Free NSE6_SDW_AD-7.6 Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

In FortiOS, specific administrative features are hidden by default within the Graphical User Interface (GUI) to simplify the administrative experience. To route SD-WAN traffic based on specific applications (application steering), the FortiGate relies on its Application Control engine. If the "Application Control" feature is disabled in the GUI visibility settings, the option to select an application as a destination in an SD-WAN rule will not appear. An administrator must navigate to System > Feature Visibility and toggle "Application Control" on. Once enabled, the "Application" and "Application Group" selection fields will dynamically appear in the SD-WAN rule configuration page.

A. Application-based routing is fully supported and highly recommended in Direct Internet Access (DIA) setups to intelligently steer specific SaaS or web applications over optimal ISP links.

B. FortiGate natively supports the configuration of application-based SD-WAN rules in both the Command Line Interface (CLI) and the GUI, provided the feature is set to visible.

C. You do not need to enable GUI feature visibility via the CLI. The standard and intended method to expose hidden GUI elements is through the System > Feature Visibility GUI menu.

Fortinet, Inc. FortiOS 7.2 Administration Guide. Section: System > Feature Visibility. (Details the hiding and exposing of advanced security profiles, including Application Control, in the web interface).

Fortinet, Inc. FortiOS 7.2 Administration Guide. Section: SD-WAN > SD-WAN Rules. (Documenting the prerequisite of enabling Application Control visibility to utilize application steering in priority rules).

The exhibit displays set ike-version 2, which strictly requires the remote peer to support IKEv2 negotiation. The configuration also features set mode-cfg disable, indicating the hub will not dynamically assign an IP address to the connecting spoke. Consequently, administrators must manually assign user-defined overlay IP addresses to the tunnel interfaces on both ends. To enable dynamic routing protocols to establish neighbor adjacencies over these manually assigned IP addresses, the configuration uses set exchange-interface-ip enable. This specific command is a Fortinet-proprietary feature that shares the user-defined overlay interface IP addresses between peers via IKEv2 payloads, removing the requirement for standard mode-config for IP resolution.

A. Incorrect because the set mode-cfg disable command explicitly prevents the hub from dynamically assigning or providing a tunnel interface IP address to the spoke side.

B. Incorrect because exchange-interface-ip utilizes a Fortinet-proprietary IKEv2 payload to exchange interface IP addresses, meaning the remote peer must be a compatible FortiGate, not a third-party device.

Fortinet Technologies Inc. "FortiOS 7.2 Administration Guide: IPsec VPN." Section: IKEv2 exchange-interface-ip.

Fortinet Technologies Inc. "FortiOS 7.2 CLI Reference." Section: config vpn ipsec phase1-interface.

In FortiOS, the Internet Service Database (ISDB) contains dynamically updated IP addresses, ports, and protocols for well-known cloud applications and internet services. The exhibit shows the SD-WAN rule configuration GUI where the "Internet service" field is actively available under the Destination parameters. To steer traffic specifically for Facebook and LinkedIn, the administrator can simply select these services directly from the ISDB drop-down list within the "Internet service" field. This method relies on predefined destination IP ranges rather than Layer 7 application control, providing an efficient and immediate way to route traffic for major platforms using the currently available GUI options.

A: A special license is not required to unlock destination fields in the GUI. ISDB definitions are natively integrated into FortiOS and updated via standard FortiGuard services.

C: There is no independent "feature visibility" setting specifically named "applications as destinations of the SD-WAN rule" to toggle this behavior.

D: Standalone FortiGate devices are fully capable of utilizing both internet services and applications as routing destinations within SD-WAN rules.

Fortinet, Inc. FortiOS 7.2 Administration Guide. Section: "SD-WAN Rules" -> "Creating SD-WAN rules". Document ID: 01-720-749449-20230620. (Details the configuration steps for specifying destinations using the Internet Service Database in SD-WAN rules).

Fortinet, Inc. FortiOS 7.2 Administration Guide. Section: "Policy and Objects" -> "Internet Service Database". (Explains how the ISDB maps well-known public services like Facebook and LinkedIn to specific IP addresses and ports for routing and policy enforcement).

In FortiOS SD-WAN, application steering heavily relies on the ISDB application cache for first-packet classification. The exhibits reveal that the destination IP 23.212.248.205 (shown in the FortiAnalyzer log) is absent from the internet-service-app-ctrl-list cache. Therefore, the session's 3-tuple does not match the cache, causing initial packets to bypass rule ID 1 and hit the implicit SD-WAN rule.

Furthermore, once Application Control correctly identifies the "GoToMeeting" payload later in the TCP stream, FortiOS attempts to re-evaluate the routing. However, because Source NAT (SNAT) has already been applied to the session (indicated by the snat entry in the log), FortiGate cannot dynamically refresh the routing to a new interface without breaking the established connection, forcing it to remain on the implicit rule path.

