Fortinet NSE7_SDW-7.2 Exam Practice Test Instant Access

Question 1

Refer to the exhibit.

Which statement about the role of the ADVPN device in handling traffic is true?

AAn IKE session is established between 10.0.1.101 and 10.0.2.101 in the process of forming a shortcut tunnel.

BThis is a hub that has received an offer from a spoke and has forwarded it to another spoke.

CTwo spokes. 192.2. 1 and 10.0.2.101. establish a shortcut.

DThis is a spoke that has received an offer from a remote hub.

Answer : D

Question 2

Within IPsec tunnel templates available on FortiManager. which template will you use to configure static tunnels for a hub and spoke topology?

AStatic_IPsec_Recommended

BHub_IPsec_Recommended

CBranch_IPsec_Recommended

DIPsec_Fortinet_Recommended

Answer : C

Recommended templates will allow you to prepare a template for IPsec tunnels using Fortinet recommended settings for phase1 and phase2 parameters.

* The IPsec_Fortinet_Recommended template defines a template for a static point-to-point tunnel

* The BRANCH_IPsec_Recommended template defines a template for a static tunnel (with a known remote IP address)

* The HUB_IPsec_Recommended template defines a template for a dynamic tunnel (an IPsec hub for dial-up tunnels)

Question 3

Exhibit A shows the firewall policy and exhibit B shows the traffic shaping policy.

The traffic shaping policy is being applied to all outbound traffic; however, inbound traffic is not being evaluated by the shaping policy.

Based on the exhibits, what configuration change must be made in which policy so that traffic shaping can be applied to inbound traffic?

ACreate a new firewall policy, and the select the SD-WAN zone as Incoming Interface.

BIn the traffic shaping policy, select Assign Shaping Class ID as Action.

CIn the firewall policy, select Proxy-based as Inspection Mode.

DIn the traffic shaping policy, enable Reverse shaper, and then select the traffic shaper to use.

Answer : D

Question 4

Which two statements reflect the benefits of implementing the ADVPN solution to replace conventional VPN topologies? (Choose two.)

AIt creates redundant tunnels between hub-and-spokes, in case failure takes place on the primary links.

BIt dynamically assigns cost and weight between the hub and the spokes, based on the physical distance.

CIt ensures that spoke-to-spoke traffic no longer needs to flow through the tunnels through the hub.

DIt provides direct connectivity between all sites by creating on-demand tunnels between spokes.

Answer : C, D

Question 5

Which statement about using BGP routes in SD-WAN is true?

ALearned routes can be used as dynamic destinations in SD-WAN rules.

BYou must use BGP to route traffic for both overlay and underlay links.

CYou must configure AS path prepending.

DYou must use external BGP.

Answer : A

Question 6

Refer to the exhibit.

Based on the exhibit, which two actions does FortiGate perform on sessions after a firewall policy change? (Choose two.)

AFortiGate flushes all sessions.

BFortiGate terminates the old sessions.

CFortiGate does not change existing sessions.

DFortiGate evaluates new sessions.

Answer : C, D

FortiGate not to flag existing impacted session as dirty by setting firewall-session-dirty to check new. The results is that FortiGate evaluates only new session against the new firewall policy.

Question 7

Which two statements are correct when traffic matches the implicit SD-WAN rule? (Choose two.)

AThe session information output displays no SD-WAN-specific details.

BAll SD-WAN rules have the default and gateway setting enabled.

CTraffic does not match any of the entries in the policy route table.

DTraffic is load balanced using the algorithm set for the v4-ecmp-mode setting.

Answer : A, C

Fortinet NSE7_SDW-7.2 Fortinet NSE 7 - SD-WAN 7.2 Exam Practice Test