Free Fortinet NSE7_SDW-7.0 Exam Questions & Answer from Training Expert ExamBoosts [Q24-Q42]

Rate this post

Free Fortinet NSE7_SDW-7.0 Exam Questions and Answer from Training Expert ExamBoosts

Top Fortinet NSE7_SDW-7.0 Courses Online

Fortinet NSE7_SDW-7.0 (Fortinet NSE 7 – SD-WAN 7.0) exam is a certification that validates the skills of network security professionals in designing, implementing, and managing secure SD-WAN solutions. Fortinet NSE 7 – SD-WAN 7.0 certification is designed to equip IT professionals with the necessary skills to secure and optimize WAN networks. NSE7_SDW-7.0 exam covers a wide range of topics, including SD-WAN architecture, design, deployment, operation, and troubleshooting.

Fortinet is a global leader in cybersecurity solutions that protect businesses and organizations from cyber threats. The company offers a wide range of products and services to ensure comprehensive security for networks, endpoints, and cloud environments. Fortinet also provides training and certification programs for security professionals to ensure they have the necessary skills to protect their organizations from cyber attacks.

Q24. Refer to the exhibits.
Exhibit A –

Exhibit B –

Exhibit A shows the SD-WAN performance SLA and exhibit B shows the SD-WAN member status, the routing table, and the performance SLA status.
If port2 is detected dead by FortiGate, what is the expected behavior?

Port2 becomes alive after three successful probes are detected.

FortiGate removes all static routes for port2.

The administrator manually restores the static routes for port2, if port2 becomes alive.

Host 8.8.8.8 is reachable through port1 and port2.

Explanation
This is due to Update static route is enable which removes the static route entry referencing the interface if the interface is dead

Q25. Refer to the exhibit.

Based on the output shown in the exhibit, which two criteria on the SD-WAN member configuration can be used to select an outgoing interface in an SD-WAN rule? (Choose two.)

Set priority 10.

Set cost 15.

Set load-balance-mode source-ip-ip-based.

Set source 100.64.1.1.

Q26. Refer to the exhibit.

Based on the exhibit, which two actions does FortiGate perform on traffic passing through port2? (Choose two.)

FortiGate does not change the routing information on existing sessions that use a valid gateway, after a route change.

FortiGate performs routing lookups for new sessions only, after a route change.

FortiGate always blocks all traffic, after a route change.

FortiGate flushes all routing information from the session table, after a route change.

Q27. Which two statements are correct when traffic matches the implicit SD-WAN rule? (Choose two.)

The sdwan_service_id flag in the session information is 0.

All SD-WAN rules have the default setting enabled.

Traffic does not match any of the entries in the policy route table.

Traffic is load balanced using the algorithm set for the v4-ecmp-mode setting.

Q28. Which statement about using BGP for ADVPN is true?

IBGP is preferred over EBGP, because IBGP preserves next hop information.

You must use BGP to route traffic for both overlay and underlay links.

You must configure BGP communities.

You must configure AS path prepending.

Q29. Refer to the exhibit.

The exhibit shows the SD-WAN rule status and configuration.
Based on the exhibit, which change in the measured packet loss will make T_INET_1_0 the new preferred member?

When all three members have the same packet loss.

When T_INET_0_0 has 4% packet loss.

When T_INET_0_0 has 12% packet loss.

When T_INET_1_0 has 4% packet loss.

Q30. Refer to the exhibit.

Which algorithm does SD-WAN use to distribute traffic that does not match any of the SD-WAN rules?

All traffic from a source IP to a destination IP is sent to the same interface.

All traffic from a source IP is sent to the same interface.

All traffic from a source IP is sent to the most used interface.

All traffic from a source IP to a destination IP is sent to the least used interface.

Q31. Which two statements are true about using SD-WAN to steer local-out traffic? (Choose two.)

FortiGate does not consider the source address of the packet when matching an SD-WAN rule for local-out traffic.

By default, local-out traffic does not use SD-WAN.

By default, FortiGate does not check if the selected member has a valid route to the destination.

You must configure each local-out feature individually, to use SD-WAN.

Q32. Refer to the exhibit.

In a dual-hub hub-and-spoke SD-WAN deployment, which is a benefit of disabling the anti-replay setting on the hubs?

