Courseiva

CCNA Nse7 Sd Wan Security Profiles Routing And Ipsec Questions

33 questions · Nse7 Sd Wan Security Profiles Routing And Ipsec topic · All types, answers revealed

Practice these questionsExam hubAll questions
1
MCQmedium

An enterprise network uses ADVPN 2.0 with BGP running over IPsec tunnels. A spoke needs to initiate a shortcut tunnel to another spoke. Which FortiOS CLI command is used on the hub to verify the active shortcut tunnels and view the shortcut state information?

A.execute router clear bgp all
B.get system sdwan neighbor
C.diagnose vpn tunnel list
D.diagnose netlink interface list
AnswerC

Correct. 'diagnose vpn tunnel list' displays active IPsec tunnels, including dynamically created ADVPN shortcut tunnels.

Why this answer

The command 'get system session info' or specific VPN commands such as 'getvpn status' or 'diagnose vpn tunnel list' are used, but for ADVPN shortcuts specifically, 'diagnose sys ipsec tunnel list' or 'get vpn ipsec status' displays the dynamic child SAs. More precisely, 'get vpn advpn status' or querying the routing table with 'get router info routing-table database' shows shortcuts. Wait, the exact diagnostic command for checking ADVPN shortcuts in FortiOS is 'diagnose vpn swift list' or checking the IPsec tunnels via 'diagnose vpn tunnel list'.

Let's look at the options to find the correct diagnostic command.

Practice this question →
2
MCQeasy

An administrator configures an SD-WAN rule with a 'Lowest Cost (SLA)' strategy. What determines the metric used by FortiOS to select the best interface when multiple links meet the SLA criteria?

A.The round-robin algorithm applied sequentially across all active links
B.The lowest physical port number on the FortiGate hardware
C.The lowest packet loss, jitter, or latency value measured by the health check among the qualifying links
D.The highest interface bandwidth capacity defined in the static route table
AnswerC

Correct. Lowest Cost (SLA) selects the interface that has the best metric value among those meeting the SLA thresholds.

Why this answer

When 'Lowest Cost (SLA)' strategy is selected, FortiOS uses the configured priority and weight, or the specific metric defined in the SLA parameters (such as lowest latency, jitter, or packet loss among those meeting the threshold). If multiple links meet the SLA thresholds, it selects based on priority and weight, or lowest cost based on the metric specified. Wait, Lowest Cost uses the cost assigned to the SD-WAN members or interface weights.

Let's look at the options.

Practice this question →
3
MCQhard

An administrator has configured BGP over multiple SD-WAN IPsec tunnels to provide redundant paths to a datacenter. However, asymmetric routing is causing stateful inspection drops on a secondary FortiGate firewall downstream. To ensure that BGP selects the preferred primary SD-WAN member consistently, which BGP attribute is best manipulated via a route-map applied to the BGP neighbor in FortiOS?

A.AS-PATH prepend
B.Cluster ID
C.Origin code
D.Local Preference
AnswerD

Correct. Local Preference is used within IBGP to dictate the preferred exit path (and thus the preferred SD-WAN IPsec tunnel) out of the local AS.

Why this answer

MED (Multi-Exit Discriminator) or Local Preference can influence inbound/outbound path selection. Local Preference is used to influence outbound routing decisions within an AS, while MED influences inbound traffic from external peers. For internal path selection across SD-WAN tunnels terminating on the same autonomous system or IBGP peers, Local Preference or weight (cisco-specific, but weight is local to FortiGate) / Route-map setting local-preference is standard.

Practice this question →
4
MCQmedium

An administrator configures an IPsec tunnel template for ADVPN 2.0 on a FortiGate hub. Which specific Phase 1 configuration parameter must be enabled to support dynamic shortcut creation between spokes in ADVPN 2.0?

A.set mode aggressive
B.set net-device enable
C.set dhcp-interception enable
D.set pfs-group modp1024
AnswerB

Correct. Enabling net-device creates dynamic network interfaces for each shortcut tunnel, enabling independent routing and security policies per shortcut.

Why this answer

To support ADVPN 2.0 shortcuts, the Phase 1 configuration must have 'set net-device enable' and 'set advpn enable' (or equivalent shortcut settings depending on FortiOS version, such as 'set tunnel-search' or 'set shortcut-forwarding'). In modern FortiOS, 'set net-device enable' is required so each dynamic shortcut creates a virtual network interface.

