2025年最新のNSE7_SDW-7.2問題集PDFでNSE7_SDW-7.2リアル試験問題解答 [Q28-Q49]

5/5 - (1 vote)

2025年最新のNSE7_SDW-7.2問題集PDFでNSE7_SDW-7.2リアル試験問題解答

有効なNSE7_SDW-7.2テスト解答とFortinet NSE7_SDW-7.2試験PDF問題を試そう

質問 28
Refer to the exhibits.
Exhibit A

Exhibit B

Exhibit A shows the SD-WAN performance SLA configuration, the SD-WAN rule configuration, and the application IDs of Facebook and YouTube. Exhibit B shows the firewall policy configuration and the underlay zone status.
Based on the exhibits, which two statements are correct about the health and performance of port1 and port2? (Choose two.)

The performance is an average of the metrics measured for Facebook and YouTube traffic passing through the member.

FortiGate is unable to measure jitter and packet loss on Facebook and YouTube traffic.

FortiGate identifies the member as dead when there is no Facebook and YouTube traffic passing through the member.

Non-TCP Facebook and YouTube traffic are not used for performance measurement.

質問 29
What are two reasons why FortiGate would be unable to complete the zero-touch provisioning process? (Choose two.)

The FortiGate cloud key has not been added to the FortiGate cloud portal.

FortiDeploy has connected with FortiGate and provided the initial configuration to contact FortiManager

The zero-touch provisioning process has completed internally, behind FortiGate.

FortiGate has obtained a configuration from the platform template in FortiGate cloud.

A factory reset performed on FortiGate.

質問 30
Refer to the exhibit.

FortiGate has multiple dial-up VPN interfaces incoming on port1 that match only FIRST_VPN.
Which two configuration changes must be made to both IPsec VPN interfaces to allow incoming connections
to match all possible IPsec dial-up interfaces? (Choose two.)

Specify a unique peer ID for each dial-up VPN interface.

Use different proposals are used between the interfaces.

Configure the IKE mode to be aggressive mode.

Use unique Diffie Hellman groups on each VPN interface.

質問 31
Refer to the exhibits.

Exhibit A shows two IPsec templates to define Branch_IPsec_1 and Branch_IPsec_2. Each template defines a VPN tunnel.
Exhibit B shows the error message that FortiManager displayed when the administrator tried to assign the second template to the FortiGate device.
Which statement best explain the cause for this issue?

You can assign only one template with a tunnel of fype static to each FortiGate device

You can define only one IPsec tunnel from branch devices to HUB1.

You can assign only one IPsec template to each FortiGate device.

You should review the branch1_fgt configuration for the already configured tunnel with the name HUB1-VPN2.

質問 32
Which statement about SD-WAN zones is true?

An SD-WAN zone can contain only one type of interface.

An SD-WAN zone can contain between 0 and 512 members.

You cannot use an SD-WAN zone in static route definitions.

You can configure up to 32 SD-WAN zones per VDOM.

質問 33
In the default SD-WAN minimum configuration, which two statements are correct when traffic matches the default implicit SD-WAN rule? (Choose two )

Traffic has matched none of the FortiGate policy routes.

Matched traffic failed RPF and was caught by the rule.

The FIB lookup resolved interface was the SD-WAN interface.

An absolute SD-WAN rule was defined and matched traffic.

質問 34
Which diagnostic command can you use to show the SD-WAN rules, interface information, and state?

diagnose sys sdwan service

diagnose sys sdwan route-tag-list

diagnose sys sdwan member

diagnose sys sdwan neighbor

質問 35
Which two statements about SD-WAN central management are true? (Choose two.)

It does not allow you to monitor the status of SD-WAN members.

It is enabled or disabled on a per-ADOM basis.

It is enabled by default.

It uses templates to configure SD-WAN on managed devices.

質問 36
Refer to the exhibit.

Which algorithm does SD-WAN use to distribute traffic that does not match any of the SD-WAN rules?

All traffic from a source IP to a destination IP is sent to the same interface.

All traffic from a source IP is sent to the same interface.

All traffic from a source IP is sent to the most used interface.

All traffic from a source IP to a destination IP is sent to the least used interface.

