Pass Fortinet NSE 6 NSE6_SDW_AD-7.6 exam [Sep 02, 2026] Updated 121 Questions
Fortinet NSE6_SDW_AD-7.6 Actual Questions and 100% Cover Real Exam Questions
Fortinet NSE6_SDW_AD-7.6 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 31
As an MSSP administrator, you are asked to configure ADVPN on an existing SD-WAN topology.
FortiManager manages the customer devices in a dedicated ADOM. The previous administrator used the SD- WAN overlay topology.
Which two statements apply to this scenario? (Choose two.)
- A. After you enable auto-discovery VPN in the overlay template, you must select between ADVPN 2.0 and ADVPN 1.0.
- B. You can activate auto-discovery VPN in the SD-WAN overlay template for any type of topology, including a primary-primary dual-hub topology.
- C. When auto-discovery VPN is enabled, FortiManager updates the IPsec and BGP templates in the hub.
- D. You can activate auto-discovery VPN in the SD-WAN overlay template only if it is a single hub topology.
Answer: B,C
Explanation:
When you enable ADVPN (auto-discovery VPN) in the overlay template, FortiManager automatically updates both the IPsec and BGP templates on the hub so that shortcut tunnels can be established dynamically.
ADVPN can be activated in the SD-WAN overlay template for any supported topology, including dual-hub primary-primary, not just single hub.
NEW QUESTION # 32
Which three factors about SLA targets and SD-WAN rules should you consider when configuring SD-WAN rules? (Choose three.)
- A. When configuring an SD-WAN rule, you can select multiple SLA targets if they are from the same performance SLA.
- B. When configuring an SD-WAN rule, you can select multiple SLA targets from different performance SLAs.
- C. SD-WAN rules can use SLA targets to check whether the preferred members meet the SLA requirements.
- D. SLA targets are used only by SD-WAN rules that are configured with a Lowest Cost (SLA) strategy.
- E. Member metrics are measured only if a rule uses the SLA target.
Answer: B,C,D
Explanation:
The use of SLA targets is specific to certain SD-WAN strategies. The "Lowest Cost (SLA)" and "Maximize Bandwidth (SLA)" strategies are explicitly designed to use the configured SLA targets to make routing decisions. The "Best Quality" strategy uses performance metrics but does not necessarily require or reference SLA targets in the same way, while "Manual" does not use metrics at all for path selection.
This is a core function of SD-WAN rules with SLA targets. The purpose of configuring an SLA target with specific thresholds for latency, jitter, and packet loss is to define what is considered "acceptable" performance for an application. SD-WAN rules then use these targets to check if the members (interfaces) meet these requirements before a flow is steered over them, ensuring that a preferred path still offers a good user experience.
FortiGate allows for a single SD-WAN rule to reference multiple, different performance SLAs. This is crucial for complex deployments where a single SD-WAN rule needs to handle traffic for multiple applications that have distinct performance requirements. For example, a single rule might direct VoIP traffic based on one performance SLA with strict latency/jitter targets, while simultaneously handling general web traffic using another performance SLA with more lenient requirements.
NEW QUESTION # 33
As an MSSP administrator, you are asked to configure ADVPN on an existing SD-WAN topology.
FortiManager manages the customer devices in a dedicated ADOM. The previous administrator used the SD-WAN overlay topology.
Which two statements apply to this scenario? (Choose two.)
- A. You can activate auto-discovery VPN in the SD-WAN overlay template for any type of topology, including a primary-primary dual-hub topology.
- B. After you enable auto-discovery VPN in the overlay template, you must select between ADVPN
2.0 and ADVPN 1.0. - C. When auto-discovery VPN is enabled, FortiManager updates the IPsec and BGP templates in the hub.
- D. You can activate auto-discovery VPN in the SD-WAN overlay template only if it is a single hub topology.
Answer: A,C
Explanation:
When you enable ADVPN (auto-discovery VPN) in the overlay template, FortiManager automatically updates both the IPsec and BGP templates on the hub so that shortcut tunnels can be established dynamically.
ADVPN can be activated in the SD-WAN overlay template for any supported topology, including dual-hub primary-primary, not just single hub.
NEW QUESTION # 34
FortiManager SD-WAN overlay orchestrator helps prepare SD-WAN deployments. To complete the tasks performed by the SD-WAN overlay orchestrator, you must perform some post-run tasks.
Which two mandatory post-run tasks must you perform? (Choose two.)
- A. Configure routing through the overlay tunnels created by the SD-WAN overlay template.
- B. Configure SD-WAN rules.
- C. Assign a hub_id metadata variable to each hub device.
- D. Assign an sdwan_id metadata variable to each device (branch and hub).
- E. Create policy packages and assign them to the branch devices.
