Fortinet Fortinet Certifications NSE7_SDW-7.0 Questions & Answers

• Question 51:

  What would best describe the SD-WAN traffic shaping mode that bases itself on a percentage of available bandwidth?

  A. Per-IP shaping mode

  B. Reverse policy shaping mode

  C. Interface-based shaping mode

  D. Shared policy shaping mode

  Correct Answer: C

  SD-WAN 6.4.5 Study Guide. pg 124

• Question 52:

  Refer to the exhibits. Exhibit A:

  

  Exhibit B:

  

  Exhibit A shows the SD-WAN rules and exhibit B shows the traffic logs. The SD-WAN traffic logs reflect how FortiGate distributes traffic. Based on the exhibits, what are two expected behaviors when FortiGate processes SD-WAN traffic? (Choose two.)

  A. The first Vimeo session may not match the Vimeo SD-WAN rule because the session is used for the application learning phase.

  B. The implicit rule overrides all other rules because parameters widely cover sources and destinations.

  C. The Vimeo SD-WAN rule steers Vimeo application traffic among all SD-WAN member interfaces.

  D. SD-WAN rules are evaluated in the same way as firewall policies: from top to bottom.

  Correct Answer: AD

• Question 53:

  Refer to the exhibit.

  Multiple IPsec VPNs are formed between two hub-and-spokes groups, and site-to-site between Hub 1 and Hub 2 The administrator configured ADVPN on the dual regions topology

  

  Which two statements are correct if a user in Toronto sends traffic to London? (Choose two )

  A. Toronto needs to establish a site-to-site tunnel with Hub 2 to bypass Hub 1.

  B. The first packets from Toronto to London are routed through Hub 1 then to Hub 2.

  C. London generates an IKE information message that contains the Toronto public IP address.

  D. Traffic from Toronto to London triggers the dynamic negotiation of a direct site-to-site VPN.

  Correct Answer: BD

  SD-WAN_6.4_Study_Guide page 207

• Question 54:

  What are two reasons for using FortiManager to organize and manage the network for a group of FortiGate devices? (Choose two )

  A. It simplifies the deployment and administration of SD-WAN on managed FortiGate devices.

  B. It improves SD-WAN performance on the managed FortiGate devices.

  C. It sends probe signals as health checks to the beacon servers on behalf of FortiGate.

  D. It acts as a policy compliance entity to review all managed FortiGate devices.

  E. It reduces WAN usage on FortiGate devices by acting as a local FortiGuard server.

  Correct Answer: AE

• Question 55:

  Refer to exhibits

  

  Exhibit A shows the system interface with the static routes and exhibit B shows the firewall policies on the managed FortiGate

  Based on the FortiGate configuration shown in the exhibits, what are two issues you might encounter when creating an SD-WAN interface on port1 and port2? {Choose two )

  A. Member interfaces that are administratively down

  B. Member interface that have IP address of 0.0.0.0/0.0.0.0

  C. Member interfaces that are physical interfaces as well as VLAN aggregate, and iPsec interfaces

  D. Member interfaces that are referenced by any other configuration element

  Correct Answer: AD

• Question 56:

  Which diagnostic command can you use to show the SD-WAN rules interface information and state?

  A. diagnose sys sdwan route-tag-list.

  B. diagnose sys sdwan service.

  C. diagnose sys sdwan member.

  D. diagnose sys sdwan neighbor.

  Correct Answer: B

  https://community.fortinet.com/t5/FortiGate/Technical-Tip-Diagnostic-commands-to-check-the-status-of-the-SD/ta-p/194246

• Question 57:

  Refer to the exhibit.

  

  Which conclusion about the packet debug flow output is correct?

  A. The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.

  B. The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the firewall policy, and the packet was dropped.

  C. The packet size exceeded the outgoing interface MTU.

  D. The total number of daily sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.

  Correct Answer: A

• Question 58:

  Refer to the exhibit.

  

  Which two statements about the debug output are true? (Choose two)

  A. The debug output shows per-IP shaper values and real-time readings.

  B. FortiGate provides statistics and reading based on historical traffic logs.

  C. Traffic being controlled by the traffic shaper is under 100 KB/s.

  D. This traffic shaper drops traffic that exceeds the set limits.

  Correct Answer: AD

• Question 59:

  Which feature enables SD-WAN to combine IPsec VPN dynamic shortcut tunnels between spokes and a static tunnel to the hub?

  A. ADVPN

  B. GRE

  C. SSLVPN

  D. OCVPN

  Correct Answer: A

• Question 60:

  Refer to Exhibit:

  

  Based on the exhibit, which algorithm does SD-WAN use to distribute traffic that does not match any of the SD-WAN rules, among the member interfaces?

  A. All traffic from a source IP to a destination IP Is sent to the same interface.

  B. All traffic from a source IP Is sent to the most used Interface.

  C. All traffic from a source IP to a destination IP is sent to the least used interface.

  D. All traffic from a source IP is sent to the same interfaces.

  Correct Answer: A