NSE7_SDW-7.2 Practice Questions Preview

Question 1

Single choice

Within IPsec tunnel templates available on FortiManager.
which template will you use to configure static tunnels for a hub and spoke topology?

A
Static_IPsec_Recommended
B
Hub_IPsec_Recommended
C
Branch_IPsec_Recommended
D
IPsec_Fortinet_Recommended

Reveal answer details Close answer details

Correct answerC

Question 2

Multiple choice

Which two statements are true about using SD-WAN to steer local-out traffic? (Choose two.)

A
FortiGate does not consider the source address of the packet when matching an SD-WAN rule for local-out traffic.
B
By default, local-out traffic does not use SD-WAN.
C
By default, FortiGate does not check if the selected member has a valid route to the destination.
D
You must configure each local-out feature individually, to use SD-WAN.

Reveal answer details Close answer details

Correct answersB, D

Question 3

Multiple choice

Which two statements about SLA targets and SD-WAN rules are true? (Choose two.)

A
When configuring an SD-WAN rule, you can select multiple SLA targets of the same performance SLA.
B
SD-WAN rules use SLA targets to check if the preferred members meet the SLA requirements.
C
SLA targets are used only by SD-WAN rules that are configured with Lowest Cost (SLA) or Maximize Bandwidth (SLA) as strategy.
D
Member metrics are measured only if an SLA target is configured.

Reveal answer details Close answer details

Correct answersB, D

Question 4

Single choice

Refer to the Exhibits:

Exhibit A, which shows the SD-WAN performance SLA and exhibit B shows the health of the participating SD-WAN members.

Based on the exhibits, which statement is correct?

A
The dead member interface stays unavailable until an administrator manually brings the interface back.
B
Port2 needs to wait 500 milliseconds to change the status from alive to dead.
C
Static routes using port2 are active in the routing table.
D
FortiGate has not received three consecutive requests from the SLA server configured for port2.

Reveal answer details Close answer details

Correct answerC

Question 5

Single choice

Refer to the exhibits.

Exhibit A shows the SD-WAN rule status and the learned BGP routes with community 65000:10.

Exhibit B shows the SD-WAN rule configuration, the BGP neighbor configuration, and the route map configuration.

The administrator wants to steer corporate traffic using routes tags in the SD-WAN rule ID 1.

However, the administrator observes that the corporate traffic does not match the SD-WAN rule ID 1.

Based on the exhibits, which configuration change is required to fix issue?

A
In the dc1-lan-rm route map configuration, set set-route-tag to 10.
B
In SD-WAN rule ID 1, change the destination to use ISDB entries.
C
In the dc1-lan-rm route map configuration, unset match-community.
D
In the BGP neighbor configuration, apply the route map dc1-lan-rm in the outbound direction.

Reveal answer details Close answer details

Correct answerA

Question 6

Multiple choice

Which two statements reflect the benefits of implementing the ADVPN solution to replace conventional VPN topologies? (Choose two.)

A
It creates redundant tunnels between hub-and-spokes, in case failure takes place on the primary links.
B
It dynamically assigns cost and weight between the hub and the spokes, based on the physical distance.
C
It ensures that spoke-to-spoke traffic no longer needs to flow through the tunnels through the hub.
D
It provides direct connectivity between all sites by creating on-demand tunnels between spokes.

Reveal answer details Close answer details

Correct answersC, D

Question 7

Multiple choice

Refer to the exhibit.

Two hub-and-spoke groups are connected through a site-to-site IPsec VPN between Hub 1 and Hub 2.

Which two configuration settings are required for Toronto and London spokes to establish an ADVPN shortcut? (Choose two.)

A
On the hubs,auto-discovery-sendermust be enabled on the IPsec VPNs to spokes.
B
On the spokes,auto-discovery-receivermust be enabled on the IPsec VPN to the hub.
C
auto-discovery-forwardermust be enabled on all IPsec VPNs.
D
On the hubs,net-devicemust be enabled on all IPsec VPNs.

