member is experiencing intermittent flapping due to DPD (Dead Peer Detection) timeout issues over a high-latency satellite link. How should the administrator adjust the Phase 1 IPsec settings on FortiOS to stabilize the tunnel without completely disabling failure detection?

A.Disable DPD entirely so the FortiGate never tears down the tunnel
B.Enable NP6/NP7 hardware offloading for Phase 1 SA renegotiation
C.Change the IPsec phase 1 mode from Main mode to Aggressive mode
D.Increase the DPD retry count and interval settings under the IPsec Phase 1 configuration
AnswerD

Satellite latency causes DPD probes to expire before replies arrive, flapping the tunnel. Raising the DPD retry count and interval under Phase 1 tolerates that delay while keeping dead peer detection active, satisfying the requirement not to disable detection.

Why this answer

Increasing the DPD retry count and interval under IPsec Phase 1 settings allows the FortiGate to tolerate longer delays before declaring the peer dead. On high-latency satellite links, packets may take longer to arrive, causing false DPD timeouts. By adjusting these parameters, the tunnel remains stable while still detecting genuine failures, as DPD is not disabled.

Exam trap

The trap is thinking that disabling DPD or changing mode solves latency issues; the correct approach is to tune DPD parameters to match link characteristics while keeping detection active.

How to eliminate wrong answers

Option A is wrong because disabling DPD entirely removes failure detection, which can lead to blackholing traffic if the peer goes down. Option B is wrong because NP6/NP7 hardware offloading is for performance, not for DPD timing; it does not affect DPD retries. Option C is wrong because changing from Main mode to Aggressive mode affects authentication and speed, not DPD timeout issues; Aggressive mode is less secure and not a solution for latency.

Practice this question →
16
MCQeasy

An administrator needs to inspect encrypted traffic traversing an SD-WAN IPsec tunnel using Deep Packet Inspection (DPI). What must be installed on the client endpoints or configured on the FortiGate to prevent browser trust warnings when using SSL/TLS full inspection?

A.ADVPN 2.0 shortcut certificates must be exchanged between spokes
B.BGP MD5 authentication keys must match on both routers
C.The FortiGate's self-signed CA certificate must be installed in the trusted root certificate store of the client endpoints
D.A pre-shared key must be configured in the IPsec Phase 1 proposal
AnswerC

Full SSL/TLS inspection makes the FortiGate re-sign server certificates with its own CA, so browsers flag them as untrusted. Installing that CA certificate into each endpoint's trusted root store restores the chain of trust, eliminating warnings while DPI decrypts, inspects and re-encrypts the tunnel traffic.

Why this answer

When the FortiGate performs SSL/TLS full inspection, it acts as a man-in-the-middle, re-signing every server certificate with its own CA certificate. For browsers and applications to trust the re-signed certificates without warnings, the FortiGate's inspection CA certificate must be imported into the trusted root certificate store of every client endpoint. This is the standard requirement for any full DPI deployment, whether over SD-WAN IPsec tunnels or direct internet paths.

Exam trap

The trap is conflating IPsec tunnel authentication (PSK, certificates for tunnel establishment) with SSL inspection trust — candidates who see 'certificate' in an IPsec context often pick the ADVPN or PSK answer instead of the client trust-store answer.

How to eliminate wrong answers

Option A is wrong because ADVPN 2.0 shortcut certificates are used for IPsec tunnel negotiation between spokes, not for browser trust of inspected TLS sessions. Option B is wrong because BGP MD5 authentication secures routing protocol peering, which is unrelated to certificate trust for DPI. Option D is wrong because the IPsec Phase 1 pre-shared key authenticates the tunnel endpoints; it has no bearing on whether a browser trusts a re-signed TLS certificate.

Practice this question →
17
MCQeasy

An administrator configures a static route where the gateway is an SD-WAN zone instead of a specific IP address. How does FortiOS process this SD-WAN static route?

A.The FortiGate drops the packet because static routes require a valid IP address gateway
B.The FortiOS SD-WAN engine intercepts the route lookup and applies SD-WAN rules to dynamically select the best member interface based on performance SLAs
C.The packet is forwarded exclusively through the physical interface with the lowest index number
D.Traffic is load-balanced equally across all physical interfaces in the FortiGate chassis using round-robin
AnswerB

Pointing a static route at an SD-WAN zone rather than a next-hop IP hands member selection to the SD-WAN engine, which evaluates configured rules and SLA health per member, then installs the chosen interface. This satisfies the stem's dynamic best-member requirement.

