(Apr-2026) FCSS_SDW_AR-7.6 Exam Dumps Contains FREE Real Quesions from the Actual Exam
Free Test Engine Verified By Fortinet Certified Solution Specialist Certified Experts
Fortinet FCSS_SDW_AR-7.6 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 30
You have a FortiGate configuration with three user-defined SD-WAN zones and two members in each of these zones. One SD-WAN member is no longer in use in health-check and SD-WAN rules. You want to delete it.
What happens if you delete the SD-WAN member from the FortiGate GUI?
- A. FodiGate accepts the deletion and removes routes as required.
- B. FortiGate displays an error message. You must use the CLI to delete an SD-WAN member.
- C. FortiGate displays an error message. SD-WAN zones must contain at least two members
- D. FortiGate accepts the deletion and places the member in the default SD-WAN zone.
Answer: A
Explanation:
In FortiOS, you can remove an SD-WAN member from the GUI as long as it is not in use in any health-checks, SD-WAN rules, or policies.
When you delete it, FortiGate will automatically clean up related routes (static or dynamic SD- WAN routes referencing that member).
NEW QUESTION # 31
(Refer to the exhibits.
Two SD-WAN event logs, the member status, the SD-WAN rule configuration, and the health-check configuration for a FortiGate device are shown.
Immediately after the log messages are displayed, how will the FortiGate steer the traffic based on the information shown in the exhibits? Choose one answer.)
- A. FortiGate uses port1 or port2 to steer the traffic for SD-WAN rule ID 1.
- B. FortiGate uses port1 to steer the traffic for SD-WAN rule ID 1.
- C. FortiGate skips SD-WAN rule ID 1.
- D. FortiGate uses port2 to steer the traffic for SD-WAN rule ID 1.
Answer: D
Explanation:
From the SD-WAN rule configuration (service edit 1, "Critical-DIA"), the rule uses mode sla and specifies:
set priority-members 1 2
This means, for traffic matching SD-WAN rule ID 1, FortiGate prefers member 1 first, then member 2, but only if the selected member meets the SLA requirements.
From the SD-WAN event log, the message explicitly states:
Member status changed. Member out-of-sla.
The log includes Member: 1
This indicates SD-WAN member 1 is now out of SLA immediately after the log is generated.
From the SD-WAN member status output:
Member(1) corresponds to interface port1
Member(2) corresponds to interface port2
Because member 1 (port1) is out of SLA, FortiGate cannot use it for an SLA-based rule at that moment. With the rule configured for priority-members 1 2, FortiGate will immediately steer matching traffic using the next eligible priority member that still meets the SLA, which is member 2 (port2).
Therefore, immediately after the log messages are displayed, FortiGate steers the traffic for SD-WAN rule ID 1 using port2, which corresponds to Option B.
Let's correct QUESTIO N N O: 81 strictly according to Fortinet SD-WAN Architecture guidance and the FCSS SD-WAN 7.6 design principles.
Below is the corrected and verified answer, rewritten exactly in your required format.
NEW QUESTION # 32
Refer to the exhibits.
The exhibits show the source NAT (SNAT) global setting. port2 interface settings, and the routing table on FortiGate.
The administrator increases the member priority on port2 to 20.
Upon configuration changes and the receipt of new packets, which two actions does FortiGate perform on existing sessions established over port2? (Choose two.)
- A. FortiGate updates the gateway information of the sessions with SNAT so that they use port1 instead of port2.
- B. FortiGate flags the SNAT session as dirty only if the administrator has assigned an IP pool to the firewall policies with NAT.
- C. FortiGate flags the sessions as dirty.
- D. FortiGate routes only new sessions over port2.
- E. FortiGate continues routing all existing sessions over port2.
Answer: A,C
Explanation:
When the member priority of a port is increased (e.g., port2 to 20), FortiGate evaluates existing sessions and applies "dirty" flags where applicable. The SD-WAN session management mechanism is described in detail: "Upon a change in SD-WAN member priority, all existing sessions using that member are marked as dirty. For SNAT sessions, the gateway information is updated to ensure future packets are routed through the newly preferred member, in this case, port1. This automatic re-evaluation allows SD-WAN to dynamically respond to topology or priority changes, maintaining optimal routing." This is fundamental to seamless failover and session persistence in Fortinet SD-WAN, ensuring active flows are redirected based on updated priorities or health status.
Reference:
[FCSS_SDW_AR-7.4 1-0.docx Q13]
FortiOS 7.4 SD-WAN Concept Guide, "Session Management During Path Change" FortiGate CLI Reference: diagnose sys session list
NEW QUESTION # 33
You want FortiGate to use SD-WAN rules to steer local-out traffic.
Which two constraints should you consider? (Choose two.)
- A. By default, local-out traffic does not use SD-WAN.
