Home / Fortinet / NSE7_SDW-7.2

Fortinet NSE7_SDW-7.2 Practice Test - Questions Answers, Page 5

Question list

List of questions

Question 41

(0)

Refer to the exhibit. Which configuration change is required if the responder FortiGate uses a dynamic routing protocol to exchange routes over IPsec?

Question 42

(0)

Which statement about SD-WAN zones is true?

Question 43

(0)

Which two statements about the SD-WAN zone configuration are true? (Choose two.)

Question 44

(0)

Exhibit. The exhibit shows the output of the command diagnose sys sdwan health-check status collected on a FortiGate device. Which two statements are correct about the health check status on this

Question 45

(0)

Refer to the exhibits. Exhibit A Exhibit B - Exhibit A shows the configuration for an SD-WAN rule and exhibit B shows the respective rule status, the routing table, and the member status. Th

Question 46

(0)

Exhibit. The exhibit shows VPN event logs on FortiGate. In the output shown in the exhibit, which statement is true?

Question 47

(0)

Refer to the exhibits. Exhibit A Exhibit B Exhibit A shows the source NAT (SNAT) global setting and exhibit B shows the routing table on FortiGate. Based on the exhibits, which two actions d

Question 48

(0)

What is the route-tag setting in an SD-WAN rule used for?

Question 49

(0)

Two hub-and-spoke groups are connected through a site-to-site IPsec VPN between Hub 1 and Hub 2. The administrator configured ADVPN on both hub-and-spoke groups. Which two outcomes are expected if

Question 50

(0)

Refer to the exhibit. An administrator is troubleshooting SD-WAN on FortiGate. A device behind branch1_fgt generates traffic to the 10.0.0.0/8 network. The administrator expects the traffic to ma

Question 41

Refer to the exhibit.

Which configuration change is required if the responder FortiGate uses a dynamic routing protocol to exchange routes over IPsec?

type must be set to static.

mode-cfg must be enabled.

exchange-interface-ip must be enabled.

add-route must be disabled.

Show Answer Comment (0)

Question 42

Which statement about SD-WAN zones is true?

An SD-WAN zone can contain only one type of interface.

An SD-WAN zone can contain between 0 and 512 members.

You cannot use an SD-WAN zone in static route definitions.

You can configure up to 32 SD-WAN zones per VDOM.

Show Answer Comment (0)

Question 43

Which two statements about the SD-WAN zone configuration are true? (Choose two.)

The service-sla-tie-break setting enables you to configure preferred member selection based on the best route to the destination.

You can delete the default zones.

The default zones are virtual-wan-link and SASE.

An SD-WAN member can belong to two or more zones.

Show Answer Comment (0)

The exhibit shows the output of the command diagnose sys sdwan health-check status collected on a FortiGate device. Which two statements are correct about the health check status on this FortiGate device? (Choose two.)

The health-check VPN_PING orders the members according to the lowest jitter.

The interface T_INET_1 missed one SLA target.

There is no SLA criteria configured for the health-check Level3_DNS.

The interface T_INET_0 missed three SLA targets.

Show Answer Comment (0)

Question 45

Refer to the exhibits.

Exhibit A

Exhibit B -

Exhibit A shows the configuration for an SD-WAN rule and exhibit B shows the respective rule status, the routing table, and the member status.

The administrator wants to understand the expected behavior for traffic matching the SD-WAN rule.

Based on the exhibits, what can the administrator expect for traffic matching the SD-WAN rule?

The traffic will be load balanced across all three overlays.

The traffic will be routed over T_INET_0_0.

The traffic will be routed over T_MPLS_0.

The traffic will be routed over T_INET_1_0.

Show Answer Comment (0)

Question 46

Exhibit.

The exhibit shows VPN event logs on FortiGate. In the output shown in the exhibit, which statement is true?

There are no IPsec tunnel statistics log messages for ADVPN cuts.

There is one shortcut tunnel built from master tunnel T_MPLS_0.

The VPN tunnel T_MPLS_0 is a shortcut tunnel.

The master tunnel T_INET_0 cannot accept the ADVPN shortcut.

