Weekend Special Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: netbudy65

Dumpsbuddy Logo
  1. Home
  2. Fortinet
  3. NSE 7 Network Security Architect
  4. NSE7_SDW-7.2
  5. Fortinet NSE 7 - SD-WAN 7.2 Questions and Answers

NSE7_SDW-7.2 Fortinet NSE 7 - SD-WAN 7.2 Questions and Answers

Questions 4

What are two common use cases for remote internet access (RIA)? (Choose two.)

Options:

A.

Provide direct internet access on spokes

B.

Provide internet access through the hub

C.

Centralize security inspection on the hub

D.

Provide thorough inspection on spokes

Buy Now
Questions 5

Refer to the exhibit.

NSE7_SDW-7.2 Question 5

The device exchanges routes using IBGP.

Which two statements are correct about the IBGP configuration and routing information on the device? (Choose two.)

Options:

A.

Each BGP route is three hops away from the destination.

B.

ibgp-multipath is disabled.

C.

additional-path is enabled.

D.

You can run the get router info routing-table database command to display the additional paths.

Buy Now
Questions 6

Which type statements about the SD-WAN members are true? (Choose two.)

Options:

A.

You can manually define the SD-WAN members sequence number.

B.

Interfaces of type virtual wire pair can be used as SD-WAN members.

C.

Interfaces of type VLAN can be used as SD-WAN members.

D.

An SD-WAN member can belong to two or more SD-WAN zones.

Buy Now
Questions 7

What three characteristics apply to provisioning templates available on FortiManager? (Choose three.)

Options:

A.

You can apply a system template and a CLI template to the same FortiGate device.

B.

A CLI template can be of type CLI script or Perl script.

C.

A template group can include a system template and an SD-WAN template.

D.

A template group can contain CLI templates of both types.

E.

Templates are applied in order, from top to bottom.

Buy Now
Questions 8

Refer to the exhibit.

NSE7_SDW-7.2 Question 8

Which two SD-WAN template member settings support the use of FortiManager meta fields? (Choose two.)

Options:

A.

Cost

B.

Interface member

C.

Priority

D.

Gateway IP

Buy Now
Questions 9

Which two statements are correct when traffic matches the implicit SD-WAN rule? (Choose two.)

Options:

A.

The session information output displays no SD-WAN-specific details.

B.

All SD-WAN rules have the default and gateway setting enabled.

C.

Traffic does not match any of the entries in the policy route table.

D.

Traffic is load balanced using the algorithm set for the v4-ecmp-mode setting.

Buy Now
Questions 10

The SD-WAN overlay template helps to prepare SD-WAN deployments. To complete the tasks performed by the SD-WAN overlay template, the administrator must perform some post-run tasks. What are three mandatory post-run tasks that must be performed? (Choose three.)

Options:

A.

Assign an sdwan_id metadata variable to each device (branch and hub).

B.

Assign a branch_id metadata variable to each branch device.

C.

Create policy packages for branch devices.

D.

Configure SD-WAN rules.

E.

Configure routing through overlay tunnels created by the SD-WAN overlay template.

Buy Now
Questions 11

The administrator uses the FortiManager SD-WAN overlay template to prepare an SD-WAN deployment. With information provided through the SD-WAN overlay template wizard, FortiManager creates templates ready to install on spoke and hub devices.

Select three templates created by the SD-WAN overlay template for a spoke device. (Choose three.)

Options:

A.

System template

B.

BGP template

C.

IPsec tunnel template

D.

CLI template

E.

Overlay template

Buy Now
Questions 12

NSE7_SDW-7.2 Question 12

Which two conclusions for traffic that matches the traffic shaper are true? (Choose two.)

Options:

A.

The traffic shaper drops packets if the bandwidth is less than 2500 KBps.

B.

The measured bandwidth is less than 100 KBps.

C.

The traffic shaper drops packets if the bandwidth exceeds 6250 KBps.

D.

The traffic shaper limits the bandwidth of each source IP to a maximum of 6250 KBps.

Buy Now
Questions 13

NSE7_SDW-7.2 Question 13

Exhibit B –

NSE7_SDW-7.2 Question 13

Exhibit A shows the system interface with the static routes and exhibit B shows the firewall policies on the managed FortiGate.

Based on the FortiGate configuration shown in the exhibits, what issue might you encounter when creating an SD-WAN zone for port1 and port2?

Options:

A.

port1 is assigned a manual IP address.

B.

port1 is referenced in a firewall policy.