Practice this question →
5
MCQmedium

An administrator configures an ADVPN 2.0 deployment between a FortiGate hub and multiple spokes using OSPF as the dynamic routing protocol. The spoke units need to establish direct shortcut tunnels dynamically. Which configuration step is mandatory on the hub to ensure that BGP or OSPF next-hop resolution works correctly for ADVPN shortcut creation?

A.Enable split-horizon globally within the OSPF routing process
B.Disable next-hop-self on the hub's BGP neighbor configuration or adjust OSPF interface settings so the advertising router is not forced as the next hop
C.Enable exchange-interface in the hub's OSPF interface configuration
D.Configure a static blackhole route for all spoke subnets on the hub
AnswerB

Correct. By default, protocols like BGP use next-hop-self which forces traffic through the hub, breaking ADVPN shortcut creation unless properly configured to preserve the originating peer's IP or using shortcut-specific routing policies.

Why this answer

In ADVPN environments running dynamic routing protocols like OSPF or BGP, network-object settings or interface settings such as setting the route-map or disabling next-hop-self on the hub allow spokes to properly resolve shortcut routes. Specifically, modifying the BGP next-hop or OSPF next-hop behavior ensures traffic is steered directly to the requesting spoke's IP rather than looping back through the hub.

Practice this question →
6
MCQmedium

An administrator implements BGP over SD-WAN tunnels to a cloud provider. The cloud provider requires BGP MD5 authentication on all peering sessions. Where is BGP MD5 authentication configured on the FortiGate?

A.Within the firewall policy authentication settings
B.Under the IPsec phase 1 interface advanced settings
C.Inside the SD-WAN health check probe configuration
D.Under the router bgp neighbor configuration block in the CLI
AnswerD

Correct. BGP neighbor passwords are configured directly inside the BGP neighbor settings under config router bgp.

Why this answer

BGP authentication passwords (such as MD5) are configured within the BGP neighbor configuration under router bgp in the FortiOS CLI.

Practice this question →
7
MCQmedium

An enterprise FortiGate is running SD-WAN with multiple internet breakouts. The administrator applies an Application Control security profile to the firewall policy. Some custom business applications are being incorrectly classified or blocked by the Application Control profile. To ensure SD-WAN can reliably steer this traffic using application signatures while preventing false positives, what is the recommended procedure?

A.Create a custom application signature override in the Application Control profile to correctly identify the traffic by port, IP, or pattern
B.Disable all security profiles on the SD-WAN interface zone
C.Configure static routes for the application servers and bypass SD-WAN rules completely
D.Switch the inspection mode from flow-based to proxy-based for all firewall policies
AnswerA

Correct. Custom application overrides allow administrators to map specific traffic patterns to known applications or custom definitions so both Application Control and SD-WAN application steering work accurately.

Why this answer

When custom or specific applications are misidentified, administrators can create a Custom Application override or custom signature, or adjust the Application Control profile overrides to change the action (e.g., allow or assign to a specific app category) without disabling security entirely.

Practice this question →
8
Multi-Selecthard

An enterprise deploys ADVPN 2.0 with BGP and security profiles applied to traffic traversing the VPN overlay. Which THREE statements are correct regarding how security profiles and ADVPN 2.0 interact in FortiOS? (Choose three)

Select 3 answers
A.SSL inspection (DPI) applied on spoke firewall policies inspects decrypted traffic traversing the ADVPN shortcut tunnel
B.Security profiles can be centrally managed and pushed to spokes using FortiManager security profile templates
C.Firewall policies enforcing security profiles (such as Antivirus and IPS) must be configured on the spoke units because shortcut traffic flows directly between spokes without passing through the hub
D.ADVPN 2.0 automatically disables all firewall inspection profiles on shortcut interfaces to maximize throughput
E.The hub FortiGate inspects all data packets exchanged between spokes even after a direct shortcut tunnel is established
AnswersA, B, C

Correct. Local firewall policies on spokes with SSL inspection applied inspect traffic going over the shortcut.

Why this answer

In ADVPN 2.0, when spokes establish direct shortcut tunnels, data flows directly between spokes without passing through the hub. Therefore, firewall policies and security profiles enforcing inspection must exist on the spoke FortiGates, not just the hub. Additionally, shortcut tunnels permit direct inspection on the spoke interfaces.

Practice this question →
9
MCQhard

An enterprise network implements BGP over ADVPN. Spoke units advertise their local subnets to the hub via BGP. To prevent spokes from learning each other's subnets directly through the hub via regular BGP route propagation before an ADVPN shortcut is established (forcing them to route through the hub unnecessarily), or conversely, to optimize route distribution, what BGP feature is typically configured on the hub?

