2026 Valid FCSS_SDW_AR-7.6 Real Exam Questions, practice Fortinet Certified Solution Specialist
Latest Success Metrics For Actual FCSS_SDW_AR-7.6 Exam (Updated 96 Questions)
Fortinet FCSS_SDW_AR-7.6 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 16
You are tasked with configuring ADVPN 2.0 on an SD-WAN topology already configured for ADVPN. What should you do to implement ADVPN 2.0 in this scenario?
- A. Update the IPsec tunnel configuration on the branches.
- B. Update the SD-WAN configuration on the branches.
- C. Update the IPsec tunnel configurations on the hub.
- D. Delete the existing ADVPN configuration and configure ADVPN 2.0.
Answer: C
NEW QUESTION # 17
Refer to the exhibit. Two hub-and-spoke groups are connected through redundant site-to-site IPsec VPNs between Hub 1 and Hub 2.
Which two configuration settings are required for the spoke A1 to establish an ADVPN shortcut with the spoke B2? (Choose two.)
- A. On hubs, auto-discovery-receiver must be enabled on the IPsec VPNs to spokes.
- B. On hubs, auto-discovery-forwarder must be enabled on the IPsec VPNs to hubs.
- C. On hubs, auto-discovery-forwarder must be enabled on the IPsec VPNs to spokes.
- D. On hubs, auto-discovery-sender must be enabled on the IPsec VPNs to spokes.
Answer: B,D
Explanation:
NEW QUESTION # 18
The SD-WAN overlay template helps to prepare SD-WAN deployments. To complete the tasks performed by the SD-WAN overlay template, the administrator must perform some post-run tasks.
What are two mandatory post-run tasks that must be performed? (Choose two.)
- A. Create policy packages and assign them to the branch devices.
- B. Configure routing through the overlay tunnels created by the SD-WAN overlay template.
- C. Assign an sdwan_id metadata variable to each device (branch and hub).
- D. Assign a hub id metadata variable to each hub device.
- E. Configure SD-WAN rules.
Answer: A,E
Explanation:
On page 76 in the Study Guide:
"You must define a unique branch ID value for each branch device"
"Mandatory . . .
- Configure the SD-WAN rules by editing the SD-WAN template
- Create policy packages for branch and hub devices"
NEW QUESTION # 19
Which statement about SD-WAN zones is true?
- A. You cannot use an SD-WAN zone in static route definitions.
- B. An SD-WAN zone can contain between 0 and 512 members.
- C. An SD-WAN zone can contain only one type of interface.
- D. You can configure up to 32 SD-WAN zones per VDOM.
Answer: B
Explanation:
SD-WAN zones logically group SD-WAN members (interfaces) often for purposes like overlay and underlay interfaces.
One SD-WAN zone can have up to 512 member interfaces, but large numbers may impact route processing and performance.
SD-WAN members cannot be shared between different zones.
NEW QUESTION # 20
Refer to the exhibits. The exhibits show the source NAT (SNAT) global setting. port2 interface settings, and the routing table on FortiGate.
The administrator increases the member priority on port2 to 20. Upon configuration changes and the receipt of new packets, which two actions does FortiGate perform on existing sessions established over port2? (Choose two.)
- A. FortiGate updates the gateway information of the sessions with SNAT so that they use port1 instead of port2.
- B. FortiGate flags the SNAT session as dirty only if the administrator has assigned an IP pool to the firewall policies with NAT.
- C. FortiGate flags the sessions as dirty.
- D. FortiGate continues routing all existing sessions over port2.
- E. FortiGate routes only new sessions over port2.
Answer: A,C
Explanation:
With set snat-route-change enable, FortiGate updates SNAT sessions' egress interface and gateway if a better route becomes available (e.g., port1 after priority change).
The sessions are flagged as dirty, meaning their routing and SNAT details are refreshed upon new traffic matching the session.
