What are three key routing principles of SD-WAN? (Choose three.)
ASD-WAN rules are skipped if the best route to the destination is not an SD-WAN member.
BRoutes to directly connected subnets have precedence over SD-WAN rules.
CSD-WAN rules are skipped if the best route to the destination is a static route.
DSD-WAN members are skipped if they do not have a valid route to the destination.
EInternet Service Database (ISDB) routes have precedence over SD-WAN rules.
Refer to the exhibit.
To check the status of an SD-WAN topology using the FortiManager SD-WAN monitor menus, you place your mouse next to branch1_fgt and receive the output shown in the exhibit.
Which conclusion can you draw from the output shown in the exhibit?
AThe template Corp-SOT defines a single-hub topology
Bbranch3_fgt is configured with three SD-WAN overlay tunnels and one is dead.
CThe three spokes have tunnels that are out of SLA.
DThree tunnels of branch2_fgt are out of SLA.
Refer to the exhibit.
Two hub-and-spoke groups are connected through redundant site-to-site IPsec VPNs between Hub 1 and Hub 2.
Which two configuration settings are required for spoke A1 to establish an auto-discovery VPN (ADVPN) shortcut with spoke B2? (Choose two.)
AOn the hubs, auto-discovery-forwarder must be enabled on the IPsec VPNs to hubs.
BOn the spokes, auto-discovery-receiver must be enabled on the IPsec VPNs to the hub.
COn the hubs, auto-discovery-receiver must be enabled on the IPsec VPNs to spokes.
DOn the spokes, auto-discovery-sender must be enabled on the IPsec VPNs to hubs.
In the context of SD-WAN, the terms underlay and overlay are commonly used to categorize links.
Which two statements about underlay and overlay links are correct? (Choose two.)
AOverlay links provide routing flexibility.
BFortiLink interface is considered an underlay link.
CA VLAN is a type of overlay link.
DOnly wired connections can be used as underlay links.
EWireless connections can be used to build overlay links.
Refer to the exhibit.
Which two conclusions can you draw from the output shown? (Choose two.)
AUDP traffic destined to the subnet 10.22.0.0/24 matches a policy route.
BAt least one SD-WAN rule is defined with application categories as the destination.
CAt least one SD-WAN rule allows traffic load balancing.
DUDP traffic destined to the subnet 10.22.0.0/24 matches a manual SD-WAN rule.
You are configuring SD-WAN to load balance network traffic and you want to take into account the link quality.
Which two facts should you consider? (Choose two.)
AThe best quality strategy supports only the round-robin hash mode.
BWhen applicable, FortiGate load balances the traffic through all members that meet the SLA target.
CYou can select the best quality strategy and allow SD-WAN load balancing.
DYou can select the lowest cost service level agreement (SLA) strategy and allow SD-WAN load balancing.
You configure the overlay tunnels for an SD-WAN hub-and-spoke topology defined with IPsec tunnels, BGP on loopback and dynamic BGP.
Which are two recommended IPsec settings for this topology? (Choose two.)
AOn the hub, set the tunnel type to static.
BOn the spoke, set the parameter net-device to enable.
COn the spoke, configure the parameter localid.
DOn the hub, set the parameter mode-cfg to enable.
An SD-WAN member is no longer used to steer SD-WAN traffic. The administrator updated the SD-WAN configuration and deleted the unused member. After the configuration update, users report that some destinations are unreachable. You confirm that the affected flow does not match an SD-WAN rule.
What could be a possible cause of the traffic interruption?
AFortiGate administratively brings down interfaces when they are removed from the SD-WAN configuration.
BFortiGate, with SD-WAN enabled, cannot route traffic through interfaces that are not SD-WAN members.
CFortiGate can remove some static routes associated with an interface when the member is removed from SD-WAN.
DFortiGate removes the layer 3 settings for interfaces that are removed from the SD-WAN configuration.
Refer to the exhibits.
The configuration of an SD-WAN rule and the corresponding rule status and routing table are shown.
You want to understand the expected behavior for traffic that matches the SD-WAN rule, at the time the output was collected.
Based on the exhibits, which behavior can you expect for traffic that matches the SD-WAN rule?
AThe traffic will be routed over HUB1-VPN1.
BThe traffic will be load balanced across all three overlays.
CThe traffic will be routed over HUB1-VPN2.
DThe traffic will be routed over HUB1-VPN3.
Refer to the exhibits.
The SD-WAN overlay template, advanced settings, and the underlay and network advertisement settings are shown.
These are the configurations for the secondary hub of a dual-hub SD-WAN topology created with the FortiManager SD-WAN overlay orchestrator.
Which two conclusions can you draw from the information shown in the exhibits? (Choose two.)
AFortiManager will create an overlay tunnel on the port2 interface.
BFortiManager will define port5 as a BGP neighbor.
CFortiManager will create an overlay tunnel on the port1 interface.
DFortiManager will define port2 as a BGP neighbor.
You manage an SD-WAN topology and you will soon deploy 50 new branches.
Which two tasks can you do in advance to simplify this deployment? (Choose two.)
ADefine metadata variable values for each device.
BCreate model devices.
CCreate a zero-touch provisioning (ZTP) template.
DCreate a policy blueprint.
Refer to the exhibit.
The event log on a FortiGate device is shown.
Based on the output shown in the exhibit, what can you conclude about the tunnels on this device?
BThe voice traffic is steered through the VPN tunnel HUB1-VPN3.
CThere is one shortcut tunnel built from the master tunnel VPN4.
DThe VPN tunnel HUB1-VPN1_0 is a shortcut tunnel.
Refer to the exhibits.
You use FortiManager to configure SD-WAN on three branch devices.
When you install the device settings, FortiManager prompts you with the error “Copy Failed” for the device branch1_fgt. When you click Log, FortiManager displays the message shown in the exhibit.
Based on the exhibits, which statement best describes the root cause of the issue?
AYou cannot combine metadata variables and installation targets.
BThe metadata variable definitions are incomplete or incorrect.
CThe connection between branch1_fgt and FortiManager failed.
DGateways for all members in a zone must be of the same type.
Refer to the exhibits.
Two IPsec templates to define Branch_IPsec_1 and Branch_IPsec_2 are shown.
Each template defines a VPN tunnel. When the administrator tried to assign the second template to the FortiGate device, the FortiManager displayed the below error message:
Which statement best describes the cause of the issue?
AYou can assign only one IPsec template to each FortiGate device.
BYou should use the same outgoing interface of both templates.
CYou can assign only one template with a tunnel type of static to each FortiGate device.
DYou should review the branch1_fgt configuration for configured tunnels in the root VDOM.
Preview