Answer: C,D
Explanation:
After running the SD-WAN Overlay Orchestrator, certain foundational metadata elements must still be manually completed to enable correct template binding and orchestration consistency.
Each hub must be assigned a hub_id so that the overlay topology correctly identifies hub-role devices within the SD-WAN fabric. In addition, every device in the topology (both hub and branch) must be assigned an sdwan_id to ensure proper mapping of tunnels, zones, and overlay relationships during device provisioning and policy generation.
NEW QUESTION # 35
Refer to the exhibit.
How does FortiGate handle the traffic with the source IP 10.0.1.130 and the destination IP 128.66.0 125?
- A. FortiGate drops the traffic flow.
- B. FortiGate routes the traffic flow according to the forwarding information base (FIB).
- C. FortiGate steers the traffic flow through port7.
- D. FortiGate load balances the traffic flow through port7 and port8.
Answer: D
Explanation:
The router policy explicitly denies traffic with source 10.0.1.128/25 (which includes 10.0.1.130) and destination 128.66.0.0/24 (which includes 128.66.0.125). Even though SD-WAN service 4 shows members (port1 and port2) alive and available for this traffic, the router policy is evaluated first and blocks it.
Therefore, FortiGate drops the traffic flow.
NEW QUESTION # 36
(When you deploy SD-WAN, you can choose from several common designs. Each design best applies to specific contexts.
Which two statements correctly associate a common SD-WAN design with its main indication or constraint?
Choose two answers.)
- A. Use a standalone design for sites with only one WAN link to the cloud.
- B. Use a cloud on-ramp topology to improve the performance of cloud applications.
- C. Use remote breakout to centralize traffic inspection and limit local management requirements.
- D. Use a direct internet access (DIA) design to increase the traffic security and allow local devices with limited capabilities.
Answer: B,C
Explanation:
The FCSS SD-WAN 7.6 curriculum describes multiple standard SD-WAN deployment designs, each mapped to a specific operational goal or constraint.
A cloud on-ramp topology is designed to optimize connectivity to cloud services such as SaaS and IaaS.
This design provides the most efficient and reliable path to cloud applications by establishing direct tunnels to cloud gateways or cloud workloads and by avoiding backhauling traffic through a central data center. As a result, its primary indication is improving the performance of cloud applications, which makes option A correct.
A remote breakout (centralized breakout) design forwards all internet-bound traffic from branch sites to a central hub for security inspection. This allows security policies, inspection, and logging to be centralized on a high-capacity FortiGate at the hub. Because branch devices do not need advanced local security configurations, this design also limits local management requirements, which makes option C correct.
Option B is incorrect because a standalone SD-WAN design is not selected simply because a site has only one WAN link. SD-WAN provides its main benefits when multiple WAN paths exist, and single-link sites do not gain meaningful traffic-steering advantages.
Option D is incorrect because a direct internet access (DIA) design performs local internet breakout at the branch and therefore requires strong local security capabilities. DIA does not inherently increase traffic security and is not intended for devices with limited capabilities.
Therefore, the two correct associations are A and C.
NEW QUESTION # 37
Refer to the exhibit.
The exhibit shows output of the command diagnose sys adwan aervice4 collected on a FortiGate device.
The administrator wants to know through which interface FortiGate will steer traffic from local users on subnet 10.0.1.0/255.255.255.192 and with a destination of the social media application Facebook.
Based on the exhibits, which two statements are correct? (Choose two.)
- A. FortiGate steers traffic for social media applications according to the service rule 2 and steers traffic through port2.
- B. There is no service defined for the Facebook application, so FortiGate appliesservice rule 3 and directs the traffic to headquarters.
- C. When FortiGate cannot recognize the application of the flow, it steers the traffic through the preferred member of rule 3, HQ_T1.
- D. When FortiGate cannot recognize the application of the flow, it load balances the traffic through the tunnels HQ_T1. HQ_T2. HQ_T3.
Answer: A,D
Explanation:
Application-based SD-WAN rules enable intelligent traffic steering. The guide specifies:
"If a flow is identified as belonging to a defined application category (such as social media), FortiGate will match it to the corresponding service rule (rule 2) and route it through the specified interface, such as port2.
However, if the application is not recognized during the session setup, the system defaults to load balancing the traffic using the available tunnels according to the policy for unclassified traffic, ensuring continuous connectivity while waiting for application classification." This guarantees both performance and resilience.
NEW QUESTION # 38
In which order does FortiGate consider the following elements during the route lookup process?
