Released Fortinet NSE6_SDW_AD-7.6 Updated Questions PDF
NSE6_SDW_AD-7.6 Dumps and Practice Test (97 Exam Questions)
NEW QUESTION # 52
Refer to the exhibit.
The exhibit shows the BGP configuration on the hub in a hub-and-spoke topology. The administrator wants BGP to advertise prefixes from spokes to other spokes over the IPsec overlays, including additional paths.
However, when looking at the spoke routing table, the administrator does not see the prefixes from other spokes and the additional paths Which three settings must the administrator configure inside each BGP neighbor group so spokes can learn the prefixes of other spokes and their additional paths? (Choose three.)
- A. Enable route-reflector-client.
- B. Set additional-path to send
- C. Enable route-reflector-server
- D. Set adv-additional-path to the number of additional paths to advertise.
- E. Set additional-path to forward
Answer: A,B,D
Explanation:
The hub must send additional paths to spokes (set additional-path send).
The hub must treat each spoke as a route-reflector client so spoke routes are reflected to other spokes.
The hub must specify how many additional paths to advertise (set adv-additional-path <n>).
NEW QUESTION # 53
(When you deploy SD-WAN, you can choose from several common designs. Each design best applies to specific contexts.
Which two statements correctly associate a common SD-WAN design with its main indication or constraint?
Choose two answers.)
- A. Use remote breakout to centralize traffic inspection and limit local management requirements.
- B. Use a standalone design for sites with only one WAN link to the cloud.
- C. Use a direct internet access (DIA) design to increase the traffic security and allow local devices with limited capabilities.
- D. Use a cloud on-ramp topology to improve the performance of cloud applications.
Answer: A,D
Explanation:
The FCSS SD-WAN 7.6 curriculum describes multiple standard SD-WAN deployment designs, each mapped to a specific operational goal or constraint.
A cloud on-ramp topology is designed to optimize connectivity to cloud services such as SaaS and IaaS.
This design provides the most efficient and reliable path to cloud applications by establishing direct tunnels to cloud gateways or cloud workloads and by avoiding backhauling traffic through a central data center. As a result, its primary indication is improving the performance of cloud applications, which makes option A correct.
A remote breakout (centralized breakout) design forwards all internet-bound traffic from branch sites to a central hub for security inspection. This allows security policies, inspection, and logging to be centralized on a high-capacity FortiGate at the hub. Because branch devices do not need advanced local security configurations, this design also limits local management requirements, which makes option C correct.
Option B is incorrect because a standalone SD-WAN design is not selected simply because a site has only one WAN link. SD-WAN provides its main benefits when multiple WAN paths exist, and single-link sites do not gain meaningful traffic-steering advantages.
Option D is incorrect because a direct internet access (DIA) design performs local internet breakout at the branch and therefore requires strong local security capabilities. DIA does not inherently increase traffic security and is not intended for devices with limited capabilities.
Therefore, the two correct associations are A and C.
NEW QUESTION # 54
Refer to the exhibits.
The administrator configured a device blueprint and CLI scripts as shown in the exhibits, to prepare for onboarding FortiGate devices in the company's stores. Later, a technician prepares a FortiGate 51G with a basic configuration and connects it to the network. The basic configuration contains the port1 configuration and the minimal configuration required to allow the device to connect to FortiManager.
After the device first connects to FortiManager, FortiManager updates the device configuration.
Based on the exhibits, which actions does FortiManager perform?
- A. FortiManager updates the device configuration according to the selected templates. It applies the corp_st template first.
- B. FortiManager updates access rights only for port1. FortiManager cannot update the IP address because it was already set manually.
- C. FortiManager updates the configuration of port1, port2, and port5. The three ports might get new IP addresses.
- D. FortiManager does not update the port1 configuration because FortiManager does not change the configuration of interfaces with fgfm access.
Answer: C
Explanation:
Enforce Device Configuration is enabled and the blueprint applies the provisioning CLI templates. The LAN- interface script sets port1 and port2 to DHCP and assigns a static IP to port5 (using the branch_id variable).
Therefore, when FortiManager pushes the blueprint, it updates the configurations of port1, port2, and port5 - and their IP addresses may change accordingly.
NEW QUESTION # 55
Within the context of SD-WAN, what does SIA correspond to?
- A. Remote Breakout
- B. Secure Internet Authorization
- C. Software Internet Access
- D. Local Breakout
Answer: D
NEW QUESTION # 56
Refer to the exhibit.
