Labour Day Sale - Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: mxmas70

 
Home > Fortinet > Fortinet Certification > NSE7_SDW-7.0

NSE7_SDW-7.0 Fortinet NSE 7 - SD-WAN 7.0 Question and Answers

Question # 4

Refer to the exhibits.

Exhibit A shows the packet duplication rule configuration, the SD-WAN zone status output, and the sniffer output on FortiGate acting as the sender. Exhibit B shows the sniffer output on a FortiGate acting as the receiver.

The administrator configured packet duplication on both FortiGate devices. The sniffer output on the sender FortiGate shows that FortiGate forwards an ICMP echo request packet over three overlays, but it only receives one reply packet through T_INET_1_0.

Based on the output shown in the exhibits, which two reasons can cause the observed behavior? (Choose two.)

A.

On the receiver FortiGate, packet-de-duplication is enabled.

B.

The ICMP echo request packets sent over T_INET_0_0 and T_MPLS_0 were dropped along the way.

C.

The ICMP echo request packets received over T_INET_0_0 and T_MPLS_0 were offloaded to NPU.

D.

On the sender FortiGate, duplication-max-num is set to 3.

Full Access
Question # 5

What are two reasons why FortiGate would be unable to complete the zero-touch provisioning process? (Choose two.)

A.

The FortiGate cloud key has not been added to the FortiGate cloud portal.

B.

FortiDeploy has connected with FortiGate and provided the initial configuration to contact FortiManager

C.

The zero-touch provisioning process has completed internally, behind FortiGate.

D.

FortiGate has obtained a configuration from the platform template in FortiGate cloud.

E.

A factory reset performed on FortiGate.

Full Access
Question # 6

Which statement is correct about SD-WAN and ADVPN?

A.

Routes for ADVPN shortcuts must be manually configured.

B.

SD-WAN can steer traffic to ADVPN shortcuts, established over IPsec overlays, configured as SD-WAN members.

C.

SD-WAN does not monitor the health and performance of ADVPN shortcuts.

D.

You must use IKEv2 on IPsec tunnels.

Full Access
Question # 7

Which diagnostic command can you use to show the configured SD-WAN zones and their assigned members?

A.

diagnose sys sdwan zone

B.

diagnose sys sdwan service

C.

diagnose sys sdwan member

D.

diagnose sys sdwan interface

Full Access
Question # 8

Two hub-and-spoke groups are connected through a site-to-site IPsec VPN between Hub 1 and Hub 2. The administrator configured ADVPN on both hub-and-spoke groups.

Which two outcomes are expected if a user in Toronto sends traffic to London? (Choose two.)

A.

London generates an IKE information message that contains the Toronto public IP address.

B.

Traffic from Toronto to London triggers the dynamic negotiation of a direct site-to-site VPN.

C.

Toronto needs to establish a site-to-site tunnel with Hub 2 to bypass Hub 1.

D.

The first packets from Toronto to London are routed through Hub 1 then to Hub 2.

Full Access
Question # 9

Refer to the exhibits.

Exhibit A -

Exhibit B -

Exhibit A shows the SD-WAN performance SLA and exhibit B shows the SD-WAN member status, the routing table, and the performance SLA status.

If port2 is detected dead by FortiGate, what is the expected behavior?

A.

Port2 becomes alive after three successful probes are detected.

B.

FortiGate removes all static routes for port2.

C.

The administrator manually restores the static routes for port2, if port2 becomes alive.

D.

Host 8.8.8.8 is reachable through port1 and port2.

Full Access
Question # 10

Which statement about using BGP for ADVPN is true?

A.

IBGP is preferred over EBGP, because IBGP preserves next hop information.

B.

You must use BGP to route traffic for both overlay and underlay links.

C.

You must configure BGP communities.

D.

You must configure AS path prepending.

Full Access
Question # 11

Which two settings can you configure to speed up routing convergence in BGP? (Choose two.)

A.

update-source

B.

set-route-tag

C.

holdtime-timer

D.

link-down-failover

Full Access
Question # 12

Which components make up the secure SD-WAN solution?

