Sample Questions of NSE6_SDW_AD-7.6 Dumps With 100% Exam Passing Guarantee
Pass Key features of NSE6_SDW_AD-7.6 Course with Updated 97 Questions
NEW QUESTION # 58
Exhibit.
For your ZTP deployment, you review the CSV file shown in exhibit and note that it is missing important information. Which two elements must you change before you can import it into FortiManager? (Choose two.)
- A. You must define a value for each device and each metadata variable that defines an IP address.
- B. You must define a name for each device
- C. You must define a value for each device and each user-defined metadata variable.
- D. You must associate a device blueprint with each device
Answer: B,D
NEW QUESTION # 59
(Refer to the exhibit.
What can you conclude from the output shown? Choose one answer.)
- A. It is a spoke device. SD-WAN rule 4 allows three shortcut tunnels.
- B. It is a spoke device. The members of SD-WAN rule 3 are grouped into two zones.
- C. It is a spoke device. SD-WAN rule 3 is configured with nine members.
- D. It is a hub device. It allowed the establishment of three auto-discovery VPN (ADVPN) shortcuts.
Answer: C
Explanation:
The command shown in the exhibit is:
diagnose sys sdwan service 4 3
This command displays the runtime state of SD-WAN rule ID 3 on the device. The output explicitly shows:
* Service(3) which confirms the SD-WAN rule being evaluated is rule number 3
* Members(9) which indicates that nine SD-WAN members are associated with this rule The listed members include multiple IPsec tunnel interfaces such as HUB1-VPN1, HUB1-VPN2, HUB1- VPN3, HUB2-VPN1, HUB2-VPN2, and HUB2-VPN3, which is characteristic of a spoke device connecting to multiple hubs in a hub-and-spoke ADVPN topology, as defined in the FCSS SD-WAN 7.6 architecture.
Option B is incorrect because, although members are listed under different interfaces, the output does not indicate SD-WAN zones. Zones are shown only in configuration output, not in this diagnostic command.
Option C is incorrect because this is not a hub device. The presence of multiple hub tunnels as SD-WAN members indicates a spoke role. Additionally, the output does not confirm the number of established ADVPN shortcuts.
Option D is incorrect because the output clearly references SD-WAN rule 3, not rule 4, and it does not state that exactly three shortcut tunnels are allowed.
Therefore, the correct conclusion is that this is a spoke device and SD-WAN rule 3 is configured with nine members, which matches option A.
NEW QUESTION # 60
You are planning a new SD-WAN deployment with the following criteria:
- Two regions
- Most of the traffic is expected to remain within its region
- No requirement for inter-region ADVPN
To remain within the recommended best practices, which routing protocol should you select for the overlays?
- A. IBGP with BGP on loopback within each region and EBGP between the regions.
- B. IBGP with BGP per overlays within each region and IBGP with BGP on loopback between the regions.
- C. OSPF for the routing within each region and EBGP between the regions.
- D. IBGP within each region and between the regions.
Answer: A
Explanation:
For SD-WAN deployments that span multiple regions-where most traffic is intra-region and there is no requirement for inter-region ADVPN-the best practice is to use IBGP with BGP on loopback interfaces for routing within each region and EBGP between the regions. This approach ensures robust and scalable routing, isolates regional routing domains, and enables policy control at region boundaries. BGP on loopback is preferred for its reliability and flexibility, as it enables peering that is not tied to specific physical interfaces.
EBGP between regions allows each region to maintain independent routing policies and summarization, optimizing performance and manageability. By separating IBGP (intra-region) and EBGP (inter-region), you create a modular architecture that scales easily and simplifies fault isolation and troubleshooting.
References:
[FCSS_SDW_AR-7.4 1-0.docx Q10]
Fortinet SD-WAN Reference Architecture Guide 7.4, "Regional Routing Best Practices" FortiOS 7.4 SD-WAN Overlay Design Guidelines
NEW QUESTION # 61
Exhibit.
Refer to the exhibit, which shows an SD-WAN zone configuration on the FortiGate GUI. What can you conclude about the zone and member configuration on this device?
- A. You can move HUB1-VPN3 from the HUB1 zone to the overlay-shops zone.