質問 37
What are two reasons why FortiGate would be unable to complete the zero-touch provisioning process?
(Choose two.)

The FortiGate cloud key has not been added to the FortiGate cloud portal.

FortiDeploy has connected with FortiGate and provided the initial configuration to contact
FortiManager

The zero-touch provisioning process has completed internally, behind FortiGate.

FortiGate has obtained a configuration from the platform template in FortiGate cloud.

A factory reset performed on FortiGate.

質問 38
Which two statements about SD-WAN central management are true? (Choose two.)

The objects are saved in the ADOM common object database.

It does not support meta fields.

It uses templates to configure SD-WAN on managed devices.

It supports normalized interfaces for SD-WAN member configuration.

質問 39
Refer to the exhibit.

The exhibit shows the details of a session and the index numbers of some relevant interfaces on a FortiGate appliance that supports hardware offloading. Based on the information shown in the exhibits, which two statements about the session are true? (Choose two.)

The reply direction of the asymmetric traffic flows from port2 to port3.

The auxiliary session can be offloaded to hardware.

The original direction of the symmetric traffic flows from port3 to port2.

The main session cannot be offloaded to hardware.

質問 40
Refer to the exhibit.

In a dual-hub hub-and-spoke SD-WAN deployment, which is a benefit of disabling the anti-replay setting on the hubs?

It instructs the hub to disable the reordering of TCP packets on behalf of the receiver, to improve performance.

It instructs the hub to disable TCP sequence number check, which is required for TCP sessions originated from spokes to fail over back and forth between the hubs.

It instructs the hub to not check the ESP sequence numbers on IPsec traffic, to improve performance.

It instructs the hub to skip content inspection on TCP traffic, to improve performance.

質問 41
Refer to the exhibits.

Exhibit A shows two IPsec templates to define Branch_IPsec_1 and Branch_IPsec_2. Each template defines a VPN tunnel.
Exhibit B shows the error message that FortiManager displayed when the administrator tried to assign the second template to the FortiGate device.
Which statement best explain the cause for this issue?

You can assign only one template with a tunnel of fype static to each FortiGate device

You can define only one IPsec tunnel from branch devices to HUB1.

You can assign only one IPsec template to each FortiGate device.

You should review the branch1_fgt configuration for the already configured tunnel with the name HUB1-VPN2.

質問 42
Refer to the exhibit.

Based on the exhibit, which two actions does FortiGate perform on traffic passing through port2? (Choose
two.)

FortiGate does not change the routing information on existing sessions that use a valid gateway, after a
route change.

FortiGate performs routing lookups for new sessions only, after a route change.

FortiGate always blocks all traffic, after a route change.

FortiGate flushes all routing information from the session table, after a route change.

質問 43
Refer to the exhibit.

Based on the exhibit, which two statements are correct about the health of the selected members? (Choose two.)

After FortiGate switches to active mode, FortiGate never fails back to passive monitoring.

During passive monitoring, FortiGate can’t detect dead members.

FortiGate can offload the traffic that is subject to passive monitoring to hardware.

FortiGate passively monitors the member if TCP traffic is passing through the member.

質問 44
Refer to the exhibit.

The exhibit shows the SD-WAN rule status and configuration.
Based on the exhibit, which change in the measured packet loss will make T_INET_1_0 the new preferred
member?

When all three members have the same packet loss.

When T_INET_0_0 has 4% packet loss.

When T_INET_0_0 has 12% packet loss.

When T_INET_1_0 has 4% packet loss.

質問 45
Exhibit.

The exhibit shows VPN event logs on FortiGate. In the output shown in the exhibit, which statement is true?

There are no IPsec tunnel statistics log messages for ADVPN cuts.

There is one shortcut tunnel built from master tunnel T_MPLS_0.

The VPN tunnel T_MPLS_0 is a shortcut tunnel.

The master tunnel T_INET_0 cannot accept the ADVPN shortcut.

質問 46
Refer to the exhibits.
Exhibit A –

Exhibit B –

Exhibit A shows the traffic shaping policy and exhibit B shows the firewall policy.
The administrator wants FortiGate to limit the bandwidth used by YouTube. When testing, the administrator
determines that FortiGate does not apply traffic shaping on YouTube traffic.
Based on the policies shown in the exhibits, what configuration change must be made so FortiGate performs
traffic shaping on YouTube traffic?