It instructs the hub to disable the reordering of TCP packets on behalf of the receiver, to improve performance.

It instructs the hub to disable TCP sequence number check, which is required for TCP sessions originated from spokes to fail over back and forth between the hubs.

It instructs the hub to not check the ESP sequence numbers on IPsec traffic, to improve performance.

It instructs the hub to skip content inspection on TCP traffic, to improve performance.

Q33. Refer to the exhibits.

An administrator is testing application steering in SD-WAN. Before generating test traffic, the administrator collected the information shown in exhibit A.
After generating GoToMeeting test traffic, the administrator examined the respective traffic log on FortiAnalyzer, which is shown in exhibit B.
The administrator noticed that the traffic matched the implicit SD-WAN rule, but they expected the traffic to match rule ID 1.
Which two reasons explain why the traffic matched the implicit SD-WAN rule? (Choose two.)

FortiGate did not refresh the routing information on the session after the application was detected.

Port1 and port2 do not have a valid route to the destination.

Full SSL inspection is not enabled on the matching firewall policy.

The session 3-tuple did not match any of the existing entries in the ISDB application cache.

Q34. Refer to the exhibit.

Two hub-and-spoke groups are connected through a site-to-site IPsec VPN between Hub 1 and Hub 2.
Which two configuration settings are required for Toronto and London spokes to establish an ADVPN shortcut? (Choose two.)

On the hubs, auto-discovery-sender must be enabled on the IPsec VPNs to spokes.

On the spokes, auto-discovery-receiver must be enabled on the IPsec VPN to the hub.

auto-discovery-forwarder must be enabled on all IPsec VPNs.

On the hubs, net-device must be enabled on all IPsec VPNs.

Q35. Refer to the exhibit.

Based on the exhibit, which statement about FortiGate re-evaluating traffic is true?

The type of traffic defined and allowed on firewall policy ID 1 is UDP.

FortiGate has terminated the session after a change on policy ID 1.

Changes have been made on firewall policy ID 1 on FortiGate.

Firewall policy ID 1 has source NAT disabled.

Q36. Refer to the exhibit.

Which statement about the role of the ADVPN device in handling traffic is true?

This is a spoke that has received a query from a remote hub and has forwarded the response to its hub.

Two hubs, 10.0.1.101 and 10.0.2.101, are receiving and forwarding queries between each other.

This is a hub that has received a query from a spoke and has forwarded it to another spoke.

Two spokes, 192.2.0.1 and 10.0.2.101, forward their queries to their hubs.

Q37. What are two benefits of using the Internet service database (ISDB) in an SD-WAN rule? (Choose two.)

The ISDB is dynamically updated and reduces administrative overhead.

The ISDB requires application control to maintain signatures and perform load balancing.

The ISDB applies rules to traffic from specific sources, based on application type.

The ISDB contains the IP addresses and port ranges of well-known internet services.

Q38. In a hub-and-spoke topology, what are two advantages of enabling ADVPN on the IPsec overlays? (Choose two.)

It provides the benefits of a full-mesh topology in a hub-and-spoke network.

It provides direct connectivity between spokes by creating shortcuts.

It enables spokes to bypass the hub during shortcut negotiation.

It enables spokes to establish shortcuts to third-party gateways.

Q39. Which two settings can you configure to speed up routing convergence in BGP? (Choose two.)

update-source

set-route-tag

holdtime-timer

link-down-failover

Q40. Refer to the exhibit.

Based on the output, which two conclusions are true? (Choose two.)

There is more than one SD-WAN rule configured.

The SD-WAN rules take precedence over regular policy routes.

The all_rules rule represents the implicit SD-WAN rule.

Entry 1(id=1) is a regular policy route.

Q41. Refer to the exhibits.
Exhibit A

Exhibit B

Exhibit A shows an SD-WAN event log and exhibit B shows the member status and the SD-WAN rule configuration.
Based on the exhibits, which two statements are correct? (Choose two.)

FortiGate updated the outgoing interface list on the rule so it prefers port2.

Port2 has the highest member priority.

Port2 has a lower latency than port1.

SD-WAN rule ID 1 is set to lowest cost (SLA) mode.

Q42. Refer to the exhibit, which shows the IPsec phase 1 configuration of a spoke.

What must you configure on the IPsec phase 1 configuration for ADVPN to work with SD-WAN?