Fortinet Fortinet Certifications NSE7_SDW-7.0 Questions & Answers

• Question 101:

  Which best describes the SD-WAN traffic shaping mode that bases itself on a percentage of available bandwidth?

  A. Interface-based shaping mode

  B. Reverse-policy shaping mode

  C. Shared-policy shaping mode

  D. Per-IP shaping mode

  Correct Answer: A

  Interface-based shaping goes further, enabling traffic controls based on percentage of the interface bandwidth.

• Question 102:

  Which two statements describe how IPsec phase 1 main mode is different from aggressive mode when performing IKE negotiation? (Choose two )

  A. A peer ID is included in the first packet from the initiator, along with suggested security policies.

  B. XAuth is enabled as an additional level of authentication, which requires a username and password.

  C. A total of six packets are exchanged between an initiator and a responder instead of three packets.

  D. The use of Diffie Hellman keys is limited by the responder and needs initiator acceptance.

  Correct Answer: AC

• Question 103:

  What are two reasons for using FortiManager to organize and manage the network for a group of FortiGate devices? (Choose two )

  A. It simplifies the deployment and administration of SD-WAN on managed FortiGate devices.

  B. It improves SD-WAN performance on the managed FortiGate devices.

  C. It sends probe signals as health checks to the beacon servers on behalf of FortiGate.

  D. It acts as a policy compliance entity to review all managed FortiGate devices.

  E. It reduces WAN usage on FortiGate devices by acting as a local FortiGuard server.

  Correct Answer: AE

• Question 104:

  Refer to the exhibit.

  

  Which algorithm does SD-WAN use to distribute traffic that does not match any of the SD- WAN rules?

  A. All traffic from a source IP to a destination IP is sent to the same interface.

  B. All traffic from a source IP is sent to the same interface.

  C. All traffic from a source IP is sent to the most used interface.

  D. All traffic from a source IP to a destination IP is sent to the least used interface.

  Correct Answer: A

• Question 105:

  Which two protocols in the IPsec suite are most used for authentication and encryption? (Choose two.)

  A. Encapsulating Security Payload (ESP)

  B. Secure Shell (SSH)

  C. Internet Key Exchange (IKE)

  D. Security Association (SA)

  Correct Answer: AC

• Question 106:

  What are two reasons why FortiGate would be unable to complete the zero-touch provisioning process? (Choose two.)

  A. The FortiGate cloud key has not been added to the FortiGate cloud portal.

  B. FortiDeploy has connected with FortiGate and provided the initial configuration to contact FortiManager

  C. The zero-touch provisioning process has completed internally, behind FortiGate.

  D. FortiGate has obtained a configuration from the platform template in FortiGate cloud.

  E. A factory reset performed on FortiGate.

  Correct Answer: AC

• Question 107:

  In a hub-and-spoke topology, what are two advantages of enabling ADVPN on the IPsec overlays? (Choose two.)

  A. It provides the benefits of a full-mesh topology in a hub-and-spoke network.

  B. It provides direct connectivity between spokes by creating shortcuts.

  C. It enables spokes to bypass the hub during shortcut negotiation.

  D. It enables spokes to establish shortcuts to third-party gateways.

  Correct Answer: AB

• Question 108:

  Which CLI command do you use to perform real-time troubleshooting for ADVPN negotiation?

  A. get router info routing-table all

  B. diagnose debug application ike

  C. diagnose vpn tunnel list

  D. get ipsec tunnel list

  Correct Answer: B

• Question 109:

  Refer to the exhibits.

  Exhibit A

  

  Exhibit B

  

  Exhibit A shows the configuration for an SD-WAN rule and exhibit B shows the respective rule status, the routing table, and the member status.

  The administrator wants to understand the expected behavior for traffic matching the SD- WAN rule.

  Based on the exhibits, what can the administrator expect for traffic matching the SD-WAN rule?

  A. The traffic will be load balanced across all three overlays.

  B. The traffic will be routed over T_INET_0_0.

  C. The traffic will be routed over T_MPLS_0.

  D. The traffic will be routed over T_INET_1_0.

  Correct Answer: D

• Question 110:

  What is the route-tag setting in an SD-WAN rule used for?

  A. To indicate the routes for health check probes.

  B. To indicate the destination of a rule based on learned BGP prefixes.

  C. To indicate the routes that can be used for routing SD-WAN traffic.

  D. To indicate the members that can be used to route SD-WAN traffic.

  Correct Answer: B