Get Fortinet FCSS_SDW_AR-7.4 Dumps Questions [2026] To Gain Brilliant Result [Q30-Q54]

QUESTION 30
You configured an SD-WAN rule with the best quality strategy and selected the predefined health check, Default_FortiGuard, to check the link performances against FortiGuard servers.
For the quality criteria, you selected Custom-profile-1.
Which factors does FortiGate use, and in which order. to determine the link that it should use to steer the traffic?

Latency – Member configuration order – Link cost threshold

Link quality index – Member configuration order – Link cost threshold

Links that meet the SLA targets – Member configuration order – Member local cost

Latency – Jitter – Packet loss – Bibandwidth – Member configuration order

QUESTION 31
Refer to the exhibits.

You connect to a device behind a branch FortiGate device and initiate a ping test. The device is part of the LAN subnet and its IP address is 10.0.1.101.
Based on the exhibits, which interface uses branch 1_fgt to steer the test traffic?

port4

HUB1-VPN1

port1

port2

QUESTION 32
Refer to the exhibit. The administrator analyzed the traffic between a branch FortiGate and the server located in the data center, and noticed the behavior shown in the diagram. When the LAN clients located behind FGT1 establish a session to a server behind DC-1, the administrator observes that, on DC-1, the reply traffic is routed over T2. even though T1 is the preferred member in the matching SD-WAN rule.
What can the administrator do to instruct DC-1 to route the reply traffic through the member with the best performance?

Enable snat-route-change under config system global.

Enable reply-session under config system sdwan.

Enable auxiliary-session under config system settings.

FortiGate route lookup for reply traffic only considers routes over the original ingress interface.

QUESTION 33
Refer to the exhibits. You connect to a device behind a branch FortiGate device and initiate a ping test. The device is part of the LAN subnet and its IP address is 10.0.1.101.
Based on the exhibits, which interface uses branch 1_fgt to steer the test traffic?

port4

HUB1-VPN1

port1

port2

QUESTION 34
Refer to the exhibit.

Which statement best describe the role of the ADVPN device in handling traffic?

This is a hub that has received a query from a spoke and has forwarded it to another spoke.

This is a hub in a dual-region topology. The remote hub tunnel ID is 10.0.2.101.

This is a spoke that has received a shortcut query from another spoke and has forwarded the response to its hub.

This is a spoke. The kernel received a shortcut request and forwards the query to another spoke.

QUESTION 35
Refer to the exhibit that shows event logs on FortiGate. Based on the output shown in the exhibit, what can you say about the tunnels on this device?

The master tunnel HU82-VPN3 cannot accept ADVPN shortcuts.

The device steers voice traffic through the VPN tunnel HUB1-VPN3.

The VPN tunnel HUB1-VPN1_0 is a shortcut tunnel.

There is one shortcut tunnel built from master tunnel VPN4.

QUESTION 36
You manage an SD-WAN topology. You will soon deploy 50 new branches.
Which three tasks can you do in advance to simplify this deployment? (Choose three.)

Update the DHCP server configuration.

Create policy blueprint.

Create a ZTP template.

Define metadata variables value for each device.

Create model devices.

QUESTION 37
Refer to the exhibit.

The exhibit shows output of the command diagnose sys adwan aervice4 collected on a FortiGate device.
The administrator wants to know through which interface FortiGate will steer traffic from local users on subnet 10.0.1.0/255.255.255.192 and with a destination of the social media application Facebook.
Based on the exhibits, which two statements are correct? (Choose two.)

When FortiGate cannot recognize the application of the flow, it steers the traffic through the preferred member of rule 3, HQ_T1.

There is no service defined for the Facebook application, so FortiGate appliesservice rule 3 and directs the traffic to headquarters.

FortiGate steers traffic for social media applications according to the service rule 2 and steers traffic through port2.

When FortiGate cannot recognize the application of the flow, it load balances the traffic through the tunnels HQ_T1. HQ_T2. HQ_T3.

