Fortinet NSE7_SDW-7.2 Cert Guide PDF 100% Cover Real Exam Questions
Pass NSE7_SDW-7.2 Exam - Real Questions and Answers
Fortinet NSE7_SDW-7.2 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 51
Refer to the exhibits.
Exhibit A shows a policy package definition Exhibit B shows the install log that the administrator received when he tried to install the policy package on FortiGate devices.
Based on the output shown in the exhibits, what can the administrator do to solve the Issue?
- A. Use a metadata variable instead of a dynamic interface to define the firewall policy.
- B. Create dynamic mapping for the LAN interface for all devices in the installation target list.
- C. Dynamic mapping should be done automatically. Review the LAN interface configuration for branch2_fgt.
- D. Policies can refer to only one LAN source interface. Keep only the D-LAN, which is the dynamic LAN interface.
Answer: B
NEW QUESTION # 52
Refer to the exhibit.
The device exchanges routes using IBGP.
Which two statements are correct about the IBGP configuration and routing information on the device?
(Choose two.)
- A. You can run the get router info routing-table database command to display the additional paths.
- B. additional-path is enabled.
- C. Each BGP route is three hops away from the destination.
- D. ibgp-multipath is disabled.
Answer: A,B
NEW QUESTION # 53
Which two interfaces are considered overlay links? (Choose two.)
- A. LAG
- B. Physical
- C. GRE
- D. IPsec
Answer: C,D
NEW QUESTION # 54
Refer to the exhibit.
The device exchanges routes using IBGP.
Which two statements are correct about the IBGP configuration and routing information on the device? (Choose two.)
- A. You can run the get router info routing-table database command to display the additional paths.
- B. additional-path is enabled.
- C. Each BGP route is three hops away from the destination.
- D. ibgp-multipath is disabled.
Answer: A,B
NEW QUESTION # 55
Refer to the exhibits.
Exhibit A shows two IPsec templates to define Branch_IPsec_1 and Branch_IPsec_2. Each template defines a VPN tunnel.
Exhibit B shows the error message that FortiManager displayed when the administrator tried to assign the second template to the FortiGate device.
Which statement best explain the cause for this issue?
- A. You can assign only one template with a tunnel of fype static to each FortiGate device
- B. You should review the branch1_fgt configuration for the already configured tunnel with the name HUB1-VPN2.
- C. You can assign only one IPsec template to each FortiGate device.
- D. You can define only one IPsec tunnel from branch devices to HUB1.
Answer: B
Explanation:
The error message indicates that there is a conflict between the IPsec templates Branch_IPsec_1 and Branch_IPsec_2 for the device branch1_fgt. This means that the device already has an IPsec tunnel with the name HUB1-VPN2 configured, and the second template is trying to assign the same name to another tunnel.
This is not allowed, as each IPsec tunnel must have a unique name. Therefore, the administrator should review the branch1_fgt configuration and either delete or rename the existing tunnel with the name HUB1-VPN2 before assigning the second template. References = IPsec tunnel templates, IPsec VPN template
6.4.3, Understand and Use Debug Commands to Troubleshoot IPsec, L2L VPN TroubleShooting :"IPSec policy invalidated proposal with error ...
NEW QUESTION # 56
Refer to the exhibit.
Based on the output, which two conclusions are true? (Choose two.)
- A. There is more than one SD-WAN rule configured.
- B. Entry 1(id=1) is a regular policy route.
- C. The SD-WAN rules take precedence over regular policy routes.
- D. The all_rules rule represents the implicit SD-WAN rule.
Answer: A,B
NEW QUESTION # 57
Refer to the exhibit.
An administrator is troubleshooting SD-WAN on FortiGate. A device behind branch1_fgt generates traffic to the 10.0.0.0/8 network. The administrator expects the traffic to match SD-WAN rule ID 1 and be routed over T_INET_0_0. However, the traffic is routed over T_INET_1_0.
Based on the output shown in the exhibit, which two reasons can cause the observed behavior? (Choose two.)
- A. T_INET_1_0 has a lower route priority value (higher priority) than T_INET_0_0.
- B. The traffic matches a regular policy route configured with T_INET_1_0 as the outgoing device.
- C. T_INET_0_0 does not have a valid route to the destination.
- D. T_INET_1_0 has a higher member configuration priority than T_INET_0_0.
Answer: B,C
NEW QUESTION # 58
Which statement about SD-WAN zones is true?
- A. You cannot use an SD-WAN zone in static route definitions.
- B. An SD-WAN zone can contain only one type of interface.
- C. You can configure up to 32 SD-WAN zones per VDOM.
- D. An SD-WAN zone can contain between 0 and 512 members.