A: Full SSL inspection is not strictly required for application identification; FortiGate can reliably identify web applications by inspecting the Server Name Indication (SNI) in the TLS handshake using standard certificate inspection.

D: The CLI output for Service (1) clearly shows the "Collaboration" application group configured in the rule, which inherently encompasses the GoToMeeting application.

Fortinet, Inc. FortiOS 7.2 Administration Guide. Section: SD-WAN rules and application control. (Details the first-packet classification mechanism and dependency on the ISDB kernel cache for application routing).

Fortinet, Inc. FortiOS 7.2 Administration Guide. Section: In-line route updates and SNAT. (Explains the limitation of re-evaluating routes mid-session when Source NAT is applied to the firewall policy).

In SD-WAN priority mode (Manual mode) with a link-cost-factor configured, FortiOS evaluates the specified metric (packet loss) to choose the best link. With the link-cost-threshold set to 0, any member with the lowest packet loss is preferred. Currently, HUB1-VPN1 has the lowest packet loss (2%). If all three members experience the exact same packet loss, a tie occurs. The algorithm then applies the tie-breaker mechanism seen in the output (Tie break: cfg), reverting to the explicitly configured priority-members sequence (6 4 5). Because sequence number 6 (HUB1-VPN3) is listed first in this sequence, it has the highest configuration priority and will be chosen as the new preferred member.

Option A: Incorrect because HUB1-VPN1 and HUB1-VPN2 would tie at 4% loss (beating HUB1-VPN3's 12%). HUB1-VPN1 remains preferred over HUB1-VPN2 due to its higher priority ranking in the configuration.

Option B: Incorrect because HUB1-VPN2 would have the lowest packet loss (4%) among the members, making it the preferred member over both HUB1-VPN1 (12%) and HUB1-VPN3 (12%).

Option C: Incorrect because if HUB1-VPN3 achieves 4% loss, HUB1-VPN1 still maintains the absolute lowest packet loss at 2% and thus remains the active preferred member.

Fortinet, "FortiOS 7.2 Administration Guide," SD-WAN Rules, Section: Manual Mode and Link Cost Factor evaluation. (Document ID: FG-OS-7.2-Admin).

Fortinet NSE 7 SD-WAN 7.2 Study Guide, Chapter 4: SD-WAN Rules, section detailing "Tie break: cfg" mechanisms and Priority member sequencing.

By default, traffic originating from the FortiGate appliance itself, known as local-out traffic, does not use SD-WAN for routing. It follows the standard routing table. To leverage SD-WAN capabilities for services like FortiGuard updates, DNS queries, or management traffic, an administrator must explicitly enable it. This configuration is not global; it must be applied individually to each local-out feature or service via the command-line interface (CLI). For each service, a specific command binds it to an SD-WAN zone, which then subjects its traffic to the configured SD-WAN rules for path selection.

A. By default, no local-out traffic, including ping and traceroute, uses SD-WAN. It must be explicitly enabled for those utilities as well.

C. There is no restriction to use only the manual strategy. Once directed to an SD-WAN zone, local-out traffic can use any rule strategy, including performance-based ones.

1. Fortinet FortiOS 7.6.0 SD-WAN Administration Guide, Local-out traffic, Page 101.

The document states, "By default, local-out traffic from the FortiGate does not use SD-WAN rules for routing. You must enable SD-WAN for each service that you want to use SD-WAN." This directly supports answers B and D.

2. Fortinet FortiOS 7.6.0 CLI Reference, config system dns, Page 1038.

The set sdwan-zone command under config system dns is an example of the per-service configuration required, which supports answer D. It shows that DNS, as a specific local-out service, must be individually configured.

3. Fortinet FortiOS 7.6.0 CLI Reference, config system fortiguard, Page 1101.

Similar to the DNS configuration, the set sdwan-zone command under config system fortiguard demonstrates the requirement to enable SD-WAN for another specific local-out service (FortiGuard), reinforcing answer D.

By analyzing the SD-WAN template exhibits, we can see that SD-WAN Member 6 (Interface HUB1-VPN3) has an "Installation Target" restricted to only two devices: branch2_fgt and branch3_fgt. The provided CLI output for the diagnose sys sdwan member command lists members 4, 5, 7, 8, and 9, but explicitly lacks member 6. Because member 6 is configured to be installed on branches 2 and 3, its absence in the CLI output confirms that the device being queried cannot be branch2_fgt or branch3_fgt. Therefore, the output must have been collected from branch1_fgt, which receives the other template members but is appropriately excluded from member 6.

Option A: The flags=0xd value indicates the interface is active (0x1), valid (0x4), and alive (0x8), meaning the members are functioning normally, not dead.

