Fortinet NSE7_SDW-7.2 Exam Questions Instant Access

Question 1

What are two advantages of using an IPsec recommended template to configure an IPsec tunnel in an hub-and-spoke topology? (Choose two.)

AIt ensures consistent settings between phase1 and phase2.

BIt guides the administrator to use Fortinet recommended settings.

CIt automatically install IPsec tunnels to every spoke when they are added to the FortiManager ADOM.

DThe VPN monitor tool provides additional statistics for tunnels defined with an IPsec recommended template.

Answer : A, B

The use of an IPsec recommended template offers the advantage of ensuring consistent settings between phase1 and phase2 (A), which is essential for the stability and security of the IPsec tunnel. Additionally, it guides the administrator to use Fortinet's recommended settings (B), which are designed to optimize performance and security based on Fortinet's best practices. Reference: The benefits of using IPsec recommended templates are outlined in Fortinet's SD-WAN documentation, which emphasizes the importance of consistency and adherence to recommended configurations.

Question 2

Refer to the exhibits.

Exhibit A shows the SD-WAN rule status and the learned BGP routes with community 65000:10.

Exhibit B shows the SD-WAN rule configuration, the BGP neighbor configuration, and the route map configuration.

The administrator wants to steer corporate traffic using routes tags in the SD-WAN rule ID 1.

However, the administrator observes that the corporate traffic does not match the SD-WAN rule ID 1.

Based on the exhibits, which configuration change is required to fix issue?

AIn the dc1-lan-rm route map configuration, set set-route-tag to 10.

BIn SD-WAN rule ID 1, change the destination to use ISDB entries.

CIn the dc1-lan-rm route map configuration, unset match-community.

DIn the BGP neighbor configuration, apply the route map dc1-lan-rm in the outbound direction.

Answer : A

Question 3

What are two common use cases for remote internet access (RIA)? (Choose two.)

AProvide direct internet access on spokes

BProvide internet access through the hub

CCentralize security inspection on the hub

DProvide thorough inspection on spokes

Answer : B, C

B . Provide internet access through the hub: This involves routing branch or remote office internet traffic through a central hub, ensuring consistent security policies and possibly better management of network resources.

C . Centralize security inspection on the hub: With this approach, all internet-bound traffic from various spokes is inspected at the hub, leveraging centralized security mechanisms for thorough inspection and policy enforcement.

Question 4

Refer to the exhibit.

The exhibit shows the SD-WAN rule status and configuration.

Based on the exhibit, which change in the measured packet loss will make T_INET_1_0 the new preferred member?

AWhen all three members have the same packet loss.

BWhen T_INET_0_0 has 4% packet loss.

CWhen T_INET_0_0 has 12% packet loss.

DWhen T_INET_1_0 has 4% packet loss.

Answer : A

Question 5

Refer to the exhibit.

An administrator is troubleshooting SD-WAN on FortiGate. A device behind branch1_fgt generates traffic to the 10.0.0.0/8 network. The administrator expects the traffic to match SD-WAN rule ID 1 and be routed over T_INET_0_0. However, the traffic is routed over T_INET_1_0.

Based on the output shown in the exhibit, which two reasons can cause the observed behavior? (Choose two.)

AThe traffic matches a regular policy route configured with T_INET_1_0 as the outgoing device.

BT_INET_1_0 has a lower route priority value (higher priority) than T_INET_0_0.

CT_INET_0_0 does not have a valid route to the destination.

DT_INET_1_0 has a higher member configuration priority than T_INET_0_0.

Answer : A, C

SD-WAN strategy is Lowest Cost (SLA) as indicated by the 'Mode(sla)' flag. Cost SLA uses SLA target, cost, and priority (i.e., interface preference - or order of config unless manually overridden by admin config) as the criteria -- in that order. Both members meet the target, both have 0 cost, and therefore member 3 (T_INET_0) wins the 'priority' tiebreaker. So if there is a valid route to the destination through member 3, it will win. The fact that it does not has nothing to do with the configured static route/member priority, which according to SG page 197 'is used as a tiebreaker for ECMP routes when matching implicit SD-WAN rule.'

Question 6

Refer to the exhibits.

Exhibit A

Exhibit B

Exhibit A shows an SD-WAN event log and exhibit B shows the member status and the SD-WAN rule configuration.

Based on the exhibits, which two statements are correct? (Choose two.)

AFortiGate updated the outgoing interface list on the rule so it prefers port2.

BPort2 has the highest member priority.

CPort2 has a lower latency than port1.

DSD-WAN rule ID 1 is set to lowest cost (SLA) mode.

Answer : A, C

Question 7

Which are two benefits of using CLI templates in FortiManager? (Choose two.)

AYou can reference meta fields.

BYou can configure interfaces as SD-WAN members without having to remove references first.

CYou can configure FortiManager to sync local configuration changes made on the managed device, to the CLI template.

DYou can configure advanced CLI settings.

Answer : A, D

Fortinet NSE 7 - SD-WAN 7.2 NSE7_SDW-7.2 Exam Questions