- B. You must configure each local-out feature individually to use SD-WAN.
- C. By default, FortiGate uses SD-WAN rules only for local-out traffic that corresponds to pingand traceroute.
- D. You can steer local-out traffic only with SD-WAN rules that use the manual strategy.
Answer: A,B
Explanation:
By default, local-out traffic does not use SD-WAN → FortiGate normally sends local-out traffic (e.g., DNS, NTP, FortiGuard updates) directly through its interfaces without applying SD-WAN rules.
You must configure each local-out feature individually to use SD-WAN → To steer local-out traffic via SD-WAN, you must explicitly configure the desired local-out features (e.g., DNS, FortiGuard, CAPWAP) to use SD-WAN rules.
NEW QUESTION # 34
Exhibit.
Two hub-and-spoke groups are connected through redundant site-to-site IPsec VPNs between Hub 1 and Hub 2 Which two configuration settings are required for the spoke A1 to establish an ADVPN shortcut with the spoke B2? (Choose two.)
- A. On hubs, auto-discovery-forwarder must be enabled on the IPsec VPNs to spokes.
- B. On hubs, auto-discovery-receiver must be enabled on the IPsec VPNs to spokes.
- C. On hubs, auto-diacovery-sender must be enabled on the IPsec VPNs to spokes
- D. On hubs, auto-discovery-forwarder must be enabled on the IPsec VPNs to hubs.
Answer: C,D
Explanation:
To allow spokes in different hub-and-spoke groups to establish ADVPN shortcuts, the hubs must be configured to forward and send ADVPN shortcut offers. The key required settings on the hub are auto-discovery-forwarder (for VPNs to hubs) and auto-discovery-sender (for VPNs to spokes). This ensures the hub can facilitate and advertise ADVPN shortcut offers between spokes.
Reference:
[FCSS_SDW_AR-7.4 1-0.docx Q1]
Fortinet SD-WAN 7.4 ADVPN Guide (Auto-discovery settings for hub-and-spoke topologies)
NEW QUESTION # 35
Refer to the exhibit. To check the status of an SD-WAN topology using the FortiManager SD- WAN monitor menus, you place your mouse next to branch1_fgt and receive the output shown in the exhibit. Which conclusion can you draw from the output shown in the exhibit?
- A. The three spokes have tunnels that are out of SLA.
- B. branch3_fgt is configured with three SD-WAN overlay tunnels and one is dead.
- C. Three tunnels of branch2_fgt are out of SLA.
- D. The template Corp-SOT defines a single-hub topology.
Answer: D
Explanation:
In the SD-WAN monitor "Template View: Corp-SOT" you see a single hub icon with multiple spokes. That visualization corresponds to a single-hub topology. The pop-up for branch1_fgt listing HUB2-VPN1/2/3 as Down Interfaces simply shows secondary (to a would-be Hub2) tunnels are down, but only one hub is actually defined/active in this template view.
NEW QUESTION # 36
Refer to the exhibits. You use FortiManager to manage the branch devices and configure the SD- WAN template. You have configured direct internet access (DIA) for the IT department users.
Now. you must configure secure internet access (SIA) for all local LAN users and have set the firewall policies as shown in the second exhibit.
Then, when you use the install wizard to install the configuration and the policy package on the branch devices, FortiManager reports an error as shown in the third exhibit. Which statement describes why FortiManager could not install the configuration on the branches?
- A. You cannot install firewall policies that reference an SD-WAN member.
- B. You cannot install firewall policies that reference an SD-WAN zone.
- C. You cannot install SIA and DIA rules on the same device.
- D. You must direct SIA traffic to a VPN tunnel.
Answer: A
Explanation:
In FortiManager, firewall policies must reference SD-WAN zones, not individual SD-WAN members (interfaces like port1 or port2). The SIA rule incorrectly references port1, which is a member - not a zone - causing the installation failure during validation.
NEW QUESTION # 37
Refer to the exhibit that shows a diagnose output on FortiGate.
Based on the output shown in the exhibit, what can you say about the device role and how it handles health checks?
- A. The device is a hub. It receives embedded health-check measures for each tunnel from the spoke.
- B. The device is a spoke. It receives health-check measures for the tunnels of another spoke.
- C. The device is a hub. It receives health-check measures for the tunnels of a spoke.
- D. The device is a spoke. It provides embedded health-check measures for each tunnel to the hub.
Answer: D
Explanation:
The diagnose output shows multiple ADVPN tunnels (HUB1-VPN1, HUB1-VPN2, HUB1-VPN3) with detailed latency, jitter, and packet loss values being reported for each. In ADVPN, the spoke performs embedded health checks and provides the hub with the performance metrics for each tunnel. Therefore, the device in the exhibit is a spoke, and it is sending health-check measurements for each tunnel to the hub.