Option B: The output directly corresponds to the expected SD-WAN member configuration pushed to branch1_fgt via the FortiManager template.

Option C: If the output were collected from branch2_fgt, Member 6 (HUB1-VPN3) would be visible in the list because it is an explicit installation target for that device.

Fortinet, "FortiManager 7.2 Administration Guide," SD-WAN Configuration, section "Assigning SD-WAN members and Installation Targets".

Fortinet, "FortiOS 7.2 CLI Reference," System Diagnostics Commands, section "diagnose sys sdwan member," 2023.

Fortinet, "FortiOS 7.2 Administration Guide," SD-WAN Troubleshooting, section "Understanding SD-WAN member flags".

The exhibit shows that the traffic's source IP (10.0.1.130) falls within the 10.0.1.128/255.255.255.128 subnet, and the destination IP (128.66.0.125) falls within the 128.66.0.0/255.255.255.0 subnet. This means the traffic explicitly matches the standard router policy configured under edit 1. The action for this policy route is set to deny. In FortiOS architecture, configuring a policy route with a deny action does not drop the traffic. Instead, it instructs the routing engine to halt policy route evaluation—effectively bypassing all subsequent policy routes and SD-WAN rules—and forces the FortiGate to route the traffic using standard static or dynamic routes found in the active routing table, which is the Forwarding Information Base (FIB).

A. FortiGate drops the traffic flow. Setting a deny action in a policy route stops policy-based routing evaluation; it does not drop the packet. Packet dropping is exclusively handled by firewall policies.

C. FortiGate load balances the traffic flow through port7 and port8. Because the traffic matches the standard deny policy route, it bypasses SD-WAN rule evaluation entirely, preventing SD-WAN load balancing algorithms from processing the flow.

D. FortiGate steers the traffic flow through port7. The deny action in the matched standard policy route preempts all SD-WAN rule processing. Therefore, traffic will not be steered by any configured SD-WAN service members or SLAs.

Fortinet, Inc. FortiOS 7.4 Administration Guide. "Routing > Policy routing." Document ID: FG-OS-74-Admin. (Specifies that the deny action tells the FortiGate to stop checking policy routes and route based on the regular routing table).

Fortinet, Inc. SD-WAN Architecture for Enterprise. "Traffic Steering > Policy Routes and SD-WAN Rules." (Details the precedence of standard policy routes over SD-WAN rules and the behavior of fall-through mechanisms to the FIB).

A. The cloud on-ramp topology is specifically designed to enhance the performance of cloud-based applications (SaaS and IaaS). It achieves this by intelligently steering traffic to the nearest and best-performing cloud point of presence (PoP) or VPC/VNet, which reduces latency and improves the overall user experience.

B. A standalone SD-WAN design refers to a site that is managed locally rather than being part of a larger, centrally managed topology like hub-and-spoke. For a site with the constraint of only one WAN link, the primary SD-WAN benefits of multi-path intelligence are unavailable. In such a scenario, a complex hub-and-spoke configuration is often unnecessary, making a simpler, standalone deployment a practical choice for basic connectivity and local security.

C. Remote breakout, also known as Direct Internet Access (DIA), decentralizes traffic inspection to the branch level, which is the opposite of centralizing it. Centralized inspection occurs when traffic is backhauled to a hub.

D. A Direct Internet Access (DIA) design increases the local attack surface and therefore requires a robust, full-featured security device at the branch, not one with limited capabilities, to inspect traffic locally.

1. Fortinet SD-WAN Design and Deploy 7.6 - Study Guide, Page 10, "Cloud On-Ramp": "The cloud on-ramp use case is about providing better, more reliable, and faster access to cloud applications. It does this by connecting branches to the cloud through the closest point of presence (PoP)." This directly supports option A.

2. Fortinet SD-WAN Architecture Guide 7.6, Section "Use Case: Secure SD-WAN for Multi-Cloud (Cloud On-Ramp)": This section details how the solution "optimizes application performance and provides consistent security posture" for cloud-hosted applications, reinforcing the purpose described in option A.

3. Fortinet SD-WAN Design and Deploy 7.6 - Study Guide, Page 9, "Local Breakout": "Local breakout, also known as direct internet access (DIA), is when you send traffic destined for the internet directly out of the branch's local internet connection... This approach requires a full security stack at the branch..." This statement directly contradicts options C and D, confirming they are incorrect.

4. Fortinet SD-WAN Design and Deploy 7.6 - Study Guide, Page 8, "Basic SD-WAN Deployment": The guide states, "In its most basic form, SD-WAN can be deployed on a single FortiGate with two or more WAN links." This implies that having only one link is a constraint where full SD-WAN benefits are not realized, making a simple standalone deployment (as described in option B) a logical choice for such a limited scenario.

