Real NSE7_SDW-7.2 Exam PDF Test Engine Practice Test Questions [Q41-Q64]

4/5 - (1 vote)

Real NSE7_SDW-7.2 Exam PDF Test Engine Practice Test Questions

Fortinet NSE7_SDW-7.2 Real 2026 Braindumps Mock Exam Dumps

Fortinet NSE7_SDW-7.2 Exam Syllabus Topics:

Topic	Details
Topic 1	Centralized Management: This area focuses on deploying and managing SD-WAN through FortiManager, including using IPsec templates and SD-WAN Overlay Templates. Mastery here demonstrates the abilities of Fortinet network and security professionals to streamline SD-WAN configuration, enhance security, and maintain consistent policies across multiple sites.
Topic 2	SD-WAN Configuration: This topic assesses skills of Fortinet network and security professionals in setting up basic SD-WAN environments, including configuring Direct Internet Access (DIA), SD-WAN Members, and Performance Service Level Agreements (SLAs). Proficiency here ensures the ability to design efficient and resilient SD-WAN configurations.
Topic 3	SD-WAN Overlay Design and Best Practices: It focuses on the deployment of hub-and-spoke IPsec topologies and configuring ADVPN. Proficiency in this topic ensures that Fortinet network and security professionals can implement effective and reliable SD-WAN overlays tailored to organizational needs.
Topic 4	SD-WAN Troubleshooting: Troubleshooting SD-WAN issues, including rules, routing, and ADVPN, is vital for maintaining network reliability. This section of the Fortinet NSE 7 – SD-WAN 7.2 exam tests the ability to diagnose and resolve SD-WAN problems using diagnostic commands and monitoring tools, ensuring robust and uninterrupted network operations.
Topic 5	Rules and Routing: Understanding SD-WAN Rules and Routing is crucial for directing traffic effectively. This topic of the NSE7_SDW-7.2 exam evaluates the capabilities of Fortinet network and security professionals to configure SD-WAN rules and routing.

Q41. Refer to the exhibit.

In a dual-hub hub-and-spoke SD-WAN deployment, which is a benefit of disabling theanti-replaysetting on the hubs?

It instructs the hub to disable the reordering of TCP packets on behalf of the receiver, to improve performance.

It instructs the hub to disable TCP sequence number check, which is required for TCP sessions originated from spokes to fail over back and forth between the hubs.

It instructs the hub to not check the ESP sequence numbers on IPsec traffic, to improve performance.

It instructs the hub to skip content inspection on TCP traffic, to improve performance.

Q42. Refer to the exhibits.
Exhibit A

Exhibit B

Exhibit A shows an SD-WAN event log and exhibit B shows the member status and the SD-WAN rule configuration.
Based on the exhibits, which two statements are correct? (Choose two.)

FortiGate updated the outgoing interface list on the rule so it prefers port2.

Port2 has the highest member priority.

Port2 has a lower latency than port1.

SD-WAN rule ID 1 is set to lowest cost (SLA) mode.

Q43. Refer to the exhibit.

Which configuration change is required if the responder FortiGate uses a dynamic routing protocol to exchange routes over IPsec?

type must be set to static.

mode-cfg must be enabled.

exchange-interface-ip must be enabled.

add-route must be disabled.

Q44. Refer to the exhibit, which shows the IPsec phase 1 configuration of a spoke.

What must you configure on the IPsec phase 1 configuration for ADVPN to work with SD-WAN?

You must set ike-version to 1.

You must enable net-device.

You must enable auto-discovery-sender.

You must disable idle-timeout.

Q45. Refer to the exhibit.

FortiGate has multiple dial-up VPN interfaces incoming on port1 that match only FIRST_VPN.
Which two configuration changes must be made to both IPsec VPN interfaces to allow incoming connections
to match all possible IPsec dial-up interfaces? (Choose two.)

Specify a unique peer ID for each dial-up VPN interface.

Use different proposals are used between the interfaces.

Configure the IKE mode to be aggressive mode.

Use unique Diffie Hellman groups on each VPN interface.