C.

port2 is referenced in a static route.

D.

port1 and port2 are not administratively down.

Buy Now
Questions 14

Refer to the exhibit.

NSE7_SDW-7.2 Question 14

Based on the exhibit, which statement about FortiGate re-evaluating traffic is true?

Options:

A.

The type of traffic defined and allowed on firewall policy ID 1 is UDP.

B.

FortiGate has terminated the session after a change on policy ID 1.

C.

Changes have been made on firewall policy ID 1 on FortiGate.

D.

Firewall policy ID 1 has source NAT disabled.

Buy Now
Questions 15

Which two interfaces are considered overlay links? (Choose two.)

Options:

A.

LAG

B.

IPsec

C.

Physical

D.

GRE

Buy Now
Questions 16

What are two advantages of using an IPsec recommended template to configure an IPsec tunnel in an hub-and-spoke topology? (Choose two.)

Options:

A.

It ensures consistent settings between phase1 and phase2.

B.

It guides the administrator to use Fortinet recommended settings.

C.

It automatically install IPsec tunnels to every spoke when they are added to the FortiManager ADOM.

D.

The VPN monitor tool provides additional statistics for tunnels defined with an IPsec recommended template.

Buy Now
Questions 17

Within IPsec tunnel templates available on FortiManager. which template will you use to configure static tunnels for a hub and spoke topology?

Options:

A.

Static_IPsec_Recommended

B.

Hub_IPsec_Recommended

C.

Branch_IPsec_Recommended

D.

IPsec_Fortinet_Recommended

Buy Now
Questions 18

Which statement is correct about SD-WAN and ADVPN?

Options:

A.

Routes for ADVPN shortcuts must be manually configured.

B.

SD-WAN can steer traffic to ADVPN shortcuts, established over IPsec overlays, configured as SD-WAN members.

C.

SD-WAN does not monitor the health and performance of ADVPN shortcuts.

D.

You must use IKEv2 on IPsec tunnels.

Buy Now
Questions 19

NSE7_SDW-7.2 Question 19

NSE7_SDW-7.2 Question 19

Exhibit A shows the firewall policy and exhibit B shows the traffic shaping policy.

The traffic shaping policy is being applied to all outbound traffic; however, inbound traffic is not being evaluated by the shaping policy.

Based on the exhibits, what configuration change must be made in which policy so that traffic shaping can be applied to inbound traffic?

Options:

A.

Create a new firewall policy, and the select the SD-WAN zone as Incoming Interface.

B.

In the traffic shaping policy, select Assign Shaping Class ID as Action.

C.

In the firewall policy, select Proxy-based as Inspection Mode.

D.

In the traffic shaping policy, enable Reverse shaper, and then select the traffic shaper to use.

Buy Now
Questions 20

Which diagnostic command can you use to show the configured SD-WAN zones and their assigned members?

Options:

A.

diagnose sys sdwan zone

B.

diagnose sys sdwan service

C.

diagnose sys sdwan member

D.

diagnose sys sdwan interface

Buy Now
Questions 21

Refer to the exhibits.

Exhibit A -

NSE7_SDW-7.2 Question 21

Exhibit B -

NSE7_SDW-7.2 Question 21

Exhibit A shows the SD-WAN performance SLA and exhibit B shows the SD-WAN member status, the routing table, and the performance SLA status.

If port2 is detected dead by FortiGate, what is the expected behavior?

Options:

A.

Port2 becomes alive after three successful probes are detected.

B.

FortiGate removes all static routes for port2.

C.

The administrator manually restores the static routes for port2, if port2 becomes alive.

D.

Host 8.8.8.8 is reachable through port1 and port2.

Buy Now
Questions 22

Refer to the exhibits.

NSE7_SDW-7.2 Question 22

NSE7_SDW-7.2 Question 22

Exhibit A shows the SD-WAN rule status and the learned BGP routes with community 65000:10.

Exhibit B shows the SD-WAN rule configuration, the BGP neighbor configuration, and the route map configuration.

The administrator wants to steer corporate traffic using routes tags in the SD-WAN rule ID 1.

However, the administrator observes that the corporate traffic does not match the SD-WAN rule ID 1.

Based on the exhibits, which configuration change is required to fix issue?

Options:

A.

In the dc1-lan-rm route map configuration, set set-route-tag to 10.

B.

In SD-WAN rule ID 1, change the destination to use ISDB entries.

C.

In the dc1-lan-rm route map configuration, unset match-community.

D.

