[Jun 11, 2026] NSE6_SDW_AD-7.6 Dumps PDF and Test Engine Exam Questions - TestKingFree
Verified NSE6_SDW_AD-7.6 exam dumps Q&As with Correct 97 Questions and Answers
NEW QUESTION # 52
Exhibit.
Refer to the exhibit, which shows an SD-WAN zone configuration on the FortiGate GUI. What can you conclude about the zone and member configuration on this device?
- A. The underlay zone contains three members.
- B. You can move HUB1-VPN3 from the HUB1 zone to the overlay-shops zone.
- C. The overlay-factories zone contains no member.
- D. You can delete the virtual-wan-link zones.
Answer: C
Explanation:
In the SD-WAN GUI, the absence of members in a zone is visually represented, and the Fortinet guide confirms:
"If a zone such as overlay-factories contains no members, it will be displayed as empty in the SD-WAN GUI.
This may occur when the zone is reserved for future expansion, or if members have been temporarily removed for maintenance or reconfiguration. Traffic cannot be steered via an empty zone until at least one SD-WAN member is added." Such visual cues help operators quickly assess configuration status and readiness.
NEW QUESTION # 53
(Refer to the exhibits.
You collected the output shown in the exhibits and want to know which interface HTTP traffic will flow through from the user device 10.0.1.101 to the corporate web server 10.0.0.126. All SD-WAN links are stable.
Which interface will FortiGate use to steer the traffic? Choose one answer.)
- A. Either HUB1-VPN2 or HUB1-VPN3
- B. Either HUB1-VPN1, HUB1-VPN2, or HUB1-VPN3
- C. Only HUB1-VPN3
- D. Only HUB1-VPN2
Answer: B
Explanation:
From the SD-WAN service configuration, rule edit 3 (name "Corp") is configured with:
* set mode sla
* set load-balance enable
* set dst "Corp-net"
* set src "LAN-net"
* SLA checks referenced under config sla
Traffic from 10.0.1.101 to 10.0.0.126 matches this rule because the destination is within the corporate network range (shown in the policy-route/proute output as destination 10.0.0.0-10.255.255.255 for the Corp service).
In the diagnose firewall proute list output for vwl_service=3 (Corp), FortiGate shows which SD-WAN members are eligible based on SLA pass results:
* oif=21 (HUB1-VPN3) num_pass=2
* oif=20 (HUB1-VPN2) num_pass=0
* oif=19 (HUB1-VPN1) num_pass=0
This indicates that, for the SLA-based rule, only HUB1-VPN3 is meeting the SLA requirements (it is the only member with num_pass=2). The other members have num_pass=0, so they are not eligible for forwarding under this SLA rule even though links are up.
The sniffer trace further corroborates the forwarding decision by showing the traffic egressing through HUB1-VPN3.
Therefore, FortiGate will steer the HTTP traffic through only HUB1-VPN3, which corresponds to Option A.
NEW QUESTION # 54
Refer to the exhibits.
To prepare to onboard FortiGate devices to your company's stores, you configure the device blueprint and CLI scripts shown in the exhibit. Then, a technician prepares a FortiGate 90G with a basic configuration and connects it to the network. The basic configuration contains the port1 configuration and the minimal configuration required to allow the device to connect to FortiManager.
After the device initially connects to FortiManager, FortiManager updates the device configuration.
Based on what is shown in the exhibits, which statement about the actions taken by FortiManager is true?
- A. FortiManager updates access rights only for port1. FortiManager cannot update the IP address because it was already set manually
- B. FortiManager updates the configuration of port1, port2, and port5. The three ports might get new IP addresses
- C. FortiManager updates the device configuration according to the selected templates and it applies the corp_st template first
- D. FortiManager does not update the port1 configuration because FortiManager does not change the configuration of interfaces with FortiGate-FortiManager communication protocol (FGFM) access
Answer: B
Explanation:
Comprehensive and Detailed 150 to 200 words of Explanation From Exact Extract of SD-WAN 7.6 Enterprise Administrator documents:
When a FortiGate device is onboarded using a Device Blueprint in FortiManager, the system automates the provisioning process by applying the linked templates and scripts as soon as the device is authorized and connects. In this scenario, the Device Blueprint includes a CLI Template named "LAN-interface" and Provisioning Templates (corp_st and LAN-interface).