Q46. Refer to the exhibits.
Exhibit A

Exhibit B

Exhibit A shows an SD-WAN event log and exhibit B shows the member status and the SD-WAN rule configuration.
Based on the exhibits, which two statements are correct? (Choose two.)

FortiGate updated the outgoing interface list on the rule so it prefers port2.

Port2 has the highest member priority.

Port2 has a lower latency than port1.

SD-WAN rule ID 1 is set to lowest cost (SLA) mode.

Q47. Refer to the exhibit.

The exhibit shows the details of a session and the index numbers of some relevant interfaces on a FortiGate appliance that supports hardware offloading. Based on the information shown in the exhibits, which two statements about the session are true? (Choose two.)

The reply direction of the asymmetric traffic flows from port2 to port3.

The auxiliary session can be offloaded to hardware.

The original direction of the symmetric traffic flows from port3 to port2.

The main session cannot be offloaded to hardware.

Q48. Refer to the exhibits.

Exhibit A shows two IPsec templates to define Branch_IPsec_1 and Branch_IPsec_2. Each template defines a VPN tunnel.
Exhibit B shows the error message that FortiManager displayed when the administrator tried to assign the second template to the FortiGate device.
Which statement best explain the cause for this issue?

You can assign only one template with a tunnel of fype static to each FortiGate device

You can define only one IPsec tunnel from branch devices to HUB1.

You can assign only one IPsec template to each FortiGate device.

You should review the branch1_fgt configuration for the already configured tunnel with the name HUB1-VPN2.

Q49. Refer to the exhibit.

An administrator used the SD-WAN overlay template to prepare an IPsec configuration for a hub-and-spoke SD-WAN topology. The exhibit shows the installation preview for one FortiGate device. In the exhibit, which statement best describes the configuration applied to the FortiGate device?

It is a hub device. It can send ADVPN shortcut offers.

It is a spoke device that establishes dynamic IPsec tunnels to the hub. The subnet range is
10.10.128.0/23.

It is a spoke device that establishes dynamic IPsec tunnels to the hub. It can send ADVPN shortcut requests.

It is a hub device and will automatically discover the spoke devices that are in the SD-WAN topology.

Q50. Refer to the exhibit.

Based on the exhibit, which statement about FortiGate re-evaluating traffic is true?

The type of traffic defined and allowed on firewall policy ID 1 is UDP.

FortiGate has terminated the session after a change on policy ID 1.

Changes have been made on firewall policy ID 1 on FortiGate.

Firewall policy ID 1 has source NAT disabled.

Q51.

Which two conclusions for traffic that matches the traffic shaper are true? (Choose two.)

The traffic shaper drops packets if the bandwidth is less than 2500 KBps.

The measured bandwidth is less than 100 KBps.

The traffic shaper drops packets if the bandwidth exceeds 6250 KBps.

The traffic shaper limits the bandwidth of each source IP to a maximum of 6250 KBps.

Q52. Which two statements describe how IPsec phase 1 main mode is different from aggressive mode when
performing IKE negotiation? (Choose two )

A peer ID is included in the first packet from the initiator, along with suggested security policies.

XAuth is enabled as an additional level of authentication, which requires a username and password.

A total of six packets are exchanged between an initiator and a responder instead of three packets.

The use of Diffie Hellman keys is limited by the responder and needs initiator acceptance.

Q53. Exhibit.

Which conclusion about the packet debug flow output is correct?

The total number of daily sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.

The packet size exceeded the outgoing interface MTU.

The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.

The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the firewall policy, and the packet was dropped.

Q54. Refer to the exhibit.

Which statement explains the output shown in the exhibit?

FortiGate performed standard FIB routing on the session.

FortiGate will not re-evaluate the session following a firewall policy change.

FortiGate used 192.2.0.1 as the gateway for the original direction of the traffic.

FortiGate must re-evaluate the session due to routing change.

Q55. Exhibit.

Which conclusion about the packet debug flow output is correct?

The total number of daily sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions
configured in the traffic shaper, and the packet was dropped.