Why this answer

When a static route's gateway is an SD-WAN zone, FortiOS treats it as an SD-WAN route and invokes the SD-WAN engine during route lookup. The engine evaluates the configured SD-WAN rules and health-check SLAs to dynamically select the best member interface for the traffic, rather than using a fixed next-hop IP. This enables performance-based routing and failover without changing the static route.

Exam trap

The trap is assuming static routes require a literal IP next-hop — candidates pick the 'drops the packet' answer, not realizing FortiOS extends static routing to support SD-WAN zones as dynamic gateways.

How to eliminate wrong answers

Option A is wrong because FortiOS explicitly supports SD-WAN zones as static route gateways — it does not drop the packet. Option C is wrong because selection is not based on interface index; it is driven by SD-WAN rules and SLA health checks. Option D is wrong because round-robin across all chassis interfaces is not how SD-WAN static routes work — the SD-WAN engine applies the configured strategy (e.g., Lowest Cost, Volume) and SLA constraints.

Practice this question →
18
Multi-Selectmedium

When configuring advanced IPsec VPN tunnels to act as members of an SD-WAN zone, which TWO configuration parameters on the FortiGate are critical for ensuring proper IPsec tunnel operation and traffic steering? (Choose two)

Select 2 answers
A.Ensure the IPsec interface is added to an SD-WAN zone and assigned a valid virtual IP/interface configuration
B.Disable NAT traversal (NAT-T) globally on all IPsec phase 1 tunnels
C.Configure the IPsec tunnel mode as dialup server on all participating branch spokes
D.Set the IPsec phase 1 authentication method strictly to RSA certificates only, disabling pre-shared keys
E.Configure Phase 2 selectors to match the exact source and destination subnets, or use 0.0.0.0/0 for route-based VPN flexibility
AnswersA, E

Adding the IPsec interface to an SD-WAN zone lets FortiOS treat the tunnel as a steerable member, while the valid virtual IP/interface binding gives the tunnel a usable local endpoint for encapsulated traffic. Without both, SD-WAN rules cannot select or forward across the tunnel.

Why this answer

Option A is correct because an IPsec interface must be a member of the SD-WAN zone to participate in SD-WAN path selection and steering; the tunnel interface needs a valid IP/interface configuration so the zone can reference it and health checks and rules can operate on it. Option E is correct because Phase 2 selectors define the interesting traffic for the tunnel: they should either match the exact protected source/destination subnets or use 0.0.0.0/0 for route-based VPNs, which allows routing and SD-WAN rules to steer traffic into the tunnel rather than being blocked by narrow selectors. Option B is wrong because NAT-T is often required when peers are behind NAT and disabling it globally would break many tunnels; it is not a critical SD-WAN membership parameter.

Option C is wrong because not all participating spokes should be dialup servers; typically the hub is the dialup server and spokes are dialup clients, and tunnel mode is not the parameter that makes a tunnel an SD-WAN member. Option D is wrong because forcing RSA certificates only and disabling pre-shared keys is an authentication policy choice, not a requirement for IPsec tunnel operation or SD-WAN traffic steering.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the misconception that SD-WAN IPsec membership requires special authentication changes (certificates, dialup roles) or disabling NAT-T, when in reality it is about interface membership and correct Phase 2 selector design for route-based VPNs.

Practice this question →
19
Multi-Selectmedium

An administrator is troubleshooting BGP route propagation over SD-WAN IPsec tunnels where a branch office is not receiving specific routes from the datacenter hub. Which TWO CLI commands on the FortiGate are most useful for diagnosing BGP peering and advertised route issues? (Choose two)

Select 2 answers
A.execute ipsec tunnel list
B.diagnose sys sdwan member
C.get system interface physical
D.get router info bgp neighbors advertised-routes
E.get router info bgp summary
AnswersD, E

This command displays the routes the local FortiGate is advertising to a specific BGP neighbour. If the branch is missing routes, checking advertised-routes on the datacenter hub confirms whether those prefixes are actually being sent across the SD-WAN IPsec tunnel.

Why this answer

Option E, 'get router info bgp summary', is correct because it displays the state of all BGP peers, including whether the branch-to-hub session is Established, the peer AS number, uptime, and prefix counts received — the fastest way to confirm the BGP peering itself is up before investigating route propagation. Option D, 'get router info bgp neighbors advertised-routes', is correct because it shows exactly which prefixes the local FortiGate is advertising to a specific neighbor, letting the administrator verify whether the missing routes are actually being sent toward the branch over the SD-WAN IPsec tunnel. The unmarked options do not belong: 'execute ipsec tunnel list' only shows IPsec tunnel status and selectors, not BGP route exchange; 'diagnose sys sdwan member' reports SD-WAN member health, latency, and SLA state but no BGP information; and 'get system interface physical' merely lists physical interface link status and addressing, which is irrelevant to BGP peering or advertised-route troubleshooting.

