Prepare for the Actual NSE 7 Network Security Architect NSE7_SDW-6.4 Exam Practice Materials Collection
NSE 7 Network Security Architect Certified Official Practice Test NSE7_SDW-6.4 - Apr-2023
NEW QUESTION 30
Which statement about using BGP routes in SD-WAN is true?
- A. You must use BGP to route traffic for both overlay and underlay links.
- B. You must configure AS path prepending.
- C. You must use external BGP.
- D. Learned routes can be used as dynamic destinations in SD-WAN rules.
Answer: D
NEW QUESTION 31
Refer to the exhibit.
Which conclusion about the packet debug flow output is correct?
- A. The original traffic exceeded the maximum packets per second of the outgoing interface, and the packet was dropped.
- B. The reply traffic exceeded the maximum bandwidth configured in the traffic shaper, and the packet was dropped.
- C. The original traffic exceeded the maximum bandwidth of the outgoing interface, and the packet was dropped.
- D. The original traffic exceeded the maximum bandwidth configured in the traffic shaper, and the packet was dropped.
Answer: D
NEW QUESTION 32
Why is it effective to use SD WAN rules when configuring application control?
- A. Because you must use certificate full inspection on the firewall policy
- B. Because the application database is manually maintained by administrators
- C. Because traffic can be load balanced based on application type
- D. Because SD-WAIM rules are independent from firewall policies to avoid controlling applications
Answer: C
Explanation:
You can configure rules to steer traffic based on the application detected by Fortigate. This is know as application steering or application-aware routing
NEW QUESTION 33
When attempting to establish an IPsec tunnel to FortiGate, all remote users match the FIRST_VPN IPsec VPN. This includes remote users that want to connect to the SECOND_VPN IPsec VPN. Which two configuration changes must you make on both IPsec VPNs so that remote users can connect to their intended IPsec VPN? (Choose two.)
- A. Configure a unique peer ID.
- B. Configure different Diffie Hellman groups.
- C. Change the IKE mode to aggressive.
- D. Configure different proposals.
Answer: A,C
Explanation:
https://kb.fortinet.com/kb/documentLink.do?externalID=10114
NEW QUESTION 34
Refer to exhibits.
Exhibit A shows the firewall policy and exhibit B shows the traffic shaping policy.
The traffic shaping policy is being applied to all outbound traffic; however, inbound traffic is not being evaluated by the shaping policy.
Based on the exhibits, what configuration change must be made in which policy so that traffic shaping can be applied to inbound traffic?
- A. The guaranteed-10mbps option must be selected as the reverse shaper option.
- B. A new firewall policy must be created and SD-WAN must be selected as the incoming interface.
- C. The reverse shaper option must be enabled and a traffic shaper must be selected
- D. The guaranteed-10mbps option must be selected as the per-IP shaper option
Answer: C
NEW QUESTION 35
Which three parameters are available to configure SD-WAN rules? (Choose three.)
- A. Type of physical link connection
- B. Internet service database (ISDB) address object
- C. Source and destination IP address
- D. Application signatures
- E. URL categories
Answer: A,B,C
NEW QUESTION 36
Which diagnostic command can you use to show the SD-WAN rules interface information and state?
- A. diagnose sys virtual-wan-link service
- B. diagnose sys virtual-wan-link member.
- C. diagnose sys virtual-wan-link neighbor.
- D. diagnose sys virtual-wan-link route-tag-list
Answer: A
NEW QUESTION 37
Refer to the exhibit.
Which are two expected behaviors of the traffic that matches the traffic shaper? (Choose two.)
- A. The traffic shaper limits the combined bandwidth of all connections to a maximum of 5 MB/sec.
- B. The traffic shaper limits the bandwidth of each source IP address to a maximum of 625 KB/sec.
- C. The number of simultaneous connections allowed for each source IP address can exceed 5 connections.
- D. The number of simultaneous connections among all source IP addresses can exceed 5 connections.
Answer: B,D
NEW QUESTION 38
Which diagnostic command you can use to show interface-specific SLA logs for the last 10 minutes?