A.BGP Route Reflection configured on the hub with spoke routers set as clients
B.BGP Multipath relaxing with maximum-paths set to 32
C.Static default route redistribution with aggregate-address suppression
D.BGP Confederation with each spoke acting as a separate autonomous system
AnswerA

Correct. BGP Route Reflection on the hub allows the hub to redistribute routes learned from one spoke to other spokes without requiring a full mesh of iBGP sessions between all spokes.

Why this answer

In BGP over ADVPN, Route Reflection is typically enabled on the hub so that spoke-to-spoke routes are reflected correctly, or next-hop behavior is manipulated. Wait, if we want spokes not to learn routes or to handle them correctly without full mesh, BGP Route Reflection (with no-client-to-client reflection if desired, or standard route reflection) is used. Alternatively, disabling next-hop-self or using peer groups.

Let's look at the options. BGP Route Reflection on the hub allows the hub to reflect routes between spoke iBGP peers without requiring a full mesh iBGP session between every spoke.

Practice this question →
10
Multi-Selecthard

An enterprise network uses OSPF over SD-WAN IPsec tunnels. The administrator notices that OSPF adjacency is constantly dropping over a specific backup SD-WAN member link due to intermittent packet loss. Which THREE configuration adjustments can improve OSPF stability over unstable SD-WAN IPsec links? (Choose three)

Select 3 answers
A.Configure OSPF network type as point-to-point on the IPsec tunnel interfaces to eliminate unnecessary DR/BDR elections
B.Enable OSPF graceful restart or helper mode on the FortiGate routers
C.Set the OSPF router ID to 0.0.0.0 on all branch spokes
D.Increase the OSPF hello interval and dead interval on the affected IPsec tunnel interfaces to tolerate temporary packet loss
E.Disable OSPF hello packets entirely and rely on static default routes
AnswersA, B, D

Correct. Point-to-point OSPF network type removes overhead and election delays on IPsec tunnel interfaces.

Why this answer

To stabilize OSPF over unstable WAN links, adjusting OSPF hello and dead intervals, configuring OSPF dead-drop or fast-hello settings carefully, or utilizing passive interfaces/MD5 authentication correctly helps. Furthermore, ensuring that OSPF timers match and are relaxed prevents unnecessary adjacency drops.

Practice this question →
11
MCQhard

A FortiGate device is configured with an SD-WAN rule utilizing a SLA rule for latency and packet loss. Security profiles including Deep Packet Inspection (DPI) SSL inspection and an Antivirus profile are applied to the firewall policy allowing this traffic. Users report intermittent connection drops on real-time UDP-based applications. Upon troubleshooting, the administrator notices that packet drops occur only when the SD-WAN rule dynamically steers traffic to a backup IPsec tunnel that has a smaller MTU. What is the most likely root cause and mitigation for this behavior?

A.Path MTU Discovery is failing because ICMP unreachable messages are blocked, and TCP MSS clamping is not adjusting the encapsulated IPsec packet size correctly
B.SD-WAN health check probes are overwhelming the IPsec tunnel bandwidth
C.The Antivirus proxy buffer is overflowing due to UDP streaming packets
D.The SSL inspection profile is attempting to decrypt UDP traffic, causing kernel panic and packet drops
AnswerA

Correct. When SD-WAN steers traffic over a tunnel with a smaller MTU, lack of fragmentation or MSS adjustment leads to drops of packets larger than the egress interface MTU.

Why this answer

IPsec encapsulation adds overhead, and if the Path MTU Discovery (PMTUD) fails due to ICMP fragmentation-needed messages being blocked by security profiles or firewalls along the path, packet drops occur for UDP streams exceeding the actual MTU. Adjusting the TCP MSS or enabling ipsec-phase1-interface fragmentation settings/tcp-mss-enforcement resolves this.

Practice this question →
12
MCQmedium

An administrator configures an SD-WAN rule to route guest Wi-Fi traffic out of a secondary broadband internet connection. However, guest users are still able to access internal corporate subnets that are routed over the primary IPsec VPN tunnel. What configuration is missing or incorrect?

