Fortinet NSE7_SDW-7.2 Exam Practice Test Instant Access

Question 1

Which two statements describe how IPsec phase 1 main mode id different from aggressive mode when performing IKE negotiation? (Choose two.)

AA peer ID is included in the first packet from the initiator, along with suggested security policies.

BXAuth is enabled as an additional level of authentication, which requires a username and password.

CThree packets are exchanged between an initiator and a responder instead of six packets.

DThe use of Diffie Hellman keys is limited by the responder and needs initiator acceptance.

Answer : A, C

Question 2

Refer to the Exhibits:

Exhibit A, which shows the SD-WAN performance SLA and exhibit B shows the health of the participating SD-WAN members.

Based on the exhibits, which statement is correct?

AThe dead member interface stays unavailable until an administrator manually brings the interface back.

BPort2 needs to wait 500 milliseconds to change the status from alive to dead.

CStatic routes using port2 are active in the routing table.

DFortiGate has not received three consecutive requests from the SLA server configured for port2.

Answer : C

Question 3

Which action fortigate performs on the traffic that is subject to a per-IP traffic shaper of 10 Mbps?

AFortiGate applies traffic shaping to the original traffic direction only.

BFortiGate shares 10 Mbps of bandwidth equally among all source IP addresses.
RIAS

CFortigate limits each source ip address to a maximum bandwidth of 10 Mbps.

DFortiGate guarantees a minimum of 10 Mbps of bandwidth to each source IP address.

Answer : C

Question 4

Which diagnostic command can you use to show the SD-WAN rules, interface information, and state?

Adiagnose sys sdwan service

Bdiagnose sys sdwan route-tag-list

Cdiagnose sys sdwan member

Ddiagnose sys sdwan neighbor

Answer : A

Question 5

Refer to the exhibit.

Based on the exhibit, which two statements are correct about the health of the selected members? (Choose two.)

AAfter FortiGate switches to active mode, FortiGate never fails back to passive monitoring.

BDuring passive monitoring, FortiGate can't detect dead members.

CFortiGate can offload the traffic that is subject to passive monitoring to hardware.

DFortiGate passively monitors the member if TCP traffic is passing through the member.

Answer : B, D

Question 6

Which statement is correct about SD-WAN and ADVPN?

ARoutes for ADVPN shortcuts must be manually configured.

BSD-WAN can steer traffic to ADVPN shortcuts, established over IPsec overlays, configured as SD-WAN members.

CSD-WAN does not monitor the health and performance of ADVPN shortcuts.

DYou must use IKEv2 on IPsec tunnels.

Answer : B

'SD-WAN supports ADVPN shortcuts. For this, SD-WAN automatically steers the traffic through shortcuts and monitors their health and performance. You add the parent tunnel as member, and after the shortcut is negotiated, SD-WAN automatically starts steering traffic through the shortcut.'

Question 7

Refer to the exhibits.

Exhibit A

Exhibit B

Exhibit A shows an SD-WAN event log and exhibit B shows the member status and the SD-WAN rule configuration.

Based on the exhibits, which two statements are correct? (Choose two.)

AFortiGate updated the outgoing interface list on the rule so it prefers port2.

BPort2 has the highest member priority.

CPort2 has a lower latency than port1.

DSD-WAN rule ID 1 is set to lowest cost (SLA) mode.

Answer : A, C

Fortinet NSE7_SDW-7.2 Fortinet NSE 7 - SD-WAN 7.2 Exam Practice Test