- B. The underlay zone contains three members.
- C. The overlay-factories zone contains no member.
- D. You can delete the virtual-wan-link zones.
Answer: C
Explanation:
In the SD-WAN GUI, the absence of members in a zone is visually represented, and the Fortinet guide confirms:
"If a zone such as overlay-factories contains no members, it will be displayed as empty in the SD-WAN GUI.
This may occur when the zone is reserved for future expansion, or if members have been temporarily removed for maintenance or reconfiguration. Traffic cannot be steered via an empty zone until at least one SD-WAN member is added." Such visual cues help operators quickly assess configuration status and readiness.
NEW QUESTION # 62
Refer to the exhibit.
Which two conclusions can you draw from the output shown? (Choose two.)
- A. UDP traffic destined to the subnet 10.22.0.0/24 matches a policy route.
- B. One SD-WAN rule allows traffic load balancing.
- C. One SD-WAN rule is defined with application categories as the destination.
- D. UDP traffic destined to the subnet 10.22.0.0/24 matches a manual SD-WAN rule.
Answer: A,C
Explanation:
One SD-WAN rule is defined with application categories as the destination # The diagnose output shows application control matches such as Microsoft.Portal, Operational.Technology, and Social.Media, confirming that SD-WAN rules are using application categories as destinations.
UDP traffic destined to the subnet 10.22.0.0/24 matches a policy route # The first entry (id=1) shows protocol=17 (UDP) with destination 10.22.0.0/24, confirming this traffic is handled by a policy route instead of an SD-WAN rule.
NEW QUESTION # 63
Refer to the exhibit.
The exhibit shows the health-check configuration on a FortiGate device used as a spoke. You notice that the hub FortiGate doesn't prioritize the traffic as expected.
Which two configuration elements should you check on the hub? (Choose two.)
- A. The performance SLA uses the same criteria.
- B. The performance SLA has the parameter priority-out-sla configured.
- C. The performance SLA is configured with set embedded-measure accept.
- D. This performance SLA uses the same members.
Answer: A,C
Explanation:
The hub must use a performance SLA with the same criteria as the spoke's health check. The spoke's health check is using ping (protocol ping) and measuring latency (link-cost-factor latency). For the hub to use the data sent by the spoke, its performance SLA must be configured to measure the same metrics. If the hub is looking for jitter or packet loss, it will not use the latency data sent by the spoke.
When a spoke sends embedded health data, the hub FortiGate must be configured to receive and use it. This is done by setting set embedded-measure accept within the performance SLA configuration on the hub. This setting explicitly tells the hub to trust and use the performance metrics received from the remote FortiGate (the spoke). Without this setting, the hub will likely ignore the embedded health data and rely on its own health checks, which could lead to incorrect traffic prioritization.
NEW QUESTION # 64
Refer to the exhibits.
The exhibits show the SD-WAN zone configuration of an SD-WAN template prepared on FortiManager and the policy package configuration.
When the administrator tries to install the configuration changes, FortiManager fails to commit.
What should the administrator do to fix the issue?
- A. Configure HUB1 as the destination of policy 3.
- B. Configure a normalized interface for the IPsec tunnel HUB1-VPN1.
- C. Configure branch1_fgt as the installation target for policy 3.
- D. Configure both HUB1-VPN1 and HUB1-VPN2 as the destination of policy 3
Answer: A
Explanation:
Policy 3 points traffic To = HUB1-VPN1, which is an SD-WAN member interface. In SD-WAN you must reference the SD-WAN zone (the logical interface) in policies, not its member tunnels. Change the policy's To interface to the zone HUB1, and the install will succeed.
NEW QUESTION # 65
Refer to the exhibits.
You use FortiManager to manage the branch devices and configure the SD-WAN template. You have configured direct internet access (DIA) for the IT department users. Now. you must configure secure internet access (SIA) for all local LAN users and have set the firewall policies as shown in the second exhibit.
Then, when you use the install wizard to install the configuration and the policy package on the branch devices, FortiManager reports an error as shown in the third exhibit.
Which statement describes why FortiManager could not install the configuration on the branches?