A.The SD-WAN health check probe is not monitoring the corporate subnet gateway
B.The IPsec Phase 2 security association selectors include the guest subnet range
C.The SD-WAN rule priority for the internal VPN interface is set higher than the broadband interface
D.The firewall policy permitting traffic from the Guest Wi-Fi interface to the internal VPN interface lacks proper security profile enforcement or is missing a deny rule blocking inter-zone access
AnswerD

Correct. Firewall policies control inter-zone traffic access. SD-WAN rules only affect routing for traffic permitted by firewall policies.

Why this answer

SD-WAN rules route internet or specific traffic based on criteria, but traffic between zones (like Guest Wi-Fi to Corporate LAN) is governed by firewall policies. If a firewall policy permits traffic from Guest Wi-Fi directly to Corporate LAN, it bypasses SD-WAN rules because SD-WAN rules only evaluate traffic matching egress SD-WAN zones/interfaces specified by the rule or routing table lookup. To prevent guest traffic from reaching internal subnets, the firewall policy must block or restrict that inter-zone traffic.

Practice this question →
13
MCQhard

A FortiGate device is running ADVPN 2.0 with OSPF. A spoke experiences transient routing loops when a shortcut tunnel tears down due to inactivity timeout. Which configuration adjustment on the FortiGate hub and spokes prevents these temporary routing blackholes or loops during shortcut teardown?

A.Disable OSPF on the spoke units and rely entirely on static default routes
B.Adjust the administrative distance or use route redistribution filters with appropriate metrics so hub routes and shortcut routes do not conflict during teardown
C.Set the IPsec phase 1 lifetime to infinite to prevent shortcuts from timing out
D.Configure asymmetric routing bypass on all firewall policies
AnswerB

Correct. Proper administrative distance tuning or route filtering ensures that when a shortcut route is removed from the routing table, the fallback hub route takes over cleanly without routing loops.

Why this answer

When shortcuts time out, routes must cleanly transition back to the hub route without creating transient routing loops. Adjusting route redistribution metrics, using specific distance values, or configuring 'shortcut-routing' / route-map timers / asymmetric routing settings prevents loops. In FortiOS ADVPN, setting appropriate dead timers or using dynamic routing distance adjustments ensures the hub route has a predictable preference when the shortcut drops.

Practice this question →
14
MCQmedium

In an ADVPN 2.0 deployment, a hub unit uses BGP to advertise routes to spokes. When a spoke learns a prefix via BGP from the hub, what mechanism allows the spoke to automatically initiate an ADVPN shortcut tunnel directly to another spoke when traffic flows between them?

A.The FortiGate kernel detects traffic matching a dynamic BGP route over the IPsec interface and initiates an IKE shortcut negotiation with the target spoke
B.OSPF sends a special multicast hello packet across the hub to establish mesh point-to-point links
C.FortiManager pushes a dynamic static route to both spokes simultaneously
D.The Web Filtering profile intercepts the packet and redirects it via proxy to the destination spoke
AnswerA

Correct. When traffic hits the ADVPN tunnel interface for a destination learned via dynamic routing, the kernel triggers an IKE negotiation directly with the target spoke's public IP.

Why this answer

ADVPN shortcuts are triggered when traffic matches a shortcut trigger mechanism. In ADVPN 2.0, IPsec phase 1 shortcut settings ('set advpn shortcut') and dynamic routing protocols working together allow the kernel to generate shortcut requests when traffic hits the phase 1 interface.

Practice this question →
15
Multi-Selectmedium

An administrator applies security profiles (Antivirus, Web Filtering, and IPS) to traffic steered by an SD-WAN rule. Performance issues arise. Which TWO methods can the administrator use to optimize inspection performance without completely disabling security? (Choose two)

Select 2 answers
A.Switch the inspection mode from proxy-based to flow-based where supported, allowing hardware offloading (NP6/NP7) to accelerate packet processing
B.Set the IPsec Phase 1 encryption algorithm to DES to speed up decryptions
C.Configure security profile exemptions or antivirus inspection overrides for trusted internal subnets or latency-sensitive VoIP traffic
D.Disable all SSL inspection globally across the entire FortiGate device
E.Remove the SD-WAN virtual interface from all firewall zones
AnswersA, C

Correct. Flow-based inspection is less resource-intensive and integrates better with hardware acceleration than proxy-based inspection.

Why this answer

Optimizing security profile performance while maintaining inspection includes switching inspection mode to flow-based where appropriate, tuning antivirus/IPS settings to bypass heavy file types or exempt trusted IPs, and leveraging hardware acceleration.

