[Apr-2024] NSE7_SDW-7.2 PDF Dumps Are Helpful To produce Your Dreams Correct QA's
New NSE7_SDW-7.2 exam Free Sample Questions to Practice
NEW QUESTION # 33
Refer to the exhibit.
An administrator used the SD-WAN overlay template to prepare an IPsec configuration for a hub-and-spoke SD-WAN topology. The exhibit shows the installation preview for one FortiGate device. In the exhibit, which statement best describes the configuration applied to the FortiGate device?
- A. It is a spoke device that establishes dynamic IPsec tunnels to the hub. The subnet range is
10.10.128.0/23. - B. It is a spoke device that establishes dynamic IPsec tunnels to the hub. It can send ADVPN shortcut requests.
- C. It is a hub device and will automatically discover the spoke devices that are in the SD-WAN topology.
- D. It is a hub device. It can send ADVPN shortcut offers.
Answer: B
Explanation:
According to the SD-WAN 7.2 Study Guide, the SD-WAN overlay template simplifies the configuration of IPsec tunnels in a hub-and-spoke topology. The template defines the following parameters:
type: dynamic for spokes, static for hubs
interface: the WAN interface to use for the IPsec tunnel
network-overlay: enable for spokes, disable for hubs
network-id: a unique identifier for each spoke
auto-discovery-sender: enable for hubs, disable for spokes
auto-discovery-receiver: enable for spokes, disable for hubs
Based on the exhibit, the FortiGate device has the following configuration:
type: dynamic
interface: port1
network-overlay: enable
network-id: 5
auto-discovery-sender: disable
auto-discovery-receiver: enable
Therefore, the FortiGate device is a spoke that establishes dynamic IPsec tunnels to the hub. It also has the network-overlay and auto-discovery-receiver options enabled, which means it can send ADVPN shortcut requests to other spokes when it receives a shortcut offer from the hub
NEW QUESTION # 34
Which two statements describe how IPsec phase 1 main mode is different from aggressive mode when
performing IKE negotiation? (Choose two )
- A. A peer ID is included in the first packet from the initiator, along with suggested security policies.
- B. The use of Diffie Hellman keys is limited by the responder and needs initiator acceptance.
- C. XAuth is enabled as an additional level of authentication, which requires a username and password.
- D. A total of six packets are exchanged between an initiator and a responder instead of three packets.
Answer: C,D
NEW QUESTION # 35
The SD-WAN overlay template helps to prepare SD-WAN deployments. To complete the tasks performed by
the SD-WAN overlay template, the administrator must perform some post-run tasks. What are three
mandatory post-run tasks that must be performed? (Choose three.)
- A. Configure routing through overlay tunnels created by the SD-WAN overlay template.
- B. Assign a branch_id metadata variable to each branch device.
- C. Configure SD-WAN rules.
- D. Create policy packages for branch devices.
- E. Assign an sdwan_id metadata variable to each device (branch and hub}.
Answer: A,D,E
NEW QUESTION # 36
Exhibit.
The exhibit shows VPN event logs on FortiGate. In the output shown in the exhibit, which statement is true?
- A. There is one shortcut tunnel built from master tunnel T_MPLS_0.
- B. The VPN tunnel T_MPLS_0 is a shortcut tunnel.
- C. There are no IPsec tunnel statistics log messages for ADVPN cuts.
- D. The master tunnel T_INET_0 cannot accept the ADVPN shortcut.
Answer: A
Explanation:
Explanation
VPN event logs record the status of VPN tunnels, such as the establishment, termination, or failure of a tunnel.
