Is the FCSS-SDW-AR-7-6 practice exam free?

Yes. ExamCademy offers all 61 FCSS-SDW-AR-7-6 practice questions for free with a registered account. No payment needed. Optional supporter features add AI explanations and spaced repetition study tools.

How accurate are the FCSS-SDW-AR-7-6 practice questions?

All FCSS-SDW-AR-7-6 questions are community-created and reviewed by moderators to align with Fortinet's published exam objectives. The community continuously reports and fixes issues to keep content accurate and up to date.

How should I study for the FCSS-SDW-AR-7-6 exam?

Start by browsing practice questions to identify weak areas. Use spaced repetition (Learn Mode) to focus study time on topics you struggle with. Combine practice questions with official Fortinet documentation and hands-on experience for best results.

FCSS-SDW-AR-7-6 Practice Exam — Free 61+ Questions

61Practice Questions

3Study Modes

FreeTo Get Started

Topic:Sort:

Question 1

SD-WAN setup

1 2 3

→

Know a question that should be here? Contribute to this exam

Your FortiGate is in production. To optimize WAN link use and improve redundancy, you enable and configure SD-WAN.
What must you do as part of this configuration update process?

A Replace references to interfaces used as SD-WAN members in the routing configuration.
B Disable the interface that you want to use as an SD-WAN member.
C Replace references to interfaces used as SD-WAN members in the firewall policies.
D Purchase and install the SD-WAN license, and reboot the FortiGate device.

As an IT manager, you want to delegate the installation and management of your SD-WAN deployment to a managed security service provider (MSSP).
Each site must maintain direct internet access and be secure. You expect significant traffic flow between the sites and want to delegate as much of the network administration and management as possible to the MSSP.
Which two MSSP deployment blueprints address your requirements? (Choose two.)

A Install the hub and spokes on the customer premises, and enable the MSSP to manage the SD-WAN deployment using FortiManager with a dedicated ADOM.
B Use a shared hub on the MSSP premises and a dedicated hub on the customer premises, and install the spokes on the customer premises.
C Install a dedicated hub on the MSSP premises for the customer, and install the spokes on the customer premises.
D Use a shared hub on the MSSP premises with a dedicated VDOM for the customer, and install the spokes on the customer premises.

Refer to the exhibit that shows a diagnose output on a FortiGate device.

Question Image

Based on the output shown in the exhibit, what can you conclude about the device role and how it handles health checks?

A The device is a spoke and it receives health-check measures for the tunnels of another spoke.
B The device is a hub and it receives health-check measures for the tunnels of a spoke.
C The device is a spoke and it provides embedded health-check measures for each tunnel to the hub.
D The device is a hub and it receives embedded health-check measures for each tunnel from the spoke.

You have a FortiGate configuration with three user-defined SD-WAN zones and two members in each of these zones. One SD-WAN member is no longer in use in health-check and SD-WAN rules. You want to delete it.
What happens if you delete the SD-WAN member from the FortiGate GUI?

A FortiGate accepts the deletion and places the member in the default SD-WAN zone.
B FortiGate displays an error message. SD-WAN zones must contain at least two members.
C FortiGate accepts the deletion and removes static routes as required.
D FortiGate accepts the SD-WAN member deletion with no further action.

Refer to the exhibit.

Question Image

Which action will FortiGate take if it detects SD-WAN members as dead?

A FortiGate bounces port5 after it detects all SD-WAN members as dead.
B FortiGate brings down port5 after it detects all SD-WAN members as dead.
C FortiGate sends alert messages through port5 when it detects all SD-WAN members as dead.
D FortiGate fails over to the secondary device after it detects port5 as dead.

What are three characteristics of the provisioning templates available on FortiManager? (Choose three.)

A A template group can include a system template and an SD-WAN template.
B A CLI template can be of type CLI script or Perl script.
C CLI templates are applied in order, from top to bottom.
D A CLI template group can contain CLI templates of different types.
E Each template group can contain up to three IPsec tunnel templates.

Refer to the exhibit.
FortiGate router policy and diagnose output

Question Image

How does FortiGate handle the traffic with the source IP 10.0.1.130 and the destination IP 128.66.0.125?

A FortiGate steers the traffic flow through port2.
B FortiGate routes the traffic flow according to the FIB.
C FortiGate load balances the traffic flow through port1 and port2.
D FortiGate drops the traffic flow.

Refer to the exhibit.

Question Image

The administrator configured the IPsec tunnel VPN1 on a FortiGate device with the parameters shown in exhibit.
Based on the configuration, which three conclusions can you draw about the characteristics and requirements of the VPN tunnel? (Choose three.)

A The remote end can be a third-party IPsec device.
B The remote end must support IKEv2.
C The tunnel interface IP address on the spoke side is provided by the hub.
D This configuration allows user-defined overlay IP addresses.
E The administrator must manually assign the tunnel interface IP address on the hub side.