QUESTION 38
The administrator uses the FortiManager SD-WAN overlay template to prepare an SD-WAN deployment. Using information provided through the SD-WAN overlay template wizard, FortiManager creates templates ready to install on the spoke and hub devices.
What are the three templates created by the SD-WAN overlay template for a spoke device?
(Choose three.)

Static route template

Rules template

CLI template

BGP template

IPsec tunnel template

QUESTION 39
Which statement about SD-WAN zones is true?

You can configure up to 32 SD-WAN zones per VDOM.

You cannot use an SD-WAN zone in static route definitions.

An SD-WAN zone can contain only one type of interface.

An SD-WAN zone can contain between 0 and 512 members.

QUESTION 40
When you use the command diagnose sys session list, how do you identify the sessions that correspond to traffic steered according to SD-WAN rules?

You identify sessions steered according to SD-WAN rules with the flag vwl.

You cannot identify SD-WAN sessions. You must use the sdwar. session filter.

You identify sessions steered according to SD-WAN rules with the data vwl_mbr_seq.

You identify sessions steered according to SD-WAN rules with the data 3dwan_service_id.

QUESTION 41
Refer to the exhibit.

The administrator configured the SD-WAN rule ID 4 with two members (port1 and port2) and strategy lowest cost (SLA).
What are the two characteristics of the session shown in the exhibit? (Choose two.)

FortiGate steered this flow according to an SD-WAN rule.

FortiGate will never re-evaluate this session.

FortiGate steered this flow according to the application detected and the outgoing interface is port3.

FortiGate will re-evaluate this session if the outgoing interface goes down.

QUESTION 42
Refer to the exhibit. The exhibit shows the details of a session and the index numbers of some relevant interfaces on a FortiGate device that supports hardware offloading.
Based on the information shown in the exhibits, which two conclusions can you draw? (Choose two.)

By default, FortiGate offloads symmetric and asymmetric flows.

The original direction of the symmetric traffic flows from port3 to port2.

The reply direction of the asymmetric traffic flows from port2 to port3.

The auxiliary session can be offloaded to hardware.

QUESTION 43
What are three key routing principles of SD-WAN? (Choose three.)

Directly connected routes have precedence over SD-WAN rules.

Policy routes have precedence over SD-WAN rules.

SD-WAN rules are skipped if the best route to the destination is a static route

SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member.

SD-WAN members are skipped if they do not have a valid route to the destination.

QUESTION 44
When a customer delegate the installation and management of its SD-WAN infrastructure to an MSSP, the MSSP usually keeps the hub within its infrastructure for ease of management and to share costly resources.
In which two situations will the MSSP install the hub in customer premises? (Choose two.)

The customer requires SIA with centralized breakout.

The administrator expects a large volume of traffic between the branches.

The customer expects a large amount of VoIP traffic.

The majority of the branch traffic is directed to a corporate data center.

QUESTION 45
Which statement describes FortiGate behavior when you reference a zone in a static route?

FoftiGate installs ECMP static routes for the first two members of the zone.

FortiGate ignores the static routes defined through members referenced in the zone.

FortiGate routes the traffic through the best performing member of the zone.

FortiGate installs a static route for each member in the zone.

QUESTION 46
Refer to the exhibits, which show the configuration of an SD-WAN rule and the corresponding rule status and routing table.

The administrator wants to understand the expected behavior for traffic matching the SD-WAN rule.
Based on the exhibits, what can the administrator expect for traffic matching the SD-WAN rule?

The traffic will be routed over HUB1-VPN3.

The traffic will be routed over HUB1-VPN2

The traffic will be routed over HUB1-VPN1.

The traffic will be load balanced across all three overlays

QUESTION 47
Refer to the exhibit that shows VPN event logs on FortiGate.

Based on the output shown in the exhibit, which statement is true?

There is one shortcut tunnel built from master tunnel T_MPLS_0.

