82 Q&As in UPDATED NSE7_SDW-6.4 Exam Questions Certification Test Engine to PDF [Q28-Q49] : Free valid test braindumps : http://free.validbraindumps.com

NEW QUESTION 28
Refer to exhibits

Exhibit A shows the system interface with the static routes and exhibit B shows the firewall policies on the managed FortiGate Based on the FortiGate configuration shown in the exhibits, what are two issues you might encounter when creating an SD-WAN interface on port1 and port2? {Choose two )

Member interfaces that are administratively down

Member interface that have IP address of 0.0.0.0/0.0.0.0

Member interfaces that are physical interfaces as well as VLAN aggregate, and iPsec interfaces

Member interfaces that are referenced by any other configuration element

NEW QUESTION 29
What are two reasons for using FortiManager to organize and manage the network for a group of FortiGate devices? (Choose two )

It simplifies the deployment and administration of SD-WAN on managed FortiGate devices.

It improves SD-WAN performance on the managed FortiGate devices.

It sends probe signals as health checks to the beacon servers on behalf of FortiGate.

It acts as a policy compliance entity to review all managed FortiGate devices.

It reduces WAN usage on FortiGate devices by acting as a local FortiGuard server.

NEW QUESTION 30
Refer to exhibits.

Exhibit A shows the performance SLA exhibit B shows the SD-WAN diagnostics output.
Based on the exhibits, which statement is correct?

Port1 became dead because no traffic was offload through the egress of port1.

SD-WAN member interfaces are affected by the SLA state of the inactive interface.

Both SD-WAN member interfaces have used separate SLA targets.

The SLA state of port1 is dead after five unanswered requests by the SLA servers.

NEW QUESTION 31
What are the two minimum configuration requirements for an outgoing interface to be selected once the SD-WAN logical interface is enabled? (Choose two )

Specify outgoing interface routing cost.

Configure SD-WAN rules interface preference.

Select SD-WAN balancing strategy.

Specify incoming interfaces in SD-WAN rules.

NEW QUESTION 32
Which statement about using BGP routes in SD-WAN is true?

Adding static routes must be enabled on all ADVPN interfaces.

VPN topologies must be form using only BGP dynamic routing with SD-WAN

Learned routes can be used as dynamic destinations in SD-WAN rules

Dynamic routing protocols can be used only with non-encrypted traffic

NEW QUESTION 33
Which statement is correct about the SD-WAN and ADVPN?

ADVPN interface can be a member of SD-WAN interface.

Dynamic VPN is not supported as an SD-Wan interface.

Spoke support dynamic VPN as a static interface.

Hub FortiGate is limited to use ADVPN as SD-WAN member interface.

NEW QUESTION 34
What are two roles that SD-WAN orchestrator plays when it works with FortiManager? (Choose two )

It configures and monitors SD-WAN networks on FortiGate devices that are managed by FortiManager.

It acts as a standalone device to assist FortiManager to manage SD-WAN interfaces on the managed FortiGate devices.

It acts as a hub FortiGate with an SD-WAN interface enabled and managed along with other FortiGate devices by FortiManager.

It acts as an application that is released and signed by Fortinet to run as a part of management extensions on FortiManager.

NEW QUESTION 35
Why is it effective to use SD WAN rules when configuring application control?

Because traffic can be load balanced based on application type

Because SD-WAIM rules are independent from firewall policies to avoid controlling applications

Because you must use certificate full inspection on the firewall policy

Because the application database is manually maintained by administrators

NEW QUESTION 36
Refer to the exhibit. Which conclusion about the packet debug flow output is correct?

The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.

The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the firewall policy, and the packet was dropped.

The packet size exceeded the outgoing interface MTU.

The total number of daily sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.

NEW QUESTION 37
Refer to the exhibit.

Which two conclusions for traffic that matches the traffic shaper are true? (Choose two.)

The traffic shaper drops packets if the bandwidth exceeds 6250 KBps.

The traffic shaper limits the bandwidth of each source IP to a maximum of 6250 KBps.

The traffic shaper drops packets if the bandwidth is less than 2500 KBps.

The measured bandwidth is less than 100 KBps.

NEW QUESTION 38
Which two statements describe how IPsec phase 1 aggressive mode is different from main mode when performing IKE negotiation? (Choose two)

A peer ID is included in the first packet from the initiator, along with suggested security policies.