Practice this question →
16
MCQeasy

When configuring an SD-WAN health check to monitor internet reachability using HTTP/HTTPS requests, which parameter defines the specific string the FortiGate expects to receive in the server response body to validate that the path is healthy?

A.probe-packet-size
B.sla-break-time
C.http-match
D.server-response-timeout
AnswerC

Correct. The http-match parameter specifies the string that must be present in the HTTP response body for the health check probe to be considered successful.

Why this answer

In SD-WAN health check (ping, tcp-echo, http, dns), when HTTP is selected as the server-type, administrators can configure a 'security-string' or 'http-match' / 'expect' string to validate the HTTP response body.

Practice this question →
17
MCQeasy

When troubleshooting SD-WAN performance SLA packet loss, an administrator wants to view real-time latency, jitter, and packet loss statistics for individual health check members. Which CLI command should be executed?

A.diagnose sys sdwan health-check
B.get system interface physical
C.execute ping-server status
D.show system sdwan
AnswerA

Correct. This command displays the current status, latency, jitter, and packet loss for configured SD-WAN health checks.

Why this answer

FortiOS provides diagnostic commands to check SD-WAN health check status and SLA metrics. The correct command is 'diagnose sys sdwan health-check'.

Practice this question →
18
MCQeasy

An administrator wants to apply a Web Filtering security profile to traffic that is being dynamically steered via an SD-WAN rule. Where must this security profile be enforced in FortiOS?

A.Inside the firewall policy that matches the traffic being steered by the SD-WAN rule
B.Directly inside the SD-WAN rule configuration under the advanced settings tab
C.Globally under the system settings as an SD-WAN overlay inspection profile
D.Within the IPsec tunnel phase 2 security association settings
AnswerA

Correct. Traffic steered by SD-WAN rules must still match a firewall policy where security profiles (like Web Filtering, Antivirus, IPS) are attached.

Why this answer

Security profiles in FortiOS are always applied within firewall policies, not directly inside SD-WAN rules or interface configurations. The SD-WAN rule handles routing/path selection, while the firewall policy handling that traffic enforces security profiles.

Practice this question →
19
MCQhard

An enterprise deploys BGP over SD-WAN with multiple MPLS and broadband connections. A route-map is applied to incoming BGP updates on the FortiGate to set a specific weight for routes learned over the MPLS interface. Why is the 'weight' attribute particularly effective in this FortiOS SD-WAN and BGP integration scenario?

A.Weight replaces the need for SD-WAN SLA rules by performing layer 7 packet inspection
B.Weight automatically adjusts the SD-WAN health check probe frequency based on route stability
C.Weight is evaluated first in the BGP best-path selection algorithm on FortiOS, allowing local preference override without altering global AS path attributes
D.Weight is propagated to all iBGP peers, ensuring cluster-wide path synchronization
AnswerC

Correct. Weight is local to the FortiGate and takes precedence over all other BGP path selection criteria, making it ideal for local path steering.

Why this answer

Weight is a Cisco/FortiOS-specific BGP attribute that is local to the router on which it is configured. It is evaluated first in the BGP best-path selection algorithm, allowing administrators to deterministically force traffic out of a specific SD-WAN/BGP member without affecting other routers in the AS.

Practice this question →
20
MCQmedium

An administrator configures an SD-WAN rule using the 'Volume' strategy across two IPsec tunnels with different bandwidth capacities (Tunnel A: 100 Mbps, Tunnel B: 50 Mbps). How does FortiOS distribute traffic across these members when using the Volume strategy?

A.Traffic is balanced equally (50/50) regardless of interface capacity
B.Traffic is sent exclusively over Tunnel A until it reaches 100% packet loss, then fails over to Tunnel B
C.Traffic is distributed proportionally based on the configured weight or bandwidth ratio of each member interface
D.Traffic is steered strictly based on real-time latency measured by health checks
AnswerC

Correct. Volume-based strategy divides traffic proportionally according to the weights assigned to the SD-WAN members, matching their respective link capacities.

Why this answer

The Volume strategy in SD-WAN distributes traffic proportional to the configured volume/weight (bandwidth capacity) of each member interface.

Practice this question →
21
MCQeasy

An administrator wants to view the active SD-WAN rule hit counts and verify which traffic is matching a specific SD-WAN rule in FortiOS. Which command should be used?

A.show system sdwan
B.execute router clear sdwan cache
C.get firewall policy statistics
D.diagnose sys sdwan service
AnswerD

Correct. This diagnostic command displays the configured SD-WAN rules (services), their hit counts, and current status.

