Fortinet NSE7_SDW-7.0 Online Practice Questions and Exam Preparation

Fortinet NSE7_SDW-7.0 Online Questions & Answers

• Question 21:

  What are two reasons why it is effective to implement the internet service database (ISDB) in an SD-WAN rule? (Choose two )

  A. The ISDB is dynamically updated and reduces administrative overhead.
  B. The ISDB applies rules to traffic from specific sources, based on application type.
  C. The ISDB requires application control to maintain signatures and perform load-balancing.
  D. The ISDB contains the IP addresses and port ranges of well-known destinations.
  A. The ISDB is dynamically updated and reduces administrative overhead.
  D. The ISDB contains the IP addresses and port ranges of well-known destinations.

  ---

  Explanation/Reference:

• Question 22:

  What are two reasons why FortiGate would be unable to complete the zero-touch provisioning process? (Choose two.)

  A. The FortiGate cloud key has not been added to the FortiGate cloud portal.
  B. FortiDeploy has connected with FortiGate and provided the initial configuration to contact FortiManager
  C. The zero-touch provisioning process has completed internally, behind FortiGate.
  D. FortiGate has obtained a configuration from the platform template in FortiGate cloud.
  E. A factory reset performed on FortiGate.
  A. The FortiGate cloud key has not been added to the FortiGate cloud portal.
  C. The zero-touch provisioning process has completed internally, behind FortiGate.

• Question 23:

  Refer to the exhibit.

  

  Which configuration change is required if the responder FortiGate uses a dynamic routing protocol to exchange routes over IPsec?

  A. type must be set to static.
  B. mode-cfg must be enabled.
  C. exchange-interface-ip must be enabled.
  D. add-route must be disabled.
  D. add-route must be disabled.

  ---

  Explanation/Reference:

  for using "non ike" routes (for example BGP/static and so on) you must do disable the add-route that inject automatically kernel route based on p2 selectors from the remote site from the SD-WAN_7.2_Study_Guide page 236

• Question 24:

  What would best describe the SD-WAN traffic shaping mode that bases itself on a percentage of available bandwidth?

  A. Per-IP shaping mode
  B. Reverse policy shaping mode
  C. Interface-based shaping mode
  D. Shared policy shaping mode
  C. Interface-based shaping mode

  ---

  Explanation/Reference:

  SD-WAN 6.4.5 Study Guide. pg 124

• Question 25:

  What are two reasons why FortiGate would be unable to complete the zero-touch provisioning process? (Choose two.)

  A. The FortiGate cloud key has not been added to the FortiGate cloud portal.
  B. FortiDeploy has connected with FortiGate and provided the initial configuration to contact FortiManager
  C. The zero-touch provisioning process has completed internally, behind FortiGate.
  D. FortiGate has obtained a configuration from the platform template in FortiGate cloud.
  E. A factory reset performed on FortiGate.
  A. The FortiGate cloud key has not been added to the FortiGate cloud portal.
  C. The zero-touch provisioning process has completed internally, behind FortiGate.

• Question 26:

  Refer to the exhibits. Exhibit A

  

  Exhibit B

  

  Exhibit A shows the SD-WAN performance SLA and exhibit B shows the SD-WAN member status, the routing table, and the performance SLA status. If port2 is detected dead by FortiGate, what is the expected behavior?

  A. Port2 becomes alive after three successful probes are detected.
  B. FortiGate removes all static routes for port2.
  C. The administrator manually restores the static routes for port2, if port2 becomes alive.
  D. Host 8.8.8.8 is reachable through port1 and port2.
  B. FortiGate removes all static routes for port2.

  ---

  Explanation/Reference:

  This is due to Update static route is enable which removes the static route entry referencing the interface if the interface is dead

• Question 27:

  What is the lnkmtd process responsible for?

  A. Monitoring links for any bandwidth saturation
  B. Processing performance SLA probes
  C. Flushing route tags addresses
  D. Logging interface quality information
  B. Processing performance SLA probes

• Question 28:

  Which two performance SLA protocols enable you to verify that the server response contains a specific value? (Choose two.)

  A. http
  B. icmp
  C. twamp
  D. dns
  A. http
  D. dns

• Question 29:

  Refer to the exhibit.

  

  Two hub-and-spoke groups are connected through a site-to-site IPsec VPN between Hub 1 and Hub 2. The administrator configured ADVPN on both hub-and-spoke groups.

  Which two outcomes are expected if a user in Toronto sends traffic to London? (Choose two.)

  A. London generates an IKE information message that contains the Toronto public IP address.
  B. Traffic from Toronto to London triggers the dynamic negotiation of a direct site-to-site VPN.
  C. Toronto needs to establish a site-to-site tunnel with Hub 2 to bypass Hub 1.
  D. The first packets from Toronto to London are routed through Hub 1 then to Hub 2.
  B. Traffic from Toronto to London triggers the dynamic negotiation of a direct site-to-site VPN.
  D. The first packets from Toronto to London are routed through Hub 1 then to Hub 2.

  ---

  Explanation/Reference:

• Question 30:

  Refer to exhibits

  

  Exhibit A shows the system interface with the static routes and exhibit B shows the firewall policies on the managed FortiGate

  Based on the FortiGate configuration shown in the exhibits, what are two issues you might encounter when creating an SD-WAN interface on port1 and port2? {Choose two )

  A. Member interfaces that are administratively down
  B. Member interface that have IP address of 0.0.0.0/0.0.0.0
  C. Member interfaces that are physical interfaces as well as VLAN aggregate, and iPsec interfaces
  D. Member interfaces that are referenced by any other configuration element
  A. Member interfaces that are administratively down
  D. Member interfaces that are referenced by any other configuration element