A.

Application, antivirus, and URL, and SSL inspection

B.

Datacenter, branch offices, and public cloud

C.

FortiGate, FortiManager, FortiAnalyzer, and FortiDeploy

D.

Telephone, ISDN, and telecom network.

Full Access
Question # 13

Which two statements are correct when traffic matches the implicit SD-WAN rule? (Choose two.)

A.

The sdwan_service_id flag in the session information is 0.

B.

All SD-WAN rules have the default setting enabled.

C.

Traffic does not match any of the entries in the policy route table.

D.

Traffic is load balanced using the algorithm set for the v4-ecmp-mode setting.

Full Access
Question # 14

Refer to the exhibit.

Based on the exhibit, which two statements are correct about the health of the selected members? (Choose two.)

A.

After FortiGate switches to active mode, FortiGate never fails back to passive monitoring.

B.

During passive monitoring, FortiGate can’t detect dead members.

C.

FortiGate can offload the traffic that is subject to passive monitoring to hardware.

D.

FortiGate passively monitors the member if TCP traffic is passing through the member.

Full Access
Question # 15

Refer to the exhibit.

The exhibit shows the SD-WAN rule status and configuration.

Based on the exhibit, which change in the measured packet loss will make T_INET_1_0 the new preferred member?

A.

When all three members have the same packet loss.

B.

When T_INET_0_0 has 4% packet loss.

C.

When T_INET_0_0 has 12% packet loss.

D.

When T_INET_1_0 has 4% packet loss.

Full Access
Question # 16

Which two protocols in the IPsec suite are most used for authentication and encryption? (Choose two.)

A.

Encapsulating Security Payload (ESP)

B.

Secure Shell (SSH)

C.

Internet Key Exchange (IKE)

D.

Security Association (SA)

Full Access
Question # 17

Refer to the exhibit.

The exhibit shows the details of a session and the index numbers of some relevant interfaces on a FortiGate appliance that supports hardware offloading. Based on the information shown in the exhibits, which two statements about the session are true? (Choose two.)

A.

The reply direction of the asymmetric traffic flows from port2 to port3.

B.

The auxiliary session can be offloaded to hardware.

C.

The original direction of the symmetric traffic flows from port3 to port2.

D.

The main session cannot be offloaded to hardware.

Full Access
Question # 18

Refer to the exhibits.

Which two statements about the IPsec VPN configuration and the status of the IPsec VPN tunnel are true? (Choose two.)

A.

FortiGate does not install IPsec static routes for remote protected networks in the routing table.

B.

The phase 1 configuration supports the network-overlay setting.

C.

FortiGate facilitated the negotiation of the T_INET_1_0_0 ADVPN shortcut over T_INET_1_0.

D.

Dead peer detection is disabled.

Full Access
Question # 19

What is a benefit of using application steering in SD-WAN?

A.

The traffic always skips the regular policy routes.

B.

You steer traffic based on the detected application.

C.

You do not need to enable SSL inspection.

D.

You do not need to configure firewall policies that accept the SD-WAN traffic.

Full Access
Question # 20

Refer to the exhibits.

Exhibit A

Exhibit B -

Exhibit A shows the configuration for an SD-WAN rule and exhibit B shows the respective rule status, the routing table, and the member status.

The administrator wants to understand the expected behavior for traffic matching the SD-WAN rule.

Based on the exhibits, what can the administrator expect for traffic matching the SD-WAN rule?

A.

The traffic will be load balanced across all three overlays.

B.

The traffic will be routed over T_INET_0_0.

C.

The traffic will be routed over T_MPLS_0.

D.

The traffic will be routed over T_INET_1_0.

Full Access
Question # 21

Which best describes the SD-WAN traffic shaping mode that bases itself on a percentage of available bandwidth?

A.

Interface-based shaping mode

B.

Reverse-policy shaping mode

C.

Shared-policy shaping mode

D.

Per-IP shaping mode

Full Access
Copyright myexamcollection.com. All Right Reserved.