Answer: C
Explanation:
SD-WAN zones are a group of interfaces that share the same SD-WAN settings, such as health check, SLA, and load balancing. Some characteristics of SD-WAN zones are:
An SD-WAN zone can contain different types of interfaces, such as physical, VLAN, aggregate, and tunnel interfaces1.
An SD-WAN zone can contain up to 512 members1.
You can use an SD-WAN zone in static route definitions, as long as the destination interface is also an SD-WAN zone1.
You can configure up to 32 SD-WAN zones per VDOM1.
NEW QUESTION # 59
Refer to the exhibits.
Exhibit A
Exhibit B
Exhibit A shows the SD-WAN performance SLA configuration, the SD-WAN rule configuration, and the application IDs of Facebook and YouTube. Exhibit B shows the firewall policy configuration and the underlay zone status.
Based on the exhibits, which two statements are correct about the health and performance of port1 and port2? (Choose two.)
- A. FortiGate identifies the member as dead when there is no Facebook and YouTube traffic passing through the member.
- B. FortiGate is unable to measure jitter and packet loss on Facebook and YouTube traffic.
- C. Non-TCP Facebook and YouTube traffic are not used for performance measurement.
- D. The performance is an average of the metrics measured for Facebook and YouTube traffic passing through the member.
Answer: C,D
Explanation:
Study Guide 7.2, pages 103 - 104. Another comment said "because without using application Control on the firewall policy, SDWAN can't work" but there is a app control "default" defined on config.
NEW QUESTION # 60
Exhibit.
The exhibit shows VPN event logs on FortiGate. In the output shown in the exhibit, which statement is true?
- A. There are no IPsec tunnel statistics log messages for ADVPN cuts.
- B. The master tunnel T_INET_0 cannot accept the ADVPN shortcut.
- C. There is one shortcut tunnel built from master tunnel T_MPLS_0.
- D. The VPN tunnel T_MPLS_0 is a shortcut tunnel.
Answer: C
Explanation:
VPN event logs record the status of VPN tunnels, such as the establishment, termination, or failure of a tunnel. The output includes the following information:
* logid: the log ID number
* type: the log type, either traffic or event
* subtype: the log subtype, either vpn or ipsec
* level: the log level, either error, warning, or notice
* vd: the virtual domain name
* logdesc: the log description
* msg: the log message
* action: the log action, such as tunnel-up, tunnel-down, or tunnel-stats
* remip: the remote IP address
* locip: the local IP address
* remport: the remote port number
* locport: the local port number
* outintf: the outgoing interface name
* cookies: the IKE SA cookies
* user: the user name
* group: the user group name
* useralt: the alternative user name
* xauthuser: the XAuth user name
* authgroup: the XAuth user group name
* assignip: the assigned IP address
* vpntunnel: the VPN tunnel name
* tunnellip: the tunnel loopback IP address
* tunnelid: the tunnel ID number
* tunneltype: the tunnel type, either ipsec or ssl
* duration: the tunnel duration in seconds
* sentbyte: the number of bytes sent
* rcvdbyte: the number of bytes received
* nextstat: the next statistics interval in seconds
* advpnsc: the ADVPN shortcut flag, either 0 or 1
Based on the exhibit, the following statement is true:
* There is one shortcut tunnel built from master tunnel T_MPLS_0. This means that the VPN tunnel T_MPLS_0 is a master tunnel that can send ADVPN shortcut offers to other spokes, and the VPN tunnel T_MPLS_0_0 is a shortcut tunnel that is built from the master tunnel T_MPLS_01. In the exhibit, the log action for T_MPLS_0 is tunnel-up, and the log action for T_MPLS_0_0 is shortcut-up.
The advpnsc flag for T_MPLS_0 is 0, indicating that it is not a shortcut tunnel, while the advpnsc flag for T_MPLS_0_0 is 1, indicating that it is a shortcut tunnel.
NEW QUESTION # 61 
Two hub-and-spoke groups are connected through a site-to-site IPsec VPN between Hub 1 and Hub 2. The administrator configured ADVPN on both hub-and-spoke groups.
Which two outcomes are expected if a user in Toronto sends traffic to London? (Choose two.)
- A. London generates an IKE information message that contains the Toronto public IP address.
- B. The first packets from Toronto to London are routed through Hub 1 then to Hub 2.
- C. Toronto needs to establish a site-to-site tunnel with Hub 2 to bypass Hub 1.
- D. Traffic from Toronto to London triggers the dynamic negotiation of a direct site-to-site VPN.
Answer: B,D
NEW QUESTION # 62
Which statement about using BGP for ADVPN is true?