- A. You cannot install firewall policies that reference an SD-WAN zone.
- B. You cannot install SIA and DIA rules on the same device.
- C. You must direct SIA traffic to a VPN tunnel.
- D. You cannot install firewall policies that reference an SD-WAN member.
Answer: D
Explanation:
FortiManager enforces a strict distinction:
"Firewall policies must reference SD-WAN zones, not individual SD-WAN members, when used in conjunction with SD-WAN templates. Attempting to install a policy that references a specific member (interface) will result in a deployment error, as member-level targeting is not supported in SD-WAN policy abstraction. This enforces centralized policy consistency and proper SD-WAN operation." Ensuring policies target zones allows FortiGate to dynamically select the optimal member.
NEW QUESTION # 66
Refer to the exhibits.
The exhibits show an SD-WAN event log, the member status, and the SD-WAN rule configuration.
Which two conclusions can you draw from the information shown? (Choose two.)
- A. Port2 has a lower latency than port1.
- B. The administrator configured the SD-WAN rule ID 1 with the default strategy mode.
- C. FortiGate updated the outgoing interface list on the rule so it prefers port2.
- D. The administrator configured the service ID 1 with the highest priority member for port2.
Answer: A,C
Explanation:
The SD-WAN rule (config service edit 1) is configured with set mode priority. This means the rule selects the best interface based on a defined performance metric, as opposed to a simple static priority or SLA. The event log (image_41cfb5.png) shows Metric latency and Message Service prioritized by performance metric will be redirected in sequence order. This indicates that the rule is using latency to determine the preferred member.
Given that the log message is about a change, and the most logical reason for a change in a priority mode is that a different member is now the best performer, it implies that the latency on port2 has become lower than that on port1.
The log message Service prioritized by performance metric will be redirected in sequence order confirms that FortiGate is changing the member being used for this service. Because the mode is priority, FortiGate dynamically selects the member that currently meets the best performance criteria, which in this case is latency. The log implies a new member has been selected as the most optimal, and with the default configuration, the members are sorted based on their performance, so the outgoing interface list is effectively updated to prefer the new best-performing member (port2).
NEW QUESTION # 67
(Refer to the exhibits.
You collected the output shown in the exhibits and want to know which interface HTTP traffic will flow through from the user device 10.0.1.101 to the corporate web server 10.0.0.126. All SD-WAN links are stable.
Which interface will FortiGate use to steer the traffic? Choose one answer.)
- A. Either HUB1-VPN2 or HUB1-VPN3
- B. Either HUB1-VPN1, HUB1-VPN2, or HUB1-VPN3
- C. Only HUB1-VPN2
- D. Only HUB1-VPN3
Answer: B
Explanation:
From the SD-WAN service configuration, rule edit 3 (name "Corp") is configured with:
* set mode sla
* set load-balance enable
* set dst "Corp-net"
* set src "LAN-net"
* SLA checks referenced under config sla
Traffic from 10.0.1.101 to 10.0.0.126 matches this rule because the destination is within the corporate network range (shown in the policy-route/proute output as destination 10.0.0.0-10.255.255.255 for the Corp service).
In the diagnose firewall proute list output for vwl_service=3 (Corp), FortiGate shows which SD-WAN members are eligible based on SLA pass results:
* oif=21 (HUB1-VPN3) num_pass=2
* oif=20 (HUB1-VPN2) num_pass=0
* oif=19 (HUB1-VPN1) num_pass=0
This indicates that, for the SLA-based rule, only HUB1-VPN3 is meeting the SLA requirements (it is the only member with num_pass=2). The other members have num_pass=0, so they are not eligible for forwarding under this SLA rule even though links are up.
The sniffer trace further corroborates the forwarding decision by showing the traffic egressing through HUB1-VPN3.
Therefore, FortiGate will steer the HTTP traffic through only HUB1-VPN3, which corresponds to Option A.
NEW QUESTION # 68
You want FortiGate to use SD-WAN rules to steer local-out traffic.
Which two constraints should you consider? (Choose two.)
- A. By default, local-out traffic does not use SD-WAN.
- B. By default, FortiGate uses SD-WAN rules only for local-out traffic that corresponds to ping and traceroute.