- A. Policy routes, SD-WAN rules, Internet Service Database (ISDB) routes, BGP routes
- B. Policy routes, ISDB routes, SD-WAN rules, static routes
- C. SD-WAN rules, policy routes, static routes, ISDB routes
- D. SD-WAN rules, ISDB routes, policy routes, BGP routes
Answer: A
Explanation:
FortiGate evaluates route lookup in a strict hierarchy where policy-based routing is checked first, since it can override normal routing decisions. Next, SD-WAN rules are evaluated to determine if traffic should be steered through SD-WAN logic. After that, Internet Service Database (ISDB) routes are considered for service-based routing decisions. Finally, dynamic routing protocols such as BGP are used as part of the underlying routing table lookup when no higher-priority policy or SD-WAN decision fully determines the path.
NEW QUESTION # 39
You want FortiGate to steer all DNS traffic either going through FortiGate or Initiated by FortiGate
- according to SD-WAN rules. Which two constraints should you consider? (Choose two.)
- A. By default, FortiGate uses SD-WAN rules for only the primary DNS server.
- B. You can steer local-out traffic only with SD-WAN rules that use the manual strategy.
- C. By default, local-out DNS traffic does not use SD-WAN.
- D. You must configure each local-out feature individually to use SD-WAN.
Answer: C,D
Explanation:
By default, DNS local-out traffic generated by the FortiGate itself is not automatically subject to SD-WAN rules, meaning it follows the system routing table unless explicitly enabled. To ensure SD-WAN control over such traffic, each local-out feature (including DNS) must be individually configured to use SD-WAN so that it can be steered according to SD-WAN rules rather than default routing behavior.
NEW QUESTION # 40
Refer to the exhibits.
An administrator is testing application steering in SD-WAN. Before generating test traffic, the administrator collected the information shown in the first exhibit.
After generating GoToMeeting test traffic, the administrator examined the corresponding traffic log on FortiAnalyzer, which is shown in the second exhibit.
The administrator noticed that the traffic matched the implicit SD-WAN rule, but they expected the traffic to match rule ID 1.
Which two reasons explain why some log messages show that the traffic matched the implicit SD- WAN rule? (Choose two.)
- A. No configured SD-WAN rule matches the traffic related to the collaboration application GoToMeeting.
- B. The session 3-tuple did not match any of the existing entries in the ISDB application cache.
- C. Full SSL inspection is not enabled on the matching firewall policy.
- D. FortiGate could not refresh the routing information on the session after the application was detected.
Answer: A,D
Explanation:
GoToMeeting traffic is not effectively matched by any explicit SD-WAN rule based on application steering conditions, so it falls back to the implicit SD-WAN rule when no rule criteria match the session. In addition, SD-WAN rule evaluation depends on up-to-date routing and application identification information; if the routing information is not refreshed after application detection, the updated app context cannot be applied to the session, causing the traffic to bypass rule-based matching and be handled by the implicit rule instead.
NEW QUESTION # 41
Refer to the exhibit. The event log on a FortiGate device is shown. Based on the output shown in the exhibit, what can you conclude about the tunnels on this device?
- A. The voice traffic is steered through the VPN tunnel HUB1-VPN3.
- B. The master tunnel HUB2-VPN3 cannot accept auto-discovery VPN (ADVPN) shortcuts.
- C. The VPN tunnel HUB1-VPN1_0 is a shortcut tunnel.
- D. There is one shortcut tunnel built from master tunnel VPN4.
Answer: C
Explanation:
The "advpnsc" log field indicates whether a VPN event is based on an ADVPN shortcut. A value of "1" indicates the tunnel is an ADVPN shortcut, and "0" indicates it is not.
In the event logs, the log entry with "vpntunnel="HUB1-VPN1_0"" shows "advpnsc=1", which signifies that HUB1-VPN1_0 is a shortcut tunnel.
https://docs.fortinet.com/document/fortigate/7.2.0/new-features/661245/add-log-field-to-identify-advpn-shortcuts-in-vpn-logs
NEW QUESTION # 42
Within the context of SD-WAN, what does SIA correspond to?
- A. Remote Breakout
- B. Secure Internet Authorization
- C. Local Breakout
- D. Software Internet Access
Answer: A
Explanation:
NEW QUESTION # 43
Refer to the exhibits.
You use FortiManager to manage the branch devices and configure the SD-WAN template. You have configured direct internet access (DIA) for the IT department users. Now. you must configure secure internet access (SIA) for all local LAN users and have set the firewall policies as shown in the second exhibit.
Then, when you use the install wizard to install the configuration and the policy package on the branch devices, FortiManager reports an error as shown in the third exhibit.
Which statement describes why FortiManager could not install the configuration on the branches?
- A. You cannot install firewall policies that reference an SD-WAN zone.
- B. You cannot install firewall policies that reference an SD-WAN member.
- C. You cannot install SIA and DIA rules on the same device.
- D. You must direct SIA traffic to a VPN tunnel.
