An administrator is analyzing SD-WAN traffic logs to identify sessions that used a specific WAN interface. Which log field would be most useful for this analysis?

The 'interface' field, which records the WAN interface used for the session.

The 'action' field, which shows whether the session was allowed or denied.

The 'dstip' field, which shows the destination IP address.

The 'policyid' field, which identifies the firewall policy.

An administrator is troubleshooting intermittent SD-WAN session drops. The drops occur only during peak hours. The administrator needs to identify the pattern of drops and correlate them with WAN interface performance. Which approach would provide the most comprehensive analysis?

Use FortiView's SD-WAN Performance widget to view real-time latency and jitter, and correlate with traffic logs showing dropped sessions.

Review only the event logs for system errors.

Review only the traffic logs for dropped sessions.

Use the CLI to check the SD-WAN configuration.

A multi-site organization uses FortiGates at each site to forward SD-WAN logs to a central syslog server. The central server is experiencing high load, and the administrator needs to reduce the volume of logs forwarded without losing critical information. Which approach would best achieve this?

Change the syslog protocol to TCP to improve reliability.

Configure log filtering on each FortiGate to forward only logs that match specific criteria, such as errors or dropped sessions.

Increase the log buffer size on each FortiGate to store more logs locally.

Enable log anonymization to reduce the size of each log entry.

What is the primary purpose of FortiView in the context of SD-WAN monitoring?

To generate automated alerts for security threats detected in the network

To provide real-time visibility into SD-WAN traffic and session behavior through graphical dashboards

To store historical logs for long-term compliance and auditing

To configure SD-WAN rules and policies for traffic steering

FortinetNSE 5 - SD-WAN Core Administrator

Domain 5Objective 1

Analyze SD-WAN Logs to Monitor Rules and Session Behavior NSE5-SD-WAN-CORE-ADMINISTRATOR Practice Questions (Page 2)

Part of the Analytics domain, which accounts for 15-25% of the NSE5-SD-WAN-CORE-ADMINISTRATOR exam.

28questions here

6free pages

6concepts

15-25%of the exam

Questions 6–10

6application · medium
An administrator is analyzing SD-WAN traffic logs to identify sessions that used a specific WAN interface. Which log field would be most useful for this analysis?
Select an answer first
7expert · hard
An administrator is troubleshooting intermittent SD-WAN session drops. The drops occur only during peak hours. The administrator needs to identify the pattern of drops and correlate them with WAN interface performance. Which approach would provide the most comprehensive analysis?
Select an answer first
8expert · hard
A multi-site organization uses FortiGates at each site to forward SD-WAN logs to a central syslog server. The central server is experiencing high load, and the administrator needs to reduce the volume of logs forwarded without losing critical information. Which approach would best achieve this?
Select an answer first
9foundation · easy
Which FortiView feature allows an administrator to see the current active sessions passing through the FortiGate?
Select an answer first
10foundation · easy
What is the primary purpose of FortiView in the context of SD-WAN monitoring?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE5-SD-WAN-CORE-ADMINISTRATOR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE5-SD-WAN-CORE-ADMINISTRATOR” is a trademark of its owner, used for identification only.