What conclusions can you draw about the traffic received by FortiGate originating from the source LAN device 10.0.1.133 and destined for the company's SMTP mail server at 10.66.0.125?
- A. ForliGate steers the traffic from the LAN device 10.0.1.133 to the company SMTP mail server
10.66.0.125 through port2. - B. FortiGate steers the traffic from the LAN device 10.0.1.133 to the SMTP mail server 10.66.0.125 through the SD-WAN member ID 1 or 2.
- C. FortiGate steers the traffic from the LAN device 10.0.1.133 to the company SMTP mail server
10.66.0.125 through the SD-WAN member ID 4. - D. FortiGate steers the traffic from the LAN device 10.0.1.133 to the company SMTP mail server 10.66
0.125 through port3.
Answer: B
Explanation:
The policy-route output shows the matching SD-WAN service for destination 10.66.0.0/24 is vwl_service=4 (LAN-to-Corp2) with vwl_mbr_seq=1 2 and paths oif=3(port1) and oif=4(port2). Therefore, traffic from
10.0.1.133 to 10.66.0.125 is steered via SD-WAN member ID 1 or 2.
NEW QUESTION # 57
Refer to the exhibit.
An administrator is troubleshooting SD-WAN on FortiGate. A device behind branch1_fgt generates traffic to the 10.0.0.0/8 network.
The administrator expects the traffic to match SD-WAN rule ID 1 and be routed over HUB1-VPN1. However, the traffic is routed over HUB1-VPN3.
Based on the output shown in the exhibit, which two reasons, individually or together, could explain the observed behavior? (Choose two.)
- A. HUB1-VPN1 does not have a valid route to the destination
- B. HUB1-VPN3 has a higher member configuration priority than HUB1-VPN1.
- C. The traffic matches a regular policy route configured with HUB1-VPN3 as the outgoing device
- D. HUB1-VPN3 has a lower route priority value (higher priority) than HUB1-VPN1.
Answer: A,D
NEW QUESTION # 58
Refer to the exhibit.
An administrator configures SD-WAN rules for a DIA setup using the FortiGate GUI. The page to configure the source and destination part of the rule looks as shown in the exhibit. The GUI page shows no option to configure an application as the destination of the SD-WAN rule Why?
- A. You cannot use applications as the destination when FortiGate is used for a DIA setup.
- B. You must enable the feature on the CLI.
- C. You must enable the feature first using the GUI menu System > Feature Visibility.
- D. FortiGate allows the configuration of applications as the destination of SD-WAN rules only on the CLI.
Answer: C
NEW QUESTION # 59
(You want to configure two static routes: one that references an SD-WAN zone and a second one that references an SD-WAN member that belongs to that zone.
Which statement about this scenario is true? Choose one answer.)
- A. You cannot create static routes for individual SD-WAN members.
- B. The destination subnets must be different.
- C. The source subnets must be different.
- D. You cannot create static routes that reference an SD-WAN zone.
Answer: B
Explanation:
In FortiOS 7.6, static routes can reference either:
* an SD-WAN zone (for example, virtual-wan-link or a user-defined SD-WAN zone), or
* a specific SD-WAN member interface that belongs to that zone.
However, FortiOS enforces a routing constraint to avoid ambiguity during route resolution. Two static routes cannot have the same destination prefix if one points to an SD-WAN zone and the other points to an SD- WAN member within that zone. This would create an overlapping and conflicting forwarding decision.
Therefore, if you configure:
* one static route that references an SD-WAN zone, and
* another static route that references an SD-WAN member belonging to that same zone, the destination subnets of the two static routes must be different.
Why the other options are incorrect:
* Option A is incorrect because FortiOS does allow static routes that reference individual SD-WAN members.
* Option B is incorrect because static routes can reference SD-WAN zones.
* Option D is incorrect because static routing decisions in FortiOS are based on destination prefixes, not source prefixes.
Thus, the correct answer is C.
NEW QUESTION # 60
An SD-WAN member is no longer used to steer SD-WAN traffic. The administrator updated the SD-WAN configuration and deleted the unused member. After the configuration update, users report that some destinations are unreachable. You confirm that the affected flow does not match an SD-WAN rule.
What could be a possible cause of the traffic interruption?
- A. FortiGate administratively brings down interfaces when they are removed from the SD-WAN configuration.
- B. FortiGate, with SD-WAN enabled, cannot route traffic through interfaces that are not SD-WAN members.
- C. FortiGate can remove some static routes associated with an interface when the member is removed from SD-WAN.