Reveal answer details Close answer details

Correct answersA, B

Question 8

Single choice

Refer to the exhibit, which shows an SD-WAN zone configuration on the FortiGate GUI.

Based on the exhibit, which statement is true?

A
You can delete the virtual-wan-link zone because it contains no member.
B
The corporate zone contains no member.
C
You can move port1 from the underlay zone to the overlay zone.
D
The overlay zone contains four members.

Reveal answer details Close answer details

Correct answerC

Question 9

Single choice

Refer to the exhibit.

The exhibit shows VPN event logs on FortiGate.
In the output shown in the exhibit, which statement is true?

A
There are no IPsec tunnel statistics log messages for ADVPN cuts.
B
There is one shortcut tunnel built from master tunnel T_MPLS_0.
C
The VPN tunnel T_MPLS_0 is a shortcut tunnel.
D
The master tunnel T_INET_0 cannot accept the ADVPN shortcut.

Reveal answer details Close answer details

Correct answerC

Question 10

Single choice

Refer to the exhibits.

Exhibit A

Exhibit B

Exhibit A shows the configuration for an SD-WAN rule and exhibit B shows the respective rule status, the routing table, and the member status.

The administrator wants to understand the expected behavior for traffic matching the SD-WAN rule.

Based on the exhibits, what can the administrator expect for traffic matching the SD-WAN rule?

A
The traffic will be load balanced across all three overlays.
B
The traffic will be routed over T_INET_0_0.
C
The traffic will be routed over T_MPLS_0.
D
The traffic will be routed over T_INET_1_0.

Reveal answer details Close answer details

Correct answerD

Question 11

Single choice

Exhibit A shows the system interface with the static routes and exhibit B shows the firewall policies on the managed FortiGate.

Exhibt A

Exhibit B

Based on the FortiGate configuration shown in the exhibits, what issue might you encounter when creating an SD-WAN zone for port1 and port2?

A
port1 is assigned a manual IP address.
B
port1 is referenced in a firewall policy.
C
port2 is referenced in a static route.
D
port1 and port2 are not administratively down.

Reveal answer details Close answer details

Correct answerB

Question 12

Multiple choice

What are two reasons why FortiGate would be unable to complete the zero-touch provisioning process? (Choose two.)

A
The FortiGate cloud key has not been added to the FortiGate cloud portal.
B
FortiDeploy has connected with FortiGate and provided the initial configuration to contact FortiManager
C
The zero-touch provisioning process has completed internally, behind FortiGate.
D
FortiGate has obtained a configuration from the platform template in FortiGate cloud.
E
A factory reset performed on FortiGate.

Reveal answer details Close answer details

Correct answersA, C

Question 13

Multiple choice

Refer to the exhibit.

FortiGate has multiple dial-up VPN interfaces incoming on port1 that match only FIRST_VPN.

Which two configuration changes must be made to both IPsec VPN interfaces to allow incoming connections to match all possible IPsec dial-up interfaces? (Choose two.)

A
Specify a unique peer ID for each dial-up VPN interface.
B
Use different proposals are used between the interfaces.
C
Configure the IKE mode to be aggressive mode.
D
Use unique Diffie Hellman groups on each VPN interface.

Reveal answer details Close answer details

Correct answersA, C

Question 14

Multiple choice

What are two common use cases for remote internet access (RIA)? (Choose two.)

A
Provide direct internet access on spokes
B
Provide internet access through the hub
C
Centralize security inspection on the hub
D
Provide thorough inspection on spokes

Reveal answer details Close answer details

Correct answersB, C

Question 15

Single choice

Refer to the exhibit.

The exhibit shows the SD-WAN rule status and configuration.

Based on the exhibit, which change in the measured packet loss will make T_INET_1_0 the new preferred member?

A
When all three members have the same packet loss.
B
When T_INET_0_0 has 4% packet loss.
C
When T_INET_0_0 has 12% packet loss.
D
When T_INET_1_0 has 4% packet loss.

Reveal answer details Close answer details

Correct answerA