Latest Fortinet FCSS_SDW_AR-7.4 Exam questions and answers
GuideTorrent FCSS_SDW_AR-7.4 Exam Practice Test Questions (Updated 75 Questions)
Fortinet FCSS_SDW_AR-7.4 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
NEW QUESTION # 44
Refer to the exhibit. You configure SD-WAN on a standalone FortiGate device. You want to create an SD-WAN rule that steers Facebook and Linkedin traffic through the less costly internet link. The FortiGate GUI page appears as shown in the exhibit.
What should you do to set Facebook and LinkedIn as destinations?
- A. Enable the applications as destinations of the SD-WAN rule feature visibility.
- B. You cannot configure applications as destinations of an SD-WAN rule on a standalone FortiGate device.
- C. In the Internet service field, select Facebook and LinkedIn.
- D. Install a license to allow applications as destinations of SD-WAN rules.
Answer: C
Explanation:
In an SD-WAN rule, you can steer application traffic by using Internet Service Database (ISDB) entries. Facebook and LinkedIn are predefined ISDB objects in FortiGate, so the correct way is to select them in the Internet service field under Destination. This ensures that all traffic to these applications is matched and routed through the chosen (less costly) link.
NEW QUESTION # 45
Refer to the exhibit.
Which statement best describe the role of the ADVPN device in handling traffic?
- A. This is a spoke. The kernel received a shortcut request and forwards the query to another spoke.
- B. This is a spoke that has received a shortcut query from another spoke and has forwarded the response to its hub.
- C. This is a hub in a dual-region topology. The remote hub tunnel ID is 10.0.2.101.
- D. This is a hub that has received a query from a spoke and has forwarded it to another spoke.
Answer: B
Explanation:
Within ADVPN topologies, shortcut requests and responses traverse spokes and hubs. Fortinet documentation states:
"When a spoke receives a shortcut query from another spoke, it may forward the response to its hub for validation or to facilitate dynamic shortcut tunnel setup. This mechanism allows direct spoke-to-spoke communication for optimized routing and performance, reducing latency and offloading the hub after initial control-plane mediation." This is a core benefit of ADVPN's dynamic shortcut feature.
NEW QUESTION # 46
An administrator is configuring SD-WAN to load balance their network traffic. Which two things should they consider when setting up SD-WAN? (Choose two.)
- A. When applicable. FortiGate load balances the traffic through all members that meet the SLA target.
- B. SD-WAN load balancing is possible only using the best quality and lowest cost (SLA) strategies.
- C. Only the manual and best-quality strategies allow SD-WAN load balancing.
- D. You can select the outbandwidth hash mode with all strategies that allow load balancing.
Answer: A,D
NEW QUESTION # 47
Which statement describes FortiGate behavior when you reference a zone in a static route?
- A. FortiGate installs a static route for each member in the zone.
- B. FoftiGate installs ECMP static routes for the first two members of the zone.
- C. FortiGate routes the traffic through the best performing member of the zone.
- D. FortiGate ignores the static routes defined through members referenced in the zone.
Answer: A
Explanation:
When referencing a zone in a static route, FortiGate's behavior is described as:
"Referencing a zone in a static route causes FortiGate to install a static route for each member interface of the zone. This enables ECMP (Equal-Cost Multi-Path) and load balancing where supported and ensures that traffic can be steered over any valid zone member according to SD-WAN rules or standard routing." This mechanism is fundamental to Fortinet's implementation of SD-WAN and simplifies large, multi- interface deployments.
References:
[FCSS_SDW_AR-7.4 1-0.docx Q21]
FortiOS 7.4 Routing Guide, "Zone-based Routing and ECMP Behavior"
NEW QUESTION # 48
Refer to the exhibits.
The exhibits show two IPsec templates to define Branch IPsec 1 and Branch_IPsec_2. Each template defines a VPN tunnel. The error message that FortiManager displayed when the administrator tried to assign the second template to the FortiGate device is also shown.
Which statement best describes the cause of the issue?
- A. You should review the branch1_fgt configuration for configured tunnels in the rootVDOM.
