NSE6_SDW_AD-7.6 Exam Questions & Answers
Fortinet NSE 6 - SD-WAN 7.6 Enterprise Administrator • Fortinet
100% money-back guarantee
Sample NSE6_SDW_AD-7.6 Questions
Practice with real exam-style questions, each with the verified correct answer and explanation.
Exhibit.
The administrator configured the IPsec tunnel VPN1 on a FortiGate device with the parameters shown in exhibit.
Based on the configuration, which three conclusions can you draw about the characteristics and requirements of the VPN tunnel? (Choose three.)
This configuration demonstrates a typical IPsec setup for SD-WAN overlays where the hub side requires a manually defined tunnel IP address, and the spoke can be flexibly configured, including interoperability with third-party IPsec devices. As described in the Fortinet SD-WAN Architect Guide: ''For some overlays, the tunnel interface IP is configured statically on the hub side, which allows more control over overlay subnetting and facilitates the use of user-defined overlay IP addresses. This approach is also a requirement for compatibility with non-FortiGate endpoints, such as third-party IPsec devices that may not support dynamic address assignment via IKE or proprietary mechanisms.'' This enables hybrid SD-WAN environments and advanced designs involving external partners or cloud services. Overlay IP flexibility is critical for route control and segmentation. Reference:
[FCSS_SDW_AR-7.4 1-0.docx Q11]
FortiOS 7.4 SD-WAN Reference Architecture, ''Overlay IP Address Management''
SD-WAN 7.4 Concept Guide, Section: 'Interoperability with Third-Party Devices'
Refer to the exhibit.
Which statement best describe the role of the ADVPN device in handling traffic?
The log shows messages on HUB1-VPN1 where the device processes a SHORTCUT_QUERY and performs NAT hole punching (peer at 192.2.0.1:4500). This indicates that the device is acting as a hub, helping two spokes (192.2.0.1 and 10.0.3.101) establish a direct ADVPN shortcut tunnel between each other, instead of routing their traffic through the hub.
Refer to the exhibit.
An administrator configures SD-WAN rules for a DIA setup using the FortiGate GUI. The page to configure the source and destination part of the rule looks as shown in the exhibit. The GUI page shows no option to configure an application as the destination of the SD-WAN rule Why?
Exhibit.
For your ZTP deployment, you review the CSV file shown in exhibit and note that it is missing important information. Which two elements must you change before you can import it into FortiManager? (Choose two.)
Refer to the exhibit.
The administrator analyzed the traffic between a branch FortiGate and the server located in the data center, and noticed the behavior shown in the diagram.
When the LAN clients located behind FGT1 establish a session to a server behind DC-1, the administrator observes that, on DC-1, the reply traffic is routed overT2. even though T1 is the preferred member in
the matching SD-WAN rule.
What can the administrator do to instruct DC-1 to route the reply traffic through the member with the best performance?
When asymmetric routing is observed (such as reply traffic not following the optimal path), the solution is: 'The auxiliary-session feature, enabled under config system settings, allows FortiGate to consider multiple egress interfaces for reply traffic, not just the original ingress interface. This is crucial for SD-WAN environments where the best path may differ between forward and return directions, especially when performance or policy rules are dynamically evaluated.' Activating this ensures reply traffic is always sent on the member with the best real-time metrics. Reference:
[FCSS_SDW_AR-7.4 1-0.docx Q23]
FortiOS 7.4 CLI Reference, 'auxiliary-session for SD-WAN Path Optimization'
Get access to all 95 verified questions with detailed answers.
Unlock All NSE6_SDW_AD-7.6 Questions