Fortinet NSE7_SDW-7.2 Online Practice Questions and Exam Preparation

Fortinet NSE7_SDW-7.2 Online Questions & Answers

• Question 1:

  What does enabling theexchange-interface-ipsetting enable FortiGate devices to exchange?

  A. The gateway address of their IPsec interfaces
  B. The tunnel ID of their IPsec interfaces
  C. The IP address of their IPsec interfaces
  D. The name of their IPsec interfaces
  C. The IP address of their IPsec interfaces

• Question 2:

  Refer to the exhibits.

  

  

  Exhibit A shows the SD-WAN rule status and the learned BGP routes with community 65000:10.

  Exhibit B shows the SD-WAN rule configuration, the BGP neighbor configuration, and the route map configuration.

  The administrator wants to steer corporate traffic using routes tags in the SD-WAN rule ID 1.

  However, the administrator observes that the corporate traffic does not match the SD-WAN rule ID 1.

  Based on the exhibits, which configuration change is required to fix issue?

  A. In the dc1-lan-rm route map configuration, set set-route-tag to 10.
  B. In SD-WAN rule ID 1, change the destination to use ISDB entries.
  C. In the dc1-lan-rm route map configuration, unset match-community.
  D. In the BGP neighbor configuration, apply the route map dc1-lan-rm in the outbound direction.
  A. In the dc1-lan-rm route map configuration, set set-route-tag to 10.

• Question 3:

  Refer to the exhibit.

  

  FortiGate has multiple dial-up VPN interfaces incoming on port1 that match only FIRST_VPN.

  Which two configuration changes must be made to both IPsec VPN interfaces to allow incoming connections to match all possible IPsec dial-up interfaces? (Choose two.)

  A. Specify a unique peer ID for each dial-up VPN interface.
  B. Use different proposals are used between the interfaces.
  C. Configure the IKE mode to be aggressive mode.
  D. Use unique Diffie Hellman groups on each VPN interface.
  A. Specify a unique peer ID for each dial-up VPN interface.
  C. Configure the IKE mode to be aggressive mode.

• Question 4:

  Refer to the exhibit.

  

  Based on the exhibit, which statement about FortiGate re-evaluating traffic is true?

  A. The type of traffic defined and allowed on firewall policy ID 1 is UDP.
  B. FortiGate has terminated the session after a change on policy ID 1.
  C. Changes have been made on firewall policy ID 1 on FortiGate.
  D. Firewall policy ID 1 has source NAT disabled.
  C. Changes have been made on firewall policy ID 1 on FortiGate.

• Question 5:

  Which statement is correct about SD-WAN and ADVPN?

  A. Routes for ADVPN shortcuts must be manually configured.
  B. SD-WAN can steer traffic to ADVPN shortcuts, established over IPsec overlays, configured as SD-WAN members.
  C. SD-WAN does not monitor the health and performance of ADVPN shortcuts.
  D. You must use IKEv2 on IPsec tunnels.
  B. SD-WAN can steer traffic to ADVPN shortcuts, established over IPsec overlays, configured as SD-WAN members.

• Question 6:

  Which two statements describe how IPsec phase 1 main mode id different from aggressive mode when performing IKE negotiation? (Choose two.)

  A. A peer ID is included in the first packet from the initiator, along with suggested security policies.
  B. XAuth is enabled as an additional level of authentication, which requires a username and password.
  C. Three packets are exchanged between an initiator and a responder instead of six packets.
  D. The use of Diffie Hellman keys is limited by the responder and needs initiator acceptance.
  A. A peer ID is included in the first packet from the initiator, along with suggested security policies.
  C. Three packets are exchanged between an initiator and a responder instead of six packets.

• Question 7:

  Refer to the exhibit.

  

  The exhibit shows the SD-WAN rule status and configuration.

  Based on the exhibit, which change in the measured packet loss will make T_INET_1_0 the new preferred member?

  A. When all three members have the same packet loss.
  B. When T_INET_0_0 has 4% packet loss.
  C. When T_INET_0_0 has 12% packet loss.
  D. When T_INET_1_0 has 4% packet loss.
  A. When all three members have the same packet loss.

• Question 8:

  Which diagnostic command can you use to show the SD-WAN rules interface information and state?

  A. diagnose sys virtual-wan-link route-tag-list.
  B. diagnose sys virtual-wan-link service.
  C. diagnose sys virtual-wan-link member.
  D. diagnose sys virtual-wan-link neighbor.
  B. diagnose sys virtual-wan-link service.

• Question 9:

  Which two statements about SD-WAN central management are true? (Choose two.)

  A. It does not allow you to monitor the status of SD-WAN members.
  B. It is enabled or disabled on a per-ADOM basis.
  C. It is enabled by default.
  D. It uses templates to configure SD-WAN on managed devices.
  B. It is enabled or disabled on a per-ADOM basis.
  D. It uses templates to configure SD-WAN on managed devices.

• Question 10:

  Refer to the exhibit.

  

  The exhibit shows VPN event logs on FortiGate. In the output shown in the exhibit, which statement is true?

  A. There are no IPsec tunnel statistics log messages for ADVPN cuts.
  B. There is one shortcut tunnel built from master tunnel T_MPLS_0.
  C. The VPN tunnel T_MPLS_0 is a shortcut tunnel.
  D. The master tunnel T_INET_0 cannot accept the ADVPN shortcut.
  C. The VPN tunnel T_MPLS_0 is a shortcut tunnel.