NEW QUESTION # 38
Refer to the exhibit.
The exhibit shows the BGP configuration on the hub in a hub-and-spoke topology. The administrator wants BGP to advertise prefixes from spokes to other spokes over the IPsec overlays, including additional paths. However, when looking at the spoke routing table, the administrator does not see the prefixes from other spokes and the additional paths Which three settings must the administrator configure inside each BGP neighbor group so spokes can learn the prefixes of other spokes and their additional paths? (Choose three.)
- A. Set additional-path to send
- B. Set additional-path to forward
- C. Set adv-additional-path to the number of additional paths to advertise.
- D. Enable route-reflector-client.
- E. Enable route-reflector-server
Answer: A,C,D
Explanation:
The hub must send additional paths to spokes (set additional-path send).
The hub must treat each spoke as a route-reflector client so spoke routes are reflected to other spokes.
The hub must specify how many additional paths to advertise (set adv-additional-path <n>).
NEW QUESTION # 39
Within the context of SD-WAN, what does SIA correspond to?
- A. Remote Breakout
- B. Software Internet Access
- C. Local Breakout
- D. Secure Internet Authorization
Answer: A
Explanation:
NEW QUESTION # 40
An MSSP uses FortiManager to manage the FortiGate devices of its customers. The administrator grouped the devices for each customer in different ADOMs. For customer A, you configured one SD-WAN overlay template that applies to all devices in the ADOM. For customer B, you configured SD-WAN for DIA at the device level, with a different configuration for each FortiGate. You onboard customer C, a car manufacturer, who requests to have a single-hub SD- WAN topology for its retail points, and a dual-hub topology for the FortiGate devices installed in its factories. Which statement best describes how you should handle this request?
- A. You can place all the devices in the same ADOM and you can create multiple SD-WAN templates, but you cannot use the SD-WAN overlay template.
- B. You can place all the devices in the same ADOM and define two topologies with the SD-WAN overlay template.
- C. You can place all the devices in the same ADOM, but you must use the SD-WAN overlay template to define only one topology.
- D. You must assign the devices to different ADOMs to avoid conflicts between the single-hub and dual-hub SD-WAN topologies.
Answer: C
Explanation:
FortiManager uses SD-WAN overlay templates per ADOM to define the SD-WAN topology.
Within a single ADOM, you can only define one SD-WAN overlay template topology that applies to all devices in that ADOM.
If different topologies are needed (e.g., single-hub for retail, dual-hub for factories), the devices cannot share multiple overlay topologies within the same ADOM.
Therefore, to handle multiple topologies, devices must be separated into different ADOMs or use separate device-level configurations outside the overlay template.
NEW QUESTION # 41
(Refer to the exhibit. The administrator configured two SD-WAN rules to load balance the traffic.
Which interfaces does FortiGate use to steer the traffic from 10.0.1.124 to 10.0.0.254? Choose one answer.)
- A. HUB2-VPN2
- B. port1 or port2
- C. HUB1-VPN2 or HUB2-VPN2
- D. Any interface in the HUB1 or HUB2 zones
Answer: C
Explanation:
The exhibit shows the runtime details of two SD-WAN services (rules):
Service(2)
Mode(manual hash-mode=inbandwidth)
Members(2): port2 (WAN2), port1 (WAN1)
Application matching: Facebook, LinkedIn, Game
Source: 10.0.1.0-10.0.1.255
This rule is clearly intended for internet/DIA application steering and does not show a corporate destination range.
Service(3)
Mode(sla hash-mode=round-robin)
Members(6): HUB1-VPN1/2/3 and HUB2-VPN1/2/3
Source: 10.0.1.0-10.0.1.255
Destination: 10.0.0.0-10.255.255.255
Traffic from 10.0.1.124 to 10.0.0.254 matches Service(3) because the destination IP 10.0.0.254 falls within the destination range 10.0.0.0-10.255.255.255.
Within Service(3), the member list shows SLA results per interface:
HUB1-VPN2 has sla(0x1) and num of pass(1)
HUB2-VPN2 has sla(0x2) and num of pass(1)
The remaining members (HUB1-VPN1, HUB2-VPN1, HUB1-VPN3, HUB2-VPN3) show sla(0x0) and num of pass(0) This indicates that, for Service(3), only HUB1-VPN2 and HUB2-VPN2 are currently meeting the SLA requirements (passing), and because the rule uses hash-mode=round-robin, FortiGate load-balances sessions across the passing members.
Therefore, FortiGate will steer the traffic using HUB1-VPN2 or HUB2-VPN2, which corresponds to Option B.
NEW QUESTION # 42
Which three factors about SLA targets and SD-WAN rules should you consider when configuring SD-WAN rules? (Choose three.)
