An administrator is setting up SD-WAN on a FortiGate with two physical interfaces (port1, port2) and one IPsec tunnel interface (tun1). They want to use all three for SD-WAN, but they are concerned about the tunnel interface being an overlay. What is the correct approach?

Add all three interfaces (port1, port2, tun1) as SD-WAN members in the same zone.

Add port1 and port2 as members, and configure tun1 as a static route.

Add tun1 as a member, but keep port1 and port2 outside SD-WAN.

Add port1 and tun1 to one zone, and port2 to a different zone.

A network admin is troubleshooting why an IPsec tunnel interface is not appearing as an available SD-WAN member. The tunnel is up and passing traffic. What is the most likely reason?

IPsec tunnels cannot be SD-WAN members.

The tunnel is an overlay and is automatically excluded from SD-WAN.

The IPsec tunnel interface has not been added to the SD-WAN member list.

The tunnel needs to be in a different zone than physical interfaces.

A company has a hub-and-spoke SD-WAN topology. At a spoke, they have a direct internet link and an IPsec VPN tunnel to the hub. They want to send all traffic to the hub over the VPN tunnel, but if the tunnel goes down, they want to use the direct internet link as a backup. They also want to ensure that if the direct internet link goes down, the VPN tunnel can still be used. What is the best way to configure this?

Add only the VPN tunnel as an SD-WAN member and configure the internet link as a static route.

Use policy-based routing to send traffic to the VPN tunnel, with a static route to the internet as a backup.

Create two zones: one for the VPN tunnel and one for the internet link. Route all traffic to the VPN zone.

Add both the internet link and the VPN tunnel as SD-WAN members in the same zone. Create an SD-WAN rule that prefers the VPN tunnel for all traffic, with the internet link as a backup.

An administrator has two FortiGate devices in a hub-and-spoke SD-WAN topology. At the spoke site, they have a physical Ethernet port (port1) connected to a broadband modem and an IPsec VPN tunnel to the hub. Which interfaces should be added as SD-WAN members at the spoke?

Add the IPsec tunnel to the SD-WAN zone but keep port1 outside SD-WAN.

Add only port1 as an SD-WAN member; the IPsec tunnel is an overlay and cannot be a member.

Add only the IPsec tunnel as an SD-WAN member; the physical port is just a transport.

Add port1 and the IPsec tunnel interface as SD-WAN members.

When configuring an SD-WAN member on a FortiGate, which of the following can be assigned as a member?

A physical interface such as port1

FortinetNSE 5 - SD-WAN Core Administrator

Domain 1Objective 2

Configure SD-WAN Members and Zones NSE5-SD-WAN-CORE-ADMINISTRATOR Practice Questions (Page 3)

Part of the Decentralized SD-WAN domain, which accounts for 20-30% of the NSE5-SD-WAN-CORE-ADMINISTRATOR exam.

22questions here

5free pages

4concepts

20-30%of the exam

Questions 11–15

11expert · medium
An administrator is setting up SD-WAN on a FortiGate with two physical interfaces (port1, port2) and one IPsec tunnel interface (tun1). They want to use all three for SD-WAN, but they are concerned about the tunnel interface being an overlay. What is the correct approach?
Select an answer first
12application · medium
A network admin is troubleshooting why an IPsec tunnel interface is not appearing as an available SD-WAN member. The tunnel is up and passing traffic. What is the most likely reason?
Select an answer first
13expert · hard
A company has a hub-and-spoke SD-WAN topology. At a spoke, they have a direct internet link and an IPsec VPN tunnel to the hub. They want to send all traffic to the hub over the VPN tunnel, but if the tunnel goes down, they want to use the direct internet link as a backup. They also want to ensure that if the direct internet link goes down, the VPN tunnel can still be used. What is the best way to configure this?
Select an answer first
14application · medium
An administrator has two FortiGate devices in a hub-and-spoke SD-WAN topology. At the spoke site, they have a physical Ethernet port (port1) connected to a broadband modem and an IPsec VPN tunnel to the hub. Which interfaces should be added as SD-WAN members at the spoke?
Select an answer first
15foundation · easy
When configuring an SD-WAN member on a FortiGate, which of the following can be assigned as a member?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE5-SD-WAN-CORE-ADMINISTRATOR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE5-SD-WAN-CORE-ADMINISTRATOR” is a trademark of its owner, used for identification only.