Fortinet NSE7_SDW-7.2 Online Practice Questions and Exam Preparation

Fortinet NSE7_SDW-7.2 Online Questions & Answers

• Question 91:

  Refer to the exhibits.

  

  Exhibit A shows the packet duplication rule configuration, the SD-WAN zone status output, and the sniffer output on FortiGate acting as the sender. Exhibit B shows the sniffer output on a FortiGate acting as the receiver.

  The administrator configured packet duplication on both FortiGate devices. The sniffer output on the sender FortiGate shows that FortiGate forwards an ICMP echo request packet over three overlays, but it only receives one reply packet

  through T_INET_1_0.

  Based on the output shown in the exhibits, which two reasons can cause the observed behavior? (Choose two.)

  A. On the receiver FortiGate,packet-de-duplicationis enabled.
  B. The ICMP echo request packets sent over T_INET_0_0 and T_MPLS_0 were dropped along the way.
  C. The ICMP echo request packets received over T_INET_0_0 and T_MPLS_0 were offloaded to NPU.
  D. On the sender FortiGate,duplication-max-numis set to3.
  A. On the receiver FortiGate,packet-de-duplicationis enabled.
  D. On the sender FortiGate,duplication-max-numis set to3.

• Question 92:

  Refer to the Exhibits: Exhibit A, which shows the SD-WAN performance SLA and exhibit B shows the health of the participating SD-WAN members. Based on the exhibits, which statement is correct?

  

  A. The dead member interface stays unavailable until an administrator manually brings the interface back.
  B. Port2 needs to wait 500 milliseconds to change the status from alive to dead.
  C. Static routes using port2 are active in the routing table.
  D. FortiGate has not received three consecutive requests from the SLA server configured for port2.
  C. Static routes using port2 are active in the routing table.

• Question 93:

  Which two statements about SLA targets and SD-WAN rules are true? (Choose two.)

  A. SD-WAN rules use SLA targets to check if the preferred members meet the SLA requirements
  B. Member metrics are measured only if an SLA target is configured
  C. When configuring an SD-WAN rule you can select multiple SLA targets of the same performance SLA
  D. SLA targets are used only by SD-WAN rules that are configured with Lowest Cost (SLA) or Maximize Bandwidth (SLA) as strategy
  A. SD-WAN rules use SLA targets to check if the preferred members meet the SLA requirements
  D. SLA targets are used only by SD-WAN rules that are configured with Lowest Cost (SLA) or Maximize Bandwidth (SLA) as strategy

• Question 94:

  What three characteristics apply to provisioning templates available on FortiManager? (Choose three.)

  A. You can apply a system template and a CLI template to the same FortiGate device.
  B. A CLI template can be of type CLI script or Perl script.
  C. A template group can include a system template and an SD-WAN template.
  D. A template group can contain CLI templates of both types.
  E. Templates are applied in order, from top to bottom.
  B. A CLI template can be of type CLI script or Perl script.
  D. A template group can contain CLI templates of both types.
  E. Templates are applied in order, from top to bottom.

• Question 95:

  Refer to the exhibit.

  

  The exhibit shows the BGP configuration on the hub in a hub-and-spoke topology. The administrator wants BGP to advertise prefixes from spokes to other spokes over the IPsec overlays, including additional paths. However, when looking at the spoke routing table, the administrator does not see the prefixes from other spokes and the additional paths.

  Based on the exhibit, which three settings must the administrator configure inside each BGP neighbor group so spokes can learn other spokes prefixes and their additional paths? (Choose three.)

  A. Setadditional-pathtosend
  B. Enableroute-reflector-client
  C. Setadvertisement-intervalto the number of additional paths to advertise
  D. Setadv-additional-pathto the number of additional paths to advertise
  E. Enablesoft-reconfiguration
  A. Setadditional-pathtosend
  B. Enableroute-reflector-client
  D. Setadv-additional-pathto the number of additional paths to advertise

• Question 96:

  Refer to the exhibit.

  

  Which statement about the role of the ADVPN device in handling traffic is true?

  A. This is a spoke that has received a query from a remote hub and has forwarded the response to its hub.
  B. Two hubs,10.0.1.101and10.0.2.101, are receiving and forwarding queries between each other.
  C. This is a hub that has received a query from a spoke and has forwarded it to another spoke.
  D. Two spokes,192.2.0.1and10.0.2.101, forward their queries to their hubs.
  C. This is a hub that has received a query from a spoke and has forwarded it to another spoke.

• Question 97:

  Refer to the exhibit.

  

  Two hub-and-spoke groups are connected through a site-to-site IPsec VPN between Hub 1 and Hub 2.

  Which two configuration settings are required for Toronto and London spokes to establish an ADVPN shortcut? (Choose two.)

  A. On the hubs,auto-discovery-sendermust be enabled on the IPsec VPNs to spokes.
  B. On the spokes,auto-discovery-receivermust be enabled on the IPsec VPN to the hub.
  C. auto-discovery-forwardermust be enabled on all IPsec VPNs.
  D. On the hubs,net-devicemust be enabled on all IPsec VPNs.
  A. On the hubs,auto-discovery-sendermust be enabled on the IPsec VPNs to spokes.
  B. On the spokes,auto-discovery-receivermust be enabled on the IPsec VPN to the hub.

• Question 98:

  Which two statements describe how IPsec phase 1 main mode is different from aggressive mode when performing IKE negotiation? (Choose two )

  A. A peer ID is included in the first packet from the initiator, along with suggested security policies.
  B. XAuth is enabled as an additional level of authentication, which requires a username and password.
  C. A total of six packets are exchanged between an initiator and a responder instead of three packets.
  D. The use of Diffie Hellman keys is limited by the responder and needs initiator acceptance.
  B. XAuth is enabled as an additional level of authentication, which requires a username and password.
  C. A total of six packets are exchanged between an initiator and a responder instead of three packets.

• Question 99:

  What are two reasons for using FortiManager to organize and manage the network for a group of FortiGate devices? (Choose two.)

  A. It simplifies the deployment and administration of SD-WAN on managed FortiGate devices.
  B. It improves SD-WAN performance on the managed FortiGate devices.
  C. It sends probe signals as health checks to the beacon servers on behalf of FortiGate.
  D. It acts as a policy compliance entity to review all managed FortiGate devices.
  E. It reduces WAN usage on FortiGate devices by acting as a local FortiGuard server.
  A. It simplifies the deployment and administration of SD-WAN on managed FortiGate devices.
  E. It reduces WAN usage on FortiGate devices by acting as a local FortiGuard server.