BEST Verified Fortinet NSE7_SDW-7.2 Exam Questions (2025)
The Best Practice Test Preparation for the NSE7_SDW-7.2 Certification Exam
Fortinet NSE7_SDW-7.2 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 51
Refer to the exhibits.
Exhibit A
Exhibit B -
Exhibit A shows the configuration for an SD-WAN rule and exhibit B shows the respective rule status, the routing table, and the member status.
The administrator wants to understand the expected behavior for traffic matching the SD-WAN rule.
Based on the exhibits, what can the administrator expect for traffic matching the SD-WAN rule?
- A. The traffic will be load balanced across all three overlays.
- B. The traffic will be routed over T_INET_1_0.
- C. The traffic will be routed over T_INET_0_0.
- D. The traffic will be routed over T_MPLS_0.
Answer: D
NEW QUESTION # 52
Refer to the exhibit.
Which are two expected behaviors of the traffic that matches the traffic shaper? (Choose two.)
- A. The traffic shaper limits the bandwidth of each source IP address to a maximum of 625 KB/sec.
- B. The number of simultaneous connections among all source IP addresses cannot exceed five connections.
- C. The number of simultaneous connections allowed for each source IP address cannot exceed five connections.
- D. The traffic shaper limits the combined bandwidth of all connections to a maximum of 5 MB/sec.
Answer: A,C
NEW QUESTION # 53
Refer to the exhibit.
The device exchanges routes using IBGP.
Which two statements are correct about the IBGP configuration and routing information on the device?
(Choose two.)
- A. You can run the get router info routing-table database command to display the additional paths.
- B. additional-path is enabled.
- C. Each BGP route is three hops away from the destination.
- D. ibgp-multipath is disabled.
Answer: A,B
NEW QUESTION # 54
What three characteristics apply to provisioning templates available on FortiManager? (Choose three.)
- A. A template group can contain CLI templates of both types.
- B. You can apply a system template and a CLI template to the same FortiGate device.
- C. A CLI template can be of type CLI script or Perl script.
- D. A template group can include a system template and an SD-WAN template.
- E. Templates are applied in order, from top to bottom.
Answer: A,C,E
Explanation:
According to the FortiManager Administration Guide, provisioning templates are used to configure FortiGate devices in a consistent and efficient way. There are different types of templates, such as system, IPsec, SD-WAN, certificate, and CLI templates. Some characteristics of provisioning templates are:
You can apply a system template and a CLI template to the same FortiGate device, as long as they do not have conflicting settings1.
A CLI template can be of type CLI script or Perl script. A CLI script template contains FortiOS CLI commands, while a Perl script template contains Perl code that can generate FortiOS CLI commands2.
A template group can include a system template and an SD-WAN template, as well as other types of templates. A template group is a collection of templates that can be applied to multiple devices at once3.
A template group can contain CLI templates of both types, as long as they do not have conflicting settings2.
Templates are applied in order, from top to bottom. The order of the templates in a template group determines the order in which they are applied to the devices3.
NEW QUESTION # 55
Which are three key routing principles in SD-WAN? (Choose three.)
- A. By default, SD-WAN members are skipped if they do not have a valid route to the destination.
- B. By default, SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member.
- C. FortiGate performs route lookups for new sessions only.
- D. Regular policy routes have precedence over SD-WAN rules.
- E. SD-WAN rules have precedence over ISDB routes.
Answer: A,B,D
Explanation:
Study Guide 7.2, pages 125, 129, 151
NEW QUESTION # 56
Refer to the exhibit.
Based on the output, which two conclusions are true? (Choose two.)
- A. There is more than one SD-WAN rule configured.
- B. Entry 1(id=1) is a regular policy route.
- C. The SD-WAN rules take precedence over regular policy routes.
- D. The all_rules rule represents the implicit SD-WAN rule.
Answer: A,B
NEW QUESTION # 57
Exhibit.
The exhibit shows the output of the command diagnose sys sdwan health-check status collected on a FortiGate device. Which two statements are correct about the health check status on this FortiGate device?
(Choose two.)
- A. There is no SLA criteria configured for the health-check Level3_DNS.
- B. The health-check VPN_PING orders the members according to the lowest jitter.
- C. The interface T_INET_0 missed three SLA targets.
- D. The interface T_INET_1 missed one SLA target.