Why this answer

To view runtime statistics and hit counts for SD-WAN rules, the command 'diagnose sys sdwan service' is used.

Practice this question →
22
Multi-Selecthard

An administrator troubleshoots a scenario where traffic matching an application-based SD-WAN rule is bypassing the preferred high-speed MPLS tunnel and taking the backup broadband tunnel instead. Which THREE factors should the administrator check to resolve this routing discrepancy? (Choose three)

Select 3 answers
A.Verify the FortiGate factory default administrator password is changed
B.Check the physical layer OSI Model cable category connected to the FortiGate port
C.Inspect the member priorities and weights configured within the specific SD-WAN rule
D.Verify whether the preferred MPLS member is failing the configured performance SLA thresholds, causing the SD-WAN engine to disqualify it
E.Check the sequence order of the SD-WAN rules; an earlier rule might be matching the traffic first
AnswersC, D, E

Correct. Member priorities and weights determine selection order among qualifying links in the SD-WAN rule.

Why this answer

When an SD-WAN rule bypasses preferred paths, potential causes include SLA health check failure (the preferred link fails the SLA threshold), incorrect rule evaluation order (an earlier rule matches first), or interface priority/weight settings within the rule. Checking these three areas is standard practice.

Practice this question →
23
MCQhard

An IPsec VPN tunnel used as an SD-WAN member is experiencing intermittent flapping due to DPD (Dead Peer Detection) timeout issues over a high-latency satellite link. How should the administrator adjust the Phase 1 IPsec settings on FortiOS to stabilize the tunnel without completely disabling failure detection?

A.Disable DPD entirely so the FortiGate never tears down the tunnel
B.Enable NP6/NP7 hardware offloading for Phase 1 SA renegotiation
C.Change the IPsec phase 1 mode from Main mode to Aggressive mode
D.Increase the DPD retry count and interval settings under the IPsec Phase 1 configuration
AnswerD

Correct. Increasing the DPD interval and retry count gives the satellite link more time to respond to liveness probes, preventing unnecessary flapping.

Why this answer

On high-latency or high-jitter links like satellite connections, the default DPD retry count and interval may be too aggressive. Increasing the DPD retry count and/or interval or switching the DPD mode to 'on-idle' or 'on-demand' helps prevent false drops.

Practice this question →
24
Multi-Selectmedium

An administrator is configuring SD-WAN rules with performance SLAs. Which TWO strategies are available in FortiOS when configuring an SD-WAN rule based on SLA metrics? (Choose two)

Select 2 answers
A.Lowest Cost (SLA)
B.Priority
C.Round-Robin DNS Load Balancing
D.Dynamic BGP AS-Prepending
E.Static Flow-Hashing
AnswersA, B

Correct. Lowest Cost (SLA) selects the path with the best metric that meets the SLA threshold.

Why this answer

FortiOS SD-WAN rule strategies include Lowest Cost (SLA), Max Bandwidth, Service-ID, Volume, and Priority. Among these, Priority and Lowest Cost (SLA) are standard strategy options utilizing SLA performance metrics.

Practice this question →
25
MCQeasy

An administrator needs to inspect encrypted traffic traversing an SD-WAN IPsec tunnel using Deep Packet Inspection (DPI). What must be installed on the client endpoints or configured on the FortiGate to prevent browser trust warnings when using SSL/TLS full inspection?

A.ADVPN 2.0 shortcut certificates must be exchanged between spokes
B.BGP MD5 authentication keys must match on both routers
C.The FortiGate's self-signed CA certificate must be installed in the trusted root certificate store of the client endpoints
D.A pre-shared key must be configured in the IPsec Phase 1 proposal
AnswerC

Correct. Client endpoints must trust the FortiGate CA certificate for SSL full inspection to operate without browser security warnings.

Why this answer

When using SSL Full Inspection (DPI), the FortiGate acts as a man-in-the-middle and re-signs certificates using a Certificate Authority (CA) certificate. This CA certificate must be installed and trusted on the client devices.

Practice this question →
26
MCQeasy

An administrator configures a static route where the gateway is an SD-WAN zone instead of a specific IP address. How does FortiOS process this SD-WAN static route?