NEW QUESTION # 21
When you use the command diagnose sys session list, how do you identify the sessions that correspond to traffic steered according to SD-WAN rules?
- A. You cannot identify SD-WAN sessions. You must use the sdwar. session filter.
- B. You identify sessions steered according to SD-WAN rules with the flag vwl.
- C. You identify sessions steered according to SD-WAN rules with the data sdwan_service_id.
- D. You identify sessions steered according to SD-WAN rules with the data vwl_mbr_seq.
Answer: C
Explanation:
The sdwan_service_id field in the output of diagnose sys session list indicates that the session was selected based on an SD-WAN rule, allowing administrators to trace which SD-WAN service (rule) steered the traffic.
NEW QUESTION # 22
Refer to the exhibit. An administrator is troubleshooting SD-WAN on FortiGate. A device behind branch1_fgt generates traffic to the 10.0.0.0/8 network.
The administrator expects the traffic to match SD-WAN rule ID 1 and be routed over HUB1- VPN1.
However, the traffic is routed over HUB1-VPN3.
Based on the output shown in the exhibit, which two reasons, individually or together, could explain the observed behavior? (Choose two.)
- A. HUB1-VPN3 has a lower route priority value (higher priority) than HUB1-VPN1.
- B. HUB1-VPN3 has a higher member configuration priority than HUB1-VPN1
- C. HUB1-VPN1 does not have a valid route to the destination
- D. The traffic matches a regular policy route configured with HUB1-VPN3 as the outgoing device
Answer: C,D
Explanation:
NEW QUESTION # 23
Refer to the exhibits.
An administrator is testing application steering in SD-WAN. Before generating test traffic, the administrator collected the information shown in the first exhibit. After generating GoToMeeting test traffic, the administrator examined the corresponding traffic log on FortiAnalyzer, which is shown in the second exhibit.
The administrator noticed that the traffic matched the implicit SD-WAN rule, but they expected the traffic to match rule ID 1.
Which two reasons explain why some log messages show that the traffic matched the implicit SD-WAN rule? (Choose two.)
- A. The session 3-tuple did not match any of the existing entries in the ISDB application cache.
- B. No configured SD-WAN rule matches the traffic related to the collaboration application GoToMeeting
- C. Full SSL inspection is not enabled on the matching firewall policy.
- D. FortiGate could not refresh the routing information on the session after the application was detected.
Answer: A,B
NEW QUESTION # 24
Refer to the exhibits, which show the configuration of an SD-WAN rule and the corresponding rule status and routing table.
The administrator wants to understand the expected behavior for traffic matching the SD-WAN rule.
Based on the exhibits, what can the administrator expect for traffic matching the SD-WAN rule?
- A. The traffic will be routed over HUB1-VPN3.
- B. The traffic will be routed over HUB1-VPN1.
- C. The traffic will be load balanced across all three overlays
- D. The traffic will be routed over HUB1-VPN2
Answer: D
Explanation:
The rule is in SLA mode with two SLAs. From the status, HUB1-VPN2 and HUB1-VPN3 meet the SLA (sla(0x2) and sla(0x3)), while HUB1-VPN1 does not (sla(0x0)). Among members that meet SLA, FortiGate uses the configured order (priority-members 4 5 6) to pick the first eligible one- HUB1-VPN2-so traffic is routed over HUB1-VPN2.
NEW QUESTION # 25
Refer to the exhibit that shows VPN event logs on FortiGate.
Based on the output shown in the exhibit, which statement is true?
- A. There are no IPsec tunnel statistics log messages for ADVPN shortcuts.
- B. The VPN tunnel T_MPLS_0 is a shortcut tunnel.
- C. The master tunnel T_INET_0 cannot accept the ADVPN shortcut.
- D. There is one shortcut tunnel built from master tunnel T_MPLS_0.
Answer: B
Explanation:
When reviewing VPN log messages, the field advpnsc will help you identify the shortcut VPN tunnels.