Answer: A,B
Explanation:
According to the FortiGate / FortiOS 6.4.2 Administration Guide, the health check status command displays the status of the health check probes for each SD-WAN member interface. The output includes the following information:
* state: the current state of the interface, either alive or dead
* packet-loss: the percentage of packets lost during the health check
* latency: the average round-trip time in milliseconds
* jitter: the variation in latency
* mos: the mean opinion score, a measure of voice quality
* bandwidth: the available bandwidth in kilobits per second for each direction (up, down, bi)
* sla map: a bitmap that indicates which SLA criteria are met or failed Based on the exhibit, the following statements are correct:
* The health-check VPN_PING orders the members according to the lowest jitter. This means that the interface with the lowest jitter value is listed first, followed by the next lowest, and so on1. In the exhibit, the order is T_MPLS, T_INET_1, and T_INET_0.
* There is no SLA criteria configured for the health-check Level3_DNS. This means that the health check does not use any SLA parameters to determine the state of the interface2. In the exhibit, the sla map value is 0x0 for both port1 and port2, indicating that no SLA criteria are applied.
NEW QUESTION # 58
Refer to the exhibits.
Exhibit A -
Exhibit B -
Exhibit A shows the traffic shaping policy and exhibit B shows the firewall policy.
The administrator wants FortiGate to limit the bandwidth used by YouTube. When testing, the administrator determines that FortiGate does not apply traffic shaping on YouTube traffic.
Based on the policies shown in the exhibits, what configuration change must be made so FortiGate performs traffic shaping on YouTube traffic?
- A. Application control must be enabled on the firewall policy.
- B. Individual SD-WAN members must be selected as the outgoing interface on the traffic shaping policy.
- C. Web filtering must be enabled on the firewall policy.
- D. Destination internet service must be enabled on the traffic shaping policy.
Answer: C
NEW QUESTION # 59
Exhibit.
The exhibit shows VPN event logs on FortiGate. In the output shown in the exhibit, which statement is true?
- A. There are no IPsec tunnel statistics log messages for ADVPN cuts.
- B. The master tunnel T_INET_0 cannot accept the ADVPN shortcut.
- C. The VPN tunnel T_MPLS_0 is a shortcut tunnel.
- D. There is one shortcut tunnel built from master tunnel T_MPLS_0.
Answer: C
NEW QUESTION # 60
Refer to the exhibit.
FortiGate has multiple dial-up VPN interfaces incoming on port1 that match only FIRST_VPN.
Which two configuration changes must be made to both IPsec VPN interfaces to allow incoming connections to match all possible IPsec dial-up interfaces? (Choose two.)
- A. Specify a unique peer ID for each dial-up VPN interface.
- B. Use unique Diffie Hellman groups on each VPN interface.
- C. Configure the IKE mode to be aggressive mode.
- D. Use different proposals are used between the interfaces.
Answer: A,C
NEW QUESTION # 61
What are two advantages of using an IPsec recommended template to configure an IPsec tunnel in an hub-and-spoke topology? (Choose two.)
- A. It ensures consistent settings between phase1 and phase2.
- B. It guides the administrator to use Fortinet recommended settings.
- C. The VPN monitor tool provides additional statistics for tunnels defined with an IPsec recommended template.
- D. It automatically install IPsec tunnels to every spoke when they are added to the FortiManager ADOM.
Answer: A,B
Explanation:
The use of an IPsec recommended template offers the advantage of ensuring consistent settings between phase1 and phase2 (A), which is essential for the stability and security of the IPsec tunnel. Additionally, it guides the administrator to use Fortinet's recommended settings (B), which are designed to optimize performance and security based on Fortinet's best practices. References: The benefits of using IPsec recommended templates are outlined in Fortinet's SD-WAN documentation, which emphasizes the importance of consistency and adherence to recommended configurations.
NEW QUESTION # 62
Refer to the exhibit.
Which two statements about the IPsec VPN configuration and the status of the IPsec VPN tunnel are true?
(Choose two.)
- A. The phase 1 configuration supports the network-overlay setting.
- B. FortiGate facilitated the negotiation of the T_INET_1_0_0 ADVPN shortcut over T_INET_1_0.
- C. FortiGate does not install IPsec static routes for remote protected networks in the routing table.
- D. Dead peer detection is disabled.
Answer: A,C
NEW QUESTION # 63
Which statement about using BGP for ADVPN is true?
