Fortinet Fortinet Certifications NSE7_SDW-7.0 Questions & Answers

• Question 11:

  What is the lnkmtd process responsible for?

  A. Monitoring links for any bandwidth saturation

  B. Processing performance SLA probes

  C. Flushing route tags addresses

  D. Logging interface quality information

  Correct Answer: B

• Question 12:

  Which diagnostic command you can use to show interface-specific SLA logs for the last 10 minutes?

  A. diagnose sys virtual-wan-link health-check

  B. diagnose sys virtual-wan-link log

  C. diagnose sys virtual-wan-link sla-log

  D. diagnose sys virtual-wan-link intf-sla-log

  Correct Answer: C

  Reference: https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/943037/sla-logging https://community.fortinet.com/t5/FortiGate/Technical-Tip-SLA-Logging/ta-p/190934

• Question 13:

  Which two statements reflect the benefits of implementing the ADVPN solution to replace conventional VPN topologies? (Choose two )

  A. It creates redundant tunnels between hub-and-spokes, in case failure takes place on the primary links.

  B. It dynamically assigns cost and weight between the hub and the spokes, based on the physical distance.

  C. It ensures that spoke-to-spoke traffic no longer needs to flow through the tunnels through the hub.

  D. It provides direct connectivity between all sites by creating on-demand tunnels between spokes.

  Correct Answer: CD

• Question 14:

  Which statement about using BGP routes in SD-WAN is true?

  A. Learned routes can be used as dynamic destinations in SD-WAN rules.

  B. You must use BGP to route traffic for both overlay and underlay links.

  C. You must configure AS path prepending.

  D. You must use external BGP.

  Correct Answer: A

• Question 15:

  Refer to the exhibit.

  

  Based on the exhibit, which status description is correct?

  A. Port1 is dead because it does not meet the SLA target.

  B. Port2 is alive because its packet loss is lower than 10%.

  C. The SD-WAN members are monitored by different performance SLAs.

  D. Traffic matching the SD-WAN rule is steered through port2.

  Correct Answer: D

• Question 16:

  Refer to the exhibits.

  

  

  ExhibitA shows the system interface with the static routes and exhibit B shows the firewall policies on the managed FortiGate.

  Based on the FortiGate configuration shown in the exhibits, what issue might you encounter when creating an SD-WAN zone for port1 and port2?

  A. port2 is referenced in a static route.

  B. port1 is assigned a manual IP address.

  C. port1 and port2 are not administratively down.

  D. port1 is referenced in a firewall policy.

  Correct Answer: D

• Question 17:

  Which statement is correct about SD-WAN and ADVPN?

  A. You must use OSPF.

  B. SD-WAN can steer traffic to ADVPN shortcuts established over IPsec overlays configured as SD-WAN members.

  C. Routes for ADVPN shortcuts must be manually configured.

  D. SD-WAN does not monitor the health and performance of ADVPN shortcuts.

  Correct Answer: B

• Question 18:

  Refer to the exhibit.

  

  Which two conclusions for traffic that matches the traffic shaper are true? (Choose two.)

  A. The traffic shaper drops packets if the bandwidth exceeds 6250 KBps.

  B. The traffic shaper limits the bandwidth of each source IP to a maximum of 6250 KBps.

  C. The traffic shaper drops packets if the bandwidth is less than 2500 KBps.

  D. The measured bandwidth is less than 100 KBps.

  Correct Answer: AD

• Question 19:

  Refer to exhibits.

  

  

  Exhibit A shows the firewall policy and exhibit B shows the traffic shaping policy.

  The traffic shaping policy is being applied to all outbound traffic; however, inbound traffic is not being evaluated by the shaping policy.

  Based on the exhibits, what configuration change must be made in which policy so that traffic shaping can be applied to inbound traffic?

  A. The reverse shaper option must be enabled and a traffic shaper must be selected

  B. The guaranteed-10mbps option must be selected as the reverse shaper option.

  C. A new firewall policy must be created and SD-WAN must be selected as the incoming interface.

  D. The guaranteed-10mbps option must be selected as the per-IP shaper option

  Correct Answer: A

• Question 20:

  Refer to the exhibit.

  

  Multiple IPsec VPNs are formed between two hub-and-spokes groups, and site-to-site between Hub 1 and Hub 2 The administrator configured ADVPN on the dual regions topology

  Which two statements are correct if a dynamic site-to-site tunne1 between Toronto and London has been established? (Choose two)

  A. auto-discovery-receiver is enabled on the egress VPN interfaces on the spokes

  B. auto-discovery-sender is enabled on the ingress VPN interfaces on hubs

  C. tunnel-search IS set to phase 2 quick mode selectors

  D. add-route is enabled to install static routes on hub devices

  E. auto-discovery-forwarder IS enabled on all VPN interfaces

  Correct Answer: AB