2024 NSE7_SDW-7.2 exam torrent NSE7_SDW-7.2 Study Guide
Easily pass NSE7_SDW-7.2 Exam with our Dumps & PDF Test Engine
NEW QUESTION # 25
Refer to the exhibit.
Two hub-and-spoke groups are connected through a site-to-site IPsec VPN between Hub 1 and Hub 2.
Which two configuration settings are required for Toronto and London spokes to establish an ADVPN
shortcut? (Choose two.)
- A. auto-discovery-forwardermust be enabled on all IPsec VPNs.
- B. On the hubs,auto-discovery-sendermust be enabled on the IPsec VPNs to spokes.
- C. On the spokes,auto-discovery-receivermust be enabled on the IPsec VPN to the hub.
- D. On the hubs,net-devicemust be enabled on all IPsec VPNs.
Answer: B,C
NEW QUESTION # 26
Refer to the exhibit.
An administrator is troubleshooting SD-WAN on FortiGate. A device behind branch1_fgt generates traffic to
the 10.0.0.0/8 network. The administrator expects the traffic to match SD-WAN rule ID 1 and be routed over
T_INET_0_0. However, the traffic is routed over T_INET_1_0.
Based on the output shown in the exhibit, which two reasons can cause the observed behavior? (Choose two.)
- A. T_INET_1_0 has a lower route priority value (higher priority) than T_INET_0_0.
- B. The traffic matches a regular policy route configured with T_INET_1_0 as the outgoing device.
- C. T_INET_0_0 does not have a valid route to the destination.
- D. T_INET_1_0 has a higher member configuration priority than T_INET_0_0.
Answer: B,C
NEW QUESTION # 27
Refer to the exhibit.
The exhibit shows the details of a session and the index numbers of some relevant interfaces on a FortiGate appliance that supports hardware offloading. Based on the information shown in the exhibits, which two statements about the session are true? (Choose two.)
- A. The original direction of the symmetric traffic flows from port3 to port2.
- B. The auxiliary session can be offloaded to hardware.
- C. The main session cannot be offloaded to hardware.
- D. The reply direction of the asymmetric traffic flows from port2 to port3.
Answer: B,D
NEW QUESTION # 28
Exhibit.
Which conclusion about the packet debug flow output is correct?
- A. The packet size exceeded the outgoing interface MTU.
- B. The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.
- C. The total number of daily sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.
- D. The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the firewall policy, and the packet was dropped.
Answer: B
Explanation:
In a Per-IP shaper configuration, if an IP address exceeds the configured concurrent session limit, the message
"Denied by quota check" appears. SD-WAN 7.0 Study Guide page 287
NEW QUESTION # 29
Refer to the exhibit.
Based on the exhibit, which two actions does FortiGate perform on sessions after a firewall policy change?
(Choose two.)
- A. FortiGate terminates the old sessions.
- B. FortiGate does not change existing sessions.
- C. FortiGate flushes all sessions.
- D. FortiGate evaluates new sessions.
Answer: B,D
Explanation:
FortiGate not to flag existing impacted session as dirty by setting firewall-session-dirty to check new. The results is that FortiGate evaluates only new session against the new firewall policy.
NEW QUESTION # 30
Which statement about SD-WAN zones is true?
- A. You cannot use an SD-WAN zone in static route definitions.
- B. An SD-WAN zone can contain between 0 and 512 members.
- C. An SD-WAN zone can contain only one type of interface.
- D. You can configure up to 32 SD-WAN zones per VDOM.
Answer: D
Explanation:
SD-WAN zones are a group of interfaces that share the same SD-WAN settings, such as health check, SLA, and load balancing. Some characteristics of SD-WAN zones are:
An SD-WAN zone can contain different types of interfaces, such as physical, VLAN, aggregate, and tunnel interfaces1.
An SD-WAN zone can contain up to 512 members1.
You can use an SD-WAN zone in static route definitions, as long as the destination interface is also an SD-WAN zone1.
You can configure up to 32 SD-WAN zones per VDOM1.
NEW QUESTION # 31
Which statement is correct about SD-WAN and ADVPN?
- A. SD-WAN can steer traffic to ADVPN shortcuts, established over IPsec overlays, configured as SD-WAN members.
- B. You must use IKEv2 on IPsec tunnels.
- C. Routes for ADVPN shortcuts must be manually configured.
- D. SD-WAN does not monitor the health and performance of ADVPN shortcuts.
Answer: A
NEW QUESTION # 32
Which are three key routing principles in SD-WAN? (Choose three.)
- A. By default, SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member.
- B. SD-WAN rules have precedence over ISDB routes.