FortiGate will set advpnsc value 1 for any log messages related to shortcut tunnels; for any other tunnel, the advpnsc value is set to 0.
NEW QUESTION # 26
Your FortiGate is in production. To optimize WAN link use and improve redundancy, you enable and configure SD-WAN.
What must you do as part of this configuration update process?
- A. Purchase and install the SD-WAN license, and reboot the FortiGate device.
- B. Disable the interface that you want to use as an SD-WAN member.
- C. Replace references to interfaces used as SD-WAN members in the firewall policies.
- D. Replace references to interfaces used as SD-WAN members in the routing configuration.
Answer: C
Explanation:
When you enable SD-WAN on a FortiGate, the individual WAN interfaces that you add into the SD-WAN zone are no longer referenced directly in firewall policies.
Instead, you must update those firewall policies to use the SD-WAN zone as the interface reference.
NEW QUESTION # 27
Refer to the exhibit.
The exhibit shows the details of a session and the index numbers of some relevant interfaces on a FortiGate device that supports hardware offloading.
Based on the information shown in the exhibits, which two conclusions can you draw? (Choose two.)
- A. By default, FortiGate offloads symmetric and asymmetric flows.
- B. The reply direction of the asymmetric traffic flows from port2 to port3.
- C. The original direction of the symmetric traffic flows from port3 to port2.
- D. The auxiliary session can be offloaded to hardware.
Answer: B,C
Explanation:
The session details show the symmetric flow's original direction as port3 → port2.
The asymmetric flow's reply direction is listed as port2 → port3.
NEW QUESTION # 28
Refer to the exhibit.
You configure SD-WAN on a standalone FortiGate device. You want to create an SD-WAN rule that steers Facebook and Linkedin traffic through the less costly internet link. The FortiGate GUI page appears as shown in the exhibit.
What should you do to set Facebook and LinkedIn as destinations?
- A. Enable the applications as destinations of the SD-WAN rule feature visibility.
- B. In the Internet service field, select Facebook and LinkedIn.
- C. Install a license to allow applications as destinations of SD-WAN rules.
- D. You cannot configure applications as destinations of an SD-WAN rule on a standalone FortiGate device.
Answer: B
Explanation:
In an SD-WAN rule, you can steer application traffic by using Internet Service Database (ISDB) entries. Facebook and LinkedIn are predefined ISDB objects in FortiGate, so the correct way is to select them in the Internet service field under Destination. This ensures that all traffic to these applications is matched and routed through the chosen (less costly) link.
NEW QUESTION # 29
(In the context of SD-WAN, the terms underlay and overlay are commonly used to categorize links.
Which two statements about underlay and overlay links are correct? Choose two answers.)
- A. Only wired connections can be used as underlay links.
- B. Wireless connections can be used to build overlay links.
- C. FortiLink interface is considered an underlay link.
- D. Overlay links provide routing flexibility.
- E. A VLAN is a type of overlay link.
Answer: B,D
Explanation:
In Fortinet SD-WAN architecture, underlay and overlay have distinct meanings:
Underlay links are the physical or logical transport networks that provide basic IP connectivity (for example, broadband, MPLS, LTE/5G).
Overlay links are virtual tunnels (such as IPsec VPNs) built on top of the underlay, providing abstraction, routing control, and segmentation.
Option B is correct.
Overlay links (for example, IPsec tunnels used in SD-WAN and ADVPN) decouple routing from the physical transport. This allows dynamic path selection, segmentation, and flexible routing policies independent of the underlay. Providing routing flexibility is a core purpose of overlays in SD-WAN.
Option D is correct.
Wireless connections such as LTE or 5G can be used as underlay transports, and overlay tunnels can be built over them. Fortinet SD-WAN fully supports building IPsec overlays on wireless underlays, making wireless links valid for overlay construction.
Why the other options are incorrect:
Option A is incorrect because a VLAN is a Layer 2 segmentation mechanism, not an SD-WAN overlay link.
