Fortinet NSE6_SDW_AD-7.6 Online Practice Questions and Exam Preparation

Fortinet NSE6_SDW_AD-7.6 Online Questions & Answers

• Question 1:

  A team is using FortiManager to deploy a new SD-WAN overlay to many branches.

  Which two actions are part of the normal centralized deployment flow after the overlay template is created? (Choose two.)

  A. Assign required metadata variables, such as unique branch identifiers, to branch devices.
  B. Configure SD-WAN rules that use the newly created overlay members or zones.
  C. Delete the FortiManager ADOM before installing the generated templates.
  D. Disable all device-level template groups because overlay orchestration cannot use them.
  E. Install FortiClient on the FortiManager server to enable IPsec template generation.
  A. Assign required metadata variables, such as unique branch identifiers, to branch devices.
  B. Configure SD-WAN rules that use the newly created overlay members or zones.

  ---

  Explanation

  The selected answer matches FortiManager SD-WAN orchestration. Templates, blueprints, metadata, ADOM separation, and install workflows prepare repeatable device configuration, but they still depend on required per-device variables and post-run validation. The rejected choices confuse template preparation with completed forwarding behavior or omit information FortiManager needs before it can install consistent SD-WAN, IPsec, policy, and routing objects.

• Question 2:

  You used the HUB IPsec_Recommended and the BRANCH IPsec_Recommended templates to define the overlay topology.

  Then, you used the SD-WAN template to define the SD-WAN members, rules, and performance SLAs.

  You applied the changes to the devices and want to use the FortiManager monitors menu to get a graphical view that shows the status of each SD-WAN member.

  Which statement best explains how to obtain this graphical view?

  A. Use the SD-WAN monitor template view to get a map view of the branches, hub, and tunnel status, including the SLA pass or missed status.
  B. Use the SD-WAN monitor table view to get a donut view and a table view that shows the status of each SD-WAN member, including the SLA pass or missed status.
  C. Use the VPN monitor map view to get a map view of the branches, hub, and tunnel status, including the SLA pass or missed status.
  D. Use the SD-WAN monitor asset view to get a donut view and a table view that shows the status of each device and the SLA status of each SD-WAN member.
  B. Use the SD-WAN monitor table view to get a donut view and a table view that shows the status of each SD-WAN member, including the SLA pass or missed status.

  ---

  Explanation

  The selected answer matches FortiManager SD-WAN orchestration. Templates, blueprints, metadata, ADOM separation, and install workflows prepare repeatable device configuration, but they still depend on required per-device variables and post-run validation. The rejected choices confuse template preparation with completed forwarding behavior or omit information FortiManager needs before it can install consistent SD-WAN, IPsec, policy, and routing objects.

• Question 3:

  Refer to the exhibit.

  

  Based on the output shown in the exhibit, what can you conclude about the device role and how it handles health checks? Choose one answer.

  A. The device is a spoke and it provides embedded health-check measures for each tunnel to the hub.
  B. The device is a spoke and it receives health-check measures for the tunnels of another spoke.
  C. The device is a hub and it receives embedded health-check measures for each tunnel from the spoke.
  D. The device is a hub and it receives health-check measures for the tunnels of a spoke.
  A. The device is a spoke and it provides embedded health-check measures for each tunnel to the hub.

  ---

  Explanation

  The selected answer follows how FortiGate evaluates SD-WAN performance SLAs. Health checks measure member quality, passive or active probe mode controls how measurements are learned, and SD-WAN rules then compare the configured quality criteria or cost strategy against eligible members. The rejected choices either ignore member health, use the wrong traffic type for passive measurement, or assume a rule can prefer a link before the SLA and strategy make that member eligible.

• Question 4:

  In which order does FortiGate consider the following elements during the route lookup process? Choose one answer.

  A. SD-WAN rules, ISDB routes, policy routes, BGP routes
  B. Policy routes, SD-WAN rules, Internet Service Database (ISDB) routes, BGP routes
  C. SD-WAN rules, policy routes, static routes, ISDB routes
  D. Policy routes, ISDB routes, SD-WAN rules, static routes
  D. Policy routes, ISDB routes, SD-WAN rules, static routes

  ---

  Explanation

  The selected answer is consistent with FortiGate routing order. Normal route lookup must first resolve traffic to an SD-WAN zone or member, and then SD-WAN rules, member status, route tags, source NAT settings, and tie breakers influence the final egress choice. The rejected choices skip part of that sequence or assume SD-WAN can steer traffic independently of the route, member, and policy objects that make the

  flow eligible.

• Question 5:

  Refer to the exhibit.

  

  Which statement best describe the role of the ADVPN device in handling traffic?

  A. This is a spoke that has received a direct shortcut query from a remote spoke.
  B. This is a hub, and two spokes, 192.2.0.1 and 10.0.3.101, establish a shortcut.
  C. This is a hub that has received a shortcut query from a spoke and has forwarded it to another spoke.
  D. This is a spoke that has received a shortcut query from a remote hub.
  B. This is a hub, and two spokes, 192.2.0.1 and 10.0.3.101, establish a shortcut.

  ---

  Explanation

  The selected answer follows Fortinet ADVPN behavior: the hub advertises reachability and the spokes can build shortcut tunnels only when the overlay, routing, and shortcut authorization parameters are consistent.

