Fortinet fcss sdw ar 7 4 practice test

Exhibit.

The administrator configured the IPsec tunnel VPN1 on a FortiGate device with the parameters
shown in exhibit.
Based on the configuration, which three conclusions can you draw about the characteristics and
requirements of the VPN tunnel? (Choose three.)

• A. The tunnel interface IP address on the spoke side is provided by the hub.
• B. The remote end can be a third-party IPsec device.
• C. The administrator must manually assign the tunnel interface IP address on the hub side
• D. The remote end must support IKEv2.
• E. This configuration allows user-defined overlay IP addresses.

You have a FortiGate configuration with three user-defined SD-WAN zones and two members in each
of these zones. One SD-WAN member is no longer in use in health-check and SD-WAN rules. You
want to delete it.
What happens if you delete the SD-WAN member from the FortiGate GUI?

• A. FodiGate accepts the deletion and removes routes as required.
• B. FortiGate displays an error message. You must use the CLI to delete an SD-WAN member.
• C. FortiGate displays an error message. SD-WAN zones must contain at least two members
• D. FortiGate accepts the deletion and places the member in the default SD-WAN zone.

Refer to the exhibits.

The exhibits show the source NAT (SNAT) global setting. port2 interface settings, and the routing
table on FortiGate.
The administrator increases the member priority on port2 to 20.
Upon configuration changes and the receipt of new packets, which two actions does FortiGate
perform on existing sessions established over port2? (Choose two.)

• A. FortiGate continues routing all existing sessions over port2.
• B. FortiGate routes only new sessions over port2.
• C. FortiGate flags the SNAT session as dirty only if the administrator has assigned an IP pool to the firewall policies with NAT.
• D. FortiGate flags the sessions as dirty.
• E. FortiGate updates the gateway information of the sessions with SNAT so that they use port1 instead of port2.

Refer to the exhibits.

The exhibits show the configuration for SD-WAN performance. SD-WAN rule, the application IDs of
Facebook and YouTube along with the firewall policy configuration and the underlay zone status.
Which two statements are true about the health and performance of SD-WAN members 3 and 4?
(Choose two.)

• A. Only related TCP traffic is used for performance measurement.
• B. The performance is an average of the metrics measured for Facebook and YouTube traffic passing through the member.
• C. Encrypted traffic is not used for the performance measurement.
• D. FortiGate identifies the member as dead when there is no Facebook and YouTube traffic passing through the member.

When you use the command diagnose sys session list, how do you identify the sessions that
correspond to traffic steered according to SD-WAN rules?

• A. You identify sessions steered according to SD-WAN rules with the flag vwl.
• B. You cannot identify SD-WAN sessions. You must use the sdwar. session filter.
• C. You identify sessions steered according to SD-WAN rules with the data vwl_mbr_seq.
• D. You identify sessions steered according to SD-WAN rules with the data 3dwan_service_id.

SD-WAN interacts with many other FortiGate features. Some of them are required to allow SD-WAN
to steer the traffic.
Which three configuration elements that you must configure before FortiGate can steer traffic
according to SD-WAN rules? (Choose three.)

• A. Firewall policies
• B. Interfaces
• C. Security profiles
• D. Traffic shaping
• E. Routing

Which three characteristics apply to provisioning templates available on FortiManager? (Choose
three.)

• A. A template group can include a system template and an SD-WAN template.
• B. Each template group can contain up to three IPsec tunnel templates.
• C. CLI templates are applied in order, from top to bottom
• D. A CLI template group can contain CLI templates of both types.
• E. A CLI template can be of type CLI script or Perl script.

Refer to the exhibit.

An administrator checks the status of an SD-WAN topology using the FortiManager SD-WAN monitor
menus. All members are configured with one or two SLAs.
Which two conclusions can you draw from the output shown? (Choose two.)

• A. The template view should be used to see the hub devices.
• B. One member of branch2_fgt is missing the SLAs.
• C. branch2_fgt establishes six tunnels to the hubs and they are all up.
• D. This SD-WAN topology contains only two branch devices.

You are tasked with configuring ADVPN 2.0 on an SD-WAN topology already configured for ADVPN.
What should you do to implement ADVPN 2.0 in this scenario?

• A. Update the IPsec tunnel configurations on the hub.
• B. Update the SD-WAN configuration on the branches.
• C. Update the IPsec tunnel configuration on the branches.
• D. Delete the existing ADVPN configuration and configure ADVPN 2.0.

Refer to the exhibits.

An administrator is testing application steering in SD-WAN. Before generating test traffic, the
administrator collected the information shown in the first exhibit. After generating GoToMeeting test
traffic, the administrator examined the corresponding traffic log on FortiAnalyzer, which is shown in
the second exhibit.
The administrator noticed that the traffic matched the implicit SD-WAN rule, but they expected the
traffic to match rule ID 1.
Which two reasons explain why some log messages show that the traffic matched the implicit SD-
WAN rule? (Choose two.)

• A. Full SSL inspection is not enabled on the matching firewall policy.
• B. The session 3-tuple did not match any of the existing entries in the ISDB application cache.
• C. FortiGate could not refresh the routing information on the session after the application was detected.
• D. No configured SD-WAN rule matches the traffic related to the collaboration application GoToMeeting