Fortinet Fortinet Certifications NSE7_SDW-6.4 Questions & Answers

• Question 61:

  Which diagnostic command can you use to show the SD-WAN rules interface information and state?

  A. diagnose sys sdwan route-tag-list.

  B. diagnose sys sdwan service.

  C. diagnose sys sdwan member.

  D. diagnose sys sdwan neighbor.

  Correct Answer: B

  https://community.fortinet.com/t5/FortiGate/Technical-Tip-Diagnostic-commands-to-check-the-status-of-the-SD/ta-p/194246

• Question 62:

  What are two reasons for using FortiManager to organize and manage the network for a group of FortiGate devices? (Choose two )

  A. It simplifies the deployment and administration of SD-WAN on managed FortiGate devices.

  B. It improves SD-WAN performance on the managed FortiGate devices.

  C. It sends probe signals as health checks to the beacon servers on behalf of FortiGate.

  D. It acts as a policy compliance entity to review all managed FortiGate devices.

  E. It reduces WAN usage on FortiGate devices by acting as a local FortiGuard server.

  Correct Answer: AE

• Question 63:

  Refer to exhibits

  

  Exhibit A shows the system interface with the static routes and exhibit B shows the firewall policies on the managed FortiGate

  Based on the FortiGate configuration shown in the exhibits, what are two issues you might encounter when creating an SD-WAN interface on port1 and port2? {Choose two )

  A. Member interfaces that are administratively down

  B. Member interface that have IP address of 0.0.0.0/0.0.0.0

  C. Member interfaces that are physical interfaces as well as VLAN aggregate, and iPsec interfaces

  D. Member interfaces that are referenced by any other configuration element

  Correct Answer: AD

• Question 64:

  Refer to the exhibit.

  Multiple IPsec VPNs are formed between two hub-and-spokes groups, and site-to-site between Hub 1 and Hub 2 The administrator configured ADVPN on the dual regions topology

  

  Which two statements are correct if a user in Toronto sends traffic to London? (Choose two )

  A. Toronto needs to establish a site-to-site tunnel with Hub 2 to bypass Hub 1.

  B. The first packets from Toronto to London are routed through Hub 1 then to Hub 2.

  C. London generates an IKE information message that contains the Toronto public IP address.

  D. Traffic from Toronto to London triggers the dynamic negotiation of a direct site-to-site VPN.

  Correct Answer: BD

  SD-WAN_6.4_Study_Guide page 207

• Question 65:

  What would best describe the SD-WAN traffic shaping mode that bases itself on a percentage of available bandwidth?

  A. Per-IP shaping mode

  B. Reverse policy shaping mode

  C. Interface-based shaping mode

  D. Shared policy shaping mode

  Correct Answer: C

  SD-WAN 6.4.5 Study Guide. pg 124

• Question 66:

  Refer to the exhibits. Exhibit A:

  

  Exhibit B:

  

  Exhibit A shows the SD-WAN rules and exhibit B shows the traffic logs. The SD-WAN traffic logs reflect how FortiGate distributes traffic. Based on the exhibits, what are two expected behaviors when FortiGate processes SD-WAN traffic? (Choose two.)

  A. The first Vimeo session may not match the Vimeo SD-WAN rule because the session is used for the application learning phase.

  B. The implicit rule overrides all other rules because parameters widely cover sources and destinations.

  C. The Vimeo SD-WAN rule steers Vimeo application traffic among all SD-WAN member interfaces.

  D. SD-WAN rules are evaluated in the same way as firewall policies: from top to bottom.

  Correct Answer: AD

• Question 67:

  Which three performance SLA protocols are available on the FortiGate CLI only? (Choose three.)

  A. tcp-echo

  B. icmp

  C. twamp

  D. udp-echo

  E. smtp

  Correct Answer: ACD

  Command output from a fortigate:

  FW-01 (test-health-check) # set protocol

  ping Use PING to test the link with the server.

  tcp-echo Use TCP echo to test the link with the server. udp-echo Use UDP echo to test the link with the server. http Use HTTP-GET to test the link with the server. twamp Use TWAMP to test the link with the server. dns Use DNS query to test

  the link with the server. tcp-connect Use a full TCP connection to test the link with the server.

  ftp Use FTP to test the link with the server.

• Question 68:

  Refer to exhibits.

  

  Exhibit A, which shows the SD-WAN performance SLA and exhibit B shows the health of the participating SD-WAN members.

  Based on the exhibits, which statement is correct?

  A. The dead member interface stays unavailable until an administrator manually brings the interface back.

  B. Port2 needs to wait 500 milliseconds to change the status from alive to dead.

  C. Static routes using port2 are active in the routing table.

  D. FortiGate has not received three consecutive requests from the SLA server configured for port2.

  Correct Answer: D

• Question 69:

  Refer to the exhibits.

  

  Exhibit A shows the SD-WAN performance SLA and exhibit B shows the SD-WAN member and the static routes configuration. If port2 is detected dead by FortiGate, which expected behavior is correct?

  A. Port2 becomes alive after one successful probe is detected.

  B. The SD-WAN interface becomes disabled and port1 becomes the WAN interface.

  C. Dead members require manual administrator access to bring them back alive.

  D. Subnets 10.0.20.0/23 and 172.20.0.0/16 are reachable only through port1.

  Correct Answer: D

• Question 70:

  Refer to exhibits.

  

  

  Exhibit A shows the SD-WAN rules and exhibit B shows the traffic logs. The SD-WAN traffic logs reflect how FortiGate processed traffic. Which two statements about how the configured SD-WAN rules are processing traffic are true? (Choose two.)

  A. The implicit rule overrides all other rules because parameters widely cover sources and destinations.

  B. SD-WAN rules are evaluated in the same way as firewall policies: from top to bottom.

  C. The All_Access_Rules rule load balances Vimeo application traffic among SD-WAN member interfaces.

  D. The initial session of an application goes through a learning phase in order to apply the correct rule.

  Correct Answer: BD