Exam trap

The trap is picking interface- or tunnel-level commands (ipsec tunnel list, sdwan member) that verify connectivity but not BGP peering state or route advertisement, which are the actual diagnostic targets here.

Practice this question →
20
Multi-Selecthard

An administrator configures an SD-WAN health check with multiple probes (e.g., ping and HTTP) to monitor a set of IPsec VPN tunnels. Which THREE criteria or settings govern how FortiOS determines whether an SD-WAN member has met or failed the performance SLA? (Choose three)

Select 3 answers
A.The BGP AS number assigned to the WAN interface gateway
B.The restoretime parameter, which specifies how many consecutive successful probes are required before restoring a failed member to healthy status
C.The physical cable length calculated in meters between the FortiGate and the nearest ISP switch
D.The failtime parameter, which dictates how many consecutive probe failures must occur before the member is marked as failed
E.Configured thresholds for latency, jitter, and packet loss that a member must remain under to be considered meeting the SLA
AnswersB, D, E

Restoretime defines how many consecutive successful probes must pass before FortiOS returns a failed SD-WAN member to healthy status. This hysteresis prevents flapping members from rejoining the SLA-qualified set too quickly, and it is one of the settings governing member health determination.

Why this answer

Option B is correct because the restoretime setting in an SD-WAN health check defines how many consecutive successful probe responses must be received before FortiOS transitions a previously failed member back to a healthy state, preventing flapping. Option D is correct because the failtime parameter specifies the number of consecutive probe failures (across the configured probes such as ping and HTTP) required before FortiOS marks that SD-WAN member as failed. Option E is correct because the SLA targets themselves—configured thresholds for latency, jitter, and packet loss—are the metrics FortiOS compares against probe results to decide whether a member is meeting the performance SLA.

Option A is not relevant because the BGP AS number is a routing attribute and does not govern SD-WAN health-check SLA evaluation. Option C is not relevant because physical cable length is not a configurable SD-WAN SLA criterion and is not used by FortiOS to determine member health.

Exam trap

FORTINET-NSE7-SPECIALTY often tests SD-WAN SLA mechanics — the trap is selecting plausible-sounding but irrelevant parameters (BGP AS, cable length) instead of the actual failtime/restoretime/threshold triad.

Practice this question →
21
MCQmedium

A FortiGate SD-WAN deployment uses a firewall policy with an Intrusion Prevention System (IPS) profile applied. After turning on IPS, administrators notice that throughput over an IPsec SD-WAN tunnel drops significantly. What is the primary reason for this throughput reduction, and how can it be mitigated?

A.IPS requires proxy-based inspection, which permanently disables IPsec hardware acceleration
B.IPS inspection requires intensive CPU processing for packet payload analysis, which can be optimized by using flow-based inspection mode and ensuring hardware offloading is active where supported
C.IPS blocks all IPsec AH/ESP headers, forcing fallback to unencrypted GRE tunnels
D.The IPS database size exceeds the IPsec Phase 2 buffer limit
AnswerB

IPS performs payload signature matching, which is CPU-intensive and caps throughput once traffic exceeds what the processor handles. Flow-based inspection reduces per-packet overhead, and hardware offloading where supported moves inspection to dedicated acceleration, restoring tunnel throughput without disabling protection.

Why this answer

IPS inspection is CPU-intensive because it analyzes packet payloads against signature databases, which reduces throughput on IPsec tunnels. Mitigation includes using flow-based inspection (which is less resource-intensive than proxy-based) and ensuring hardware offloading (NPU/CP) is active where supported, so encrypted traffic can be accelerated.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the misconception that IPS requires proxy mode or breaks IPsec — candidates pick extreme answers instead of the balanced flow-based + offload solution.

How to eliminate wrong answers

Option A is wrong because IPS does not require proxy-based inspection — flow-based IPS is supported and does not permanently disable IPsec hardware acceleration. Option C is wrong because IPS does not block IPsec AH/ESP headers; it inspects decrypted payloads after IPsec termination. Option D is wrong because IPS database size is unrelated to IPsec Phase 2 buffer limits; Phase 2 buffers are for SA negotiation, not signature storage.