- A. You must configure AS path prepending.
- B. IBGP is preferred over EBGP, because IBGP preserves next hop information.
- C. You must use BGP to route traffic for both overlay and underlay links.
- D. You must configure BGP communities.
Answer: B
Explanation:
ADVPN is a technology that allows dynamic creation of IPsec tunnels between branch sites without requiring pre-configured policies or keys. BGP is a routing protocol that can be used to exchange routes between ADVPN peers. IBGP is a type of BGP that runs between routers in the same autonomous system (AS), while EBGP is a type of BGP that runs between routers in different ASes. IBGP is preferred over EBGP for ADVPN, because IBGP preserves the next hop information of the routes, which is needed to establish the IPsec tunnels. EBGP changes the next hop information to the EBGP peer address, which may not be reachable by the ADVPN peers. Therefore, using IBGP for ADVPN avoids the need to configure additional static routes or redistribute routes between BGP and another routing protocol. References = ADVPN with BGP as the routing protocol, ADVPN, SD-WAN self-healing with BGP, Technical Tip: ADVPN with BGP as the routing protocol The statement that IBGP is preferred over EBGP for ADVPN because IBGP preserves next hop information (D) is true. In a typical ADVPN deployment, it's beneficial to maintain next hop information across the network to ensure proper routing and optimal path selection. References: This understanding comes from my knowledge of Fortinet's SD-WAN and ADVPN configurations, where BGP's behavior in terms of next hop preservation is a key consideration.
NEW QUESTION # 63
Exhibit.
The exhibit shows VPN event logs on FortiGate. In the output shown in the exhibit, which statement is true?
- A. There are no IPsec tunnel statistics log messages for ADVPN cuts.
- B. The master tunnel T_INET_0 cannot accept the ADVPN shortcut.
- C. There is one shortcut tunnel built from master tunnel T_MPLS_0.
- D. The VPN tunnel T_MPLS_0 is a shortcut tunnel.
Answer: C
Explanation:
VPN event logs record the status of VPN tunnels, such as the establishment, termination, or failure of a tunnel.
The output includes the following information:
logid: the log ID number
type: the log type, either traffic or event
subtype: the log subtype, either vpn or ipsec
level: the log level, either error, warning, or notice
vd: the virtual domain name
logdesc: the log description
msg: the log message
action: the log action, such as tunnel-up, tunnel-down, or tunnel-stats remip: the remote IP address locip: the local IP address remport: the remote port number locport: the local port number outintf: the outgoing interface name cookies: the IKE SA cookies user: the user name group: the user group name useralt: the alternative user name xauthuser: the XAuth user name authgroup: the XAuth user group name assignip: the assigned IP address vpntunnel: the VPN tunnel name tunnellip: the tunnel loopback IP address tunnelid: the tunnel ID number tunneltype: the tunnel type, either ipsec or ssl duration: the tunnel duration in seconds sentbyte: the number of bytes sent rcvdbyte: the number of bytes received nextstat: the next statistics interval in seconds advpnsc: the ADVPN shortcut flag, either 0 or 1 Based on the exhibit, the following statement is true:
There is one shortcut tunnel built from master tunnel T_MPLS_0. This means that the VPN tunnel T_MPLS_0 is a master tunnel that can send ADVPN shortcut offers to other spokes, and the VPN tunnel T_MPLS_0_0 is a shortcut tunnel that is built from the master tunnel T_MPLS_01. In the exhibit, the log action for T_MPLS_0 is tunnel-up, and the log action for T_MPLS_0_0 is shortcut-up. The advpnsc flag for T_MPLS_0 is 0, indicating that it is not a shortcut tunnel, while the advpnsc flag for T_MPLS_0_0 is 1, indicating that it is a shortcut tunnel.
NEW QUESTION # 64
What three characteristics apply to provisioning templates available on FortiManager? (Choose three.)
- A. A template group can contain CLI templates of both types.
- B. You can apply a system template and a CLI template to the same FortiGate device.
- C. A CLI template can be of type CLI script or Perl script.
- D. A template group can include a system template and an SD-WAN template.
- E. Templates are applied in order, from top to bottom.
Answer: A,C,E
Explanation:
Explanation
According to the FortiManager Administration Guide, provisioning templates are used to configure FortiGate
devices in a consistent and efficient way. There are different types of templates, such as system, IPsec,
SD-WAN, certificate, and CLI templates. Some characteristics of provisioning templates are:
You can apply a system template and a CLI template to the same FortiGate device, as long as they do
not have conflicting settings1.
A CLI template can be of type CLI script or Perl script. A CLI script template contains FortiOS CLI
commands, while a Perl script template contains Perl code that can generate FortiOS CLI commands2.