The output includes the following information:
logid: the log ID number
type: the log type, either traffic or event
subtype: the log subtype, either vpn or ipsec
level: the log level, either error, warning, or notice
vd: the virtual domain name
logdesc: the log description
msg: the log message
action: the log action, such as tunnel-up, tunnel-down, or tunnel-stats
remip: the remote IP address
locip: the local IP address
remport: the remote port number
locport: the local port number
outintf: the outgoing interface name
cookies: the IKE SA cookies
user: the user name
group: the user group name
useralt: the alternative user name
xauthuser: the XAuth user name
authgroup: the XAuth user group name
assignip: the assigned IP address
vpntunnel: the VPN tunnel name
tunnellip: the tunnel loopback IP address
tunnelid: the tunnel ID number
tunneltype: the tunnel type, either ipsec or ssl
duration: the tunnel duration in seconds
sentbyte: the number of bytes sent
rcvdbyte: the number of bytes received
nextstat: the next statistics interval in seconds
advpnsc: the ADVPN shortcut flag, either 0 or 1
Based on the exhibit, the following statement is true:
There is one shortcut tunnel built from master tunnel T_MPLS_0. This means that the VPN tunnel
T_MPLS_0 is a master tunnel that can send ADVPN shortcut offers to other spokes, and the VPN tunnel
T_MPLS_0_0 is a shortcut tunnel that is built from the master tunnel T_MPLS_01. In the exhibit, the
log action for T_MPLS_0 is tunnel-up, and the log action for T_MPLS_0_0 is shortcut-up. The advpnsc
flag for T_MPLS_0 is 0, indicating that it is not a shortcut tunnel, while the advpnsc flag for
T_MPLS_0_0 is 1, indicating that it is a shortcut tunnel.
NEW QUESTION # 37
Refer to the exhibit, which shows the IPsec phase 1 configuration of a spoke.
What must you configure on the IPsec phase 1 configuration for ADVPN to work with SD-WAN?
- A. You must enable net-device.
- B. You must enable auto-discovery-sender.
- C. You must disable idle-timeout.
- D. You must set ike-version to 1.
Answer: A
NEW QUESTION # 38
Refer to the exhibits.
Exhibit A
Exhibit B
Exhibit A shows the source NAT (SNAT) global setting and exhibit B shows the routing table on FortiGate.
Based on the exhibits, which two actions does FortiGate perform on existing sessions established over port2, if the administrator increases the static route priority on port2 to 20? (Choose two.)
- A. FortiGate updates the gateway information of the sessions with SNAT so that they use port1 instead of port2.
- B. FortiGate flags the sessions as dirty.
- C. FortiGate performs a route lookup for the original traffic only.
- D. FortiGate continues routing the sessions with no SNAT, over port2.
Answer: A,B
NEW QUESTION # 39
Which two statements are correct when traffic matches the implicit SD-WAN rule? (Choose two.)
- A. Traffic is load balanced using the algorithm set for the v4-ecmp-mode setting.
- B. Traffic does not match any of the entries in the policy route table.
- C. All SD-WAN rules have the default setting enabled.
- D. The sdwan_service_id flag in the session information is 0.
Answer: B,D
Explanation:
Explanation
sdwan_service_id is 0 = match SD-WAN implicit rule, study guide 7.0 page 120, 7.2 page 149 SD-WAN rules
internally are interpreted as a Policy route, so when the traffic doesn't match with any policy route, it will be
flowing by implict policy.
NEW QUESTION # 40
What are two benefits of choosing packet duplication over FEC for data loss correction on noisy links?
(Choose two.)
- A. Packet duplication does not require a route to the destination.
- B. Packet duplication can leverage multiple IPsec overlays for sending additional data.
- C. Packet duplication uses smaller parity packets which results in less bandwidth consumption.
- D. Packet duplication supports hardware offloading.
Answer: B,D
NEW QUESTION # 41
Refer to the exhibit.
Based on the exhibit, which statement about FortiGate re-evaluating traffic is true?
- A. The type of traffic defined and allowed on firewall policy ID 1 is UDP.
- B. Changes have been made on firewall policy ID 1 on FortiGate.
- C. FortiGate has terminated the session after a change on policy ID 1.
- D. Firewall policy ID 1 has source NAT disabled.
Answer: B
NEW QUESTION # 42
Refer to the exhibit.
The device exchanges routes using IBGP.
Which two statements are correct about the IBGP configuration and routing information on the device?
(Choose two.)
- A. ibgp-multipath is disabled.
- B. Each BGP route is three hops away from the destination.
- C. additional-path is enabled.
- D. You can run the get router info routing-table database command to display the additional paths.
Answer: C,D
NEW QUESTION # 43
Refer to the exhibit.
Which statement about the role of the ADVPN device in handling traffic is true?
- A. Two spokes, 192.2.0.1 and 10.0.2.101, forward their queries to their hubs.