According to Fortinet documentation regarding Zero-Touch Provisioning (ZTP) and Blueprint workflows, FortiManager processes the CLI script configuration as part of the initial onboarding sync. The provided CLI script explicitly contains instructions for port1, port2, and port5. Specifically, it sets port1 and port2 to mode dhcp. Even though port1 already has a manual IP address ($15.1.0.154$) used for the initial FGFM connection, the FortiManager will push the configuration defined in the template.
When FortiManager pushes a configuration change to the interface used for the FGFM tunnel (port1), it does so by updating the configuration database. Since the template specifies set mode dhcp for port1 and port2, and a specific IP range for port5 using a metadata variable (10.0.$(branch_id).254), all three ports will be updated.
Consequently, they may receive new IP addresses based on DHCP assignments or variable substitution.
FortiManager is capable of updating the management interface as long as the new configuration does not permanently sever the FGFM connection.
NEW QUESTION # 55
Refer to the exhibits.
The exhibits show the SD-WAN zone configuration of an SD-WAN template prepared on FortiManager and the policy package configuration.
When the administrator tries to install the configuration changes, FortiManager fails to commit.
What should the administrator do to fix the issue?
- A. Configure branch1_fgt as the installation target for policy 3.
- B. Configure HUB1 as the destination of policy 3.
- C. Configure a normalized interface for the IPsec tunnel HUB1-VPN1.
- D. Configure both HUB1-VPN1 and HUB1-VPN2 as the destination of policy 3
Answer: B
Explanation:
Policy 3 points traffic To = HUB1-VPN1, which is an SD-WAN member interface. In SD-WAN you must reference the SD-WAN zone (the logical interface) in policies, not its member tunnels. Change the policy's To interface to the zone HUB1, and the install will succeed.
NEW QUESTION # 56
(Refer to the exhibit.
Which statement correctly describes the role of the ADVPN device in handling traffic? Choose one answer.)
- A. This device is a spoke that has received a direct shortcut query from a remote spoke.
- B. This device is a spoke that has received a shortcut query from a remote hub.
- C. This device is a hub that has received a shortcut query from a spoke and has forwarded it to another spoke.
- D. This device is a hub, and two spokes, 192.2.0.1 and 10.0.3.101, established a shortcut.
Answer: C
Explanation:
The log messages shown in the exhibit include the following key indicators:
* processing notify type SHORTCUT_QUERY
* shortcut-query received from 192.2.0.1
* local-nat=yes, peer-nat=no
* NAT hole punching for peer at 192.2.0.1:4500
In the FCSS SD-WAN 7.6 ADVPN workflow, shortcut queries are always initiated by spokes, not hubs.
A spoke sends a shortcut query to its hub when it detects traffic destined for another spoke. The hub's role is to receive this shortcut query and forward the discovery information toward the destination spoke, enabling the two spokes to build a direct shortcut tunnel.
The device name in the log (HUB1-VPN1) and the presence of NAT hole punching coordination clearly indicate that this device is acting as a hub, not a spoke. Hubs do not form shortcuts themselves; instead, they facilitate shortcut establishment between spokes by relaying discovery and negotiation information.
Option A is incorrect because a spoke does not receive shortcut queries from other spokes directly.
Option B is incorrect because the log does not indicate that the shortcut has already been established; it shows the query and coordination phase, not completion.
Option D is incorrect because hubs do not initiate shortcut queries toward spokes.
Therefore, the correct description is that this device is a hub that has received a shortcut query from a spoke and has forwarded it to another spoke, which corresponds to option C.
NEW QUESTION # 57
Refer to the exhibits.
The exhibits show the configuration for SD-WAN performance. SD-WAN rule, the application IDs of Facebook and YouTube along with the firewall policy configuration and the underlay zone status.
Which two statements are true about the health and performance of SD-WAN members 3 and 4? (Choose two.)
- A. Encrypted traffic is not used for the performance measurement.
- B. The performance is an average of the metrics measured for Facebook and YouTube traffic passing through the member.