In the BGP neighbor configuration, apply the route map dc1-lan-rm in the outbound direction.

Buy Now
Questions 23

Refer to the exhibit.

NSE7_SDW-7.2 Question 23

Which statement explains the output shown in the exhibit?

Options:

A.

FortiGate performed standard FIB routing on the session.

B.

FortiGate will not re-evaluate the session following a firewall policy change.

C.

FortiGate used192.2.0.1as the gateway for the original direction of the traffic.

D.

FortiGate must re-evaluate the session due to routing change.

Buy Now
Questions 24

Refer to the exhibit.

NSE7_SDW-7.2 Question 24

Two hub-and-spoke groups are connected through a site-to-site IPsec VPN between Hub 1 and Hub 2.

Which two configuration settings are required for Toronto and London spokes to establish an ADVPN shortcut? (Choose two.)

Options:

A.

On the hubs,auto-discovery-sendermust be enabled on the IPsec VPNs to spokes.

B.

On the spokes,auto-discovery-receivermust be enabled on the IPsec VPN to the hub.

C.

auto-discovery-forwardermust be enabled on all IPsec VPNs.

D.

On the hubs,net-devicemust be enabled on all IPsec VPNs.

Buy Now
Questions 25

Refer to the exhibits.

Exhibit A

NSE7_SDW-7.2 Question 25

Exhibit B

NSE7_SDW-7.2 Question 25

Exhibit A shows the SD-WAN performance SLA configuration, the SD-WAN rule configuration, and the application IDs of Facebook and YouTube. Exhibit B shows the firewall policy configuration and the underlay zone status.

Based on the exhibits, which two statements are correct about the health and performance of port1 and port2? (Choose two.)

Options:

A.

The performance is an average of the metrics measured for Facebook and YouTube traffic passing through the member.

B.

FortiGate is unable to measure jitter and packet loss on Facebook and YouTube traffic.

C.

FortiGate identifies the member as dead when there is no Facebook and YouTube traffic passing through the member.

D.

Non-TCP Facebook and YouTube traffic are not used for performance measurement.

Buy Now
Questions 26

Refer to the exhibit.

NSE7_SDW-7.2 Question 26

In a dual-hub hub-and-spoke SD-WAN deployment, which is a benefit of disabling theanti-replaysetting on the hubs?

Options:

A.

It instructs the hub to disable the reordering of TCP packets on behalf of the receiver, to improve performance.

B.

It instructs the hub to disable TCP sequence number check, which is required for TCP sessions originated from spokes to fail over back and forth between the hubs.

C.

It instructs the hub to not check the ESP sequence numbers on IPsec traffic, to improve performance.

D.

It instructs the hub to skip content inspection on TCP traffic, to improve performance.

Buy Now
Questions 27

What are two benefits of using the Internet service database (ISDB) in an SD-WAN rule? (Choose two.)

Options:

A.

The ISDB is dynamically updated and reduces administrative overhead.

B.

The ISDB requires application control to maintain signatures and perform load balancing.

C.

The ISDB applies rules to traffic from specific sources, based on application type.

D.

The ISDB contains the IP addresses and port ranges of well-known internet services.

Buy Now
Questions 28

Refer to the exhibit, which shows the IPsec phase 1 configuration of a spoke.

NSE7_SDW-7.2 Question 28

What must you configure on the IPsec phase 1 configuration for ADVPN to work with SD-WAN?

Options:

A.

You must set ike-version to 1.

B.

You must enable net-device.

C.

You must enable auto-discovery-sender.

D.

You must disable idle-timeout.

Buy Now
Questions 29

Which two statements describe how IPsec phase 1 main mode is different from aggressive mode when performing IKE negotiation? (Choose two )

Options:

A.

A peer ID is included in the first packet from the initiator, along with suggested security policies.

B.

XAuth is enabled as an additional level of authentication, which requires a username and password.

C.

A total of six packets are exchanged between an initiator and a responder instead of three packets.

D.

The use of Diffie Hellman keys is limited by the responder and needs initiator acceptance.

Buy Now
Exam Code: NSE7_SDW-7.2
Exam Name: Fortinet NSE 7 - SD-WAN 7.2
Last Update: Oct 16, 2025
Questions: 99

PDF + Testing Engine

$134.99
buy now NSE7_SDW-7.2 pdf + testing engine

Testing Engine

$99.99
buy now NSE7_SDW-7.2 testing engine

PDF (Q&A)

$84.99
buy now NSE7_SDW-7.2 pdf