A template group can include a system template and an SD-WAN template, as well as other types of
templates. A template group is a collection of templates that can be applied to multiple devices at once3.
A template group can contain CLI templates of both types, as long as they do not have conflicting
settings2.
Templates are applied in order, from top to bottom. The order of the templates in a template group
determines the order in which they are applied to the devices3.
NEW QUESTION # 65 
Exhibit B -
Exhibit A shows the system interface with the static routes and exhibit B shows the firewall policies on the managed FortiGate.
Based on the FortiGate configuration shown in the exhibits, what issue might you encounter when creating an SD-WAN zone for port1 and port2?
- A. port2 is referenced in a static route.
- B. port1 is referenced in a firewall policy.
- C. port1 is assigned a manual IP address.
- D. port1 and port2 are not administratively down.
Answer: B
NEW QUESTION # 66
Which CLI command do you use to perform real-time troubleshooting for ADVPN negotiation?
- A. diagnose vpn tunnel list
- B. get router info routing-table all
- C. get ipsec tunnel list
- D. diagnose debug application ike
Answer: D
NEW QUESTION # 67
Refer to the exhibits.
Exhibit A
Exhibit B
Exhibit A shows the SD-WAN performance SLA configuration, the SD-WAN rule configuration, and the application IDs of Facebook and YouTube. Exhibit B shows the firewall policy configuration and the underlay zone status.
Based on the exhibits, which two statements are correct about the health and performance of port1 and port2?
(Choose two.)
- A. FortiGate identifies the member as dead when there is no Facebook and YouTube traffic passing through the member.
- B. FortiGate is unable to measure jitter and packet loss on Facebook and YouTube traffic.
- C. Non-TCP Facebook and YouTube traffic are not used for performance measurement.
- D. The performance is an average of the metrics measured for Facebook and YouTube traffic passing through the member.
Answer: C,D
Explanation:
Study Guide 7.2, pages 103 - 104. Another comment said "because without using application Control on the firewall policy, SDWAN can't work" but there is a app control "default" defined on config.
NEW QUESTION # 68
Exhibit.
Which conclusion about the packet debug flow output is correct?
- A. The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.
- B. The packet size exceeded the outgoing interface MTU.
- C. The total number of daily sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.
- D. The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the firewall policy, and the packet was dropped.
Answer: A
Explanation:
In a Per-IP shaper configuration, if an IP address exceeds the configured concurrent session limit, the message
"Denied by quota check" appears. SD-WAN 7.0 Study Guide page 287
NEW QUESTION # 69
Refer to the exhibit, which shows an SD-WAN zone configuration on the FortiGate GUI.
Based on the exhibit, which statement is true?
- A. You can delete the virtual-wan-link zone because it contains no member.
- B. The corporate zone contains no member.
- C. You can move port1 from the underlay zone to the overlay zone.
- D. The overlay zone contains four members.
Answer: B
Explanation:
Based on the exhibit, the "corporate" zone contains no member (B). In the FortiGate GUI, zones without members do not display any interfaces listed under them, which is the case for the corporate zone in the exhibit. Reference: This conclusion is based on standard Fortinet GUI interpretation and the operational logic of SD-WAN zones as per Fortinet's guidelines and user interface standards.
NEW QUESTION # 70
Which two statements describe how IPsec phase 1 main mode id different from aggressive mode when performing IKE negotiation? (Choose two.)
- A. Three packets are exchanged between an initiator and a responder instead of six packets.
- B. A peer ID is included in the first packet from the initiator, along with suggested security policies.
- C. The use of Diffie Hellman keys is limited by the responder and needs initiator acceptance.
- D. XAuth is enabled as an additional level of authentication, which requires a username and password.
Answer: A,B
NEW QUESTION # 71
Refer to the exhibits.
Exhibit A
Exhibit B
Exhibit A shows the source NAT (SNAT) global setting and exhibit B shows the routing table on FortiGate.
Based on the exhibits, which two actions does FortiGate perform on existing sessions established over port2, if
the administrator increases the static route priority on port2 to 20? (Choose two.)
- A. FortiGate performs a route lookup for the original traffic only.
- B. FortiGate updates the gateway information of the sessions with SNAT so that they use port1 instead of port2.
- C. FortiGate continues routing the sessions with no SNAT, over port2.
- D. FortiGate flags the sessions as dirty.
Answer: B,D
NEW QUESTION # 72
......
100% Free NSE7_SDW-7.2 Daily Practice Exam With 101 Questions: https://actualtests.realvalidexam.com/NSE7_SDW-7.2-real-exam-dumps.html