- D. FortiGate removes the layer 3 settings for interfaces that are removed from the SD-WAN configuration.
Answer: C
Explanation:
When an SD-WAN member is deleted, FortiGate can also remove static routes that were tied to that interface.
If those routes are needed for destinations not covered by SD-WAN rules, traffic to those networks becomes unreachable. This explains why flows not matching SD-WAN rules are interrupted after the member was removed.
NEW QUESTION # 61
Which two statements correctly describe what happens when traffic matches the implicit SD-WAN rule?
(Choose two.)
- A. Traffic does not match any of the entries in the policy route table.
- B. The session information output displays no SD-WAN service id.
- C. Traffic is load balanced using the algorithm set for the v4-ecmp-mode setting.
- D. The traffic is distributed, regardless of weight, through all available static routes.
- E. FortiGate flags the session with may_dirty and vwl_def ault.
Answer: A,B
Explanation:
The implicit SD-WAN rule serves as the final catch-all. Per Fortinet:
"Sessions matching the implicit SD-WAN rule do not have an SD-WAN service id, as they are not associated with any specific user-defined SD-WAN rule. Additionally, this occurs only when traffic fails to match any entry in the policy route table. This default handling guarantees connectivity while minimizing the risk of blackholed traffic." Administrators can observe this in diagnostic outputs for troubleshooting.
NEW QUESTION # 62
(In which order does FortiGate consider the following elements during the route lookup process? Choose one answer.)
- A. Policy routes, SD-WAN rules, Internet Service Database (ISDB) routes, BGP routes
- B. SD-WAN rules, policy routes, static routes, ISDB routes
- C. SD-WAN rules, ISDB routes, policy routes, BGP routes
- D. Policy routes, ISDB routes, SD-WAN rules, static routes
Answer: D
Explanation:
In FortiOS (including FortiOS 7.6), FortiGate follows a strict and well-defined route lookup order when determining how to forward traffic. This order is critical for understanding SD-WAN behavior and is explicitly referenced in the FCSS SD-WAN curriculum.
The correct lookup sequence is:
* Policy routes (Policy-Based Routing)Policy routes are evaluated first. If traffic matches a policy route, FortiGate immediately forwards the traffic according to that policy and bypasses all other routing mechanisms.
* Internet Service Database (ISDB) routesIf no policy route matches, FortiGate checks ISDB routes.
These routes match traffic based on Internet Services rather than destination IP prefixes.
* SD-WAN rulesIf neither a policy route nor an ISDB route matches, FortiGate evaluates SD-WAN rules to determine the outgoing interface based on the configured SD-WAN strategy.
* Routing table (connected, static, and dynamic routes such as BGP)If no SD-WAN rule matches, FortiGate performs a normal routing table lookup.
* FIB (Forwarding Information Base)The FIB is used to forward the packet based on the selected route.
* DropIf no valid route exists, the packet is dropped.
Among the options provided, only Option D correctly reflects the beginning of this sequence by placing policy routes first, followed by ISDB routes, then SD-WAN rules, and finally static routes (representing the routing table).
Therefore, the correct answer is D.
NEW QUESTION # 63
(Refer to the exhibit.
Which statement correctly describes the role of the ADVPN device in handling traffic? Choose one answer.)
- A. This device is a spoke that has received a direct shortcut query from a remote spoke.
- B. This device is a spoke that has received a shortcut query from a remote hub.
- C. This device is a hub that has received a shortcut query from a spoke and has forwarded it to another spoke.
- D. This device is a hub, and two spokes, 192.2.0.1 and 10.0.3.101, established a shortcut.
Answer: C
Explanation:
The log messages shown in the exhibit include the following key indicators:
* processing notify type SHORTCUT_QUERY
* shortcut-query received from 192.2.0.1
* local-nat=yes, peer-nat=no
* NAT hole punching for peer at 192.2.0.1:4500
In the FCSS SD-WAN 7.6 ADVPN workflow, shortcut queries are always initiated by spokes, not hubs.
A spoke sends a shortcut query to its hub when it detects traffic destined for another spoke. The hub's role is to receive this shortcut query and forward the discovery information toward the destination spoke, enabling the two spokes to build a direct shortcut tunnel.
The device name in the log (HUB1-VPN1) and the presence of NAT hole punching coordination clearly indicate that this device is acting as a hub, not a spoke. Hubs do not form shortcuts themselves; instead, they facilitate shortcut establishment between spokes by relaying discovery and negotiation information.
Option A is incorrect because a spoke does not receive shortcut queries from other spokes directly.