The master tunnel T_INET_0 cannot accept the ADVPN shortcut.

There are no IPsec tunnel statistics log messages for ADVPN shortcuts.

The VPN tunnel T_MPLS_0 is a shortcut tunnel.

QUESTION 48
Refer to the exhibit. Which statement best describe the role of the ADVPN device in handling traffic?

This is a hub that has received a query from a spoke and has forwarded it to another spoke.

This is a hub in a dual-region topology. The remote hub tunnel ID is 10.0.2.101.

This is a spoke that has received a shortcut query from another spoke and has forwarded the response to its hub.

This is a spoke. The kernel received a shortcut request and forwards the query to another spoke.

QUESTION 49
Refer to the exhibit.

An administrator checks the status of an SD-WAN topology using the FortiManager SD-WAN monitor menus. All members are configured with one or two SLAs.
Which two conclusions can you draw from the output shown? (Choose two.)

The template view should be used to see the hub devices.

One member of branch2_fgt is missing the SLAs.

branch2_fgt establishes six tunnels to the hubs and they are all up.

This SD-WAN topology contains only two branch devices.

QUESTION 50
Refer to the exhibit. Which SD-WAN rule and interface uses FortiGate to steer the traffic from the LAN subnet 10.0.1.0/24 to the corporate server 10.2.5.254?

SD-WAN service rule 3 and interface HUB1-VPN2.

SD-WAN service rule 3 and interface HUB1-VPN3.

SD-WAN service rule 4 and port1 or port2.

SD-WAN service rule 4 and interface port2.

QUESTION 51
Refer to the exhibits. You use FortiManager to configure SD-WAN on three branch devices.
When you install the device settings. FortiManager prompts you with the error “Copy Failed” for the device branch1_fat When you click the log button. FortiManager displays the message shown in the exhibit.
Based on the exhibits, which statement best describes the issue and how you can resolve it?

Remove the installation target for the SD-WAN member port4. You cannot combine metadata variable and installation targets.

Gateways for all members in a zone must be defined the same way. Specify the gateway of the SD-WAN member port! without metadata variables.

Check the metadata variable definitions, and review the per-device mapping configuration.

Check the connection between branch1_fgt and FortiManager

QUESTION 52
Refer to the exhibit. The administrator used the SD-WAN overlay template to prepare an IPsec tunnels configuration for a hub-and-spoke SD-WAN topology. The exhibit shows the FortiManager installation preview for one FortiGate device.
Based on the exhibit, which statement best describes the configuration applied to the FortiGate device?

It is a spoke device that establishes dynamic IPsec tunnels to the hub. The local subnet range is
10.10.128.0/23.

It is a hub device. It can send ADVPN shortcut offers.

It is a hub device. It will automatically discover the spoke devices and add them to the SD-WAN topology.

It is a spoke device that establishes dynamic IPsec tunnels to the hub It can send ADVPN shortcut requests.

QUESTION 53
The SD-WAN overlay template helps to prepare SD-WAN deployments. To complete the tasks performed by the SD-WAN overlay template, the administrator must perform some post-run tasks. What are two mandatory post-run tasks that must be performed? (Choose two.)

Configure routing through the overlay tunnels created by the SD-WAN overlay template.

Create policy packages and assign them to the branch devices.

Assign a hub id metadata variable to each hub device.

Configure SD-WAN rules

Assign an sdwan_id metadata variable to each device (branch and hub)

QUESTION 54
The FortiGate devices are managed by ForliManager, and are configured for direct internet access (DIA). You confirm that DIA is working as expected for each branch, and check the SD- WAN zone configuration and firewall policies shown in the exhibits.

Then, you use the SD-WAN overlay template to configure the IPsec overlay tunnels. You create the associated SD-WAN rules to connect existing branches to the company hub device and apply the changes on the branches.
After those changes, users complain that they lost internet access. DIA is no longer working.
Based on the exhibit, which statement best describes the possible root cause of this issue?