Practice this question →
22
MCQhard

An administrator is troubleshooting an SD-WAN deployment where traffic matching an SD-WAN rule with a destination service object (e.g., HTTPS) is not being steered according to the SLA priority. Instead, it is always taking the default static route member. Upon checking the firewall policies, what is the most common reason why an SD-WAN rule fails to process application or service-based traffic matching?

A.IPsec VPN phase 2 selectors must be set to 0.0.0.0/0 for service-based rules to evaluate
B.The SD-WAN rules are evaluated sequentially from top to bottom; an earlier broad SD-WAN rule with matching source/destination IP addresses is intercepting the traffic before the service-specific rule is reached
C.The firewall policy containing the traffic has SSL inspection disabled, preventing service-based identification
D.The FortiGate kernel requires hardware acceleration (NP7) to be disabled for service-based SD-WAN rules to function
AnswerB

SD-WAN rules are evaluated top-down, so a broader earlier rule matching the same source and destination IPs captures the traffic first. The service-specific rule is never reached, and traffic follows the default static route member instead.

Why this answer

SD-WAN rules are evaluated top-down in the order they appear in the rule list, and the first matching rule wins. If an earlier rule matches on broad source/destination IP criteria, it intercepts the traffic before the service-specific rule (e.g., HTTPS) is ever evaluated, so the service-based steering never applies. This is the most common cause of 'my SD-WAN rule isn't working' in FortiGate deployments.

Exam trap

The trap is assuming SD-WAN rules match on service objects regardless of rule order — candidates forget that an earlier broad IP-based rule silently intercepts traffic, making the service-specific rule appear broken.

How to eliminate wrong answers

Option A is wrong because IPsec phase 2 selectors do not need to be 0.0.0.0/0 for service-based SD-WAN rules to evaluate — selectors affect which traffic is encrypted, not how SD-WAN rules match. Option C is wrong because SSL inspection is not required for service-based SD-WAN matching; FortiGate identifies services via its application signature database and destination service objects, not by decrypting traffic. Option D is wrong because NP7 hardware acceleration does not need to be disabled — SD-WAN rules function with hardware acceleration enabled, and disabling it would degrade performance without fixing the matching issue.

Practice this question →
23
Multi-Selectmedium

An administrator is configuring BGP over SD-WAN IPsec tunnels between a headquarters FortiGate and branch FortiGates. Which TWO configuration steps are required to ensure robust and stable dynamic routing over the SD-WAN IPsec tunnels? (Choose two)

Select 2 answers
A.Set the BGP administrative distance to 255 to disable all routing updates
B.Configure BGP neighbors using the loopback interface IP addresses or tunnel specific IP addresses rather than physical interface IPs
C.Enable BGP graceful restart or adjust keepalive and holddown timers to accommodate potential latency spikes and failover delays on WAN links
D.Configure static default routes on all BGP neighbors pointing to the null0 interface
E.Disable IPsec phase 2 encryption to allow BGP plaintext hello packets to pass through without encapsulation overhead
AnswersB, C

Loopback or tunnel-specific addresses keep BGP sessions up regardless of which physical WAN link carries the IPsec tunnel. Peering to physical interface IPs breaks the session when that link fails or the tunnel renegotiates, so this satisfies the requirement for stable dynamic routing across SD-WAN members.

Why this answer

Option B is correct because peering BGP over loopback or tunnel-specific IP addresses decouples the BGP session from any single physical WAN link, so the session stays up when an individual SD-WAN member link flaps and traffic can be steered across remaining IPsec tunnels. Option C is correct because WAN latency spikes and failover delays can exceed default BGP keepalive (60s) and hold-down (180s) timers, causing session resets; enabling graceful restart or tuning these timers preserves routing state and prevents unnecessary reconvergence during transient SD-WAN events. Option A is wrong because administrative distance 255 makes the route unusable and does not disable BGP updates; it would break routing rather than stabilize it.

Option D is wrong because static default routes to null0 would blackhole traffic and are not a BGP-over-SD-WAN requirement. Option E is wrong because disabling IPsec Phase 2 encryption would break the IPsec tunnel and is not needed for BGP, which is encapsulated inside the tunnel.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the misconception that disabling encryption or using null0 routes can solve routing issues, but the real focus is on stable BGP peering and timer adjustments for SD-WAN resilience.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Nse7 SD Wan Security Profiles Routing And Ipsec questions.

Start 20-question session
CCNA Nse7 SD Wan Security Profiles Routing And Ipsec Questions | Courseiva