- C. Only related TCP traffic is used for performance measurement.
- D. FortiGate identifies the member as dead when there is no Facebook and YouTube traffic passing through the member.
Answer: B,D
NEW QUESTION # 58
An administrator is configuring SD-WAN to load balance their network traffic. Which two things should they consider when setting up SD-WAN? (Choose two.)
- A. SD-WAN load balancing is possible only using the best quality and lowest cost (SLA) strategies.
- B. You can select the outbandwidth hash mode with all strategies that allow load balancing.
- C. Only the manual and best-quality strategies allow SD-WAN load balancing.
- D. When applicable. FortiGate load balances the traffic through all members that meet the SLA target.
Answer: B,D
NEW QUESTION # 59
(You configure the overlay tunnels for an SD-WAN hub-and-spoke topology defined with IPsec tunnels, BGP on loopback, and dynamic BGP.
Which are two recommended IPsec settings for this topology? Choose two answers.)
- A. On the hub, set the tunnel type to static.
- B. On the spoke, set the parameter net-device to enable.
- C. On the hub, set the parameter mode-cfg to enable.
- D. On the spoke, configure the parameter localid.
Answer: B,D
NEW QUESTION # 60
An SD-WAN member is no longer used to steer SD-WAN traffic. The administrator updated the SD-WAN configuration and deleted the unused member. After the configuration update, users report that some destinations are unreachable. You confirm that the affected flow does not match an SD-WAN rule.
What could be a possible cause of the traffic interruption?
- A. FortiGate administratively brings down interfaces when they are removed from the SD-WAN configuration.
- B. FortiGate, with SD-WAN enabled, cannot route traffic through interfaces that are not SD-WAN members.
- C. FortiGate can remove some static routes associated with an interface when the member is removed from SD-WAN.
- D. FortiGate removes the layer 3 settings for interfaces that are removed from the SD-WAN configuration.
Answer: C
Explanation:
When an SD-WAN member is deleted, FortiGate can also remove static routes that were tied to that interface.
If those routes are needed for destinations not covered by SD-WAN rules, traffic to those networks becomes unreachable. This explains why flows not matching SD-WAN rules are interrupted after the member was removed.
NEW QUESTION # 61
Refer to the exhibit.
You configure SD-WAN on a standalone FortiGate device. You want to create an SD-WAN rule that steers Facebook and Linkedin traffic through the less costly internet link. The FortiGate GUI page appears as shown in the exhibit.
What should you do to set Facebook and LinkedIn as destinations?
- A. In the Internet service field, select Facebook and LinkedIn.
- B. Install a license to allow applications as destinations of SD-WAN rules.
- C. Enable the applications as destinations of the SD-WAN rule feature visibility.
- D. You cannot configure applications as destinations of an SD-WAN rule on a standalone FortiGate device.
Answer: A
Explanation:
In an SD-WAN rule, you can steer application traffic by using Internet Service Database (ISDB) entries.
Facebook and LinkedIn are predefined ISDB objects in FortiGate, so the correct way is to select them in the Internet service field under Destination. This ensures that all traffic to these applications is matched and routed through the chosen (less costly) link.
NEW QUESTION # 62
Within the context of SD-WAN, what does SIA correspond to?
- A. Remote Breakout
- B. Secure Internet Authorization
- C. Software Internet Access
- D. Local Breakout
Answer: D
NEW QUESTION # 63
Exhibit.
Which action will FortiGate take if it detects SD-WAN members as dead?
- A. FoftiGate bounces port5 after it detects all SD-WAN members as dead.
- B. FortiGate brings down port5 after it detects all SD-WAN members as dead.
- C. FortiGate fails over to the secondary device after it detects port5 as dead.
- D. FortiGate sends alert messages through poft5 when it detects all SD-WAN members as dead
Answer: D
NEW QUESTION # 64
Refer to the exhibit.
How does FortiGate handle the traffic with the source IP 10.0.1.130 and the destination IP 128.66.0 125?
- A. FortiGate drops the traffic flow.
- B. FortiGate load balances the traffic flow through port7 and port8.