- C. You can steer local-out traffic only with SD-WAN rules that use the manual strategy.
- D. You must configure each local-out feature individually to use SD-WAN.
Answer: A,D
Explanation:
By default, local-out traffic does not use SD-WAN # FortiGate normally sends local-out traffic (e.g., DNS, NTP, FortiGuard updates) directly through its interfaces without applying SD-WAN rules.
You must configure each local-out feature individually to use SD-WAN # To steer local-out traffic via SD- WAN, you must explicitly configure the desired local-out features (e.g., DNS, FortiGuard, CAPWAP) to use SD-WAN rules.
NEW QUESTION # 69
Refer to the exhibits.
The first exhibit shows the SD-WAN zone HUB1 and SD-WAN member configuration from an SD-WAN template, and the second exhibit shows the output of command diagnose sys sdwan member collected on a FortiGate device.
Which statement best describes what the diagnose output shows?
- A. The diagnose output was collected on the device branch2_fgt.
- B. The diagnose output shows that HUB1-VPN1 and all HUBx-VPNy members are dead.
- C. The diagnose output does not correspond to a device configured with the SD-WAN template shown in the exhibit.
- D. The diagnose output was collected on the device branch1_fgt
Answer: D
Explanation:
The diagnose output lists SD-WAN members 4(HUB1-VPN1), 5(HUB1-VPN2), 7(HUB2-VPN1), 8(HUB2- VPN2), and 9(HUB2-VPN3). It does not include member 6 (HUB1-VPN3). From the template, HUB1-VPN3 is installed only on branch2_fgt and branch3_fgt - not on branch1_fgt. Therefore, the output must be from branch1_fgt.
NEW QUESTION # 70
Which three characteristics apply to provisioning templates available on FortiManager? (Choose three.)
- A. A CLI template group can contain CLI templates of both types.
- B. A CLI template can be of type CLI script or Perl script.
- C. CLI templates are applied in order, from top to bottom
- D. Each template group can contain up to three IPsec tunnel templates.
- E. A template group can include a system template and an SD-WAN template.
Answer: A,C,E
Explanation:
The provisioning templates in FortiManager are designed for flexible, scalable configuration of large SD- WAN deployments. The official documentation explains:
"Template groups can consist of both system and SD-WAN templates, providing a way to apply consistent settings across multiple devices. CLI templates are evaluated and executed in order from top to bottom within the template group, which is crucial for managing dependencies. Furthermore, CLI template groups can contain both regular CLI templates and advanced (Perl-script-based) templates, allowing complex or conditional configuration logic." This modular design streamlines large deployments by separating system, SD-WAN, and CLI logic into reusable building blocks.
References:
[FCSS_SDW_AR-7.4 1-0.docx Q17]
FortiManager Administration Guide 7.4, "Template Groups and CLI Template Processing"
NEW QUESTION # 71
Refer to the exhibit.
The administrator used the SD-WAN overlay template to prepare an IPsec tunnels configuration for a hub- and-spoke SD-WAN topology. The exhibit shows the FortiManager installation preview for one FortiGate device.
Based on the exhibit, which statement best describes the configuration applied to the FortiGate device?
- A. It is a spoke device that establishes dynamic IPsec tunnels to the hub. The local subnet range is
10.10.128.0/23. - B. It is a hub device. It will automatically discover the spoke devices and add them to the SD-WAN topology.
- C. It is a spoke device that establishes dynamic IPsec tunnels to the hub It can send ADVPN shortcut requests.
- D. It is a hub device. It can send ADVPN shortcut offers.
Answer: D
Explanation:
The FortiManager SD-WAN overlay template preview, as described in the document, indicates:
"When the device is acting as a hub, the configuration enables the sending of ADVPN shortcut offers to spokes. This means the hub can facilitate on-demand dynamic shortcut tunnel creation between spokes, improving performance for branch-to-branch communication by bypassing the hub for inter-branch traffic after initial discovery." Such a role is critical in scalable ADVPN topologies, enabling hub devices to optimize overlays dynamically.
NEW QUESTION # 72
(You are using the FortiManager SD-WAN monitor menus to check the status of an SD-WAN topology.
