[UPDATED] Fortinet NSE6_SDW_AD-7.6 Certification Exam Questions
Quickly and Easily Pass Fortinet Exam with NSE6_SDW_AD-7.6 real Dumps
Fortinet NSE6_SDW_AD-7.6 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 18
When you deploy SD-WAN, you can choose from several common designs. Each design best applies to specific contexts. Which two statements correctly associate a common SD-WAN design with its main indication or constraint? (Choose two.)
- A. Use a direct internet access (DIA) design to increase the traffic security and allow local devices with limited capabilities.
- B. Use remote breakout to centralize traffic inspection and limit local management requirements.
- C. Use a standalone design for sites with only one WAN link to the cloud.
- D. Use a cloud on-ramp topology to improve the performance of cloud applications.
Answer: C,D
Explanation:
A standalone SD-WAN design is appropriate for sites with a single WAN link, where no multiple- path load balancing or redundancy is required.
A cloud on-ramp topology is used to optimize performance for cloud applications by providing direct, optimized paths to cloud service providers.
NEW QUESTION # 19
Refer to the exhibits.
You use FortiManager to configure SD-WAN on three branch devices.
When you install the device settings, FortiManager prompts you with the error "Copy Failed" for the device branch1_fgt. When you click the log button, FortiManager displays the message shown in the exhibit.
There are two different ways to resolve this issue. Based on the exhibits, which methods could you use?
(Choose two.)
- A. Update the management IP address of branch1_fgt.
- B. Review the per-device mapping configuration for metadata variables
- C. Specify the gateway of the SD-WAN member port1 with an IP address or use the default value.
- D. Do not define installation targets for SD-WAN members.
Answer: B,C
Explanation:
Specify the gateway of the SD-WAN member port1 with an IP address or use the default value # The error log shows invalid ip - prop[gateway]: ip4class(${sdwan_port1_gw}) invalid ip addr, meaning the variable
${sdwan_port1_gw} does not have a valid mapping. Assigning a valid IP address or default value for the gateway resolves this error.
Review the per-device mapping configuration for metadata variables # The issue is tied to how the metadata variable ${sdwan_port1_gw} is mapped for branch1_fgt. If this device does not have the variable properly defined in per-device mapping, the configuration will fail. Correcting the mapping ensures that the install works.
NEW QUESTION # 20
Refer to the exhibit. For your ZTP deployment, you review the CSV file shown in exhibit and note that it is missing important information. Which two elements must you change before you can import it into FortiManager? (Choose two.)
- A. You must define a value for each device and each user-defined metadata variable.
- B. You must define a name for each device
- C. You must associate a device blueprint with each device
- D. You must define a value for each device and each metadata variable that defines an IP address.
Answer: B,C
Explanation:
NEW QUESTION # 21
Refer to the exhibit.
An SD-WAN zone configuration on the FortiGate GUI is shown.
What can you conclude about the zone and member configuration on this device?
- A. The WAN2 zone contains no member.
- B. You can delete the WAN1 zone.
- C. You can add the member B-125 to the WAN3 zone and keep it as a member of the Test zone.
- D. You can delete the virtual-wan-link zone.
Answer: A
Explanation:
The WAN2 zone shows no child member listed beneath it, indicating that it currently contains no SD-WAN member interfaces. This is the only conclusion clearly supported by the configuration shown in the GUI.
NEW QUESTION # 22
You configured an SD-WAN rule with the best quality strategy and selected the predefined health check, Default_FortiGuard, to check the link performances against FortiGuard servers.
For the quality criteria, you selected Custom-profile-1.
Which factors does FortiGate use, and in which order. to determine the link that it should use to steer the traffic?
- A. Links that meet the SLA targets - Member configuration order - Member local cost
- B. Link quality index - Member configuration order - Link cost threshold
- C. Latency - Jitter - Packet loss - Bibandwidth - Member configuration order
- D. Latency - Member configuration order - Link cost threshold
Answer: B
Explanation:
" The custom-profile-1 metric uses a formula that calculates a composite value out of the latency, jitter, packet loss, and bibandwidth. The composite value is called the link quality index. " And from page 227, the factors FortiGate uses in order are: " FortiGate determines the member with the best quality using three factors:
member configuration order, the link-cost-threshold setting, and the value of the metric measured for the member. "
NEW QUESTION # 23
Refer to the exhibits.
You are using FortiManager to manage the branch devices and configure the SD-WAN template.
You update the configuration to address new user requirements and set the firewall policies shown in the second exhibit.
Then, when you use the install wizard to install the updated configuration and firewall policy package on the branch devices, FortiManager reports the error shown in the third exhibit.
