[Nov-2024] Updated Fortinet NSE7_SDW-7.2 Dumps – PDF & Online Engine
NSE7_SDW-7.2.pdf - Questions Answers PDF Sample Questions Reliable
Fortinet NSE7_SDW-7.2 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 53
Refer to the exhibit.
An administrator used the SD-WAN overlay template to prepare an IPsec configuration for a hub-and-spoke SD-WAN topology. The exhibit shows the installation preview for one FortiGate device. In the exhibit, which statement best describes the configuration applied to the FortiGate device?
- A. It is a hub device and will automatically discover the spoke devices that are in the SD-WAN topology.
- B. It is a spoke device that establishes dynamic IPsec tunnels to the hub. The subnet range is
10.10.128.0/23. - C. It is a spoke device that establishes dynamic IPsec tunnels to the hub. It can send ADVPN shortcut requests.
- D. It is a hub device. It can send ADVPN shortcut offers.
Answer: C
Explanation:
According to the SD-WAN 7.2 Study Guide, the SD-WAN overlay template simplifies the configuration of IPsec tunnels in a hub-and-spoke topology. The template defines the following parameters:
type: dynamic for spokes, static for hubs
interface: the WAN interface to use for the IPsec tunnel
network-overlay: enable for spokes, disable for hubs
network-id: a unique identifier for each spoke
auto-discovery-sender: enable for hubs, disable for spokes
auto-discovery-receiver: enable for spokes, disable for hubs
Based on the exhibit, the FortiGate device has the following configuration:
type: dynamic
interface: port1
network-overlay: enable
network-id: 5
auto-discovery-sender: disable
auto-discovery-receiver: enable
Therefore, the FortiGate device is a spoke that establishes dynamic IPsec tunnels to the hub. It also has the network-overlay and auto-discovery-receiver options enabled, which means it can send ADVPN shortcut requests to other spokes when it receives a shortcut offer from the hub
NEW QUESTION # 54
Refer to the exhibit.
The exhibit shows the BGP configuration on the hub in a hub-and-spoke topology. The administrator wants
BGP to advertise prefixes from spokes to other spokes over the IPsec overlays, including additional paths.
However, when looking at the spoke routing table, the administrator does not see the prefixes from other
spokes and the additional paths.
Based on the exhibit, which three settings must the administrator configure inside each BGP neighbor group so
spokes can learn other spokes prefixes and their additional paths? (Choose three.)
- A. Enablesoft-reconfiguration
- B. Setadditional-pathtosend
- C. Setadvertisement-intervalto the number of additional paths to advertise
- D. Setadv-additional-pathto the number of additional paths to advertise
- E. Enableroute-reflector-client
Answer: B,D,E
NEW QUESTION # 55
Refer to the exhibit.
Which conclusion about the packet debug flow output is correct?
- A. The original traffic exceeded the maximum bandwidth configured in the traffic shaper, and the packet
was dropped. - B. The reply traffic exceeded the maximum bandwidth configured in the traffic shaper, and the packet was
dropped. - C. The original traffic exceeded the maximum bandwidth of the outgoing interface, and the packet was
dropped. - D. The original traffic exceeded the maximum packets per second of the outgoing interface, and the packet
was dropped.
Answer: A
NEW QUESTION # 56
Which two settings can you configure to speed up routing convergence in BGP? (Choose two.)
- A. holdtime-timer
- B. link-down-failover
- C. update-source
- D. set-route-tag
Answer: A,B
NEW QUESTION # 57
Which best describes the SD-WAN traffic shaping mode that bases itself on a percentage of available bandwidth?
- A. Shared-policy shaping mode
- B. Interface-based shaping mode
- C. Reverse-policy shaping mode
- D. Per-IP shaping mode
Answer: B
Explanation:
Interface-based shaping goes further, enabling traffic controls based on percentage of the interface bandwidth.
NEW QUESTION # 58
Refer to the exhibit.
The exhibit shows the details of a session and the index numbers of some relevant interfaces on a FortiGate appliance that supports hardware offloading. Based on the information shown in the exhibits, which two statements about the session are true? (Choose two.)
- A. The reply direction of the asymmetric traffic flows from port2 to port3.
- B. The original direction of the symmetric traffic flows from port3 to port2.
- C. The main session cannot be offloaded to hardware.
- D. The auxiliary session can be offloaded to hardware.
Answer: A,D
NEW QUESTION # 59
Exhibit.
The exhibit shows the output of the command diagnose sys sdwan health-check status collected on a FortiGate
device. Which two statements are correct about the health check status on this FortiGate device? (Choose
two.)
- A. The interface T_INET_1 missed one SLA target.