XAuth is enabled as an additional level of authentication, which requires a username and password.

A total of six packets are exchanged between an initiator and a responder instead of three packets.

The use of Diffie Hellman keys is limited by the responder and needs initiator acceptance.

NEW QUESTION 39
Refer to exhibits.

Exhibit A shows the SD-WAN rules and exhibit B shows the traffic logs. The SD-WAN traffic logs reflect how FortiGate processed traffic.
Which two statements about how the configured SD-WAN rules are processing traffic are true? (Choose two.)

The implicit rule overrides all other rules because parameters widely cover sources and destinations.

SD-WAN rules are evaluated in the same way as firewall policies: from top to bottom.

The All_Access_Rules rule load balances Vimeo application traffic among SD-WAN member interfaces.

The initial session of an application goes through a learning phase in order to apply the correct rule.

NEW QUESTION 40
Refer to Exhibit:

Based on the exhibit, which algorithm does SD-WAN use to distribute traffic that does not match any of the SD-WAN rules, among the member interfaces?

All traffic from a source IP to a destination IP Is sent to the same interface.

All traffic from a source IP Is sent to the most used Interface.

All traffic from a source IP to a destination IP is sent to the least used interface.

All traffic from a source IP is sent to the same interfaces.

NEW QUESTION 41
What would best describe the SD-WAN traffic shaping mode that bases itself on a percentage of available bandwidth?

Per-IP shaping mode

Reverse policy shaping mode

Interface-based shaping mode

Shared policy shaping mode

NEW QUESTION 42
Which components make up the secure SD-WAN solution?

Application, antivirus, and URL, and SSL inspection

Datacenter, branch offices, and public cloud

FortiGate, FortiManager, FortiAnalyzer, and FortiDeploy

Telephone, ISDN, and telecom network.

NEW QUESTION 43
Refer to the exhibit.

Which statement about the trace evaluation by FortiGate is true?

Packets exceeding the configured maximum concurrent connection limit are denied by the per-IP shaper.

The packet exceeded the configured bandwidth and was dropped based on the priority configuration.

The packet exceeded the configured maximum bandwidth and was dropped by the shared shaper.

Packets exceeding the configured concurrent connection limit are dropped based on the priority

NEW QUESTION 44
Which statement about using BGP routes in SD-WAN is true?

Adding static routes must be enabled on all ADVPN interfaces.

VPN topologies must be form using only BGP dynamic routing with SD-WAN

Learned routes can be used as dynamic destinations in SD-WAN rules

Dynamic routing protocols can be used only with non-encrypted traffic

NEW QUESTION 45
Which two interfaces are considered overlay links? (Choose two.)

IPsec

Physical

LAG

GRE

NEW QUESTION 46
Refer to the exhibit.

Which two statements about the status of the VPN tunnel are true? <Choose two )

There are separate virtual interfaces for each dial-up client.

VPN static routes are prevented from populating the FortiGate routing table.

FortiGate created a single IPsec virtual interface that is shared by all clients.

100.64.3.1 is one of the remote IP address that comes through index interface 1.

NEW QUESTION 47
Which CLI command do you use to perform real-time troubleshooting for ADVPN on either a hub or a spoke FortiGate?

diagnose sys virtual-wan-link service

get router info routing-table

diagnose debug application ike

get ipsec tunnel list

NEW QUESTION 48
When attempting to establish an IPsec tunnel to FortiGate, all remote users match the FIRST_VPN IPsec VPN. This includes remote users that want to connect to the SECOND_VPN IPsec VPN. Which two configuration changes must you make on both IPsec VPNs so that remote users can connect to their intended IPsec VPN? (Choose two.)

Configure different proposals.

Configure a unique peer ID.

Change the IKE mode to aggressive.

Configure different Diffie Hellman groups.

NEW QUESTION 49
Refer to the exhibit.

Which statement about the trace evaluation by FomGate is true?

Packets exceeding the configured maximum concurrent connection limit are denied by the per-IP shaper.

The packet exceeded the configured bandwidth and was dropped based on the priority configuration.

The packet exceeded the configured maximum bandwidth and was dropped by the shared shaper.

Packets exceeding the configured concurrent connection limit are dropped based on the priority configuration.