Option C is incorrect because FortiLink is used for internal management and switch/AP connectivity, not as a WAN underlay for SD-WAN.
Option E is incorrect because underlay links can be wired or wireless; they are not limited to wired connections.
Therefore, the two correct statements are B and D.
NEW QUESTION # 30
(Refer to the exhibit.
You configure SD-WAN on a standalone FortiGate device.
You want to create an SD-WAN rule that steers traffic related to Facebook and LinkedIn through the less costly internet link.
What must you do to set Facebook and LinkedIn applications as destinations from the GUI? Choose one answer.)
- A. Enable the visibility of the applications field as destinations of the SD-WAN rule.
- B. In the Internet service field, select Facebook and LinkedIn.
- C. Install a license to allow applications as destinations of SD-WAN rules.
- D. You cannot configure applications as destinations of an SD-WAN rule on a standalone FortiGate device.
Answer: B
Explanation:
In FortiOS 7.6, SD-WAN rules can steer traffic based on Internet Services, which represent predefined application and service signatures maintained by FortiGuard. Common applications such as Facebook and LinkedIn are included in the Internet Service database.
According to the FCSS SD-WAN 7.6 curriculum, when configuring an SD-WAN rule from the GUI on a standalone FortiGate device, applications are selected as destinations using the Internet service field, not by enabling a separate application destination field. The exhibit highlights the Internet service option under the Destination section, which is the correct method to match traffic for specific applications.
Option A is incorrect because there is no GUI option to enable application visibility as destinations for SD-WAN rules. Application matching is already abstracted through Internet Services.
Option C is incorrect because standalone FortiGate devices fully support application-based steering using Internet Services in SD-WAN rules.
Option D is incorrect because no additional license is required to use Internet Services in SD-WAN rules. This functionality is included in FortiOS and relies on the built-in FortiGuard Internet Service database.
Therefore, to steer Facebook and LinkedIn traffic through a specific WAN link, you must select Facebook and LinkedIn in the Internet service field, which corresponds to option B.
NEW QUESTION # 31
Refer to the exhibit, which shows the SD-WAN rule status and configuration. Based on the exhibit, which change in the measured packet loss will make HUB1-VPN3 the new preferred member?
- A. When all three members have the same packet loss
- B. When HUB1-VPN1 has 12% packet loss
- C. When HUB1-VPN3 has 4% packet loss
- D. When HUB1-VPN1 has 4% packet loss
Answer: A
Explanation:
The rule is in mode: priority with priority-members 6 4 5. The members' seq_nums map to:
4 → HUB1-VPN1
5 → HUB1-VPN2
6 → HUB1-VPN3
When the link-cost-factor is packet-loss, the lowest loss wins; but if the losses are tied, selection falls back to the priority-members order. With all three showing the same packet loss, the tie- break picks seq_num 6 first - i.e., HUB1-VPN3 - making it the preferred member.
NEW QUESTION # 32
You have configured the performance SLA with the probe mode as Prefer Passive.
What are two observable impacts of this configuration? (Choose two.)
- A. FortiGate passively monitors the member if TCP traffic is passing through the member.
- B. FortiGate passively monitors the member if ICMP traffic is passing through the member.
- C. After FortiGate switches to active mode, the SLA performance rule falls back to passive monitoring after 3 minutes.
- D. FortiGate can offload the traffic that is subject to passive monitoring to hardware.
- E. During passive monitoring, the SLA performance rule cannot detect dead members.
Answer: A,E
Explanation:
When "Prefer Passive" is set, FortiGate attempts to passively monitor the health of SD-WAN members using real application traffic like TCP sessions, collecting statistics such as latency, jitter, and packet loss from actual observed flows.
Passive monitoring does not generate probe packets; it relies entirely on existing traffic. If there is no matching traffic, health check data is unavailable, meaning dead members may go undetected when only passive monitoring is active.