- A. You must configure AS path prepending.
- B. IBGP is preferred over EBGP, because IBGP preserves next hop information.
- C. You must use BGP to route traffic for both overlay and underlay links.
- D. You must configure BGP communities.
Answer: B
Explanation:
ADVPN is a technology that allows dynamic creation of IPsec tunnels between branch sites without requiring pre-configured policies or keys. BGP is a routing protocol that can be used to exchange routes between ADVPN peers. IBGP is a type of BGP that runs between routers in the same autonomous system (AS), while EBGP is a type of BGP that runs between routers in different ASes. IBGP is preferred over EBGP for ADVPN, because IBGP preserves the next hop information of the routes, which is needed to establish the IPsec tunnels. EBGP changes the next hop information to the EBGP peer address, which may not be reachable by the ADVPN peers. Therefore, using IBGP for ADVPN avoids the need to configure additional static routes or redistribute routes between BGP and another routing protocol. References = ADVPN with BGP as the routing protocol, ADVPN, SD-WAN self-healing with BGP, Technical Tip: ADVPN with BGP as the routing protocol The statement that IBGP is preferred over EBGP for ADVPN because IBGP preserves next hop information (D) is true. In a typical ADVPN deployment, it's beneficial to maintain next hop information across the network to ensure proper routing and optimal path selection. References: This understanding comes from my knowledge of Fortinet's SD-WAN and ADVPN configurations, where BGP's behavior in terms of next hop preservation is a key consideration.
NEW QUESTION # 64
Refer to the exhibit.
An administrator is troubleshooting SD-WAN on FortiGate. A device behind branch1_fgt generates traffic to the 10.0.0.0/8 network. The administrator expects the traffic to match SD-WAN rule ID 1 and be routed over T_INET_0_0. However, the traffic is routed over T_INET_1_0.
Based on the output shown in the exhibit, which two reasons can cause the observed behavior? (Choose two.)
- A. T_INET_1_0 has a lower route priority value (higher priority) than T_INET_0_0.
- B. The traffic matches a regular policy route configured with T_INET_1_0 as the outgoing device.
- C. T_INET_0_0 does not have a valid route to the destination.
- D. T_INET_1_0 has a higher member configuration priority than T_INET_0_0.
Answer: B,C
Explanation:
SD-WAN strategy is Lowest Cost (SLA) as indicated by the "Mode(sla)" flag. Cost SLA uses SLA target, cost, and priority (i.e., interface preference - or order of config unless manually overridden by admin config) as the criteria -- in that order. Both members meet the target, both have 0 cost, and therefore member 3 (T_INET_0) wins the "priority" tiebreaker. So if there is a valid route to the destination through member 3, it will win. The fact that it does not has nothing to do with the configured static route/member priority, which according to SG page 197 "is used as a tiebreaker for ECMP routes when matching implicit SD-WAN rule."
NEW QUESTION # 65
Refer to the exhibit.
In a dual-hub hub-and-spoke SD-WAN deployment, which is a benefit of disabling theanti-replaysetting on the hubs?
- A. It instructs the hub to disable the reordering of TCP packets on behalf of the receiver, to improve performance.
- B. It instructs the hub to not check the ESP sequence numbers on IPsec traffic, to improve performance.
- C. It instructs the hub to disable TCP sequence number check, which is required for TCP sessions originated from spokes to fail over back and forth between the hubs.
- D. It instructs the hub to skip content inspection on TCP traffic, to improve performance.
Answer: C
NEW QUESTION # 66
Refer to the exhibit.
In a dual-hub hub-and-spoke SD-WAN deployment, which is a benefit of disabling the anti-replay setting on the hubs?
- A. It instructs the hub to disable the reordering of TCP packets on behalf of the receiver, to improve performance.
- B. It instructs the hub to not check the ESP sequence numbers on IPsec traffic, to improve performance.
- C. It instructs the hub to disable TCP sequence number check, which is required for TCP sessions originated from spokes to fail over back and forth between the hubs.
- D. It instructs the hub to skip content inspection on TCP traffic, to improve performance.
Answer: C
NEW QUESTION # 67
......
NSE7_SDW-7.2 Exam Dumps, Practice Test Questions BUNDLE PACK: https://validtorrent.prep4pass.com/NSE7_SDW-7.2_exam-braindumps.html