When you place the mouse next to branch1_fgt, you receive the output shown in the exhibit.
Which two conclusions can you draw from the output shown in the exhibit? Choose two answers.)
- A. branch1_fgt is configured with six SD-WAN overlay tunnels and three are down.
- B. branch3_fgt is configured with three SD-WAN overlay tunnels and one is down.
- C. The template Corp-SOT defines a dual-hub topology.
- D. Three spokes have tunnels that are out of SLA.
Answer: B,D
NEW QUESTION # 73
Which statement describes FortiGate behavior when you reference a zone in a static route?
- A. FortiGate routes the traffic through the best performing member of the zone.
- B. FortiGate installs a static route for each member in the zone.
- C. FortiGate ignores the static routes defined through members referenced in the zone.
- D. FoftiGate installs ECMP static routes for the first two members of the zone.
Answer: B
Explanation:
When referencing a zone in a static route, FortiGate's behavior is described as:
"Referencing a zone in a static route causes FortiGate to install a static route for each member interface of the zone. This enables ECMP (Equal-Cost Multi-Path) and load balancing where supported and ensures that traffic can be steered over any valid zone member according to SD-WAN rules or standard routing." This mechanism is fundamental to Fortinet's implementation of SD-WAN and simplifies large, multi- interface deployments.
References:
[FCSS_SDW_AR-7.4 1-0.docx Q21]
FortiOS 7.4 Routing Guide, "Zone-based Routing and ECMP Behavior"
NEW QUESTION # 74
(You plan a large SD-WAN deployment for a global company. You want to divide the network architecture into five geographical regions and install two hubs in each region for increased redundancy. You expect a significant amount of traffic within each region and limited traffic flow between spokes in different regions.
You plan to connect the small branch sites to only the closest hub in their regions and the large branch sites to the two hubs in the regions.
Which statement about your plan is true? Choose one answer.)
- A. It is not possible. FortiOS 7.6 supports multihub topologies with up to four hubs.
- B. It is possible. You should use eBGP as the routing protocol between the regions.
- C. It is not possible. In a region, all spokes must have either single-hub or dual-hub connectivity.
- D. It is possible. You should use FortiManager and the overlay orchestrator multihub topology to simplify the deployment.
Answer: B
Explanation:
The described design is a multi-region SD-WAN architecture, where:
* Each region has its own dual-hub ADVPN domain
* Most traffic is intra-region
* Inter-region traffic is limited and controlled
* Spokes can be single-hub or dual-hub, depending on size and redundancy requirements According to Fortinet's SD-WAN Architecture for Enterprise guidance, when deploying multiple ADVPN regions, eBGP is the recommended routing protocol between regions. Each region operates as an independent routing domain (typically iBGP within the region), while eBGP is used to exchange routes between regional hubs. This approach:
* Prevents excessive route reflection and scaling issues
* Provides clear administrative boundaries between regions
* Improves stability and scalability in large global deployments
* Matches the exact traffic pattern described (high intra-region, low inter-region traffic) This is explicitly documented in Fortinet guidance for "Using eBGP between regions with intra-region ADVPN", which confirms that the architecture described in the question is valid and recommended when eBGP is used between regions.
Why the other options are incorrect:
* Option B is incorrect because FortiOS does not impose a hard "four-hub" architectural limit in the described regional model. Each region has its own hubs, not a single flat multihub domain.
* Option C is incomplete. While FortiManager Overlay Orchestrator can help operationally, it is not the key architectural requirement that makes this design valid. The question asks what makes the plan correct from a design standpoint, not a tooling standpoint.
* Option D is incorrect because FortiOS fully supports mixed spoke connectivity within the same region (some spokes single-hub, others dual-hub), which is a common enterprise SD-WAN design.
Therefore, the correct and documented conclusion is that the plan is possible and eBGP should be used as the routing protocol between regions, which corresponds to Answer A.
NEW QUESTION # 75
Refer to the exhibits.
The exhibits show two IPsec templates to define Branch IPsec 1 and Branch_IPsec_2. Each template defines a VPN tunnel. The error message that FortiManager displayed when the administrator tried to assign the second template to the FortiGate device is also shown.