NEW QUESTION # 33
An MSSP uses FortiManager to manage the FortiGate devices of its customers. The administrator grouped the devices for each customer in different ADOMs. For customer A, you configured one SD-WAN overlay template that applies to all devices in the ADOM. For customer B, you configured SD-WAN for DIA at the device level, with a different configuration for each FortiGate. You onboard customer C, a car manufacturer, who requests to have a single-hub SD- WAN topology for its retail points, and a dual-hub topology for the FortiGate devices installed in its factories. Which statement best describes how you should handle this request?
- A. You can place all the devices in the same ADOM and you can create multiple SD-WAN templates, but you cannot use the SD-WAN overlay template.
- B. You can place all the devices in the same ADOM and define two topologies with the SD-WAN overlay template.
- C. You must assign the devices to different ADOMs to avoid conflicts between the single-hub and dual-hub SD-WAN topologies.
- D. You can place all the devices in the same ADOM, but you must use the SD-WAN overlay template to define only one topology.
Answer: D
Explanation:
FortiManager uses SD-WAN overlay templates per ADOM to define the SD-WAN topology.
Within a single ADOM, you can only define one SD-WAN overlay template topology that applies to all devices in that ADOM.
If different topologies are needed (e.g., single-hub for retail, dual-hub for factories), the devices cannot share multiple overlay topologies within the same ADOM.
Therefore, to handle multiple topologies, devices must be separated into different ADOMs or use separate device-level configurations outside the overlay template.
NEW QUESTION # 34
Refer to the exhibit. The administrator configured the IPsec tunnel VPN1 on a FortiGate device with the parameters shown in exhibit.
Based on the configuration, which three conclusions can you draw about the characteristics and requirements of the VPN tunnel? (Choose three.)
- A. The remote end can be a third-party IPsec device.
- B. The tunnel interface IP address on the spoke side is provided by the hub.
- C. The administrator must manually assign the tunnel interface IP address on the hub side
- D. The remote end must support IKEv2.
- E. This configuration allows user-defined overlay IP addresses.
Answer: C,D,E
Explanation:
The administrator must manually assign the tunnel interface IP address on the hub side The setting "set exchange-interface-ip enable" means the tunnel interface IP address is exchanged, but the hub side IP must be set manually.
The remote end must support IKEv2
The command "set ike-version 2" explicitly configures IKE version 2 for this tunnel, so the remote device must support IKEv2.
This configuration allows user-defined overlay IP addresses
The tunnel interface enables user control over IP addressing for the overlay network, allowing custom IP assignments.
NEW QUESTION # 35
(Refer to the exhibits.
You collected the output shown in the exhibits and want to know which interface HTTP traffic will flow through from the user device 10.0.1.101 to the corporate web server 10.0.0.126. All SD-WAN links are stable.
Which interface will FortiGate use to steer the traffic? Choose one answer.)
- A. Either HUB1-VPN2 or HUB1-VPN3
- B. Either HUB1-VPN1, HUB1-VPN2, or HUB1-VPN3
- C. Only HUB1-VPN2
- D. Only HUB1-VPN3
Answer: B
Explanation:
From the SD-WAN service configuration, rule edit 3 (name "Corp") is configured with:
set mode sla
set load-balance enable
set dst "Corp-net"
set src "LAN-net"
SLA checks referenced under config sla
Traffic from 10.0.1.101 to 10.0.0.126 matches this rule because the destination is within the corporate network range (shown in the policy-route/proute output as destination 10.0.0.0-10.255.255.255 for the Corp service).
In the diagnose firewall proute list output for vwl_service=3 (Corp), FortiGate shows which SD-WAN members are eligible based on SLA pass results:
oif=21 (HUB1-VPN3) num_pass=2
oif=20 (HUB1-VPN2) num_pass=0
oif=19 (HUB1-VPN1) num_pass=0
This indicates that, for the SLA-based rule, only HUB1-VPN3 is meeting the SLA requirements (it is the only member with num_pass=2). The other members have num_pass=0, so they are not eligible for forwarding under this SLA rule even though links are up.
