ExamGecko
Home Home / Fortinet / NSE7_SDW-7.2

Fortinet NSE7_SDW-7.2 Practice Test - Questions Answers, Page 9

Question list
Search
Search

Related questions











Refer to the exhibit.

Exhibit A shows the firewall policy and exhibit B shows the traffic shaping policy.

The traffic shaping policy is being applied to all outbound traffic; however, inbound traffic is not being evaluated by the shaping policy.

Based on the exhibits, what configuration change must be made in which policy so that traffic shaping can be applied to inbound traffic?

A.
Create a new firewall policy, and the select the SD-WAN zone as Incoming Interface.
A.
Create a new firewall policy, and the select the SD-WAN zone as Incoming Interface.
Answers
B.
In the traffic shaping policy, select Assign Shaping Class ID as Action.
B.
In the traffic shaping policy, select Assign Shaping Class ID as Action.
Answers
C.
In the firewall policy, select Proxy-based as Inspection Mode.
C.
In the firewall policy, select Proxy-based as Inspection Mode.
Answers
D.
In the traffic shaping policy, enable Reverse shaper, and then select the traffic shaper to use.
D.
In the traffic shaping policy, enable Reverse shaper, and then select the traffic shaper to use.
Answers
Suggested answer: D

Refer to the exhibit.

Based on the output, which two conclusions are true? (Choose two.)

A.
There is more than one SD-WAN rule configured.
A.
There is more than one SD-WAN rule configured.
Answers
B.
The SD-WAN rules take precedence over regular policy routes.
B.
The SD-WAN rules take precedence over regular policy routes.
Answers
C.
The all_rules rule represents the implicit SD-WAN rule.
C.
The all_rules rule represents the implicit SD-WAN rule.
Answers
D.
Entry 1(id=1) is a regular policy route.
D.
Entry 1(id=1) is a regular policy route.
Answers
Suggested answer: A, D

What does enabling the exchange-interface-ip setting enable FortiGate devices to exchange?

A.
The gateway address of their IPsec interfaces
A.
The gateway address of their IPsec interfaces
Answers
B.
The tunnel ID of their IPsec interfaces
B.
The tunnel ID of their IPsec interfaces
Answers
C.
The IP address of their IPsec interfaces
C.
The IP address of their IPsec interfaces
Answers
D.
The name of their IPsec interfaces
D.
The name of their IPsec interfaces
Answers
Suggested answer: C

Which diagnostic command can you use to show the configured SD-WAN zones and their assigned members?

A.
diagnose sys sdwan zone
A.
diagnose sys sdwan zone
Answers
B.
diagnose sys sdwan service
B.
diagnose sys sdwan service
Answers
C.
diagnose sys sdwan member
C.
diagnose sys sdwan member
Answers
D.
diagnose sys sdwan interface
D.
diagnose sys sdwan interface
Answers
Suggested answer: C

Refer to the exhibit.

Which two SD-WAN template member settings support the use of FortiManager meta fields? (Choose two.)

A.
Cost
A.
Cost
Answers
B.
Interface member
B.
Interface member
Answers
C.
Priority
C.
Priority
Answers
D.
Gateway IP
D.
Gateway IP
Answers
Suggested answer: B, D

Which two conclusions for traffic that matches the traffic shaper are true? (Choose two.)

A.
The traffic shaper drops packets if the bandwidth is less than 2500 KBps.
A.
The traffic shaper drops packets if the bandwidth is less than 2500 KBps.
Answers
B.
The measured bandwidth is less than 100 KBps.
B.
The measured bandwidth is less than 100 KBps.
Answers
C.
The traffic shaper drops packets if the bandwidth exceeds 6250 KBps.
C.
The traffic shaper drops packets if the bandwidth exceeds 6250 KBps.
Answers
D.
The traffic shaper limits the bandwidth of each source IP to a maximum of 6250 KBps.
D.
The traffic shaper limits the bandwidth of each source IP to a maximum of 6250 KBps.
Answers
Suggested answer: B, C

Which CLI command do you use to perform real-time troubleshooting for ADVPN negotiation?

A.
get router info routing-table all
A.
get router info routing-table all
Answers
B.
diagnose debug application ike
B.
diagnose debug application ike
Answers
C.
diagnose vpn tunnel list
C.
diagnose vpn tunnel list
Answers
D.
get ipsec tunnel list
D.
get ipsec tunnel list
Answers
Suggested answer: B

Explanation:

IKE real-time debug - useful when debugging ADVPN shortcut messages and spoke-to-spoke negotiations.

* diagnose debug console timestamp enable

* diagnose vpn ike log filter clear

* diagnose vpn ike log filter mdst-addr4 <ip.of.hub> <ip.of.spoke>

* diagnose debug application ike -1

* diagnose debug enable

Which two statements are correct when traffic matches the implicit SD-WAN rule? (Choose two.)

A.
The sdwan_service_id flag in the session information is 0.
A.
The sdwan_service_id flag in the session information is 0.
Answers
B.
All SD-WAN rules have the default setting enabled.
B.
All SD-WAN rules have the default setting enabled.
Answers
C.
Traffic does not match any of the entries in the policy route table.
C.
Traffic does not match any of the entries in the policy route table.
Answers
D.
Traffic is load balanced using the algorithm set for the v4-ecmp-mode setting.
D.
Traffic is load balanced using the algorithm set for the v4-ecmp-mode setting.
Answers
Suggested answer: A, C

Explanation:

sdwan_service_id is 0 = match SD-WAN implicit rule, study guide 7.0 page 120, 7.2 page 149 SD-WAN rules internally are interpreted as a Policy route, so when the traffic doesn't match with any policy route, it will be flowing by implict policy.

Refer to the exhibit.

Based on the exhibit, which two actions does FortiGate perform on sessions after a firewall policy change? (Choose two.)

A.
FortiGate flushes all sessions.
A.
FortiGate flushes all sessions.
Answers
B.
FortiGate terminates the old sessions.
B.
FortiGate terminates the old sessions.
Answers
C.
FortiGate does not change existing sessions.
C.
FortiGate does not change existing sessions.
Answers
D.
FortiGate evaluates new sessions.
D.
FortiGate evaluates new sessions.
Answers
Suggested answer: C, D

Explanation:

FortiGate not to flag existing impacted session as dirty by setting firewall-session-dirty to check new. The results is that FortiGate evaluates only new session against the new firewall policy.

Which two statements about SD-WAN central management are true? (Choose two.)

A.
The objects are saved in the ADOM common object database.
A.
The objects are saved in the ADOM common object database.
Answers
B.
It does not support meta fields.
B.
It does not support meta fields.
Answers
C.
It uses templates to configure SD-WAN on managed devices.
C.
It uses templates to configure SD-WAN on managed devices.
Answers
D.
It supports normalized interfaces for SD-WAN member configuration.
D.
It supports normalized interfaces for SD-WAN member configuration.
Answers
Suggested answer: A, C

Explanation:

Normalized interfaces are not supported for SD-WAN templates. You can create multiple SD-WAN zones and add interface members to the SD-WAN zones. You must bind the interface members by name to physical interfaces or VPN interfaces.https://docs.fortinet.com/document/fortigate/7.0.0/sd-wan-new-features/794804/new-sd-wan-template-fmg

Total 97 questions
Go to page: of 10