- B. You can assign only one IPsec template to each FortiGate device.
- C. You can assign only one template with a tunnel type of static to each FortiGate device.
- D. You should use the same outgoing interface of both templates.
Answer: B
Explanation:
The FortiManager SD-WAN overlay system allows only one IPsec template to be assigned to each device per overlay operation. The guide clarifies:
"If you attempt to assign more than one IPsec template to a FortiGate device for the same overlay type, FortiManager will display an error, preventing duplicate or conflicting tunnel configurations. This limitation ensures a one-to-one mapping between device and overlay template per operation, maintaining configuration integrity and preventing routing issues." This prevents complex troubleshooting scenarios and enforces best practices for overlay design.
NEW QUESTION # 49
Refer to the exhibit.
An administrator checks the status of an SD-WAN topology using the FortiManager SD-WAN monitor menus. All members are configured with one or two SLAs.
Which two conclusions can you draw from the output shown? (Choose two.)
- A. The template view should be used to see the hub devices.
- B. branch2_fgt establishes six tunnels to the hubs and they are all up.
- C. This SD-WAN topology contains only two branch devices.
- D. One member of branch2_fgt is missing the SLAs.
Answer: C,D
NEW QUESTION # 50
The SD-WAN overlay template helps to prepare SD-WAN deployments. To complete the tasks performed by the SD-WAN overlay template, the administrator must perform some post-run tasks.
What are three mandatory post-run tasks that must be performed? (Choose three.)
- A. Assign an sdwan_id metadata variable to each device (branch and hub).
- B. Assign a branch_id metadata variable to each branch device.
- C. Configure SD-WAN rules.
- D. Create policy packages for branch devices.
- E. Configure routing through overlay tunnels created by the SD-WAN overlay template.
Answer: B,C,E
NEW QUESTION # 51
Refer to the exhibit. You want to configure SD-WAN on a network as shown in the exhibit. The network contains many FortiGate devices. Some are used as NGFW, and some are installed with extensions such as FortiSwitch, FortiAP or FortiExtender. What should you consider when planning your deployment?
- A. You must build multiple SD-WAN topologies. Each topology must contain only one type of extension.
- B. You must use FortiManager to manage your SD-WAN topology.
- C. You can build an SD-WAN topology that includes all devices. The hubs can be FortiGate devices with Forti Extender.
- D. You can build an SD-WAN topology that includes all devices. The hubs must be devices without extensions.
Answer: D
NEW QUESTION # 52
You manage an SD-WAN topology. You will soon deploy 50 new branches. Which three tasks can you do in advance to simplify this deployment? (Choose three.)
- A. Create policy blueprint.
- B. Create model devices.
- C. Define metadata variables value for each device.
- D. Update the DHCP server configuration.
- E. Create a ZTP template.
Answer: A,B,E
NEW QUESTION # 53
You have configured the performance SLA with the probe mode as Prefer Passive.
What are two observable impacts of this configuration? (Choose two.)
- A. During passive monitoring, the SLA performance rule cannot detect dead members.
- B. FortiGate can offload the traffic that is subject to passive monitoring to hardware.
- C. FortiGate passively monitors the member if TCP traffic is passing through the member.
- D. After FortiGate switches to active mode, the SLA performance rule falls back to passive monitoring after 3 minutes.
- E. FortiGate passively monitors the member if ICMP traffic is passing through the member.
Answer: C,E
Explanation:
FortiGate passively monitors the member if TCP traffic is passing through the member → With Prefer Passive mode, FortiGate inspects existing traffic (like TCP flows) to measure performance metrics without generating its own probes.
FortiGate passively monitors the member if ICMP traffic is passing through the member → Similarly, when ICMP flows exist, FortiGate uses them for SLA checks.
NEW QUESTION # 54
Refer to the exhibit. The administrator analyzed the traffic between a branch FortiGate and the server located in the data center, and noticed the behavior shown in the diagram. When the LAN clients located behind FGT1 establish a session to a server behind DC-1, the administrator observes that, on DC-1, the reply traffic is routed over T2. even though T1 is the preferred member in the matching SD-WAN rule.