The sniffer trace further corroborates the forwarding decision by showing the traffic egressing through HUB1-VPN3.
Therefore, FortiGate will steer the HTTP traffic through only HUB1-VPN3, which corresponds to Option A.
NEW QUESTION # 36
You have a FortiGate configuration with three user-defined SD-WAN zones and two members in each of these zones. One SD-WAN member is no longer in use in health-check and SD-WAN rules. You want to delete it.
What happens if you delete the SD-WAN member from the FortiGate GUI?
- A. FodiGate accepts the deletion and removes routes as required.
- B. FortiGate displays an error message. You must use the CLI to delete an SD-WAN member.
- C. FortiGate accepts the deletion and places the member in the default SD-WAN zone.
- D. FortiGate displays an error message. SD-WAN zones must contain at least two members
Answer: A
Explanation:
In FortiOS, you can remove an SD-WAN member from the GUI as long as it is not in use in any health-checks, SD-WAN rules, or policies.
When you delete it, FortiGate will automatically clean up related routes (static or dynamic SD- WAN routes referencing that member).
NEW QUESTION # 37
The administrator uses the FortiManager SD-WAN overlay template to prepare an SD-WAN deployment. Using information provided through the SD-WAN overlay template wizard, FortiManager creates templates ready to install on the spoke and hub devices.
What are the three templates created by the SD-WAN overlay template for a spoke device? (Choose three.)
- A. Rules template
- B. IPsec tunnel template
- C. BGP template
- D. Static route template
- E. CLI template
Answer: A,B,C
Explanation:
Rules template → Defines the SD-WAN rules for traffic steering.
BGP template → Configures dynamic routing for overlay tunnels.
IPsec tunnel template → Builds the IPsec VPN tunnels from the spoke to the hubs.
NEW QUESTION # 38
Refer to the exhibit.
An administrator is troubleshooting SD-WAN on FortiGate. A device behind branch1_fgt generates traffic to the 10.0.0.0/8 network.
The administrator expects the traffic to match SD-WAN rule ID 1 and be routed over HUB1-VPN1. However, the traffic is routed over HUB1-VPN3.
Based on the output shown in the exhibit, which two reasons, individually or together, could explain the observed behavior? (Choose two.)
- A. The traffic matches a regular policy route configured with HUB1-VPN3 as the outgoing device
- B. HUB1-VPN3 has a higher member configuration priority than HUB1-VPN1.
- C. HUB1-VPN3 has a lower route priority value (higher priority) than HUB1-VPN1.
- D. HUB1-VPN1 does not have a valid route to the destination
Answer: C,D
NEW QUESTION # 39
Refer to the exhibit. You configure SD-WAN on a standalone FortiGate device. You want to create an SD-WAN rule that steers Facebook and Linkedin traffic through the less costly internet link. The FortiGate GUI page appears as shown in the exhibit.
What should you do to set Facebook and LinkedIn as destinations?
- A. Enable the applications as destinations of the SD-WAN rule feature visibility.
- B. In the Internet service field, select Facebook and LinkedIn.
- C. Install a license to allow applications as destinations of SD-WAN rules.
- D. You cannot configure applications as destinations of an SD-WAN rule on a standalone FortiGate device.
Answer: B
Explanation:
In an SD-WAN rule, you can steer application traffic by using Internet Service Database (ISDB) entries. Facebook and LinkedIn are predefined ISDB objects in FortiGate, so the correct way is to select them in the Internet service field under Destination. This ensures that all traffic to these applications is matched and routed through the chosen (less costly) link.
NEW QUESTION # 40
......
Genuine FCSS_SDW_AR-7.6 Exam Dumps Free Demo Valid QA's: https://getfreedumps.passreview.com/FCSS_SDW_AR-7.6-exam-questions.html