2023 Realistic Verified Free Fortinet NSE7_SDW-7.0 Exam Questions [Q20-Q42]

5/5 - (1 vote)

2023 Realistic Verified Free Fortinet NSE7_SDW-7.0 Exam Questions

NSE7_SDW-7.0 Real Exam Questions and Answers FREE

Q20. Which diagnostic command can you use to show the member utilization statistics measured by performance SLAs for the last 10 minutes?

diagnose sys sdwan intf-sla-log

diagnose sys sdwan health-check

diagnose sys sdwan log

diagnose sys sdwan sla-log

Q21.

Which two conclusions for traffic that matches the traffic shaper are true? (Choose two.)

The traffic shaper drops packets if the bandwidth is less than 2500 KBps.

The measured bandwidth is less than 100 KBps.

The traffic shaper drops packets if the bandwidth exceeds 6250 KBps.

The traffic shaper limits the bandwidth of each source IP to a maximum of 6250 KBps.

Q22. In a hub-and-spoke topology, what are two advantages of enabling ADVPN on the IPsec overlays? (Choose two.)

It provides the benefits of a full-mesh topology in a hub-and-spoke network.

It provides direct connectivity between spokes by creating shortcuts.

It enables spokes to bypass the hub during shortcut negotiation.

It enables spokes to establish shortcuts to third-party gateways.

Q23. What are two reasons why FortiGate would be unable to complete the zero-touch provisioning process?
(Choose two.)

The FortiGate cloud key has not been added to the FortiGate cloud portal.

FortiDeploy has connected with FortiGate and provided the initial configuration to contact FortiManager

The zero-touch provisioning process has completed internally, behind FortiGate.

FortiGate has obtained a configuration from the platform template in FortiGate cloud.

A factory reset performed on FortiGate.

Q24.

Exhibit B –

Exhibit A shows the system interface with the static routes and exhibit B shows the firewall policies on the managed FortiGate.
Based on the FortiGate configuration shown in the exhibits, what issue might you encounter when creating an SD-WAN zone for port1 and port2?

port1 is assigned a manual IP address.

port1 is referenced in a firewall policy.

port2 is referenced in a static route.

port1 and port2 are not administratively down.

Q25. Refer to the exhibit, which shows the IPsec phase 1 configuration of a spoke.

What must you configure on the IPsec phase 1 configuration for ADVPN to work with SD-WAN?

You must set ike-version to 1.

You must enable net-device.

You must enable auto-discovery-sender.

You must disable idle-timeout.

Q26. Refer to the exhibit.

FortiGate has multiple dial-up VPN interfaces incoming on port1 that match only FIRST_VPN.
Which two configuration changes must be made to both IPsec VPN interfaces to allow incoming connections to match all possible IPsec dial-up interfaces? (Choose two.)

Specify a unique peer ID for each dial-up VPN interface.

Use different proposals are used between the interfaces.

Configure the IKE mode to be aggressive mode.

Use unique Diffie Hellman groups on each VPN interface.

Q27. Which two protocols in the IPsec suite are most used for authentication and encryption? (Choose two.)

Encapsulating Security Payload (ESP)

Secure Shell (SSH)

Internet Key Exchange (IKE)

Security Association (SA)

Q28. Which CLI command do you use to perform real-time troubleshooting for ADVPN negotiation?

get router info routing-table all

diagnose debug application ike

diagnose vpn tunnel list

get ipsec tunnel list

Q29. Which best describes the SD-WAN traffic shaping mode that bases itself on a percentage of available bandwidth?

Interface-based shaping mode

Reverse-policy shaping mode

Shared-policy shaping mode

Per-IP shaping mode

Explanation
Interface-based shaping goes further, enabling traffic controls based on percentage of the interface bandwidth.

Q30. Exhibit.

Which conclusion about the packet debug flow output is correct?

The total number of daily sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.

The packet size exceeded the outgoing interface MTU.

The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.

The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the firewall policy, and the packet was dropped.

Q31. Refer to the exhibit.

Which algorithm does SD-WAN use to distribute traffic that does not match any of the SD-WAN rules?