- B. Two hubs, 10.0.1.101 and 10.0.2.101, are receiving and forwarding queries between each other.
- C. This is a hub that has received a query from a spoke and has forwarded it to another spoke.
- D. This is a spoke that has received a query from a remote hub and has forwarded the response to its hub.
Answer: C
NEW QUESTION # 44
Refer to the exhibits.
Exhibit A
Exhibit B
Exhibit A shows an SD-WAN event log and exhibit B shows the member status and the SD-WAN rule
configuration.
Based on the exhibits, which two statements are correct? (Choose two.)
- A. Port2 has a lower latency than port1.
- B. FortiGate updated the outgoing interface list on the rule so it prefers port2.
- C. SD-WAN rule ID 1 is set to lowest cost (SLA) mode.
- D. Port2 has the highest member priority.
Answer: A,B
NEW QUESTION # 45
Refer to the exhibit.
The device exchanges routes using IBGP.
Which two statements are correct about the IBGP configuration and routing information on the device?
(Choose two.)
- A. ibgp-multipath is disabled.
- B. Each BGP route is three hops away from the destination.
- C. additional-path is enabled.
- D. You can run the get router info routing-table database command to display the additional paths.
Answer: C,D
NEW QUESTION # 46 
Which two conclusions for traffic that matches the traffic shaper are true? (Choose two.)
- A. The measured bandwidth is less than 100 KBps.
- B. The traffic shaper limits the bandwidth of each source IP to a maximum of 6250 KBps.
- C. The traffic shaper drops packets if the bandwidth is less than 2500 KBps.
- D. The traffic shaper drops packets if the bandwidth exceeds 6250 KBps.
Answer: A,D
NEW QUESTION # 47
Refer to the exhibits.
Exhibit A
Exhibit B -
Exhibit A shows the configuration for an SD-WAN rule and exhibit B shows the respective rule status, the routing table, and the member status.
The administrator wants to understand the expected behavior for traffic matching the SD-WAN rule.
Based on the exhibits, what can the administrator expect for traffic matching the SD-WAN rule?
- A. The traffic will be routed over T_INET_1_0.
- B. The traffic will be routed over T_INET_0_0.
- C. The traffic will be load balanced across all three overlays.
- D. The traffic will be routed over T_MPLS_0.
Answer: A
NEW QUESTION # 48
Refer to the exhibits.
An administrator is testing application steering in SD-WAN. Before generating test traffic, the administrator
collected the information shown in exhibit A.
After generating GoToMeeting test traffic, the administrator examined the respective traffic log on
FortiAnalyzer, which is shown in exhibit B. The administrator noticed that the traffic matched the implicit
SD-WAN rule, but they expected the traffic to match rule ID 1.
Which two reasons explain why the traffic matched the implicit SD-WAN rule? (Choose two.)
- A. FortiGate did not refresh the routing information on the session after the application was detected.
- B. The session 3-tuple did not match any of the existing entries in the ISDB application cache.
- C. Full SSL inspection is not enabled on the matching firewall policy.
- D. Port1 and port2 do not have a valid route to the destination.
Answer: A,B
Explanation:
Explanation
Study guide 7.2 Page 191
NEW QUESTION # 49
Refer to the exhibit.
Two hub-and-spoke groups are connected through a site-to-site IPsec VPN between Hub 1 and Hub 2.
Which two configuration settings are required for Toronto and London spokes to establish an ADVPN
shortcut? (Choose two.)
- A. On the hubs,net-devicemust be enabled on all IPsec VPNs.
- B. On the spokes,auto-discovery-receivermust be enabled on the IPsec VPN to the hub.
- C. auto-discovery-forwardermust be enabled on all IPsec VPNs.
- D. On the hubs,auto-discovery-sendermust be enabled on the IPsec VPNs to spokes.
Answer: B,D
NEW QUESTION # 50
......
Cover NSE7_SDW-7.2 Exam Questions Make Sure You 100% Pass: https://www.testkingit.com/Fortinet/latest-NSE7_SDW-7.2-exam-dumps.html
NSE7_SDW-7.2 dumps Accurate Questions and Answers with Free: https://drive.google.com/open?id=1NtZ0HQl1G7DZKVukRgcXwtGLKc8nguo0