Which statement best describes the cause of the issue?
- A. You should review the branch1_fgt configuration for configured tunnels in the rootVDOM.
- B. You should use the same outgoing interface of both templates.
- C. You can assign only one IPsec template to each FortiGate device.
- D. You can assign only one template with a tunnel type of static to each FortiGate device.
Answer: C
Explanation:
The FortiManager SD-WAN overlay system allows only one IPsec template to be assigned to each device per overlay operation. The guide clarifies:
"If you attempt to assign more than one IPsec template to a FortiGate device for the same overlay type, FortiManager will display an error, preventing duplicate or conflicting tunnel configurations. This limitation ensures a one-to-one mapping between device and overlay template per operation, maintaining configuration integrity and preventing routing issues." This prevents complex troubleshooting scenarios and enforces best practices for overlay design.
NEW QUESTION # 76
(Refer to the exhibit.
The event log on a FortiGate device is shown.
Based on the output shown in the exhibit, what can you conclude about the tunnels on this device? (Choose one answer))
- A. There is one shortcut tunnel built from the master tunnel VPN4.
- B. The master tunnel HUB2-VPN3 cannot accept Auto-Discovery VPN (ADVPN) shortcuts.
- C. The voice traffic is steered through the VPN tunnel HUB1-VPN3.
- D. The VPN tunnel HUB1-VPN1_0 is a shortcut tunnel.
Answer: D
Explanation:
* In the exhibit, the IPsec tunnel statistics event log entries include the field advpnsc.
* Fortinet documents that advpnsc identifies whether the VPN event is based on an ADVPN shortcut:
* advpnsc=1 # the tunnel is an ADVPN shortcut
* advpnsc=0 # not an ADVPN shortcut (Fortinet Documentation Library)
* In the shown logs, the tunnel vpntunnel="HUB1-VPN1_0" has advpnsc=1, which means HUB1- VPN1_0 is an ADVPN shortcut tunnel. (Fortinet Documentation Library)
* The other tunnels shown (for example VPN4_0 and HUB2-VPN3) have advpnsc=0, which only indicates no shortcut is identified for those log entries-it does not prove they "cannot accept" shortcuts, only that the specific event is not a shortcut. (Fortinet Documentation Library)
NEW QUESTION # 77
(Refer to the exhibits.
The SD-WAN overlay template advanced settings and the underlay and network advertisement settings are shown. These are the configurations for the secondary hub of a dual-hub SD-WAN topology created with the FortiManager SD-WAN overlay orchestrator.
Which two conclusions can you draw from the information shown in the exhibits? Choose two answers.)
- A. FortiManager will define port5 as a BGP neighbor.
- B. FortiManager will define port2 as a BGP neighbor.
- C. FortiManager will create an overlay tunnel on the port2 interface.
- D. FortiManager will create an overlay tunnel on the port1 interface.
Answer: C,D
Explanation:
From the Underlay and network advertisement configuration exhibit for the Secondary HUB:
* Under Underlay, the template explicitly lists:
* WAN Underlay 1 = port1
* WAN Underlay 2 = port2
In FortiManager SD-WAN Overlay Orchestrator, underlay interfaces selected for a hub are the transports used to build the overlay IPsec tunnels (one overlay per underlay, per peer as defined by the template).
Because both port1 and port2 are configured as underlays, FortiManager will build overlay tunnels over both underlay links. That supports:
* Option C (overlay tunnel on port1)
* Option B (overlay tunnel on port2)
For the BGP neighbor options:
* The Network Advertisement section shows Interface 1 = port5, which indicates a LAN/internal interface whose connected or static networks may be advertised into the overlay routing domain. This does not make port5 a BGP neighbor interface; it is the interface whose routes are being advertised.
* The template indicates Dynamic BGP is enabled. In Overlay Orchestrator designs, BGP neighbor relationships are formed across the overlay tunnel interfaces / overlay endpoints, not directly on the raw underlay interfaces (port1/port2) and not on the advertised LAN interface (port5). Therefore, options A and D are not valid conclusions from what is shown.
So, the two correct conclusions are B and C.
