Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
Fortinet
NSE 7 Network Security Architect
NSE7_SDW-7.2
Fortinet NSE 7 - SD-WAN 7.2 Questions and Answers

Pass the Fortinet NSE 7 Network Security Architect NSE7_SDW-7.2 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam NSE7_SDW-7.2 Premium Access

View all detail and faqs for the NSE7_SDW-7.2 exam

Go to Exam

769 Students Passed

91% Average Score

91% Same Questions

Viewing page 2 out of 3 pages

Viewing questions 11-20 out of questions

Questions # 11:

Refer to the exhibits.

Question # 11

Exhibit A shows the packet duplication rule configuration, the SD-WAN zone status output, and the sniffer output on FortiGate acting as the sender. Exhibit B shows the sniffer output on a FortiGate acting as the receiver.

The administrator configured packet duplication on both FortiGate devices. The sniffer output on the sender FortiGate shows that FortiGate forwards an ICMP echo request packet over three overlays, but it only receives one reply packet through T_INET_1_0.

Based on the output shown in the exhibits, which two reasons can cause the observed behavior? (Choose two.)

Options:

On the receiver FortiGate,packet-de-duplicationis enabled.

The ICMP echo request packets sent over T_INET_0_0 and T_MPLS_0 were dropped along the way.

The ICMP echo request packets received over T_INET_0_0 and T_MPLS_0 were offloaded to NPU.

On the sender FortiGate,duplication-max-numis set to3.

Answer

A, D

Questions # 12:

Refer to the exhibit.

Question # 12

The exhibit shows the details of a session and the index numbers of some relevant interfaces on a FortiGate appliance that supports hardware offloading. Based on the information shown in the exhibits, which two statements about the session are true? (Choose two.)

Options:

The reply direction of the asymmetric traffic flows from port2 to port3.

The auxiliary session can be offloaded to hardware.

The original direction of the symmetric traffic flows from port3 to port2.

The main session cannot be offloaded to hardware.

Answer

A, B

Questions # 13:

Refer to the exhibit.

Question # 13

Based on the exhibit, which action does FortiGate take?

Options:

FortiGate bounces port5 after it detects all SD-WAN members as dead.

FortiGate fails over to the secondary device after it detects all SD-WAN members as dead.

FortiGate brings up port5 after it detects all SD-WAN members as alive.

FortiGate brings down port5 after it detects all SD-WAN members as dead.

Answer

Questions # 14:

What are two benefits of using forward error correction (FEC) in IPsec VPNs? (Choose two.)

Options:

FEC supports hardware offloading.

FEC improves reliability of noisy links.

FEC transmits parity packets that can be used to reconstruct packet loss.

FEC can leverage multiple IPsec tunnels for parity packets transmission.

Answer

B, C

Questions # 15:

Refer to the exhibits.

Question # 15

Exhibit A shows two IPsec templates to define Branch_IPsec_1 and Branch_IPsec_2. Each template defines a VPN tunnel.

Exhibit B shows the error message that FortiManager displayed when the administrator tried to assign the second template to the FortiGate device.

Which statement best explain the cause for this issue?

Options:

You can assign only one template with a tunnel of fype static to each FortiGate device

You can define only one IPsec tunnel from branch devices to HUB1.

You can assign only one IPsec template to each FortiGate device.

You should review the branch1_fgt configuration for the already configured tunnel with the name HUB1-VPN2.

Answer

Explanation

The error message in Exhibit B indicates a conflicting template assignment. This occurs because FortiManager does not allow the assignment of multiple IPsec templates thatdefine VPN tunnels with the same name or settings to the same FortiGate device. The conflict arises from trying to assign a second IPsec template to a device that already has one assigned. References: This is based on Fortinet's best practices and administrative guidelines which state that each FortiGate device should be assigned a unique IPsec template to avoid configuration conflicts.

Questions # 16:

Refer to the exhibit.

Question # 16

Which two SD-WAN template member settings support the use of FortiManager meta fields? (Choose two.)

Options:

Cost

Interface member

Priority

Gateway IP

Answer

B, D

Questions # 17:

Refer to the exhibit.

Question # 17

Which two statements about the IPsec VPN configuration and the status of the IPsec VPN tunnel are true? (Choose two.)

Options:

FortiGate does not install IPsec static routes for remote protected networks in the routing table.

The phase 1 configuration supports the network-overlay setting.

FortiGate facilitated the negotiation of the T_INET_1_0_0 ADVPN shortcut over T_INET_1_0.

Dead peer detection is disabled.

Answer

A, B

Questions # 18:

Which diagnostic command can you use to show the SD-WAN rules, interface information, and state?

diagnose sys sdwan service

diagnose sys sdwan route-tag-list

diagnose sys sdwan member

Options:

diagnose sys sdwan neighbor

Answer

Questions # 19:

Which three matching traffic criteria are available in SD-WAN rules? (Choose three.)

Options:

Type of physical link connection

Internet service database (ISDB) address object

Source and destination IP address

URL categories

Application signatures

Answer

B, C, E

Questions # 20:

Refer to the exhibit.

Question # 20

Based on the output shown in the exhibit, which two criteria on the SD-WAN member configuration can be used to select an outgoing interface in an SD-WAN rule? (Choose two.)