- C. FortiGate routes the traffic flow according to the forwarding information base (FIB).
- D. FortiGate steers the traffic flow through port7.
Answer: B
Explanation:
The router policy explicitly denies traffic with source 10.0.1.128/25 (which includes 10.0.1.130) and destination 128.66.0.0/24 (which includes 128.66.0.125). Even though SD-WAN service 4 shows members (port1 and port2) alive and available for this traffic, the router policy is evaluated first and blocks it.
Therefore, FortiGate drops the traffic flow.
NEW QUESTION # 65
As an IT manager for a healthcare company, you want to delegate the installation and management of your SD-WAN deployment to a managed security service provider (MSSP). Each site must maintain direct internet access and ensure that it is secure. You expected significant traffic flow between the sites and want to delegate as much of the network administration and management as possible to the MSSP.
Which two MSSP deployment blueprints best address the customer's requirements? (Choose two.)
- A. Use a shared hub at the MSSP premises and a dedicated hub at the customer premises and install the spokes at the customer premises.
- B. Install a dedicated hub at the MSSP premises for the new customer, and install the spokes at the customer premises.
- C. Use a shared hub at the MSSP premises with a dedicated VDOM for the new customer, and install the spokes at the customer premises.
- D. Install the hub and spokes at the customer premises and enable the MSSP to manage the SD-WAN deployment using FortiManager with a dedicated ADOM.
Answer: B,C
Explanation:
Hosting the hub at the MSSP centralizes installation, security, and ongoing management while each site (spoke) keeps local DIA. This can be done multi-tenant with a shared hub using a dedicated VDOM or with a fully dedicated hub per customer for stricter isolation and control, both meeting the requirement to delegate administration to the MSSP and support high inter-site traffic.
NEW QUESTION # 66
The FortiGate devices are managed by ForliManager, and are configured for direct internet access (DIA). You confirm that DIA is working as expected for each branch, and check the SD-WAN zone configuration and firewall policies shown in the exhibits.
Then, you use the SD-WAN overlay template to configure the IPsec overlay tunnels. You create the associated SD-WAN rules to connect existing branches to the company hub device and apply the changes on the branches.
After those changes, users complain that they lost internet access. DIA is no longer working.
Based on the exhibit, which statement best describes the possible root cause of this issue?
- A. The SD-WAN overlay template didn't configure a firewall policy to allow traffic through the overlay.
- B. The SD-WAN overlay template defines a zone for each underlay interface and moves the interfaces into those zones.
- C. The SD-WAN overlay template redefines the interface gateway addresses if they are defined with metadata variables.
- D. The SD-WAN overlay template updates the SD-WAN template and the rules.
Answer: B
Explanation:
The SD-WAN overlay template defines a zone for each underlay interface and moves the interfaces into those zones. This statement perfectly describes the likely sequence of events. The template, when applied, re- organizes the interfaces and zones, causing the existing firewall policy that relies on the old zone configuration to fail. This is the most plausible root cause.
NEW QUESTION # 67
Refer to the exhibit that shows an SD-WAN zone configuration on the FortiManager GUI.
Based on the exhibit, how will the FortiGate device behave after it receives this configuration?
- A. The configuration instructs FortiGate to establish shortcuts only for overlay interfaces that meet the SLA target HUB1_HC.
- B. The configuration instructs FortiGate to choose an ADVPN shortcut based on SD-WAN information.
- C. The configuration instructs FortiGate to establish shortcuts only when at least two members meet the SLA target.
- D. The configuration instructs FortiGate to allow ADVPN shortcuts for the tunnels of this SD-WAN zone.
Answer: C
Explanation:
This is because the setting minimum-sla-meet-members = 2 requires at least two SD-WAN zone members (in this case, HUB2-VPN1, HUB2-VPN2, and HUB2-VPN3) to pass the defined SLA health check (HUB1_HC) before the FortiGate will establish ADVPN shortcuts. If fewer than two members meet the SLA, shortcuts will not be created.
NEW QUESTION # 68
The SD-WAN overlay template helps to prepare SD-WAN deployments. To complete the tasks performed by the SD-WAN overlay template, the administrator must perform some post-run tasks. What are two mandatory post-run tasks that must be performed? (Choose two.)
