Fortinet NSE 7 - SD-WAN 7.2 - NSE7_SDW-7.2 Exam Questions [2026]

QUESTION NO: 1
Which two statements describe how IPsec phase 1 main mode id different from aggressive mode when performing IKE negotiation? (Choose two.)

A. The use of Diffie Hellman keys is limited by the responder and needs initiator acceptance. B. A peer ID is included in the first packet from the initiator, along with suggested security policies. C. Three packets are exchanged between an initiator and a responder instead of six packets. D. XAuth is enabled as an additional level of authentication, which requires a username and password.

Correct Answer: B,C

QUESTION NO: 2
Which best describes the SD-WAN traffic shaping mode that bases itself on a percentage of available bandwidth?

A. Shared-policy shaping mode B. Reverse-policy shaping mode C. Per-IP shaping mode D. Interface-based shaping mode

Correct Answer: D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 3
In which SD-WAN template field can you use a metadata variable?

A. You can use metadata variables only to define interface members and the gateway IP. B. Any field Identified with a dollar sign ($) in a magnifying glass. C. All SD-WAN template fields support metadata variables. D. Any field identified with an "M" in a circle.

Correct Answer: B

QUESTION NO: 4
What are two benefits of choosing packet duplication over FEC for data loss correction on noisy links?
(Choose two.)

A. Packet duplication does not require a route to the destination. B. Packet duplication supports hardware offloading. C. Packet duplication can leverage multiple IPsec overlays for sending additional data. D. Packet duplication uses smaller parity packets which results in less bandwidth consumption.

Correct Answer: B,C

QUESTION NO: 5
What are two advantages of using an IPsec recommended template to configure an IPsec tunnel in an hub-and- spoke topology? (Choose two.)

A. It ensures consistent settings between phase1 and phase2. B. The VPN monitor tool provides additional statistics for tunnels defined with an IPsec recommended template. C. It automatically install IPsec tunnels to every spoke when they are added to the FortiManager ADOM. D. It guides the administrator to use Fortinet recommended settings.

Correct Answer: A,D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 6
Refer to the exhibits.

Exhibit A shows the SD-WAN rule status and the learned BGP routes with community 65000:10.
Exhibit B shows the SD-WAN rule configuration, the BGP neighbor configuration, and the route map configuration.
The administrator wants to steer corporate traffic using routes tags in the SD-WAN rule ID 1.
However, the administrator observes that the corporate traffic does not match the SD-WAN rule ID 1.
Based on the exhibits, which configuration change is required to fix issue?

A. In the dc1-lan-rm route map configuration, unset match-community. B. In SD-WAN rule ID 1, change the destination to use ISDB entries. C. In the BGP neighbor configuration, apply the route map dc1-lan-rm in the outbound direction. D. In the dc1-lan-rm route map configuration, set set-route-tag to 10.

Correct Answer: D

QUESTION NO: 7

Exhibit B -

Exhibit A shows the system interface with the static routes and exhibit B shows the firewall policies on the managed FortiGate.
Based on the FortiGate configuration shown in the exhibits, what issue might you encounter when creating an SD-WAN zone for port1 and port2?

A. port1 is assigned a manual IP address. B. port2 is referenced in a static route. C. port1 and port2 are not administratively down. D. port1 is referenced in a firewall policy.

Correct Answer: D