Fortinet Fortinet Certifications NSE7_SDW-7.0 Questions & Answers

• Question 21:

  Refer to the exhibit.

  

  Which are two expected behaviors of the traffic that matches the traffic shaper? (Choose two.)

  A. The traffic shaper limits the bandwidth of each source IP address to a maximum of 625 KB/sec.

  B. The number of simultaneous connections among all source IP addresses can exceed 5 connections.

  C. The number of simultaneous connections allowed for each source IP address can exceed 5 connections.

  D. The traffic shaper limits the combined bandwidth of all connections to a maximum of 5 MB/sec.

  Correct Answer: AB

• Question 22:

  In which two ways does FortiGate learn the FortiManager IP address or FQDN for zero-touch provisioning? (Choose two.)

  A. From a FortiGuard definitions update

  B. From the central management configuration configured in FortiDeploy

  C. From a DHCP server configured with options 240 or 241

  D. From another FortiGate device in the same local network

  Correct Answer: BC

  https://www.historiantech.com/zeroish-touch-provisioning-with-fortimanager-explained/

• Question 23:

  What are two roles that SD-WAN orchestrator plays when it works with FortiManager? (Choose two )

  A. It configures and monitors SD-WAN networks on FortiGate devices that are managed by FortiManager.

  B. It acts as a standalone device to assist FortiManager to manage SD-WAN interfaces on the managed FortiGate devices.

  C. It acts as a hub FortiGate with an SD-WAN interface enabled and managed along with other FortiGate devices by FortiManager.

  D. It acts as an application that is released and signed by Fortinet to run as a part of management extensions on FortiManager.

  Correct Answer: AD

  SD-WAN 6.4 Guide Page 158. https://docs2.fortinet.com/document/fortimanager/6.4.0/sd-wan-orchestrator-6-4-0-administration-guide/91581/introduction

• Question 24:

  Refer to exhibits. Exhibit A.

  

  Exhibit B.

  

  Exhibit A shows the SD-WAN performance SLA and exhibit B shows the SO-WAN interface and the static routes configuration. Port1 and port2 are member interfaces of the SD-WAN, and port2 becomes a dead member after reaching the failure thresholds Which statement about the dead member is correct?

  A. Subnets 100 .64.1.0/23 and 172 . 20 . 0. 0/16 are reachable only through port1

  B. SD-WAN interface becomes disabled and port1 becomes the WAN interface

  C. Dead members require manual administrator access to bring them back alive

  D. Port2 might become alive when a single response is received from an SLA server

  Correct Answer: A

• Question 25:

  Refer to the exhibit.

  

  Based on the output, which two statements are true? (Choose two )

  A. The diagnostic output presents only of the policy routes

  B. The all_rules rule is the implicit SD-WAN rule in place

  C. There is more than one SD-WAN rule configured

  D. At least one policy route is implemented and in effect

  Correct Answer: AC

• Question 26:

  Which CLI command do you use to perform real-time troubleshooting for ADVPN negotiation?

  A. diagnose sys virtual-wan-link service

  B. get router info routing-table

  C. diagnose debug application ike

  D. get ipsec tunnel list

  Correct Answer: C

• Question 27:

  Refer to Exhibit:

  

  Which statement is correct it the responder FortiGate is using a dynamic routing protocol over the IPsec VPN interface?

  A. The phase 1 type must be changed to static for dynamic routing.

  B. Only dial-up connections without XAuth can be used for the dynamic routing

  C. add-route must be disabled to prevent FortiGate from installing VPN static routes

  D. peertype must be set to accept only one peer ID for a unique VPN interface

  Correct Answer: C

• Question 28:

  Which two protocols in the IPsec suite are most used for authentication and encryption? (Choose two)

  A. Secure Shell (SSH)

  B. Encapsulating Security Payload (ESP)

  C. Internet Key Exchange (IKE)

  D. Transport Layer Security (TLS)

  E. Security Association (SA)

  Correct Answer: BC

• Question 29:

  Which diagnostic command can you use to show the SD-WAN rules interface information and state?

  A. diagnose sys virtual-wan-link neighbor.

  B. diagnose sys virtual--wan--link route-tag-list

  C. diagnose sys virtual--wan--link member.

  D. diagnose sys virtual-wan-link service

  Correct Answer: D

  Reference: https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/818746/sd-wan-related-diagnose-commands

• Question 30:

  Which action FortiGate performs on traffic that is subject to a per-IP traffic shaper of 10 Mbps?

  A. FortiGate shares 10 Mbps of bandwidth equally among all source IP addresses.

  B. FortiGate applies traffic shaping to the original traffic direction only.

  C. FortiGate limits each source IP address to a maximum bandwidth of 10 Mbps.

  D. FortiGate guarantees a minimum of 10 Mbps of bandwidth to each source IP address.

  Correct Answer: C