Option B is incorrect because the log does not indicate that the shortcut has already been established; it shows the query and coordination phase, not completion.
Option D is incorrect because hubs do not initiate shortcut queries toward spokes.
Therefore, the correct description is that this device is a hub that has received a shortcut query from a spoke and has forwarded it to another spoke, which corresponds to option C.
NEW QUESTION # 64
(Refer to the exhibits.
The SD-WAN zones and members configuration of two branch devices are shown. The two branch devices are part of the same hub-and-spoke topology and connect to the same hub. The devices are configured to allow Auto-Discovery VPN (ADVPN). The configuration on the hub allows the initial communication between the two spokes.
When traffic flows require it, between which interfaces can the devices establish shortcuts? Choose one answer.)
- A. Interface connected to HUB only
- B. Any interface in the overlay zones
- C. Between T2 on Branch-A and TA on Branch-B
- D. Between T3 on Branch-A and TC on Branch-B
Answer: C
Explanation:
From the exhibit, both branches have an SD-WAN zone named overlay with set advpn-select enable, and each SD-WAN member in that zone is assigned a transport-group value.
Branch-A members:
* T1 # transport-group 1
* T2 # transport-group 1
* T3 # transport-group 2
Branch-B members:
* TA # transport-group 1
* TB # transport-group 2
* TC # transport-group 3
In FCSS SD-WAN 7.6 ADVPN design, transport-group is used to constrain which underlays are allowed to form ADVPN shortcuts with each other. A spoke can establish an ADVPN shortcut only between interfaces that belong to the same transport-group on both sides. This prevents building shortcuts across dissimilar transports.
Evaluating the options:
* Option D (T2 on Branch-A with transport-group 1 and TA on Branch-B with transport-group 1) is a valid shortcut pairing.
* Option C is not valid because T3 is transport-group 2 while TC is transport-group 3, so they are not permitted to form a shortcut.
* Option A is incorrect because not all overlay-zone interfaces are eligible; eligibility is restricted by transport-group matching.
* Option B is incorrect because ADVPN shortcuts are spoke-to-spoke tunnels (facilitated by the hub), not limited to "interfaces connected to hub only." Therefore, the valid shortcut pairing listed is between T2 on Branch-A and TA on Branch-B, which corresponds to Option D.
NEW QUESTION # 65 
Refer to the exhibit.
You want to configure SD-WAN on a network as shown in the exhibit.
The network contains many FortiGate devices. Some are used as NGFW, and some are installed with extensions such as FortiSwitch. FortiAP. or Forti Ex tender.
What should you consider when planning your deployment?
- A. You can build an SD-WAN topology that includes all devices. The hubs must be devices without extensions.
- B. You must build multiple SD-WAN topologies. Each topology must contain only one type of extension.
- C. You must use FortiManager to manage your SD-WAN topology.
- D. You can build an SD-WAN topology that includes all devices. The hubs can be FortiGate devices with Forti Extender.
Answer: A
Explanation:
In Fortinet SD-WAN, hubs should not have extensions like FortiSwitch, FortiAP, or FortiExtender installed, as these can affect hub functionality and scalability. While all device types can be included in the topology, the hubs must be "clean" FortiGate devices without such extensions to ensure proper ADVPN and overlay management.
References:
[FCSS_SDW_AR-7.4 1-0.docx Q3]
Fortinet SD-WAN Reference Architecture Guide 7.4 - Hub requirements
NEW QUESTION # 66
SD-WAN interacts with many other FortiGate features. Some of them are required to allow SD-WAN to steer the traffic.
Which three configuration elements that you must configure before FortiGate can steer traffic according to SD-WAN rules? (Choose three.)
- A. Routing
- B. Interfaces
- C. Firewall policies
- D. Security profiles
- E. Traffic shaping
Answer: A,B,C
Explanation:
Before FortiGate can steer traffic according to SD-WAN rules, certain configuration elements must be present. The guide states:
"SD-WAN is not a standalone feature and interacts with several fundamental FortiGate configurations.
Specifically, you must: (1) Define the interfaces (physical, VLAN, or IPsec) that will act as SD-WAN members, (2) Create firewall policies to allow traffic to be steered by SD-WAN, and (3) Set up routing so that traffic has valid routes via SD-WAN members. Without these, SD-WAN rules will not be able to match or steer any traffic." Security profiles and traffic shaping are not mandatory for basic SD-WAN steering but can be layered on for enhanced security and QoS once foundational elements are present.