  BGP reachability, loopback or tunnel addressing, and correct phase-1 or phase-2 settings must all agree;

  otherwise traffic remains on the hub path or the shortcut cannot be used for the desired flows.

• Question 6:

  Refer to the exhibit.

  

  Which SD-WAN rule and interface uses FortiGate to steer the traffic from the LAN subnet 10.0.1.0/24 to the corporate server 10.2.5.254?

  A. SD-WAN service rule 3 and interface HUB1-VPN2.
  B. SD-WAN service rule 3 and interface HUB1-VPN3.
  C. SD-WAN service rule 4 and port1 or port2.
  D. SD-WAN service rule 4 and interface port2.
  D. SD-WAN service rule 4 and interface port2.

  ---

  Explanation

  The selected answer matches Fortinet SD-WAN overlay design. Underlay interfaces provide transport, while IPsec tunnels and SD-WAN members form the overlay used by rules and health checks. Correct hub, spoke, template, and tunnel settings are required before traffic can be steered reliably; the rejected choices either mix underlay and overlay roles or assume a tunnel state that the FortiGate configuration would not produce.

• Question 7:

  Refer to the exhibits.

  

  Two SD-WAN event logs, the member status, the SD-WAN rule configuration, and the health-check configuration for a FortiGate device are shown.

  Immediately after the log messages are displayed, how will the FortiGate steer the traffic based on the information shown in the exhibits? Choose one answer.

  A. FortiGate skips SD-WAN rule ID 1.
  B. FortiGate uses port2 to steer the traffic for SD-WAN rule ID 1.
  C. FortiGate uses port1 to steer the traffic for SD-WAN rule ID 1.
  D. FortiGate uses port1 or port2 to steer the traffic for SD-WAN rule ID 1.
  B. FortiGate uses port2 to steer the traffic for SD-WAN rule ID 1.

  ---

  Explanation

  The selected answer follows how FortiGate evaluates SD-WAN performance SLAs. Health checks measure member quality, passive or active probe mode controls how measurements are learned, and SD-WAN rules then compare the configured quality criteria or cost strategy against eligible members. The rejected choices either ignore member health, use the wrong traffic type for passive measurement, or assume a rule can prefer a link before the SLA and strategy make that member eligible.

• Question 8:

  An SD-WAN member is no longer used to steer SD-WAN traffic.

  The administrator updated the SD-WAN configuration and deleted the unused member.

  After the configuration update, users report that some destinations are unreachable.

  You confirm that the affected flow does not match an SD-WAN rule.

  What could be a possible cause of the traffic interruption?

  A. FortiGate, with SD-WAN enabled, cannot route traffic through interfaces that are not SD-WAN members.
  B. FortiGate can remove some static routes associated with an interface when the member is removed from SD-WAN.
  C. FortiGate removes the layer 3 settings for interfaces that are removed from the SD-WAN configuration.
  D. FortiGate administratively brings down interfaces when they are removed from the SD-WAN configuration.
  B. FortiGate can remove some static routes associated with an interface when the member is removed from SD-WAN.

  ---

  Explanation

  The selected answer is consistent with FortiGate routing order. Normal route lookup must first resolve traffic to an SD-WAN zone or member, and then SD-WAN rules, member status, route tags, source NAT settings, and tie breakers influence the final egress choice. The rejected choices skip part of that sequence or assume SD-WAN can steer traffic independently of the route, member, and policy objects that make the

  flow eligible.

• Question 9:

  Refer to the exhibits.

  

  

  The exhibits show the SD-WAN zone configuration of an SD-WAN template prepared on FortiManager and the policy package configuration.

  When the administrator tries to install the configuration changes, FortiManager fails to commit.

  What should the administrator do to fix the issue?

  A. Configure branch1_fgt as the installation target for policy 3.
  B. Configure HUB1 as the destination of policy 3.
  C. Configure a normalized interface for the IPsec tunnel HUB1-VPN1.
  D. Configure both HUB1-VPN1 and HUB1-VPN2 as the destination of policy 3
  B. Configure HUB1 as the destination of policy 3.

  ---

  Explanation

  The selected answer matches FortiManager SD-WAN orchestration. Templates, blueprints, metadata, ADOM separation, and install workflows prepare repeatable device configuration, but they still depend on required per-device variables and post-run validation. The rejected choices confuse template preparation with completed forwarding behavior or omit information FortiManager needs before it can install consistent SD-WAN, IPsec, policy, and routing objects.

• Question 10:

  What are three key routing principles of SD-WAN? (Choose three.)

  A. Directly connected routes have precedence over SD-WAN rules.
  B. Policy routes have precedence over SD-WAN rules.
  C. SD-WAN rules are skipped if the best route to the destination is a static route
  D. SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member.
  E. SD-WAN members are skipped if they do not have a valid route to the destination.
  B. Policy routes have precedence over SD-WAN rules.
  D. SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member.
  E. SD-WAN members are skipped if they do not have a valid route to the destination.

  ---

  Explanation

  The selected answer is consistent with FortiGate routing order. Normal route lookup must first resolve traffic to an SD-WAN zone or member, and then SD-WAN rules, member status, route tags, source NAT settings, and tie breakers influence the final egress choice. The rejected choices skip part of that sequence or assume SD-WAN can steer traffic independently of the route, member, and policy objects that make the

  flow eligible.