Show Answer Comment (0)

Suggested answer: B

Explanation:

VPN event logs record the status of VPN tunnels, such as the establishment, termination, or failure of a tunnel. The output includes the following information:

logid: the log ID number

type: the log type, either traffic or event

subtype: the log subtype, either vpn or ipsec

level: the log level, either error, warning, or notice

vd: the virtual domain name

logdesc: the log description

msg: the log message

action: the log action, such as tunnel-up, tunnel-down, or tunnel-stats

remip: the remote IP address

locip: the local IP address

remport: the remote port number

locport: the local port number

outintf: the outgoing interface name

cookies: the IKE SA cookies

user: the user name

group: the user group name

useralt: the alternative user name

xauthuser: the XAuth user name

authgroup: the XAuth user group name

assignip: the assigned IP address

vpntunnel: the VPN tunnel name

tunnellip: the tunnel loopback IP address

tunnelid: the tunnel ID number

tunneltype: the tunnel type, either ipsec or ssl

duration: the tunnel duration in seconds

sentbyte: the number of bytes sent

rcvdbyte: the number of bytes received

nextstat: the next statistics interval in seconds

advpnsc: the ADVPN shortcut flag, either 0 or 1

Based on the exhibit, the following statement is true:

There is one shortcut tunnel built from master tunnel T_MPLS_0.This means that the VPN tunnel T_MPLS_0 is a master tunnel that can send ADVPN shortcut offers to other spokes, and the VPN tunnel T_MPLS_0_0 is a shortcut tunnel that is built from the master tunnel T_MPLS_01. In the exhibit, the log action for T_MPLS_0 is tunnel-up, and the log action for T_MPLS_0_0 is shortcut-up. The advpnsc flag for T_MPLS_0 is 0, indicating that it is not a shortcut tunnel, while the advpnsc flag for T_MPLS_0_0 is 1, indicating that it is a shortcut tunnel.

Question 47

Refer to the exhibits.

Exhibit A

Exhibit B

Exhibit A shows the source NAT (SNAT) global setting and exhibit B shows the routing table on FortiGate.

Based on the exhibits, which two actions does FortiGate perform on existing sessions established over port2, if the administrator increases the static route priority on port2 to 20? (Choose two.)

FortiGate flags the sessions as dirty.

FortiGate continues routing the sessions with no SNAT, over port2.

FortiGate performs a route lookup for the original traffic only.

FortiGate updates the gateway information of the sessions with SNAT so that they use port1 instead of port2.

Show Answer Comment (0)

Question 48

What is the route-tag setting in an SD-WAN rule used for?

To indicate the routes for health check probes.

To indicate the destination of a rule based on learned BGP prefixes.

To indicate the routes that can be used for routing SD-WAN traffic.

To indicate the members that can be used to route SD-WAN traffic.

Show Answer Comment (0)

Question 49

Two hub-and-spoke groups are connected through a site-to-site IPsec VPN between Hub 1 and Hub 2. The administrator configured ADVPN on both hub-and-spoke groups.

Which two outcomes are expected if a user in Toronto sends traffic to London? (Choose two.)

London generates an IKE information message that contains the Toronto public IP address.

Traffic from Toronto to London triggers the dynamic negotiation of a direct site-to-site VPN.

Toronto needs to establish a site-to-site tunnel with Hub 2 to bypass Hub 1.

The first packets from Toronto to London are routed through Hub 1 then to Hub 2.

Show Answer Comment (0)

Question 50

Refer to the exhibit.

An administrator is troubleshooting SD-WAN on FortiGate. A device behind branch1_fgt generates traffic to the 10.0.0.0/8 network. The administrator expects the traffic to match SD-WAN rule ID 1 and be routed over T_INET_0_0. However, the traffic is routed over T_INET_1_0.

Based on the output shown in the exhibit, which two reasons can cause the observed behavior? (Choose two.)

The traffic matches a regular policy route configured with T_INET_1_0 as the outgoing device.

T_INET_1_0 has a lower route priority value (higher priority) than T_INET_0_0.

T_INET_0_0 does not have a valid route to the destination.

T_INET_1_0 has a higher member configuration priority than T_INET_0_0.

Show Answer Comment (0)

Total 97 questions