- C. By default, SD-WAN members are skipped if they do not have a valid route to the destination.
- D. Regular policy routes have precedence over SD-WAN rules.
- E. FortiGate performs route lookups for new sessions only.
Answer: A,C,D
Explanation:
Study Guide 7.2, pages 125, 129, 151
NEW QUESTION # 33
Refer to the exhibit.
Based on the output shown in the exhibit, which two criteria on the SD-WAN member configuration can be
used to select an outgoing interface in an SD-WAN rule? (Choose two.)
- A. Set priority 10.
- B. Set cost 15.
- C. Set source 100.64.1.1.
- D. Set load-balance-mode source-ip-ip-based.
Answer: A,B
NEW QUESTION # 34
Refer to the exhibits.
Exhibit A shows the packet duplication rule configuration, the SD-WAN zone status output, and the sniffer
output on FortiGate acting as the sender. Exhibit B shows the sniffer output on a FortiGate acting as the
receiver.
The administrator configured packet duplication on both FortiGate devices. The sniffer output on the sender
FortiGate shows that FortiGate forwards an ICMP echo request packet over three overlays, but it only receives
one reply packet through T_INET_1_0.
Based on the output shown in the exhibits, which two reasons can cause the observed behavior? (Choose two.)
- A. The ICMP echo request packets received over T_INET_0_0 and T_MPLS_0 were offloaded to NPU.
- B. The ICMP echo request packets sent over T_INET_0_0 and T_MPLS_0 were dropped along the way.
- C. On the sender FortiGate,duplication-max-numis set to3.
- D. On the receiver FortiGate,packet-de-duplicationis enabled.
Answer: C,D
NEW QUESTION # 35
Refer to the exhibits.
Exhibit A
Exhibit B -
Exhibit A shows the configuration for an SD-WAN rule and exhibit B shows the respective rule status, the
routing table, and the member status.
The administrator wants to understand the expected behavior for traffic matching the SD-WAN rule.
Based on the exhibits, what can the administrator expect for traffic matching the SD-WAN rule?
- A. The traffic will be routed over T_INET_1_0.
- B. The traffic will be routed over T_INET_0_0.
- C. The traffic will be routed over T_MPLS_0.
- D. The traffic will be load balanced across all three overlays.
Answer: A
NEW QUESTION # 36
Which statement about SD-WAN zones is true?
- A. You cannot use an SD-WAN zone in static route definitions.
- B. An SD-WAN zone can contain between 0 and 512 members.
- C. An SD-WAN zone can contain only one type of interface.
- D. You can configure up to 32 SD-WAN zones per VDOM.
Answer: D
Explanation:
Explanation
SD-WAN zones are a group of interfaces that share the same SD-WAN settings, such as health check, SLA,
and load balancing. Some characteristics of SD-WAN zones are:
An SD-WAN zone can contain different types of interfaces, such as physical, VLAN, aggregate, and
tunnel interfaces1.
An SD-WAN zone can contain up to 512 members1.
You can use an SD-WAN zone in static route definitions, as long as the destination interface is also an
SD-WAN zone1.
You can configure up to 32 SD-WAN zones per VDOM1.
NEW QUESTION # 37
Which components make up the secure SD-WAN solution?
- A. FortiGate, FortiManager, FortiAnalyzer, and FortiDeploy
- B. Application, antivirus, and URL, and SSL inspection
- C. Telephone, ISDN, and telecom network.
- D. Datacenter, branch offices, and public cloud
Answer: A
NEW QUESTION # 38
Which are two benefits of using CLI templates in FortiManager? (Choose two.)
- A. You can configure interfaces as SD-WAN members without having to remove references first.
- B. You can reference meta fields.
- C. You can configure FortiManager to sync local configuration changes made on the managed device, to the CLI template.
- D. You can configure advanced CLI settings.
Answer: B,D
NEW QUESTION # 39
Refer to the exhibit.
The device exchanges routes using IBGP.
Which two statements are correct about the IBGP configuration and routing information on the device?
(Choose two.)
- A. Each BGP route is three hops away from the destination.
- B. ibgp-multipath is disabled.
- C. You can run the get router info routing-table database command to display the additional paths.
- D. additional-path is enabled.
Answer: C,D
NEW QUESTION # 40
Refer to the exhibit.
Which two statements about the IPsec VPN configuration and the status of theIPsec VPNtunnel are true?
(Choose two.)
- A. FortiGate does not install IPsec static routes for remote protected networks in the routing table. Most
Voted - B. Dead peer detection is disabled.
- C. FortiGate facilitated the negotiation of the T_INET_1_0_0 ADVPN shortcut over T_INET_1_0.