Refer to the exhibit.

SD-WAN Network Topology -

Question Image

You want to configure SD-WAN on a network, as shown in the exhibit.
The network contains many FortiGate devices. Some are used as next-generation firewalls (NGFW), and some are installed with extensions such as FortiSwitch, FortiAP, or FortiExtender.
Which factors should you consider when planning your deployment?

A You should build multiple SD-WAN topologies. Each topology should contain only one type of extension.
B You can build an SD-WAN topology that includes all devices. The hubs must be devices without extensions.
C You should exclude the FortiGate devices with FortiLink connection from the SD-WAN topology.
D You can build an SD-WAN topology that includes all devices. The hubs can be FortiGate devices with FortiExtender.

Refer to the exhibit.

FortiManager SD-WAN monitor -

Question Image

To check the status of an SD-WAN topology using the FortiManager SD-WAN monitor menus, you place your mouse next to branch1_fgt and receive the output shown in the exhibit.
Which conclusion can you draw from the output shown in the exhibit?

A Three tunnels of branch2_fgt are out of SLA.
B The template Corp-SOT defines a single-hub topology.
C branch3_fgt is configured with three SD-WAN overlay tunnels and one is dead.
D The three spokes have tunnels that are out of SLA.

Refer to the exhibit.

Diagnose output -

Question Image

The exhibit shows output of the command diagnose sys sdwan service4 collected on a FortiGate device.
The administrator wants to know through which interface FortiGate will steer traffic from local users on subnet 10.0.1.0/255.255.255.192 and with a destination of the social media application Facebook.
Based on the exhibits, which two statements are correct? (Choose two.)

A When FortiGate cannot recognize the application of the flow, it load balances the traffic through the tunnels HQ_T1, HQ_T2, HQ_T3.
B FortiGate steers traffic for social media applications according to the service rule 2 and steers traffic through port2.
C When FortiGate cannot recognize the application of the flow, it steers the traffic through the preferred member of rule 3, HQ_T1.
D There is no service defined for the Facebook application, so FortiGate applies service rule 3 and directs the traffic to headquarters.

Refer to the exhibit.

Question Image

The health-check configuration on a FortiGate device used as a spoke is shown.
You notice that the hub FortiGate does not prioritize the traffic as expected.
Which two configuration elements should you check on the hub? (Choose two.)

A This performance SLA uses the same members.
B The performance SLA is configured with set embedded-measure accept.
C The performance SLA uses the same criteria.
D The performance SLA has the parameter priority-out-sla configured.

Refer to the exhibit.

Question Image

Two hub-and-spoke groups are connected through redundant site-to-site IPsec VPNs between Hub 1 and Hub 2.
Which two configuration settings are required for spoke A1 to establish an auto-discovery VPN (ADVPN) shortcut with spoke B2? (Choose two.)

A On the hubs, auto-discovery-receiver must be enabled on the IPsec VPNs to spokes.
B On the hubs, auto-discovery-forwarder must be enabled on the IPsec VPNs to hubs.
C On the spokes, auto-discovery-receiver must be enabled on the IPsec VPNs to the hub.
D On the spokes, auto-discovery-sender must be enabled on the IPsec VPNs to hubs.

Refer to the exhibit.

Diagnose output -

Question Image

An administrator is troubleshooting SD-WAN on FortiGate. A device behind branch1_fgt generates traffic to the 10.0.0.0/8 network. The administrator expects the traffic to match SD-WAN rule ID 1 and be routed over HUB1-VPN1. However, the traffic is routed over HUB1-VPN.
Based on the output shown in the exhibit, which two reasons, individually or together, could explain the observed behavior? (Choose two.)

A HUB1-VPN1 does not have a valid route to the destination.
B HUB1-VPN3 has a higher member configuration priority than HUB1-VPN1.
C The traffic matches a regular policy route configured with HUB1-VPN3 as the outgoing device.
D HUB1-VPN3 has a lower route priority value (higher priority) than HUB1-VPN1.

Refer to the exhibit, which shows the SD-WAN rule status and configuration.
SD-WAN rules status and configuration

Question Image

Based on the exhibit, which change in the measured packet loss will make HUB1-VPN3 the new preferred member?

A When all three members have the same packet loss
B When HUB1-VPN3 has 4% packet loss
C When HUB1-VPN1 has 12% packet loss
D When HUB1-VPN1 has 4% packet loss

Refer to the exhibits.

Interface details -

Question Image

Static route details -

Question Image

Firewall policies on managed FortiGate

Question Image

The interface details, static route configuration, and firewall policies on the managed FortiGate device are shown.
You want to configure a new SD-WAN zone, named Underlay, that contains the interfaces port1 and port2.
What should be your first action?

A Delete the static routes.
B Delete the SD-WAN Zone Test.
C Delete the firewall policies.
D Define port1 as an SD-WAN member.