A.The FortiGate drops the packet because static routes require a valid IP address gateway
B.The FortiOS SD-WAN engine intercepts the route lookup and applies SD-WAN rules to dynamically select the best member interface based on performance SLAs
C.The packet is forwarded exclusively through the physical interface with the lowest index number
D.Traffic is load-balanced equally across all physical interfaces in the FortiGate chassis using round-robin
AnswerB

Correct. Routing to an SD-WAN zone hands off the forwarding decision to the SD-WAN rules and SLA evaluation engine.

Why this answer

When a static route points to an SD-WAN zone as its gateway, the FortiOS routing table delegates the packet forwarding decision to the SD-WAN engine, which then evaluates SD-WAN rules to select the best member interface.

Practice this question →
27
Multi-Selectmedium

When configuring advanced IPsec VPN tunnels to act as members of an SD-WAN zone, which TWO configuration parameters on the FortiGate are critical for ensuring proper IPsec tunnel operation and traffic steering? (Choose two)

Select 2 answers
A.Ensure the IPsec interface is added to an SD-WAN zone and assigned a valid virtual IP/interface configuration
B.Disable NAT traversal (NAT-T) globally on all IPsec phase 1 tunnels
C.Configure the IPsec tunnel mode as dialup server on all participating branch spokes
D.Set the IPsec phase 1 authentication method strictly to RSA certificates only, disabling pre-shared keys
E.Configure Phase 2 selectors to match the exact source and destination subnets, or use 0.0.0.0/0 for route-based VPN flexibility
AnswersA, E

Correct. IPsec interfaces must be added to an SD-WAN zone to participate in SD-WAN rules.

Why this answer

When configuring IPsec tunnels for SD-WAN, setting the interface as a member of an SD-WAN zone and ensuring correct Phase 2 selectors or mode-cfg / routing settings are essential. Specifically, setting the interface to allow traffic, defining appropriate Phase 2 selectors or using 0.0.0.0/0 with route-based VPNs, and assigning it to an SD-WAN zone are critical.

Practice this question →
28
Multi-Selectmedium

An administrator is troubleshooting BGP route propagation over SD-WAN IPsec tunnels where a branch office is not receiving specific routes from the datacenter hub. Which TWO CLI commands on the FortiGate are most useful for diagnosing BGP peering and advertised route issues? (Choose two)

Select 2 answers
A.execute ipsec tunnel list
B.diagnose sys sdwan member
C.get system interface physical
D.get router info bgp neighbors advertised-routes
E.get router info bgp summary
AnswersD, E

Correct. This command displays the routes being advertised by the FortiGate to a specific BGP neighbor.

Why this answer

To troubleshoot BGP routing issues on FortiOS, commands examining the BGP summary, advertised routes, and received routes are essential. These include 'get router info bgp summary' and 'get router info bgp neighbors <ip> advertised-routes'.

Practice this question →
29
Multi-Selecthard

An administrator configures an SD-WAN health check with multiple probes (e.g., ping and HTTP) to monitor a set of IPsec VPN tunnels. Which THREE criteria or settings govern how FortiOS determines whether an SD-WAN member has met or failed the performance SLA? (Choose three)

Select 3 answers
A.The BGP AS number assigned to the WAN interface gateway
B.The restoretime parameter, which specifies how many consecutive successful probes are required before restoring a failed member to healthy status
C.The physical cable length calculated in meters between the FortiGate and the nearest ISP switch
D.The failtime parameter, which dictates how many consecutive probe failures must occur before the member is marked as failed
E.Configured thresholds for latency, jitter, and packet loss that a member must remain under to be considered meeting the SLA
AnswersB, D, E

Correct. Restoretime ensures stability by requiring multiple consecutive successful probes before returning a recovered link to service.

Why this answer

FortiOS SD-WAN health check SLA criteria evaluate packet loss, jitter, latency, and threshold failures. When multiple criteria or probes are used, settings such as latency-threshold, packet-loss-threshold, jitter-threshold, and failtime/restoretime determine state transitions.

Practice this question →
30
Multi-Selecthard

An administrator troubleshoots an ADVPN 2.0 deployment where dynamic shortcut tunnels fail to establish between branch spokes. Which THREE diagnostic steps or log checks should the administrator perform on the FortiGate hub or spoke to isolate the issue? (Choose three)

Select 3 answers
A.Check 'diagnose vpn tunnel list' to verify if dynamic shortcut child security associations are being created
B.Check the firewall policy statistics to ensure SD-WAN rules have zero hit counts globally
C.Run diagnose vpn ike log-filter ... and enable IKE real-time debugging to inspect negotiation messages between spokes
D.Execute 'execute format disk' to reset the internal flash storage and clear corrupted ADVPN certificates
E.Verify that 'get router info routing-table database' contains the dynamic shortcut routes injected when traffic hits the phase 1 interface
AnswersA, C, E

Correct. This command shows active child SAs, confirming whether the shortcut tunnel has successfully built.