- A. diagnose sys virtual-wan-link health-check
- B. diagnose sys virtual-wan-link log
- C. diagnose sys virtual-wan-link sla-log
- D. diagnose sys virtual-wan-link intf-sla-log
Answer: C
NEW QUESTION 39
Refer to the exhibits.
Exhibit A shows the SD-WAN performance SLA and exhibit B shows the SD-WAN member and the static routes configuration.
If port2 is detected dead by FortiGate, which expected behavior is correct?
- A. Dead members require manual administrator access to bring them back alive.
- B. Port2 becomes alive after one successful probe is detected.
- C. The SD-WAN interface becomes disabled and port1 becomes the WAN interface.
- D. Subnets 10.0.20.0/23 and 172.20.0.0/16 are reachable only through port1.
Answer: D
NEW QUESTION 40
Which two configuration tasks are required to use SD-WAN? (Choose two.)
- A. Specify the outgoing interface routing cost.
- B. Specify the incoming interfaces in SD-WAN rules.
- C. Add one or more members to an SD-WAN zone.
- D. Configure at least one firewall policy for SD-WAN traffic.
Answer: C,D
NEW QUESTION 41
Refer to the exhibit.
FortiGate has multiple dial-up VPN interfaces incoming on portl that match only FIRSTJVPN.
Which two configuration changes must be made to both IPsec
VPN interfaces to allow incoming connections to match all possible IPsec dial-up interfaces? (Choose two )
- A. Use different proposals are used between the interfaces.
- B. Configure a unique peer ID for each dial-up VPN interface
- C. Configure the IKE mode to be aggressive mode
- D. Use unique Diffie Hellman groups on each VPN interface
Answer: B,C
NEW QUESTION 42
Refer to exhibits.
Exhibit A shows the firewall policy and exhibit B shows the traffic shaping policy.
The traffic shaping policy is being applied to all outbound traffic; however, inbound traffic is not being evaluated by the shaping policy.
Based on the exhibits, what configuration change must be made in which policy so that traffic shaping can be applied to inbound traffic?
- A. The reverse shaper option must be enabled and a traffic shaper must be selected
- B. A new firewall policy must be created and SD-WAN must be selected as the incoming interface.
- C. The guaranteed-10mbps option must be selected as the reverse shaper option.
- D. The guaranteed-10mbps option must be selected as the per-IP shaper option
Answer: C
NEW QUESTION 43
Which three parameters are available to configure SD-WAN rules? (Choose three.)
- A. URL categories
- B. Internet service database (ISDB) address object
- C. Type of physical link connection
- D. Source and destination IP address
- E. Application signatures
Answer: A,B,D
NEW QUESTION 44
What is the lnkmtd process responsible for?
- A. Processing performance SLA probes
- B. Monitoring links for any bandwidth saturation
- C. Flushing route tags addresses
- D. Logging interface quality information
Answer: D
NEW QUESTION 45
What are two roles that SD-WAN orchestrator plays when it works with FortiManager? (Choose two.)
- A. It configures and monitors SD-WAN networks on FortiGate devices that are managed by FortiManager.
- B. It acts as a hub FortiGate with an SD-WAN interface enabled and managed along with other FortiGate devices by FortiManager.
- C. It acts as an application that is released and signed by Fortinet to run as a part of management extensions on FortiManager.
- D. It acts as a standalone device to assist FortiManager to manage SD-WAN interfaces on the managed FortiGate devices.
Answer: C,D
Explanation:
Explanation/Reference:
NEW QUESTION 46
Which diagnostic command you can use to show interface-specific SLA logs for the last 10 minutes?
- A. diagnose sys virtual-wan-link health-check
- B. diagnose sys virtual-wan-link log
- C. diagnose sys virtual-wan-link sla-log
- D. diagnose sys virtual-wan-link intf-sla-log
Answer: C
Explanation:
Explanation/Reference: https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/943037/sla-logging
NEW QUESTION 47
......
Ace Fortinet NSE7_SDW-6.4 Certification with Actual Questions Apr 07, 2023 Updated: https://www.actualtestsquiz.com/NSE7_SDW-6.4-test-torrent.html
2023 The Most Effective NSE7_SDW-6.4 with 82 Questions Answers: https://drive.google.com/open?id=1u-65KuEUWg1NgpzkAjSZT6kcdyMvfpvn