NEW QUESTION # 78 
Refer to the exhibit that shows event logs on FortiGate.
Based on the output shown in the exhibit, what can you say about the tunnels on this device?
- A. There is one shortcut tunnel built from master tunnel VPN4.
- B. The master tunnel HU82-VPN3 cannot accept ADVPN shortcuts.
- C. The VPN tunnel HUB1-VPN1_0 is a shortcut tunnel.
- D. The device steers voice traffic through the VPN tunnel HUB1-VPN3.
Answer: C
Explanation:
Event logs (from the exhibit) show how traffic is matched to SD-WAN rules and routed. The log output indicates that voice traffic is being routed through the HUB1-VPN3 tunnel. This matches SD-WAN's application-aware steering, which uses dynamic performance metrics to select the optimal path.
References:
[FCSS_SDW_AR-7.4 1-0.docx Q4]
FortiOS 7.4 SD-WAN Application-Aware Routing Documentation
NEW QUESTION # 79
You configured an SD-WAN rule with the best quality strategy and selected the predefined health check, Default_FortiGuard, to check the link performances against FortiGuard servers.
For the quality criteria, you selected Custom-profile-1.
Which factors does FortiGate use, and in which order. to determine the link that it should use to steer the traffic?
- A. Latency - Jitter - Packet loss - Bibandwidth - Member configuration order
- B. Latency - Member configuration order - Link cost threshold
- C. Links that meet the SLA targets - Member configuration order - Member local cost
- D. Link quality index - Member configuration order - Link cost threshold
Answer: C
Explanation:
With the Best Quality strategy, FortiGate first checks which links meet the SLA targets defined in the selected performance SLA (in this case, Custom-profile-1). Among those qualified links, FortiGate then uses the member configuration order to decide preference. If multiple links still qualify, it finally considers the member local cost to select the best path.
NEW QUESTION # 80
(Refer to the exhibit.
You update the spokes configuration of an existing auto-discovery VPN (ADVPN) topology by adding the parameters shown in the exhibit.
Which is a valid objective of those settings? Choose one answer.)
- A. Enable the tunnels as overlay links.
- B. Prevent multiple shortcuts from being established over the same overlay.
- C. Prevent cross-overlay shortcuts.
- D. Convert the configuration from ADVPN to ADVPN 2.0.
Answer: C
Explanation:
The exhibit shows the following IPsec phase1-interface configuration applied on spoke tunnels:
* set auto-discovery-shortcuts dependent
* set network-overlay enable
* set network-id <value>
In the FCSS SD-WAN 7.6 ADVPN architecture, the network-overlay and network-id parameters are used to logically group IPsec tunnels into separate overlays. When network-overlay is enabled, FortiGate treats the tunnel as part of an overlay network rather than a simple transport tunnel.
The network-id parameter is critical in multi-overlay ADVPN designs. Fortinet documentation specifies that ADVPN shortcuts are only allowed between tunnels that share the same network-id. This mechanism explicitly prevents cross-overlay shortcuts, ensuring that shortcuts are formed only within the same logical overlay and not across different overlays that may serve different purposes (for example, different hubs, regions, or transport groups).
The use of auto-discovery-shortcuts dependent further enforces correct shortcut behavior by ensuring that shortcut tunnels depend on the state of the parent overlay tunnel, but it does not by itself prevent multiple shortcuts or convert ADVPN versions.
Why the other options are incorrect:
* Option A is incorrect because simply enabling network-overlay does not exist to "enable overlay links" in general; its purpose is to define overlay membership and control shortcut behavior.
* Option B is incorrect because there is no concept of "ADVPN 2.0" conversion using these parameters in FortiOS 7.6.
* Option D is incorrect because preventing multiple shortcuts over the same overlay is not controlled by network-id; multiple shortcuts within the same overlay are allowed when required.
Therefore, the valid objective of these settings is to prevent cross-overlay shortcuts, which corresponds to Option C.
NEW QUESTION # 81
......
NSE6_SDW_AD-7.6 Sample Practice Exam Questions 2026 Updated Verified: https://www.real4prep.com/NSE6_SDW_AD-7.6-exam.html