What can the administrator do to instruct DC-1 to route the reply traffic through the member with the best performance?
- A. Enable reply-session under config system sdwan.
- B. Enable auxiliary-session under config system settings.
- C. Enable snat-route-change under config system global.
- D. FortiGate route lookup for reply traffic only considers routes over the original ingress interface.
Answer: B
Explanation:
To ensure DC-1 responds via the best-performing SD-WAN member (T1) instead of defaulting to T2, enable auxiliary-sessionunder config system settings, so reply traffic is evaluated against current route policies-not bound to the ingress interface.
NEW QUESTION # 55
When a customer delegate the installation and management of its SD-WAN infrastructure to an MSSP, the MSSP usually keeps the hub within its infrastructure for ease of management and to share costly resources.
In which two situations will the MSSP install the hub in customer premises? (Choose two.)
- A. The majority of the branch traffic is directed to a corporate data center.
- B. The administrator expects a large volume of traffic between the branches.
- C. The customer expects a large amount of VoIP traffic.
- D. The customer requires SIA with centralized breakout.
Answer: B,D
NEW QUESTION # 56
Refer to the exhibit.
An administrator configures SD-WAN rules for a DIA setup using the FortiGate GUI. The page to configure the source and destination part of the rule looks as shown in the exhibit. The GUI page shows no option to configure an application as the destination of the SD-WAN rule Why?
- A. You must enable the feature first using the GUI menu System > Feature Visibility.
- B. FortiGate allows the configuration of applications as the destination of SD-WAN rules only on the CLI.
- C. You cannot use applications as the destination when FortiGate is used for a DIA setup.
- D. You must enable the feature on the CLI.
Answer: C
NEW QUESTION # 57
Refer to the exhibits.
The exhibits show two IPsec templates to define Branch IPsec 1 and Branch_IPsec_2. Each template defines a VPN tunnel. The error message that FortiManager displayed when the administrator tried to assign the second template to the FortiGate device is also shown.
Which statement best describes the cause of the issue?
- A. You should review the branch1_fgt configuration for configured tunnels in the rootVDOM.
- B. You can assign only one IPsec template to each FortiGate device.
- C. You can assign only one template with a tunnel type of static to each FortiGate device.
- D. You should use the same outgoing interface of both templates.
Answer: B
NEW QUESTION # 58
Refer to the exhibits.
Exhibit A
Exhibit B
Exhibit A shows a policy package definition. Exhibit B shows the install log that the administrator received when he tried to install the policy package on FortiGate devices.
Based on the output shown in the exhibits, what can the administrator do to solve the issue?
- A. Create dynamic mapping for the LAN interface for all devices in the installation target list.
- B. Dynamic mapping should be done automatically. Review the LAN interface configuration for branch2_fgt.
- C. Use a metadata variable instead of a dynamic interface to define the firewall policy.
- D. Policies can refer to only one LAN source interface. Keep only the D-LAN, which is the dynamic LAN interface.
Answer: A
NEW QUESTION # 59
Refer to the exhibit.
Refer to the exhibit.
You want to configure SD-WAN on a network as shown in the exhibit.
The network contains many FortiGate devices. Some are used as NGFW, and some are installed with extensions such as FortiSwitch. FortiAP. or Forti Ex tender.
What should you consider when planning your deployment?
- A. You must build multiple SD-WAN topologies. Each topology must contain only one type of extension.
- B. You must use FortiManager to manage your SD-WAN topology.
- C. You can build an SD-WAN topology that includes all devices. The hubs can be FortiGate devices with Forti Extender.
- D. You can build an SD-WAN topology that includes all devices. The hubs must be devices without extensions.
Answer: D
NEW QUESTION # 60
Which statement about SD-WAN zones is true?
- A. You can configure up to 32 SD-WAN zones per VDOM.
- B. An SD-WAN zone can contain only one type of interface.
- C. An SD-WAN zone can contain between 0 and 512 members.
- D. You cannot use an SD-WAN zone in static route definitions.