Why can't FortiManager install the configuration on the branch devices?
- A. You cannot install firewall policies that reference an SD-WAN zone.
- B. You cannot install firewall policies that reference an SD-WAN member.
- C. You cannot install firewall policies for HTTPS traffic with no SSL inspection.
- D. You must direct traffic with the default security profile to a VPN tunnel.
Answer: B
Explanation:
FortiManager SD-WAN templates require firewall policies to reference SD-WAN zones (or the virtual-wan-link abstraction), not individual SD-WAN member interfaces. In the exhibit, one of the policies directly uses a member interface (port1) instead of an SD-WAN zone, which causes validation and installation failure during the policy package deployment. FortiManager therefore rejects the installation because SD-WAN member-level references in policies are not supported in managed SD-WAN deployments.
NEW QUESTION # 24
You are planning a large SD-WAN deployment with approximately 1000 spokes and want to allow ADVPN between the spokes. Some remote sites use FortiSASE to connect to the company's SD-WAN hub. Which overlay routing configuration should you use?
- A. BGP on loopback with IPsec phase2 selectors for ADVPN shortcut routing.
- B. BGP per overlay with dynamic BGP for ADVPN shortcut routing.
- C. BGP on loopback with dynamic BGP for ADVPN shortcut routing.
- D. BGP per overlay with BGP next-hop convergence for ADVPN shortcut routing.
Answer: C
Explanation:
For a large-scale SD-WAN deployment (such as 1000 spokes) where ADVPN shortcut routing is required and some remote sites connect via FortiSASE, the recommended overlay routing configuration is BGP running on loopback interfaces, combined with dynamic BGP for ADVPN shortcut routing. This design leverages the scalability and resilience of BGP, allowing dynamic discovery and route exchange necessary for shortcut tunnels between spokes in ADVPN environments. Using loopback interfaces for BGP peering is considered best practice because it decouples routing protocol stability from physical link status, ensuring that if a physical underlay interface fails, the BGP session remains up as long as there's an alternate path. With dynamic BGP, each spoke can efficiently learn the routes to other spokes and dynamically establish shortcuts, which is critical at this scale. This method also integrates smoothly with FortiSASE for remote connectivity to the SD-WAN hub, providing flexibility and centralized management.
References:
[FCSS_SDW_AR-7.4 1-0.docx Q6]
Fortinet SD-WAN Reference Architecture Guide 7.4, "Scalable Routing with BGP on Loopback and ADVPN Shortcuts" Fortinet SD-WAN Concept Guide, "Overlay Routing Designs for Large Deployments"
NEW QUESTION # 25
Refer to the exhibits. The exhibits show the SD-WAN zone configuration of an SD-WAN template prepared on FortiManager and the policy package configuration.
When the administrator tries to install the configuration changes, FortiManager fails to commit.
What should the administrator do to fix the issue?
- A. Configure branch1_fgt as the installation target for policy 3.
- B. Configure both HUB1-VPN1 and HUB1-VPN2 as the destination of policy 3.
- C. Configure HUB1 as the destination of policy 3.
- D. Configure a normalized interface for the IPsec tunnel HUB1-VPN1.
Answer: C
Explanation:
Policy 3 points traffic To = HUB1-VPN1, which is an SD-WAN member interface. In SD-WAN you must reference the SD-WAN zone (the logical interface) in policies, not its member tunnels.
Change the policy's To interface to the zone HUB1, and the install will succeed.
NEW QUESTION # 26
Refer to the exhibits. You use FortiManager to manage the branch devices and configure the SD- WAN template. You have configured direct internet access (DIA) for the IT department users.
Now. you must configure secure internet access (SIA) for all local LAN users and have set the firewall policies as shown in the second exhibit.
Then, when you use the install wizard to install the configuration and the policy package on the branch devices, FortiManager reports an error as shown in the third exhibit. Which statement describes why FortiManager could not install the configuration on the branches?
- A. You cannot install firewall policies that reference an SD-WAN zone.
- B. You cannot install firewall policies that reference an SD-WAN member.
- C. You must direct SIA traffic to a VPN tunnel.
- D. You cannot install SIA and DIA rules on the same device.
Answer: B
Explanation:
In FortiManager, firewall policies must reference SD-WAN zones, not individual SD-WAN members (interfaces like port1 or port2). The SIA rule incorrectly references port1, which is a member - not a zone - causing the installation failure during validation.
NEW QUESTION # 27
Refer to the exhibits.
The SD-WAN zones and members configuration of two branch devices are shown.