References:
[FCSS_SDW_AR-7.4 1-0.docx Q16]
FortiOS 7.4 SD-WAN Concept Guide, "Prerequisite Configuration Elements for SD-WAN Steering
NEW QUESTION # 67
Refer to the exhibits.
You connect to a device behind a branch FortiGate device and initiate a ping test. The device is part of the LAN subnet and its IP address is 10.0.1.101.
Based on the exhibits, which interface uses branch 1_fgt to steer the test traffic?
- A. port1
- B. HUB1-VPN1
- C. port4
- D. port2
Answer: D
NEW QUESTION # 68
(Refer to the exhibit.
You configure SD-WAN on a standalone FortiGate device.
You want to create an SD-WAN rule that steers traffic related to Facebook and LinkedIn through the less costly internet link.
What must you do to set Facebook and LinkedIn applications as destinations from the GUI? Choose one answer.)
- A. In the Internet service field, select Facebook and LinkedIn.
- B. Install a license to allow applications as destinations of SD-WAN rules.
- C. Enable the visibility of the applications field as destinations of the SD-WAN rule.
- D. You cannot configure applications as destinations of an SD-WAN rule on a standalone FortiGate device.
Answer: A
Explanation:
In FortiOS 7.6, SD-WAN rules can steer traffic based on Internet Services, which represent predefined application and service signatures maintained by FortiGuard. Common applications such as Facebook and LinkedIn are included in the Internet Service database.
According to the FCSS SD-WAN 7.6 curriculum, when configuring an SD-WAN rule from the GUI on a standalone FortiGate device, applications are selected as destinations using the Internet service field, not by enabling a separate application destination field. The exhibit highlights the Internet service option under the Destination section, which is the correct method to match traffic for specific applications.
Option A is incorrect because there is no GUI option to enable application visibility as destinations for SD- WAN rules. Application matching is already abstracted through Internet Services.
Option C is incorrect because standalone FortiGate devices fully support application-based steering using Internet Services in SD-WAN rules.
Option D is incorrect because no additional license is required to use Internet Services in SD-WAN rules.
This functionality is included in FortiOS and relies on the built-in FortiGuard Internet Service database.
Therefore, to steer Facebook and LinkedIn traffic through a specific WAN link, you must select Facebook and LinkedIn in the Internet service field, which corresponds to option B.
NEW QUESTION # 69
Refer to the exhibit.
Which statement best describe the role of the ADVPN device in handling traffic?
- A. This is a hub that has received a query from a spoke and has forwarded it to another spoke.
- B. This is a spoke that has received a shortcut query from another spoke and has forwarded the response to its hub.
- C. This is a spoke. The kernel received a shortcut request and forwards the query to another spoke.
- D. This is a hub in a dual-region topology. The remote hub tunnel ID is 10.0.2.101.
Answer: B
Explanation:
Within ADVPN topologies, shortcut requests and responses traverse spokes and hubs. Fortinet documentation states:
"When a spoke receives a shortcut query from another spoke, it may forward the response to its hub for validation or to facilitate dynamic shortcut tunnel setup. This mechanism allows direct spoke-to-spoke communication for optimized routing and performance, reducing latency and offloading the hub after initial control-plane mediation." This is a core benefit of ADVPN's dynamic shortcut feature.
NEW QUESTION # 70
Which statement describes FortiGate behavior when you reference a zone in a static route?
- A. FoftiGate installs ECMP static routes for the first two members of the zone.
- B. FortiGate installs a static route for each member in the zone.
- C. FortiGate ignores the static routes defined through members referenced in the zone.
- D. FortiGate routes the traffic through the best performing member of the zone.
Answer: B
Explanation:
When referencing a zone in a static route, FortiGate's behavior is described as:
"Referencing a zone in a static route causes FortiGate to install a static route for each member interface of the zone. This enables ECMP (Equal-Cost Multi-Path) and load balancing where supported and ensures that traffic can be steered over any valid zone member according to SD-WAN rules or standard routing." This mechanism is fundamental to Fortinet's implementation of SD-WAN and simplifies large, multi- interface deployments.
References:
[FCSS_SDW_AR-7.4 1-0.docx Q21]
FortiOS 7.4 Routing Guide, "Zone-based Routing and ECMP Behavior"
NEW QUESTION # 71
......
NSE6_SDW_AD-7.6 Exam Dumps Pass with Updated 2026 Certified Exam Questions: https://www.prepawaypdf.com/Fortinet/NSE6_SDW_AD-7.6-practice-exam-dumps.html