Why this answer

Troubleshooting ADVPN shortcut failures requires checking IPsec status, IKE exchanges, routing table entries, and network device creation. Valid diagnostic steps include checking IKE daemon output, verifying IPsec tunnel status, and inspecting routing table entries for shortcut triggers.

Practice this question →
31
MCQmedium

A FortiGate SD-WAN deployment uses a firewall policy with an Intrusion Prevention System (IPS) profile applied. After turning on IPS, administrators notice that throughput over an IPsec SD-WAN tunnel drops significantly. What is the primary reason for this throughput reduction, and how can it be mitigated?

A.IPS requires proxy-based inspection, which permanently disables IPsec hardware acceleration
B.IPS inspection requires intensive CPU processing for packet payload analysis, which can be optimized by using flow-based inspection mode and ensuring hardware offloading is active where supported
C.IPS blocks all IPsec AH/ESP headers, forcing fallback to unencrypted GRE tunnels
D.The IPS database size exceeds the IPsec Phase 2 buffer limit
AnswerB

Correct. IPS profile processing consumes CPU cycles, and flow-based inspection mode optimized for NPx offloading mitigates performance degradation.

Why this answer

IPS inspection performs deep packet inspection and signature matching, which is CPU-intensive. While NP6/NP7 hardware offloading accelerates IPsec encryption, full content inspection like IPS typically requires CPU processing unless offloaded or optimized. Using flow-based inspection or hardware offloading settings where supported helps mitigate performance impact.

Practice this question →
32
MCQhard

An administrator is troubleshooting an SD-WAN deployment where traffic matching an SD-WAN rule with a destination service object (e.g., HTTPS) is not being steered according to the SLA priority. Instead, it is always taking the default static route member. Upon checking the firewall policies, what is the most common reason why an SD-WAN rule fails to process application or service-based traffic matching?

A.IPsec VPN phase 2 selectors must be set to 0.0.0.0/0 for service-based rules to evaluate
B.The SD-WAN rules are evaluated sequentially from top to bottom; an earlier broad SD-WAN rule with matching source/destination IP addresses is intercepting the traffic before the service-specific rule is reached
C.The firewall policy containing the traffic has SSL inspection disabled, preventing service-based identification
D.The FortiGate kernel requires hardware acceleration (NP7) to be disabled for service-based SD-WAN rules to function
AnswerB

Correct. SD-WAN rules are evaluated top-down. If a broader rule matches the traffic first, the more specific service-based rule below it is never evaluated.

Why this answer

For SD-WAN rules based on applications or destination services to take effect, the matching firewall policy must have application control or appropriate inspection enabled, or the SD-WAN rule position/criteria order must match correctly. Furthermore, explicit proxy or policy routing interactions can interfere if implicit firewall rules intercept the traffic first.

Practice this question →
33
Multi-Selectmedium

An administrator is configuring BGP over SD-WAN IPsec tunnels between a headquarters FortiGate and branch FortiGates. Which TWO configuration steps are required to ensure robust and stable dynamic routing over the SD-WAN IPsec tunnels? (Choose two)

Select 2 answers
A.Set the BGP administrative distance to 255 to disable all routing updates
B.Configure BGP neighbors using the loopback interface IP addresses or tunnel specific IP addresses rather than physical interface IPs
C.Enable BGP graceful restart or adjust keepalive and holddown timers to accommodate potential latency spikes and failover delays on WAN links
D.Configure static default routes on all BGP neighbors pointing to the null0 interface
E.Disable IPsec phase 2 encryption to allow BGP plaintext hello packets to pass through without encapsulation overhead
AnswersB, C

Correct. Using loopback or tunnel specific IPs ensures BGP sessions remain stable even if underlying physical WAN interfaces flap, as long as an alternative path exists.

Why this answer

Robust BGP over SD-WAN requires configuring the BGP router ID, setting up appropriate timers or neighbor relationships, and ensuring that the underlying SD-WAN members and IPsec tunnels allow routing protocol traffic. Additionally, managing BGP timers or enabling graceful restart helps maintain stability during brief IPsec reconnections.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Nse7 Sd Wan Security Profiles Routing And Ipsec questions.

Start 20-question session