- B. The health-check VPN_PING orders the members according to the lowest jitter.
- C. The interface T_INET_0 missed three SLA targets.
- D. There is no SLA criteria configured for the health-check Level3_DNS.
Answer: B,D
Explanation:
Explanation
According to the FortiGate / FortiOS 6.4.2 Administration Guide, the health check status command displays
the status of the health check probes for each SD-WAN member interface. The output includes the following
information:
state: the current state of the interface, either alive or dead
packet-loss: the percentage of packets lost during the health check
latency: the average round-trip time in milliseconds
jitter: the variation in latency
mos: the mean opinion score, a measure of voice quality
bandwidth: the available bandwidth in kilobits per second for each direction (up, down, bi)
sla map: a bitmap that indicates which SLA criteria are met or failed
Based on the exhibit, the following statements are correct:
The health-check VPN_PING orders the members according to the lowest jitter. This means that the
interface with the lowest jitter value is listed first, followed by the next lowest, and so on1. In the
exhibit, the order is T_MPLS, T_INET_1, and T_INET_0.
There is no SLA criteria configured for the health-check Level3_DNS. This means that the health check
does not use any SLA parameters to determine the state of the interface2. In the exhibit, the sla map
value is 0x0 for both port1 and port2, indicating that no SLA criteria are applied.
NEW QUESTION # 60
Refer to the Exhibits:
Exhibit A, which shows the SD-WAN performance SLA and exhibit B shows the health of the participating SD-WAN members.
Based on the exhibits, which statement is correct?
- A. Static routes using port2 are active in the routing table.
- B. FortiGate has not received three consecutive requests from the SLA server configured for port2.
- C. Port2 needs to wait 500 milliseconds to change the status from alive to dead.
- D. The dead member interface stays unavailable until an administrator manually brings the interface back.
Answer: A
NEW QUESTION # 61 
Two hub-and-spoke groups are connected through a site-to-site IPsec VPN between Hub 1 and Hub 2. The administrator configured ADVPN on both hub-and-spoke groups.
Which two outcomes are expected if a user in Toronto sends traffic to London? (Choose two.)
- A. Traffic from Toronto to London triggers the dynamic negotiation of a direct site-to-site VPN.
- B. The first packets from Toronto to London are routed through Hub 1 then to Hub 2.
- C. London generates an IKE information message that contains the Toronto public IP address.
- D. Toronto needs to establish a site-to-site tunnel with Hub 2 to bypass Hub 1.
Answer: A,B
NEW QUESTION # 62
Refer to the exhibits.
Exhibit A
Exhibit B
Exhibit A shows the source NAT (SNAT) global setting and exhibit B shows the routing table on FortiGate.
Based on the exhibits, which two actions does FortiGate perform on existing sessions established over port2, if the administrator increases the static route priority on port2 to 20? (Choose two.)
- A. FortiGate updates the gateway information of the sessions with SNAT so that they use port1 instead of port2.
- B. FortiGate performs a route lookup for the original traffic only.
- C. FortiGate continues routing the sessions with no SNAT, over port2.
- D. FortiGate flags the sessions as dirty.
Answer: A,C
NEW QUESTION # 63
What is the route-tag setting in an SD-WAN rule used for?
- A. To indicate the destination of a rule based on learned BGP prefixes.
- B. To indicate the members that can be used to route SD-WAN traffic.
- C. To indicate the routes that can be used for routing SD-WAN traffic.
- D. To indicate the routes for health check probes.
Answer: A
NEW QUESTION # 64
Refer to the exhibit.
In a dual-hub hub-and-spoke SD-WAN deployment, which is a benefit of disabling theanti-replaysetting on the hubs?
- A. It instructs the hub to disable TCP sequence number check, which is required for TCP sessions originated from spokes to fail over back and forth between the hubs.
- B. It instructs the hub to not check the ESP sequence numbers on IPsec traffic, to improve performance.
- C. It instructs the hub to skip content inspection on TCP traffic, to improve performance.
- D. It instructs the hub to disable the reordering of TCP packets on behalf of the receiver, to improve performance.
Answer: A
NEW QUESTION # 65
Exhibit.
The exhibit shows VPN event logs on FortiGate. In the output shown in the exhibit, which statement is true?
- A. The master tunnel T_INET_0 cannot accept the ADVPN shortcut.
- B. The VPN tunnel T_MPLS_0 is a shortcut tunnel.
- C. There is one shortcut tunnel built from master tunnel T_MPLS_0.
- D. There are no IPsec tunnel statistics log messages for ADVPN cuts.