Answer: C
NEW QUESTION # 61
Refer to the exhibit. An administrator configures SD-WAN rules for a DIA setup using the FortiGate GUI. The page to configure the source and destination part of the rule looks as shown in the exhibit. The GUI page shows no option to configure an application as the destination of the SD-WAN rule Why?
- A. You must enable the feature first using the GUI menu System > Feature Visibility.
- B. FortiGate allows the configuration of applications as the destination of SD-WAN rules only on the CLI.
- C. You cannot use applications as the destination when FortiGate is used for a DIA setup.
- D. You must enable the feature on the CLI.
Answer: C
NEW QUESTION # 62
Refer to the exhibits. You connect to a device behind a branch FortiGate device and initiate a ping test. The device is part of the LAN subnet and its IP address is 10.0.1.101.
Based on the exhibits, which interface uses branch 1_fgt to steer the test traffic?
- A. HUB1-VPN1
- B. port2
- C. port1
- D. port4
Answer: C
NEW QUESTION # 63
Refer to the exhibits.
You connect to a device behind a branch FortiGate device and initiate a ping test. The device is part of the LAN subnet and its IP address is 10.0.1.101.
Based on the exhibits, which interface uses branch 1_fgt to steer the test traffic?
- A. HUB1-VPN1
- B. port1
- C. port2
- D. port4
Answer: C
NEW QUESTION # 64
Exhibit.
For your ZTP deployment, you review the CSV file shown in exhibit and note that it is missing important information. Which two elements must you change before you can import it into FortiManager? (Choose two.)
- A. You must associate a device blueprint with each device
- B. You must define a name for each device
- C. You must define a value for each device and each user-defined metadata variable.
- D. You must define a value for each device and each metadata variable that defines an IP address.
Answer: C,D
NEW QUESTION # 65
You manage an SD-WAN topology. You will soon deploy 50 new branches.
Which three tasks can you do in advance to simplify this deployment? (Choose three.)
- A. Create policy blueprint.
- B. Create model devices.
- C. Define metadata variables value for each device.
- D. Update the DHCP server configuration.
- E. Create a ZTP template.
Answer: A,B,E
Explanation:
Creating a ZTP (Zero Touch Provisioning) template automates onboarding of new branches.
Policy blueprints allow predefining consistent configurations for security and SD-WAN rules.
Model devices help preconfigure settings tied to device models, speeding up deployment.
NEW QUESTION # 66
Refer to the exhibit. Which action will FortiGate take if it detects SD-WAN members as dead?
- A. FortiGate fails over to the secondary device after it detects port5 as dead.
- B. FortiGate sends alert messages through poft5 when it detects all SD-WAN members as dead.
- C. FoftiGate bounces port5 after it detects all SD-WAN members as dead.
- D. FortiGate brings down port5 after it detects all SD-WAN members as dead.
Answer: D
NEW QUESTION # 67
You used the HUB IPsec_Recommended and the BRANCH IPsec_Recommended templates to define the overlay topology. Then, you used the SD-WAN template to define the SD- WAN members, rules, and performance SLAs.
You applied the changes to the devices and want to use the FortiManager monitors menu to get a graphical view that shows the status of each SD-WAN member.
Which statement best explains how to obtain this graphical view?
- A. Use the SD-WAN monitor asset view to get a donut view and a table view that shows the status of each device and the SLA status of each SD-WAN member.
- B. Use the VPN monitor map view to get a map view of the branches, hub, and tunnel status, including the SLA pass or missed status.
- C. Use the SD-WAN monitor template view to get a map view of the branches, hub, and tunnel status, including the SLA pass or missed status.
- D. Use the SD-WAN monitor table view to get a donut view and a table view that shows the status of each SD-WAN member, including the SLA pass or missed status.
Answer: D
Explanation:
The SD-WAN monitor's table view in FortiManager provides a donut visualization plus a detailed table that shows each SD-WAN member's status and SLA pass/miss, giving the per-member health view you're after.
NEW QUESTION # 68
......
Pass Your Fortinet Exam with FCSS_SDW_AR-7.4 Exam Dumps: https://examcollection.guidetorrent.com/FCSS_SDW_AR-7.4-dumps-questions.html