- A. Assign a hub id metadata variable to each hub device.
- B. Configure SD-WAN rules
- C. Create policy packages and assign them to the branch devices.
- D. Assign an sdwan_id metadata variable to each device (branch and hub)
- E. Configure routing through the overlay tunnels created by the SD-WAN overlay template.
Answer: B,C
Explanation:
After using the SD-WAN overlay template, two mandatory post-run tasks remain:
"First, administrators must create and assign policy packages to branch devices, as security and access policies are not included in overlay templates. Second, SD-WAN rules must be configured so that traffic can be matched and steered appropriately through the established overlays. Neglecting either task results in ungoverned traffic or inefficient routing, undermining the benefits of SD-WAN." Templates automate topology, but policy and rule definition are critical for operational effectiveness.
References:
[FCSS_SDW_AR-7.4 1-0.docx Q25]
Fortinet SD-WAN Reference Architecture 7.4, "Post-Deployment Tasks for SD-WAN Overlay Templates"
NEW QUESTION # 69
Refer to the exhibits.
The interface details, static route configuration, and firewall policies on the managed FortiGate device are shown.
You want to configure a new SD-WAN zone, named Underlay, that contains the interfaces port1 and port2.
What must be your first action?
- A. Delete the static routes.
- B. Delete the SD-WAN Zone Test.
- C. Define port1 as an SD-WAN member.
- D. Delete the firewall policies.
Answer: A
Explanation:
In the exhibits, port2 is already assigned to the SD-WAN zone named Test. An interface can only belong to a single SD-WAN zone, so before you can add both port1 and port2 into the new SD-WAN zone Underlay, you must first delete the SD-WAN Zone Test to free port2.
NEW QUESTION # 70
When a customer delegate the installation and management of its SD-WAN infrastructure to an MSSP, the MSSP usually keeps the hub within its infrastructure for ease of management and to share costly resources.
In which two situations will the MSSP install the hub in customer premises? (Choose two.)
- A. The majority of the branch traffic is directed to a corporate data center.
- B. The customer expects a large amount of VoIP traffic.
- C. The administrator expects a large volume of traffic between the branches.
- D. The customer requires SIA with centralized breakout.
Answer: A,C
NEW QUESTION # 71
You are planning a large SD-WAN deployment with approximately 1000 spokes and want to allow ADVPN between the spokes. Some remote sites use FortiSASE to connect to the company's SD-WAN hub. Which overlay routing configuration should you use?
- A. BGP per overlay with BGP next-hop convergence for ADVPN shortcut routing.
- B. BGP per overlay with dynamic BGP for ADVPN shortcut routing.
- C. BGP on loopback with IPsec phase2 selectors for ADVPN shortcut routing.
- D. BGP on loopback with dynamic BGP for ADVPN shortcut routing.
Answer: D
Explanation:
For a large-scale SD-WAN deployment (such as 1000 spokes) where ADVPN shortcut routing is required and some remote sites connect via FortiSASE, the recommended overlay routing configuration is BGP running on loopback interfaces, combined with dynamic BGP for ADVPN shortcut routing. This design leverages the scalability and resilience of BGP, allowing dynamic discovery and route exchange necessary for shortcut tunnels between spokes in ADVPN environments. Using loopback interfaces for BGP peering is considered best practice because it decouples routing protocol stability from physical link status, ensuring that if a physical underlay interface fails, the BGP session remains up as long as there's an alternate path. With dynamic BGP, each spoke can efficiently learn the routes to other spokes and dynamically establish shortcuts, which is critical at this scale. This method also integrates smoothly with FortiSASE for remote connectivity to the SD-WAN hub, providing flexibility and centralized management.
References:
[FCSS_SDW_AR-7.4 1-0.docx Q6]
Fortinet SD-WAN Reference Architecture Guide 7.4, "Scalable Routing with BGP on Loopback and ADVPN Shortcuts" Fortinet SD-WAN Concept Guide, "Overlay Routing Designs for Large Deployments"
NEW QUESTION # 72
Refer to the exhibits, which show the configuration of an SD-WAN rule and the corresponding rule status and routing table.