- A. When configuring an SD-WAN rule, you can select multiple SLA targets if they are from the same performance SLA.
- B. When configuring an SD-WAN rule, you can select multiple SLA targets from different performance SLAs.
- C. SLA targets are used only by SD-WAN rules that are configured with a Lowest Cost (SLA) strategy.
- D. SD-WAN rules can use SLA targets to check whether the preferred members meet the SLA requirements.
- E. Member metrics are measured only if a rule uses the SLA target.
Answer: B,C,D
Explanation:
The use of SLA targets is specific to certain SD-WAN strategies. The "Lowest Cost (SLA)" and
"Maximize Bandwidth (SLA)" strategies are explicitly designed to use the configured SLA targets to make routing decisions. The "Best Quality" strategy uses performance metrics but does not necessarily require or reference SLA targets in the same way, while "Manual" does not use metrics at all for path selection.
This is a core function of SD-WAN rules with SLA targets. The purpose of configuring an SLA target with specific thresholds for latency, jitter, and packet loss is to define what is considered
"acceptable" performance for an application. SD-WAN rules then use these targets to check if the members (interfaces) meet these requirements before a flow is steered over them, ensuring that a preferred path still offers a good user experience.
FortiGate allows for a single SD-WAN rule to reference multiple, different performance SLAs. This is crucial for complex deployments where a single SD-WAN rule needs to handle traffic for multiple applications that have distinct performance requirements. For example, a single rule might direct VoIP traffic based on one performance SLA with strict latency/jitter targets, while simultaneously handling general web traffic using another performance SLA with more lenient requirements.
NEW QUESTION # 43
Refer to the exhibits.
You use FortiManager to manage the branch devices and configure the SD-WAN template. You have configured direct internet access (DIA) for the IT department users. Now. you must configure secure internet access (SIA) for all local LAN users and have set the firewall policies as shown in the second exhibit.
Then, when you use the install wizard to install the configuration and the policy package on the branch devices, FortiManager reports an error as shown in the third exhibit.
Which statement describes why FortiManager could not install the configuration on the branches?
- A. You cannot install firewall policies that reference an SD-WAN member.
- B. You cannot install firewall policies that reference an SD-WAN zone.
- C. You cannot install SIA and DIA rules on the same device.
- D. You must direct SIA traffic to a VPN tunnel.
Answer: A
Explanation:
FortiManager enforces a strict distinction:
"Firewall policies must reference SD-WAN zones, not individual SD-WAN members, when used in conjunction with SD-WAN templates. Attempting to install a policy that references a specific member (interface) will result in a deployment error, as member-level targeting is not supported in SD-WAN policy abstraction. This enforces centralized policy consistency and proper SD-WAN operation." Ensuring policies target zones allows FortiGate to dynamically select the optimal member.
NEW QUESTION # 44
(In the context of SD-WAN, the terms underlay and overlay are commonly used to categorize links.
Which two statements about underlay and overlay links are correct? Choose two answers.)
- A. Overlay links provide routing flexibility.
- B. FortiLink interface is considered an underlay link.
- C. Only wired connections can be used as underlay links.
- D. Wireless connections can be used to build overlay links.
- E. A VLAN is a type of overlay link.
Answer: A,D
Explanation:
In Fortinet SD-WAN architecture, underlay and overlay have distinct meanings:
Underlay links are the physical or logical transport networks that provide basic IP connectivity (for example, broadband, MPLS, LTE/5G).
Overlay links are virtual tunnels (such as IPsec VPNs) built on top of the underlay, providing abstraction, routing control, and segmentation.
Option B is correct.
Overlay links (for example, IPsec tunnels used in SD-WAN and ADVPN) decouple routing from the physical transport. This allows dynamic path selection, segmentation, and flexible routing policies independent of the underlay. Providing routing flexibility is a core purpose of overlays in SD-WAN.
Option D is correct.
Wireless connections such as LTE or 5G can be used as underlay transports, and overlay tunnels can be built over them. Fortinet SD-WAN fully supports building IPsec overlays on wireless underlays, making wireless links valid for overlay construction.
Why the other options are incorrect:
Option A is incorrect because a VLAN is a Layer 2 segmentation mechanism, not an SD-WAN overlay link.
Option C is incorrect because FortiLink is used for internal management and switch/AP connectivity, not as a WAN underlay for SD-WAN.
Option E is incorrect because underlay links can be wired or wireless; they are not limited to wired connections.
Therefore, the two correct statements are B and D.
NEW QUESTION # 45
......
Use Real Fortinet Achieve the FCSS_SDW_AR-7.6 Dumps - 100% Exam Passing Guarantee: https://examtorrent.dumpsactual.com/FCSS_SDW_AR-7.6-actualtests-dumps.html