Answer: C
Explanation:
VPN event logs record the status of VPN tunnels, such as the establishment, termination, or failure of a tunnel. The output includes the following information:
logid: the log ID number
type: the log type, either traffic or event
subtype: the log subtype, either vpn or ipsec
level: the log level, either error, warning, or notice
vd: the virtual domain name
logdesc: the log description
msg: the log message
action: the log action, such as tunnel-up, tunnel-down, or tunnel-stats remip: the remote IP address locip: the local IP address remport: the remote port number locport: the local port number outintf: the outgoing interface name cookies: the IKE SA cookies user: the user name group: the user group name useralt: the alternative user name xauthuser: the XAuth user name authgroup: the XAuth user group name assignip: the assigned IP address vpntunnel: the VPN tunnel name tunnellip: the tunnel loopback IP address tunnelid: the tunnel ID number tunneltype: the tunnel type, either ipsec or ssl duration: the tunnel duration in seconds sentbyte: the number of bytes sent rcvdbyte: the number of bytes received nextstat: the next statistics interval in seconds advpnsc: the ADVPN shortcut flag, either 0 or 1 Based on the exhibit, the following statement is true:
There is one shortcut tunnel built from master tunnel T_MPLS_0. This means that the VPN tunnel T_MPLS_0 is a master tunnel that can send ADVPN shortcut offers to other spokes, and the VPN tunnel T_MPLS_0_0 is a shortcut tunnel that is built from the master tunnel T_MPLS_01. In the exhibit, the log action for T_MPLS_0 is tunnel-up, and the log action for T_MPLS_0_0 is shortcut-up. The advpnsc flag for T_MPLS_0 is 0, indicating that it is not a shortcut tunnel, while the advpnsc flag for T_MPLS_0_0 is 1, indicating that it is a shortcut tunnel.
NEW QUESTION # 66
Refer to the exhibits.
Exhibit A
Exhibit B
Exhibit A shows an SD-WAN event log and exhibit B shows the member status and the SD-WAN rule configuration.
Based on the exhibits, which two statements are correct? (Choose two.)
- A. Port2 has the highest member priority.
- B. Port2 has a lower latency than port1.
- C. FortiGate updated the outgoing interface list on the rule so it prefers port2.
- D. SD-WAN rule ID 1 is set to lowest cost (SLA) mode.
Answer: B,C
NEW QUESTION # 67
Refer to the exhibit.
Based on the output shown in the exhibit, which two criteria on the SD-WAN member configuration can be used to select an outgoing interface in an SD-WAN rule? (Choose two.)
- A. Set priority 10.
- B. Set source 100.64.1.1.
- C. Set cost 15.
- D. Set load-balance-mode source-ip-ip-based.
Answer: A,C
NEW QUESTION # 68
Refer to the exhibit.
Which configuration change is required if the responder FortiGate uses a dynamic routing protocol to
exchange routes over IPsec?
- A. mode-cfg must be enabled.
- B. add-route must be disabled.
- C. exchange-interface-ip must be enabled.
- D. type must be set to static.
Answer: B
NEW QUESTION # 69
Refer to the exhibit, which shows the IPsec phase 1 configuration of a spoke.
What must you configure on the IPsec phase 1 configuration for ADVPN to work with SD-WAN?
- A. You must set ike-version to 1.
- B. You must enable net-device.
- C. You must enable auto-discovery-sender.
- D. You must disable idle-timeout.
Answer: B
NEW QUESTION # 70
Which statement about SD-WAN zones is true?
- A. You cannot use an SD-WAN zone in static route definitions.
- B. You can configure up to 32 SD-WAN zones per VDOM.
- C. An SD-WAN zone can contain only one type of interface.
- D. An SD-WAN zone can contain between 0 and 512 members.
Answer: B
NEW QUESTION # 71
Refer to the exhibit.
Which are two expected behaviors of the traffic that matches the traffic shaper? (Choose two.)
- A. The traffic shaper limits the combined bandwidth of all connections to a maximum of 5 MB/sec.
- B. The number of simultaneous connections among all source IP addresses cannot exceed five connections.
- C. The traffic shaper limits the bandwidth of each source IP address to a maximum of 625 KB/sec.
- D. The number of simultaneous connections allowed for each source IP address cannot exceed five connections.
Answer: C,D
NEW QUESTION # 72
......
Fortinet NSE7_SDW-7.2 Dumps PDF Are going to be The Best Score: https://www.freepdfdump.top/NSE7_SDW-7.2-valid-torrent.html
NSE 7 Network Security Architect NSE7_SDW-7.2 Exam and Certification Test Engine: https://drive.google.com/open?id=1FeanomoV3uFlX622qU-rp72pOQ1M8rYB