- D. The phase 1 configuration supports the network-overlay setting. Most Voted
Answer: A,D
NEW QUESTION # 41
Which diagnostic command can you use to show the configured SD-WAN zones and their assigned members?
- A. diagnose sys sdwan zone
- B. diagnose sys sdwan service
- C. diagnose sys sdwan member
- D. diagnose sys sdwan interface
Answer: A
NEW QUESTION # 42
Refer to the exhibit.
Based on the exhibit, which two actions does FortiGate perform on traffic passing through port2? (Choose
two.)
- A. FortiGate flushes all routing information from the session table, after a route change.
- B. FortiGate always blocks all traffic, after a route change.
- C. FortiGate performs routing lookups for new sessions only, after a route change.
- D. FortiGate does not change the routing information on existing sessions that use a valid gateway, after a
route change.
Answer: C,D
NEW QUESTION # 43
Refer to the exhibit.
Which configuration change is required if the responder FortiGate uses a dynamic routing protocol to
exchange routes over IPsec?
- A. add-route must be disabled.
- B. mode-cfg must be enabled.
- C. exchange-interface-ip must be enabled.
- D. type must be set to static.
Answer: A
NEW QUESTION # 44
Refer to the exhibit.
Based on the exhibit, which statement about FortiGate re-evaluating traffic is true?
- A. Changes have been made on firewall policy ID 1 on FortiGate.
- B. The type of traffic defined and allowed on firewall policy ID 1 is UDP.
- C. FortiGate has terminated the session after a change on policy ID 1.
- D. Firewall policy ID 1 has source NAT disabled.
Answer: A
NEW QUESTION # 45
Which two statements are correct when traffic matches the implicit SD-WAN rule? (Choose two.)
- A. Traffic is load balanced using the algorithm set for the v4-ecmp-mode setting.
- B. Traffic does not match any of the entries in the policy route table.
- C. The sdwan_service_id flag in the session information is 0.
- D. All SD-WAN rules have the default setting enabled.
Answer: B,C
Explanation:
sdwan_service_id is 0 = match SD-WAN implicit rule, study guide 7.0 page 120, 7.2 page 149 SD-WAN rules internally are interpreted as a Policy route, so when the traffic doesn't match with any policy route, it will be flowing by implict policy.
NEW QUESTION # 46
Which two statements are true about using SD-WAN to steer local-out traffic? (Choose two.)
- A. By default, local-out traffic does not use SD-WAN.
- B. FortiGate does not consider the source address of the packet when matching an SD-WAN rule for
local-out traffic. - C. You must configure each local-out feature individually, to use SD-WAN.
- D. By default, FortiGate does not check if the selected member has a valid route to the destination.
Answer: A,C
NEW QUESTION # 47
Refer to the exhibit.
Which configuration change is required if the responder FortiGate uses a dynamic routing protocol to exchange routes over IPsec?
- A. add-route must be disabled.
- B. mode-cfg must be enabled.
- C. exchange-interface-ip must be enabled.
- D. type must be set to static.
Answer: A
NEW QUESTION # 48
Refer to the exhibits.
Exhibit A -
Exhibit B -
Exhibit A shows the SD-WAN performance SLA and exhibit B shows the SD-WAN member status, the routing table, and the performance SLA status.
If port2 is detected dead by FortiGate, what is the expected behavior?
- A. Port2 becomes alive after three successful probes are detected.
- B. The administrator manually restores the static routes for port2, if port2 becomes alive.
- C. FortiGate removes all static routes for port2.
- D. Host 8.8.8.8 is reachable through port1 and port2.
Answer: C
Explanation:
This is due to Update static route is enable which removes the static route entry referencing the interface if the interface is dead
NEW QUESTION # 49
Which are three key routing principles in SD-WAN? (Choose three.)
- A. By default, SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member.
- B. SD-WAN rules have precedence over ISDB routes.
- C. By default, SD-WAN members are skipped if they do not have a valid route to the destination.
- D. Regular policy routes have precedence over SD-WAN rules.
- E. FortiGate performs route lookups for new sessions only.
Answer: A,C,D
Explanation:
Explanation
Study Guide 7.2, pages 125, 129, 151
NEW QUESTION # 50
......
NSE7_SDW-7.2 PDF Pass Leader, NSE7_SDW-7.2 Latest Real Test: https://www.dumpsmaterials.com/NSE7_SDW-7.2-real-torrent.html
Valid NSE7_SDW-7.2 Test Answers & NSE7_SDW-7.2 Exam PDF: https://drive.google.com/open?id=1T0KQlrTHg40_zjlbOtZlAt1TB8Wbnzq7
