Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. Fortinet
  5. FCSS_SDW_AR-7.6

Fortinet FCSS_SDW_AR-7.6 Exam
FCSS - SD-WAN 7.6 Architect (Page 6 )

Updated On: 19-Jan-2026
Page 4 of 20
PDF with 94 Questions

Exhibit.



The administrator configured the IPsec tunnel VPN1 on a FortiGate device with the parameters shown in exhibit.

Based on the configuration, which three conclusions can you draw about the characteristics and requirements of the VPN tunnel? (Choose three.)

  1. The tunnel interface IP address on the spoke side is provided by the hub.
  2. The remote end can be a third-party IPsec device.
  3. The administrator must manually assign the tunnel interface IP address on the hub side
  4. The remote end must support IKEv2.
  5. This configuration allows user-defined overlay IP addresses.

Answer(s): B,C,E

Explanation:

This configuration demonstrates a typical IPsec setup for SD-WAN overlays where the hub side requires a manually defined tunnel IP address, and the spoke can be flexibly configured, including interoperability with third-party IPsec devices. As described in the Fortinet SD-WAN Architect Guide:
"For some overlays, the tunnel interface IP is configured statically on the hub side, which allows more control over overlay subnetting and facilitates the use of user-defined overlay IP addresses. This approach is also a requirement for compatibility with non-FortiGate endpoints, such as third- party IPsec devices that may not support dynamic address assignment via IKE or proprietary mechanisms." This enables hybrid SD-WAN environments and advanced designs involving external partners or cloud services. Overlay IP flexibility is critical for route control and segmentation.


Reference:

FortiOS 7.4 SD-WAN Reference Architecture, "Overlay IP Address Management"

SD-WAN 7.4 Concept Guide, Section: "Interoperability with Third-Party Devices"



You have a FortiGate configuration with three user-defined SD-WAN zones and two members in each of these zones. One SD-WAN member is no longer in use in health-check and SD-WAN rules. You want to delete it.

What happens if you delete the SD-WAN member from the FortiGate GUI?

  1. FodiGate accepts the deletion and removes routes as required.
  2. FortiGate displays an error message. You must use the CLI to delete an SD-WAN member.
  3. FortiGate displays an error message. SD-WAN zones must contain at least two members
  4. FortiGate accepts the deletion and places the member in the default SD-WAN zone.

Answer(s): A



Refer to the exhibits.



The exhibits show the source NAT (SNAT) global setting. port2 interface settings, and the routing table on FortiGate.

The administrator increases the member priority on port2 to 20.

Upon configuration changes and the receipt of new packets, which two actions does FortiGate perform on existing sessions established over port2? (Choose two.)

  1. FortiGate continues routing all existing sessions over port2.
  2. FortiGate routes only new sessions over port2.
  3. FortiGate flags the SNAT session as dirty only if the administrator has assigned an IP pool to the firewall policies with NAT.
  4. FortiGate flags the sessions as dirty.
  5. FortiGate updates the gateway information of the sessions with SNAT so that they use port1 instead of port2.

Answer(s): D,E

Explanation:

When the member priority of a port is increased (e.g., port2 to 20), FortiGate evaluates existing sessions and applies "dirty" flags where applicable. The SD-WAN session management mechanism is described in detail: "Upon a change in SD-WAN member priority, all existing sessions using that member are marked as dirty. For SNAT sessions, the gateway information is updated to ensure future packets are routed through the newly preferred member, in this case, port1. This automatic re- evaluation allows SD-WAN to dynamically respond to topology or priority changes, maintaining optimal routing." This is fundamental to seamless failover and session persistence in Fortinet SD- WAN, ensuring active flows are redirected based on updated priorities or health status.


Reference:

FortiOS 7.4 SD-WAN Concept Guide, "Session Management During Path Change"

FortiGate CLI diagnose sys session list



Refer to the exhibits.



The exhibits show the configuration for SD-WAN performance. SD-WAN rule, the application IDs of Facebook and YouTube along with the firewall policy configuration and the underlay zone status.

Which two statements are true about the health and performance of SD-WAN members 3 and 4? (Choose two.)

  1. Only related TCP traffic is used for performance measurement.
  2. The performance is an average of the metrics measured for Facebook and YouTube traffic passing through the member.
  3. Encrypted traffic is not used for the performance measurement.
  4. FortiGate identifies the member as dead when there is no Facebook and YouTube traffic passing through the member.

Answer(s): B,D



When you use the command diagnose sys session list, how do you identify the sessions that correspond to traffic steered according to SD-WAN rules?

  1. You identify sessions steered according to SD-WAN rules with the flag vwl.
  2. You cannot identify SD-WAN sessions. You must use the sdwar. session filter.
  3. You identify sessions steered according to SD-WAN rules with the data vwl_mbr_seq.
  4. You identify sessions steered according to SD-WAN rules with the data 3dwan_service_id.

Answer(s): D

Explanation:

When using the diagnose sys session list command, SD-WAN-specific session steering is indicated by the presence of the sdwan_service_id field in the session data. This identifier ties the session directly to a specific SD-WAN rule or service. As noted in the Fortinet documentation: "Sessions that are handled according to SD-WAN rules will include a service ID tag (sdwan_service_id) in their session listing. This allows administrators to correlate live sessions with SD-WAN policy matches for troubleshooting and visibility." This is a crucial diagnostic tool, as it distinguishes between traffic managed by traditional routing and that explicitly controlled by SD-WAN steering logic, aiding in operational insight and troubleshooting.


Reference:

FortiOS 7.4 CLI Reference, "diagnose sys session list: SD-WAN Service ID Tagging"

SD-WAN 7.4 Concept Guide, Section: "Session Identification for SD-WAN Traffic"



Viewing page 6 of 20
Viewing questions 26 - 30 out of 94 questions



Post your Comments and Discuss Fortinet FCSS_SDW_AR-7.6 exam prep with other Community members:

Join the FCSS_SDW_AR-7.6 Discussion