The packet size exceeded the outgoing interface MTU.

The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions
configured in the traffic shaper, and the packet was dropped.

The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions
configured in the firewall policy, and the packet was dropped.

Q56. Which statement about SD-WAN zones is true?

An SD-WAN zone can contain only one type of interface.

An SD-WAN zone can contain between 0 and 512 members.

You cannot use an SD-WAN zone in static route definitions.

You can configure up to 32 SD-WAN zones per VDOM.

Q57. Which diagnostic command can you use to show the member utilization statistics measured by performance SLAs for the last 10 minutes?

diagnose sys sdwan sla-log

diagnose ays sdwan health-check

diagnose sys sdwan intf-sla-log

diagnose sys sdwan log

Q58. Which three matching traffic criteria are available in SD-WAN rules? (Choose three.)

Type of physical link connection

Internet service database (ISDB) address object

Source and destination IP address

URL categories

Application signatures

Q59. Refer to the exhibit, which shows the IPsec phase 1 configuration of a spoke.

What must you configure on the IPsec phase 1 configuration for ADVPN to work with SD-WAN?

You must set ike-version to 1.

You must enable net-device.

You must enable auto-discovery-sender.

You must disable idle-timeout.

Q60. Refer to the exhibits.

Exhibit A shows the packet duplication rule configuration, the SD-WAN zone status output, and the sniffer output on FortiGate acting as the sender. Exhibit B shows the sniffer output on a FortiGate acting as the receiver.
The administrator configured packet duplication on both FortiGate devices. The sniffer output on the sender FortiGate shows that FortiGate forwards an ICMP echo request packet over three overlays, but it only receives one reply packet through T_INET_1_0.
Based on the output shown in the exhibits, which two reasons can cause the observed behavior? (Choose two.)

On the receiver FortiGate, packet-de-duplication is enabled.

The ICMP echo request packets sent over T_INET_0_0 and T_MPLS_0 were dropped along the way.

The ICMP echo request packets received over T_INET_0_0 and T_MPLS_0 were offloaded to NPU.

On the sender FortiGate, duplication-max-num is set to 3.

Q61. Refer to the exhibits.

An administrator is testing application steering in SD-WAN. Before generating test traffic, the administrator collected the information shown in exhibit A.
After generating GoToMeeting test traffic, the administrator examined the respective traffic log on FortiAnalyzer, which is shown in exhibit B. The administrator noticed that the traffic matched the implicit SD-WAN rule, but they expected the traffic to match rule ID 1.
Which two reasons explain why the traffic matched the implicit SD-WAN rule? (Choose two.)

FortiGate did not refresh the routing information on the session after the application was detected.

Port1 and port2 do not have a valid route to the destination.

Full SSL inspection is not enabled on the matching firewall policy.

The session 3-tuple did not match any of the existing entries in the ISDB application cache.

Q62. Refer to the exhibits.

Exhibit A shows the packet duplication rule configuration, the SD-WAN zone status output, and the sniffer
output on FortiGate acting as the sender. Exhibit B shows the sniffer output on a FortiGate acting as the
receiver.
The administrator configured packet duplication on both FortiGate devices. The sniffer output on the sender
FortiGate shows that FortiGate forwards an ICMP echo request packet over three overlays, but it only receives
one reply packet through T_INET_1_0.
Based on the output shown in the exhibits, which two reasons can cause the observed behavior? (Choose two.)

On the receiver FortiGate,packet-de-duplicationis enabled.

The ICMP echo request packets sent over T_INET_0_0 and T_MPLS_0 were dropped along the way.

The ICMP echo request packets received over T_INET_0_0 and T_MPLS_0 were offloaded to NPU.

On the sender FortiGate,duplication-max-numis set to3.

Q63. Refer to the exhibits.
Exhibit A –

Exhibit B –

Exhibit A shows the SD-WAN performance SLA and exhibit B shows the SD-WAN member status, the routing table, and the performance SLA status.
If port2 is detected dead by FortiGate, what is the expected behavior?