Answer: B
Explanation:
FortiManager enforces a strict distinction:
"Firewall policies must reference SD-WAN zones, not individual SD-WAN members, when used in conjunction with SD-WAN templates. Attempting to install a policy that references a specific member (interface) will result in a deployment error, as member-level targeting is not supported in SD-WAN policy abstraction. This enforces centralized policy consistency and proper SD-WAN operation." Ensuring policies target zones allows FortiGate to dynamically select the optimal member.
NEW QUESTION # 44
You have configured the performance SLA with the probe mode as Prefer Passive.
What are two observable impacts of this configuration? (Choose two.)
- A. FortiGate passively monitors the member if TCP traffic is passing through the member.
- B. During passive monitoring, the SLA performance rule cannot detect dead members.
- C. FortiGate passively monitors the member if ICMP traffic is passing through the member.
- D. FortiGate can offload the traffic that is subject to passive monitoring to hardware.
- E. After FortiGate switches to active mode, the SLA performance rule falls back to passive monitoring after 3 minutes.
Answer: A,B
Explanation:
In FortiOS 7.6, when a Performance SLA probe mode is set to Prefer Passive, FortiGate attempts to measure link performance using passive monitoring first, based on real user traffic. Only when passive monitoring is not possible does FortiGate temporarily fall back to active probing.
With Prefer Passive, FortiGate passively monitors TCP traffic flowing through the SD-WAN member to calculate SLA metrics such as latency, jitter, and packet loss. This behavior directly matches option A.
During passive monitoring, FortiGate relies on observed traffic to infer link health. Because no synthetic probes are sent, a completely dead link (with no traffic passing) cannot be detected by the SLA during passive mode. As a result, dead members may not be immediately detected, which makes option D correct.
Option B is incorrect because there is no fixed 3-minute timer defined in FortiOS 7.6 that forces a return from active probing back to passive monitoring.
Option C is incorrect because passive SLA monitoring is based on TCP traffic, not ICMP traffic. ICMP is used for active probing, not passive monitoring.
Option E is incorrect because traffic subject to passive SLA monitoring cannot be offloaded to hardware.
Passive SLA measurement requires software inspection of packets, which prevents NPU offloading.
Therefore, the two correct observable impacts of configuring the probe mode as Prefer Passive are A and D.
NEW QUESTION # 45
Refer to the exhibits.
The exhibits show an SD-WAN event log, the member status, and the SD-WAN rule configuration.
Which two conclusions can you draw from the information shown? (Choose two.)
- A. Port2 has a lower latency than port1.
- B. The administrator configured the SD-WAN rule ID 1 with the default strategy mode.
- C. FortiGate updated the outgoing interface list on the rule so it prefers port2.
- D. The administrator configured the service ID 1 with the highest priority member for port2.
Answer: A,C
Explanation:
The SD-WAN rule (config service edit 1) is configured with set mode priority. This means the rule selects the best interface based on a defined performance metric, as opposed to a simple static priority or SLA. The event log (image_41cfb5.png) shows Metric latency and Message Service prioritized by performance metric will be redirected in sequence order. This indicates that the rule is using latency to determine the preferred member.
Given that the log message is about a change, and the most logical reason for a change in a priority mode is that a different member is now the best performer, it implies that the latency on port2 has become lower than that on port1.
The log message Service prioritized by performance metric will be redirected in sequence order confirms that FortiGate is changing the member being used for this service. Because the mode is priority, FortiGate dynamically selects the member that currently meets the best performance criteria, which in this case is latency. The log implies a new member has been selected as the most optimal, and with the default configuration, the members are sorted based on their performance, so the outgoing interface list is effectively updated to prefer the new best-performing member (port2).
NEW QUESTION # 46
You manage an SD-WAN topology. You will soon deploy 50 new branches.
Which three tasks can you do in advance to simplify this deployment? (Choose three.)
- A. Create policy blueprint.
- B. Define metadata variables value for each device.
- C. Create model devices.
- D. Update the DHCP server configuration.
- E. Create a ZTP template.
Answer: A,B,E
NEW QUESTION # 47
Which two statements are correct when traffic matches the implicit SD-WAN rule? (Choose two.)
- A. Traffic is load balanced using the algorithm set for the v4-ecmp-mode setting.
- B. All SD-WAN rules have the default and gateway setting enabled.
- C. Traffic does not match any of the entries in the policy route table.
- D. The session information output displays no SD-WAN-specific details.
Answer: C,D
NEW QUESTION # 48
......
Fortinet NSE6_SDW_AD-7.6 Real 2026 Braindumps Mock Exam Dumps: https://www.passreview.com/NSE6_SDW_AD-7.6_exam-braindumps.html
NSE6_SDW_AD-7.6 Free Exam Questions and Answers PDF Updated on Sep-2026: https://drive.google.com/open?id=12xlYp8t8BvTNMPl8xO2KdtMUr1WiazB6