Pre-Summer Sale Special - Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: sntaclus

examout.co

Refer to the exhibit.

The administrator analyzed the traffic between a branch FortiGate and the server located in the data center, and noticed the behavior shown in the diagram.

When the LAN clients located behind FGT1 establish a session to a server behind DC-1, the administrator observes that, on DC-1, the reply traffic is routed overT2. even though T1 is the preferred member in

the matching SD-WAN rule.

What can the administrator do to instruct DC-1 to route the reply traffic through the member with the best performance?

A.

Enable snat-route-change under config system global.

B.

Enable reply-session under config system sdwan.

C.

Enable auxiliary-session under config system settings.

D.

FortiGate route lookup for reply traffic only considers routes over the original ingress interface.

Refer to the exhibits.

The exhibits show the SD-WAN zone configuration of an SD-WAN template prepared on FortiManager and the policy package configuration.

When the administrator tries to install the configuration changes, FortiManager fails to commit.

What should the administrator do to fix the issue?

A.

Configure branch1_fgt as the installation target for policy 3.

B.

Configure HUB1 as the destination of policy 3.

C.

Configure a normalized interface for the IPsec tunnel HUB1-VPN1.

D.

Configure both HUB1-VPN1 and HUB1-VPN2 as the destination of policy 3

Refer to the exhibits.

The interface details, static route configuration, and firewall policies on the managed FortiGate device are shown.

You want to configure a new SD-WAN zone, named Underlay, that contains the interfaces port1 and port2.

What must be your first action?

A.

Define port1 as an SD-WAN member.

B.

Delete the static routes.

C.

Delete the SD-WAN Zone Test.

D.

Delete the firewall policies.

(When you deploy SD-WAN, you can choose from several common designs. Each design best applies to specific contexts.

Which two statements correctly associate a common SD-WAN design with its main indication or constraint? Choose two answers.)

A.

Use a cloud on-ramp topology to improve the performance of cloud applications.

B.

Use a standalone design for sites with only one WAN link to the cloud.

C.

Use remote breakout to centralize traffic inspection and limit local management requirements.

D.

Use a direct internet access (DIA) design to increase the traffic security and allow local devices with limited capabilities.

An SD-WAN member is no longer used to steer SD-WAN traffic. The administrator updated the SD-WAN configuration and deleted the unused member. After the configuration update, users report that some destinations are unreachable. You confirm that the affected flow does not match an SD-WAN rule.

What could be a possible cause of the traffic interruption?

A.

FortiGate, with SD-WAN enabled, cannot route traffic through interfaces that are not SD-WAN members.

B.

FortiGate can remove some static routes associated with an interface when the member is removed from SD-WAN.

C.

FortiGate removes the layer 3 settings for interfaces that are removed from the SD-WAN configuration.

D.

FortiGate administratively brings down interfaces when they are removed from the SD-WAN configuration.

You manage an SD-WAN topology. You will soon deploy 50 new branches.

Which three tasks can you do in advance to simplify this deployment? (Choose three.)

A.

Update the DHCP server configuration.

B.

Create model devices.

C.

Create a ZTP template.

D.

Define metadata variables value for each device.

E.

Create policy blueprint.

(Refer to the exhibit.

An SD-WAN zone configuration on the FortiGate GUI is shown.

What can you conclude about the zone and member configuration on this device? Choose one answer.)

A.

You can delete the virtual-wan-link zone.

B.

The WAN2 zone contains no member.

C.

You can delete the WAN1 zone.

D.

You can add the member B-125 to the WAN3 zone and keep it as a member of the Test zone.

(You want to configure two static routes: one that references an SD-WAN zone and a second one that references an SD-WAN member that belongs to that zone.

Which statement about this scenario is true? Choose one answer.)

A.

You cannot create static routes for individual SD-WAN members.

B.

You cannot create static routes that reference an SD-WAN zone.

C.

The destination subnets must be different.

D.

The source subnets must be different.

Exhibit.

Refer to the exhibit, which shows the SD-WAN rule status and configuration.

Based on the exhibit, which change in the measured packet loss will make HUB1-VPN3 the new preferred member?

A.

When HUB1-VPN1 has 4% packet loss

B.

When HUB1-VPN1 has 12% packet loss

C.

When HUB1-VPN3 has 4% packet loss

D.

When all three members have the same packet loss

Refer to the exhibits.

The exhibits show two IPsec templates to define Branch IPsec 1 and Branch_IPsec_2. Each template defines a VPN tunnel. The error message that FortiManager displayed when the administrator tried to assign the second template to the FortiGate device is also shown.

Which statement best describes the cause of the issue?

A.

You can assign only one template with a tunnel type of static to each FortiGate device.

B.

You can assign only one IPsec template to each FortiGate device.

C.

You should review the branch1_fgt configuration for configured tunnels in the rootVDOM.

D.

You should use the same outgoing interface of both templates.