You manage an SD-WAN topology and you will soon deploy 50 new branches.
Which two tasks can you do in advance to simplify this deployment? (Choose two.)

A Create a policy blueprint.
B Define metadata variable values for each device.
C Create model devices.
D Create a zero-touch provisioning (ZTP) template.

Refer to the exhibit.

Question Image

The event log on a FortiGate device is shown.
Based on the output shown in the exhibit, what can you conclude about the tunnels on this device?

A The voice traffic is steered through the VPN tunnel HUB1-VPN3.
B The VPN tunnel HUB1-VPN1_0 is a shortcut tunnel.
C The master tunnel HUB2-VPN3 cannot accept auto-discovery VPN (ADVPN) shortcuts.
D There is one shortcut tunnel built from the master tunnel VPN4.

You want FortiGate to use SD-WAN rules to steer ping local-out traffic.
Which two constraints should you consider? (Choose two.)

A By default, local-out traffic does not use SD-WAN.
B You must configure each local-out feature individually to use SD-WAN.
C By default, FortiGate uses SD-WAN rules only for local-out traffic that corresponds to ping and traceroute.
D You can steer local-out traffic only with SD-WAN rules that use the manual strategy.

Refer to the exhibit.

Question Image

You configure the SD-WAN rule ID 4 with two members (port1 and port2) and the strategy lowest cost (SLA).
Which two statements about the session shown in the exhibit are true? (Choose two.)

A FortiGate steered this flow according to the application detected and the outgoing interface is port3.
B FortiGate will reevaluate this session if the outgoing interface goes down.
C FortiGate steered this flow according to the SD-WAN rule 4.
D FortiGate will reevaluate this session if you update the routing table.

You are configuring ADVPN 2.0 on an SD-WAN topology already configured for ADVPN.
What should you do to implement ADVPN 2.0 in this scenario?

A Update the IPsec tunnel configuration on the branches.
B Delete the existing ADVPN configuration and configure ADVPN 2.0.
C Update the IPsec tunnel configurations on the hub.
D Update the SD-WAN configuration on the branches.

Refer to the exhibit.

SD-WAN rule -

Question Image

You configure SD-WAN on a standalone FortiGate device.
You want to create an SD-WAN rule that steers traffic related to Facebook and LinkedIn through the less costly internet link.
What must you do to set Facebook and LinkedIn applications as destinations from the GUI?

A In the Internet service field, select Facebook and LinkedIn.
B Enable the visibility of the applications field as destinations of the SD-WAN rule.
C You cannot configure applications as destinations of an SD-WAN rule on a standalone FortiGate device.
D Install a license to allow applications as destinations of SD-WAN rules.

Which three factors about SLA targets and SD-WAN rules should you consider when configuring SD-WAN rules? (Choose three.)

A SLA targets are used only by SD-WAN rules that are configured with a Lowest Cost (SLA) strategy.
B SD-WAN rules can use SLA targets to check whether the preferred members meet the SLA requirements.
C Member metrics are measured only if a rule uses the SLA target.
D When configuring an SD-WAN rule, you can select multiple SLA targets if they are from the same performance SLA.
E When configuring an SD-WAN rule, you can select multiple SLA targets from different performance SLAs.

You plan a large SD-WAN deployment for a global company. You want to divide the network architecture into five geographical regions and install two hubs in each region for increased redundancy.
You expect a significant amount of traffic within each region and limited traffic flow between spokes in different regions. You plan to connect the small branch sites to only the closest hub in their regions and the large branch sites to the two hubs in the regions.
Which statement about your plan is true?

A It is possible. You should use FortiManager and the overlay orchestrator multihub topology to simplify the deployment.
B It is possible. You should use EBGP as the routing protocol between the regions.
C It is not possible. In a region, all spokes must have either single-hub or dual-hub connectivity.
D It is not possible. FortiOS 7.6 supports multihub topologies with up to four hubs.

Refer to the exhibits.
SD-WAN overlay template advanced settings

Question Image

Underlay and network advertisement configuration

Question Image

The SD-WAN overlay template, advanced settings, and the underlay and network advertisement settings are shown.
These are the configurations for the secondary hub of a dual-hub SD-WAN topology created with the FortiManager SD-WAN overlay orchestrator.
Which two conclusions can you draw from the information shown in the exhibits? (Choose two.)

A FortiManager will define port5 as a BGP neighbor.
B FortiManager will create an overlay tunnel on the port2 interface.
C FortiManager will define port2 as a BGP neighbor.
D FortiManager will create an overlay tunnel on the port1 interface.

FCSS-SDW-AR-7-6Preview

About the FCSS-SDW-AR-7-6 Exam

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25

FCSS-SDW-AR-7-6Preview

About the FCSS-SDW-AR-7-6 Exam

Mode Selection

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25