Fortinet FCSS_SDW_AR-7.4 Exam Questions Instant Access

Question 1

Refer to the exhibit.

The administrator configured the SD-WAN rule ID 4 with two members (port1 and port2) and strategy lowest cost (SLA).

What are the two characteristics of the session shown in the exhibit? (Choose two.)

AFortiGate steered this flow according to an SD-WAN rule.

BFortiGate will never re-evaluate this session.

CFortiGate steered this flow according to the application detected and the outgoing interface is port3.

DFortiGate will re-evaluate this session if the outgoing interface goes down.

Answer : A, D

The line sdwan_mbr_seq=1 sdwan_service_id=4 indicates that this session is part of an SD-WAN rule. sdwan_service_id=4 confirms that the session is being handled by SD-WAN rule ID 4. This directly links the flow to the SD-WAN configuration.

The line no_offload_reason: redir-to-ips denied-by-nturbo shows that the session is not offloaded to the NPU (Network Processing Unit) and is being processed by the main CPU. A session that is not offloaded can be re-evaluated. If the outgoing interface (the one currently being used) goes down, the FortiGate will re-evaluate the session against the SD-WAN rules to find a new active member to steer the traffic through. This is a fundamental behavior of SD-WAN, which ensures network resilience.

Question 2

Refer to the exhibits.

The first exhibit shows the SD-WAN zone HUB1 and SD-WAN member configuration from an SD-WAN template, and the second exhibit shows the output of command diagnose sys sdwan member collected on a FortiGate device.

Which statement best describes what the diagnose output shows?

AThe diagnose output shows that HUB1-VPN1 and all HUBx-VPNy members are dead.

BThe diagnose output does not correspond to a device configured with the SD-WAN template shown in the exhibit.

CThe diagnose output was collected on the device branch2_fgt.

DThe diagnose output was collected on the device branch1_fgt

Answer : D

The diagnose output lists SD-WAN members 4(HUB1-VPN1), 5(HUB1-VPN2), 7(HUB2-VPN1), 8(HUB2-VPN2), and 9(HUB2-VPN3). It does not include member 6 (HUB1-VPN3). From the template, HUB1-VPN3 is installed only on branch2_fgt and branch3_fgt - not on branch1_fgt. Therefore, the output must be from branch1_fgt.

Question 3

You are tasked with configuring ADVPN 2.0 on an SD-WAN topology already configured for ADVPN. What should you do to implement ADVPN 2.0 in this scenario?

AUpdate the IPsec tunnel configurations on the hub.

BUpdate the SD-WAN configuration on the branches.

CUpdate the IPsec tunnel configuration on the branches.

DDelete the existing ADVPN configuration and configure ADVPN 2.0.

Answer : A

Question 4

Refer to the exhibit.

What conclusions can you draw about the traffic received by FortiGate originating from the source LAN device 10.0.1.133 and destined for the company's SMTP mail server at 10.66.0.125?

AFortiGate steers the traffic from the LAN device 10.0.1.133 to the company SMTP mail server 10.66 0.125 through port3.

BForliGate steers the traffic from the LAN device 10.0.1.133 to the company SMTP mail server 10.66.0.125 through port2.

CFortiGate steers the traffic from the LAN device 10.0.1.133 to the company SMTP mail server 10.66.0.125 through the SD-WAN member ID 4.

DFortiGate steers the traffic from the LAN device 10.0.1.133 to the SMTP mail server 10.66.0.125 through the SD-WAN member ID 1 or 2.

Answer : D

The policy-route output shows the matching SD-WAN service for destination 10.66.0.0/24 is vwl_service=4 (LAN-to-Corp2) with vwl_mbr_seq=1 2 and paths oif=3(port1) and oif=4(port2). Therefore, traffic from 10.0.1.133 to 10.66.0.125 is steered via SD-WAN member ID 1 or 2.

Question 5

As an MSSP administrator, you are asked to configure ADVPN on an existing SD-WAN topology. FortiManager manages the customer devices in a dedicated ADOM. The previous administrator used the SD-WAN overlay topology.

Which two statements apply to this scenario? (Choose two.)

AYou can activate auto-discovery VPN in the SD-WAN overlay template only if it is a single hub topology.

BWhen auto-discovery VPN is enabled, FortiManager updates the IPsec and BGP templates in the hub.

CAfter you enable auto-discovery VPN in the overlay template, you must select between ADVPN 2.0 and ADVPN 1.0.

DYou can activate auto-discovery VPN in the SD-WAN overlay template for any type of topology, including a primary-primary dual-hub topology.

Answer : B, D

When you enable ADVPN (auto-discovery VPN) in the overlay template, FortiManager automatically updates both the IPsec and BGP templates on the hub so that shortcut tunnels can be established dynamically.

ADVPN can be activated in the SD-WAN overlay template for any supported topology, including dual-hub primary--primary, not just single hub.

Question 6

You used the HUB IPsec_Recommended and the BRANCH IPsec_Recommended templates to define the overlay topology. Then, you used the SD-WAN template to define the SD- WAN members, rules, and performance SLAs.

You applied the changes to the devices and want to use the FortiManager monitors menu to get a graphical view that shows the status of each SD-WAN member.

Which statement best explains how to obtain this graphical view?

AUse the SD-WAN monitor template view to get a map view of the branches, hub, and tunnel status, including the SLA pass or missed status.

BUse the SD-WAN monitor table view to get a donut view and a table view that shows the status of each SD-WAN member, including the SLA pass or missed status.

CUse the VPN monitor map view to get a map view of the branches, hub, and tunnel status, including the SLA pass or missed status.

DUse the SD-WAN monitor asset view to get a donut view and a table view that shows the status of each device and the SLA status of each SD-WAN member.

Answer : B

The SD-WAN monitor's table view in FortiManager provides a donut visualization plus a detailed table that shows each SD-WAN member's status and SLA pass/miss, giving the per-member health view you're after.

Question 7

Refer to the exhibit.

An administrator configures SD-WAN rules for a DIA setup using the FortiGate GUI. The page to configure the source and destination part of the rule looks as shown in the exhibit. The GUI page shows no option to configure an application as the destination of the SD-WAN rule Why?

AYou cannot use applications as the destination when FortiGate is used for a DIA setup.

BFortiGate allows the configuration of applications as the destination of SD-WAN rules only on the CLI.

CYou must enable the feature on the CLI.

DYou must enable the feature first using the GUI menu System > Feature Visibility.

Answer : D

Fortinet FCSS - SD-WAN 7.4 Architect FCSS_SDW_AR-7.4 Exam Questions