The administrator wants to understand the expected behavior for traffic matching the SD-WAN rule.
Based on the exhibits, what can the administrator expect for traffic matching the SD-WAN rule?
- A. The traffic will be routed over HUB1-VPN2
- B. The traffic will be routed over HUB1-VPN1.
- C. The traffic will be load balanced across all three overlays
- D. The traffic will be routed over HUB1-VPN3.
Answer: A
Explanation:
The rule is in SLA mode with two SLAs. From the status, HUB1-VPN2 and HUB1-VPN3 meet the SLA (sla (0x2) and sla(0x3)), while HUB1-VPN1 does not (sla(0x0)). Among members that meet SLA, FortiGate uses the configured order (priority-members 4 5 6) to pick the first eligible one-HUB1-VPN2-so traffic is routed over HUB1-VPN2.
NEW QUESTION # 73
Refer to the exhibit, which shows the SD-WAN rule status and configuration.
Based on the exhibit, which change in the measured latency will first make HUB1-VPN3 the new preferred member?
- A. When HUB1-VPN3 has a lower latency than HUB1-VPN1 and HUB1-VPN2
- B. When HUB1-VPN1 has a latency of 200 ms
- C. When HUB1-VPN3 has a latency of 90 ms
- D. When HUB1-VPN3 has a latency of 80 ms
Answer: B
Explanation:
The rule is in priority mode with HUB1-VPN1 (seq 4) as the first preferred member, HUB1-VPN2 second, and HUB1-VPN3 third. Latency itself does not cause HUB1-VPN3 to become preferred unless a higher- priority member fails SLA. If HUB1-VPN1's latency exceeds the SLA threshold (here simulated by latency reaching 200 ms), FortiGate stops using it and moves down the priority list. That is when HUB1-VPN3 could become the active path.
NEW QUESTION # 74
(Which two features must you configure before FortiGate can steer traffic according to SD-WAN rules?
Choose two answers.)
- A. Overlay links
- B. Firewall policies
- C. Underlay links
- D. Security profiles
- E. Traffic shaping
Answer: B,C
Explanation:
For FortiGate to steer traffic using SD-WAN rules, two foundational elements must be in place: available WAN paths (underlay links) and firewall policies that allow traffic to reach the SD-WAN interface.
Underlay links (Option B) are mandatory because SD-WAN operates by selecting among multiple WAN transports (for example, broadband, MPLS, LTE, or IPsec tunnels). These links are configured as SD-WAN members and form the physical or logical paths over which traffic can be steered. Without underlay links, SD- WAN has no paths to evaluate or select.
Firewall policies (Option E) are also mandatory because FortiGate only processes and forwards traffic that is explicitly permitted by a firewall policy. When SD-WAN is enabled, firewall policies must reference the SD- WAN interface or SD-WAN zone as the outgoing interface. If no such policy exists, traffic will not be forwarded and SD-WAN rules will never be evaluated.
Why the other options are incorrect:
* Security profiles (Option A) are optional and relate to inspection, not SD-WAN steering.
* Overlay links (Option C) are used in specific designs such as ADVPN or hub-and-spoke overlays, but SD-WAN can steer traffic without overlays (for example, DIA-only designs).
* Traffic shaping (Option D) is not required for SD-WAN decision-making; it is an optional optimization feature.
Therefore, the two required features that must be configured before FortiGate can steer traffic according to SD-WAN rules are underlay links and firewall policies, which correspond to B and E.
NEW QUESTION # 75
(Refer to the exhibit. You noticed that one SD-WAN member went down and you immediately collected the session output shown in the exhibit. What can you conclude from this output? Choose one answer.)
- A. FortiGate cannot reevaluate the session.
- B. FortiGate didn't receive any traffic related to this session after the interface went down.
- C. FortiGate flushed the gateway for the session.
- D. FortiGate already reevaluated this session.
Answer: D
NEW QUESTION # 76
......
Fortinet NSE6_SDW_AD-7.6 Test Engine PDF - All Free Dumps: https://learningtree.testkingfree.com/Fortinet/NSE6_SDW_AD-7.6-practice-exam-dumps.html