Destination internet service must be enabled on the traffic shaping policy.

Application control must be enabled on the firewall policy.

Web filtering must be enabled on the firewall policy.

Individual SD-WAN members must be selected as the outgoing interface on the traffic shaping policy.

質問 47
Refer to the exhibits.
Exhibit A

Exhibit B –

Exhibit A shows the configuration for an SD-WAN rule and exhibit B shows the respective rule status, the routing table, and the member status.
The administrator wants to understand the expected behavior for traffic matching the SD-WAN rule.
Based on the exhibits, what can the administrator expect for traffic matching the SD-WAN rule?

The traffic will be load balanced across all three overlays.

The traffic will be routed over T_INET_0_0.

The traffic will be routed over T_MPLS_0.

The traffic will be routed over T_INET_1_0.

質問 48
Refer to the exhibit.

Which statement explains the output shown in the exhibit?

FortiGate performed standard FIB routing on the session.

FortiGate will not re-evaluate the session following a firewall policy change.

FortiGate used192.2.0.1as the gateway for the original direction of the traffic.

FortiGate must re-evaluate the session due to routing change.

質問 49
Refer to the exhibits.
Exhibit A –

Exhibit B –

Exhibit A shows a site-to-site topology between two FortiGate devices: branch1_fgt and dc1_fgt. Exhibit B shows the system global and system settings configuration on dc1_fgt.
When branch1_client establishes a connection to dc1_host, the administrator observes that, on dc1_fgt, the reply traffic is routed over T_INET_0_0, even though T_INET_1_0 is the preferred member in the matching SD-WAN rule.
Based on the information shown in the exhibits, what configuration change must be made on dc1_fgt so dc1_fgt routes the reply traffic over T_INET_1_0?

Enable auxiliary-session under config system settings.

Disable tp-session-without-syn under config system settings.

Enable snat-route-change under config system global.

Disable allow-subnet-overlap under config system settings.

Fortinet NSE7_SDW-7.2 認定試験の出題範囲：

トピック	出題範囲
トピック 1	SD-WAN 構成: このトピックでは、ダイレクトインターネットアクセス (DIA)、SD-WAN メンバー、パフォーマンスサービスレベルアグリーメント (SLA) の構成を含む、基本的な SD-WAN 環境のセットアップにおける Fortinet ネットワークおよびセキュリティプロフェッショナルのスキルを評価します。ここでの熟練度により、効率的で回復力のある SD-WAN 構成を設計する能力が保証されます。
トピック 2	SD-WAN オーバーレイの設計とベストプラクティス: ハブアンドスポーク IPsec トポロジの展開と ADVPN の構成に重点を置いています。このトピックに精通することで、Fortinet のネットワークおよびセキュリティプロフェッショナルは、組織のニーズに合わせてカスタマイズされた効果的で信頼性の高い SD-WAN オーバーレイを実装できるようになります。
トピック 3	ルールとルーティング: SD-WAN のルールとルーティングを理解することは、トラフィックを効果的に誘導するために不可欠です。NSE7_SDW-7.2 試験のこのトピックでは、Fortinet のネットワークおよびセキュリティ専門家が SD-WAN のルールとルーティングを構成する能力を評価します。
トピック 4	SD-WAN トラブルシューティング: ルール、ルーティング、ADVPN などの SD-WAN の問題のトラブルシューティングは、ネットワークの信頼性を維持するために不可欠です。Fortinet NSE 7 – SD-WAN 7.2 試験のこのセクションでは、診断コマンドと監視ツールを使用して SD-WAN の問題を診断および解決し、堅牢で中断のないネットワーク運用を確保する能力がテストされます。
トピック 5	集中管理: この領域では、IPsec テンプレートや SD-WAN オーバーレイテンプレートの使用など、FortiManager を介した SD-WAN の導入と管理に重点を置いています。ここでの習得は、Fortinet のネットワークおよびセキュリティ専門家が SD-WAN 構成を合理化し、セキュリティを強化し、複数のサイトにわたって一貫したポリシーを維持できる能力を実証します。