The two branch devices are part of the same hub-and-spoke topology and connect to the same hub. The devices are configured to allow auto-discovery VPN (ADVPN). The configuration on the hub allows the initial communication between the two spokes.
When traffic flows require it, between which interfaces can the devices establish shortcuts?
- A. Any interface in the overlay zones
- B. Interface connected to HUB only.
- C. Between T3 on Branch-A and TC on Branch-B
- D. Between T2 on Branch-A and TA on Branch-B
Answer: D
Explanation:
In FortiOS ADVPN deployments utilizing SD-WAN, the transport-group option is used to control spoke-to-spoke shortcut creation. By default, a shortcut can only be dynamically established between two spokes if their respective overlay interfaces belong to the same transport group ID.
If the IDs do not match, the shortcut formation is prevented, and traffic continues to route through the hub.
By cross-referencing the transport groups from both branch configurations, we find:
Transport Group 1: Contains T1 and T2 on Branch-A, and TA on Branch-B. This allows dynamic shortcuts between T2 and TA.
Transport Group 2: Contains T3 on Branch-A and TB on Branch-B. This allows dynamic shortcuts between T3 and TB.
Transport Group 3: Only contains TC on Branch-B (Branch-A has no member in this group), meaning TC cannot form shortcuts with Branch-A.
NEW QUESTION # 28
Refer to the exhibit. Which action will FortiGate take if it detects SD-WAN members as dead?
- A. FoftiGate bounces port5 after it detects all SD-WAN members as dead.
- B. FortiGate sends alert messages through poft5 when it detects all SD-WAN members as dead.
- C. FortiGate fails over to the secondary device after it detects port5 as dead.
- D. FortiGate brings down port5 after it detects all SD-WAN members as dead.
Answer: D
Explanation:
NEW QUESTION # 29
Refer to the exhibits.
You use FortiManager to configure SD-WAN on three branch devices.
When you install the device settings, FortiManager prompts you with the error "Copy Failed" for the device branch1_fgt. When you click the log button, FortiManager displays the message shown in the exhibit.
Based on the exhibits, which statement best describes the issue and how you can resolve it?
- A. Gateways for all members in a zone must be defined the same way. Specify the gateway of the SD-WAN member port1 without metadata variables.
- B. Remove the installation target for the SD-WAN member port4. You cannot combine metadata variable and installation targets.
- C. Check the connection between branch1_fgt and FortiManager.
- D. Check the metadata variable definitions, and review the per-device mapping configuration.
Answer: D
Explanation:
The installation log shows that FortiManager fails during object copy due to an invalid gateway value derived from a metadata variable (for example, $(sdwan_port1_gw)). This indicates that the variable is not properly resolved for branch1_fgt, causing an invalid IP address during policy compilation. The issue is therefore related to inconsistent or missing per-device variable mapping, which must be verified and corrected in the metadata definitions and device-specific mappings so that the SD-WAN gateway values resolve correctly during installation.
NEW QUESTION # 30
Refer to the exhibits.
You use FortiManager to configure SD-WAN on three branch devices.
When you install the device settings. FortiManager prompts you with the error "Copy Failed" for the device branch1_fat When you click the log button. FortiManager displays the message shown in the exhibit.
- A. Remove the installation target for the SD-WAN member port4. You cannot combine metadata variable and installation targets.
- B. Gateways for all members in a zone must be defined the same way. Specify the gateway of the SD- WAN member port! without metadata variables.
- C. Based on the exhibits, which statement best describes the issue and how you can resolve it?
- D. Check the metadata variable definitions, and review the per-device mapping configuration.
- E. Check the connection between branch1_fgt and FortiManager
Answer: D
NEW QUESTION # 31
(Refer to the exhibit.
What can you conclude from the output shown? Choose one answer.)
- A. It is a spoke device. SD-WAN rule 4 allows three shortcut tunnels.
- B. It is a spoke device. SD-WAN rule 3 is configured with nine members.
- C. It is a hub device. It allowed the establishment of three auto-discovery VPN (ADVPN) shortcuts.
- D. It is a spoke device. The members of SD-WAN rule 3 are grouped into two zones.
Answer: B
Explanation:
The command shown in the exhibit is:
diagnose sys sdwan service 4 3
This command displays the runtime state of SD-WAN rule ID 3 on the device. The output explicitly shows:
* Service(3) which confirms the SD-WAN rule being evaluated is rule number 3
* Members(9) which indicates that nine SD-WAN members are associated with this rule The listed members include multiple IPsec tunnel interfaces such as HUB1-VPN1, HUB1-VPN2, HUB1- VPN3, HUB2-VPN1, HUB2-VPN2, and HUB2-VPN3, which is characteristic of a spoke device connecting to multiple hubs in a hub-and-spoke ADVPN topology, as defined in the FCSS SD-WAN 7.6 architecture.
Option B is incorrect because, although members are listed under different interfaces, the output does not indicate SD-WAN zones. Zones are shown only in configuration output, not in this diagnostic command.
Option C is incorrect because this is not a hub device. The presence of multiple hub tunnels as SD-WAN members indicates a spoke role. Additionally, the output does not confirm the number of established ADVPN shortcuts.
Option D is incorrect because the output clearly references SD-WAN rule 3, not rule 4, and it does not state that exactly three shortcut tunnels are allowed.
Therefore, the correct conclusion is that this is a spoke device and SD-WAN rule 3 is configured with nine members, which matches option A.
NEW QUESTION # 32
Refer to the exhibit. The administrator configured two SD-WAN rules to load balance traffic.
Which interfaces does FortiGate use to steer the traffic from 10.0.1.124 to 10.0.0.254?
- A. Any interface in the HUB1 or HUB2 zones.
- B. HUB1-VPN2
- C. FortiGate route the traffic according to the FIB.
- D. por1 or port2
Answer: A
Explanation:
The traffic matches SD-WAN service 3, which includes multiple overlay members across both HUB1 and HUB2 zones. FortiGate selects from any of the active members in these zones based on the configured SLA and load-balancing method, so traffic can be steered over any interface in HUB1 or HUB2 that is currently eligible.
NEW QUESTION # 33
Refer to the exhibits.
The configuration of an SD-WAN rule and the corresponding rule status and routing table are shown.
You want to understand the expected behavior for traffic that matches the SD-WAN rule, at the time the output was collected.
Based on the exhibits, which behavior can you expect for traffic that matches the SD-WAN rule?
- A. The traffic will be load balanced across all three overlays
- B. The traffic will be routed over HUB1-VPN2
- C. The traffic will be routed over HUB1-VPN3.
- D. The traffic will be routed over HUB1-VPN1.
Answer: B
Explanation:
The rule is in SLA mode with two SLAs. From the status, HUB1-VPN2 and HUB1-VPN3 meet the SLA (sla(0x2) and sla(0x3)), while HUB1-VPN1 does not (sla(0x0)). Among members that meet SLA, FortiGate uses the configured order (priority-members 4 5 6) to pick the first eligible one- HUB1-VPN2-so traffic is routed over HUB1-VPN2.
NEW QUESTION # 34
Refer to the exhibit that shows a diagnose output on FortiGate.
Based on the output shown in the exhibit, what can you say about the device role and how it handles health checks?
- A. The device is a spoke. It provides embedded health-check measures for each tunnel to the hub.
- B. The device is a hub. It receives health-check measures for the tunnels of a spoke.
- C. The device is a spoke. It receives health-check measures for the tunnels of another spoke.
- D. The device is a hub. It receives embedded health-check measures for each tunnel from the spoke.
Answer: C
NEW QUESTION # 35
You manage an SD-WAN topology. You will soon deploy 50 new branches.
Which three tasks can you do in advance to simplify this deployment? (Choose three.)
- A. Create model devices.
- B. Create a ZTP template.
- C. Update the DHCP server configuration.
- D. Define metadata variables value for each device.
- E. Create policy blueprint.
Answer: A,B,E
Explanation:
When planning to deploy a large number of branches (e.g., 50), Fortinet recommends several preparatory steps to simplify and automate the rollout. Creating model devices allows you to predefine configurations and settings that can be cloned or adapted for each branch, saving time and minimizing manual errors. Preparing a Zero Touch Provisioning (ZTP) template enables automatic onboarding and provisioning of new FortiGates as soon as they come online, reducing manual intervention. Lastly, creating a policy blueprint allows for standardized policy deployment across all branches, ensuring consistent security and SD-WAN rule enforcement. This holistic approach streamlines the deployment process, allows for rapid scaling, and ensures that all devices are configured according to corporate policy from day one.
References:
[FCSS_SDW_AR-7.4 1-0.docx Q8]
Fortinet SD-WAN 7.4 Reference Architecture, "ZTP and Model Device Strategies for Scalable Rollouts" FortiManager Admin Guide, "Policy Blueprints and Automation for Branch Deployment"
NEW QUESTION # 36
......
Start your NSE6_SDW_AD-7.6 Exam Questions Preparation: https://buildazure.actualvce.com/Fortinet/NSE6_SDW_AD-7.6-valid-vce-dumps.html