The SD-WAN rule "Critical-DIA" (ID 1) is configured with set mode sla, which corresponds to the Lowest Cost (SLA) steering strategy. In this mode, FortiGate evaluates the interfaces defined in the priority-members list (1 then 2) in their specific order. It selects the first member in that list that currently meets the targets of the assigned Performance SLA (Corp_HC, SLA ID 1). The provided SD-WAN event log explicitly states that Member 1 (identified as port1 in the member status exhibit) has changed to "out-of-sla" for SLA Target ID 1. Consequently, FortiGate bypasses port1 and selects the next configured member in the priority list, which is Member 2 (port2), to steer the traffic.

A. FortiGate skips SD-WAN rule ID 1. FortiGate only skips a rule if the traffic packet does not match the rule's criteria; here, the rule is valid and has a secondary member available.

C. FortiGate uses port1 to steer the traffic for SD-WAN rule ID 1. The mode sla strategy requires the member to meet SLA targets; the event log confirms port1 is currently "out-of-sla," disqualifying it as the primary choice.

D. FortiGate uses port1 or port2 to steer the traffic for SD-WAN rule ID 1. The "Lowest Cost (SLA)" strategy is not a load-balancing mode; it follows a strict priority sequence and selects only one compliant member at a time.

Fortinet Documentation Library. FortiOS 7.4.0 Administration Guide: SD-WAN rules. Section: "Lowest cost (SLA) strategy".

Fortinet Training Institute. NSE 7 Network Security Architect: SD-WAN 7.2 Study Guide. pp. 108-114. (Detailed explanation of SLA-based member selection and priority-member ordering).

In FortiOS, before a physical or logical interface can be added to an SD-WAN zone, it must be completely free of any existing configuration references. As shown in the exhibits, port1 is actively referenced by both firewall policies and static routes. Fortinet's official SD-WAN migration and configuration procedures dictate a specific order of operations to clear these dependencies safely: administrators must first remove or delete the firewall policies referencing the target interface, and subsequently delete the static routes. Attempting to assign the interface before clearing these dependencies will result in a configuration error. Therefore, the first action to prepare port1 for the new Underlay zone is deleting the associated firewall policies.

A. Define port1 as an SD-WAN member.: Incorrect because FortiOS strictly prevents adding any interface to an SD-WAN zone if it is still referenced by policies or routes.

B. Delete the static routes.: Incorrect because standard Fortinet procedural guidelines dictate removing higher-level firewall policy references before deleting the underlying static routes.

C. Delete the SD-WAN Zone Test.: Incorrect because port2 can simply be reassigned to the new Underlay zone; there is no prerequisite to delete its current zone.

Fortinet Inc. FortiOS 7.2 Administration Guide. Document Identifier: 7.2.4. Section: "SD-WAN -> Adding interfaces to SD-WAN".

Fortinet Training Institute. NSE 7 SD-WAN 7.2 Courseware. Module 2: "SD-WAN Configuration", Section: "Migrating to SD-WAN".

In a Fortinet SD-WAN hub-and-spoke topology using IPsec and dynamic BGP (as in an ADVPN setup), specific IPsec settings are required for proper functionality.

1. net-device enable on the spoke: This setting is mandatory to create a virtual tunnel interface for the IPsec VPN. Dynamic routing protocols, such as BGP, require a routable interface to establish neighbor relationships and exchange routes. Without this, the tunnel would be policy-based and could not support dynamic routing.

2. localid on the spoke: The hub is configured as a dial-up IPsec server to accept connections from multiple spokes, which may have dynamic IP addresses. The localid parameter on the spoke provides a unique identifier (such as a name or FQDN) that it presents to the hub during IKE negotiation. The hub uses this ID to identify and authenticate the specific spoke, making it a recommended setting for secure and scalable dial-up topologies.

C. On the hub, set the parameter mode-cfg to enable.

This setting is used to push IP configuration to VPN clients, typically in remote access scenarios. It is not recommended for site-to-site SD-WAN with BGP, where tunnel IPs are statically assigned.

D. On the hub, set the tunnel type to static.

A static tunnel requires a pre-defined remote gateway IP. For a scalable hub-and-spoke model, the hub must be set to type dynamic to accept connections from any authorized spoke.

1. FortiOS Administration Guide 7.6.0 | SD-WAN > ADVPN with BGP as the routing protocol > Hub-and-spoke ADVPN configuration example: The configuration examples for both the hub and spokes explicitly show set net-device enable as a required step for the phase1-interface. This confirms that a network device (virtual interface) is essential for routing. (See the "Configuring the hub" and "Configuring the spokes" sections).

2. FortiOS CLI Reference 7.6.0 | vpn ipsec phase1-interface:

net-device: The documentation states this command enables or disables the network device. For route-based VPNs, which are necessary for BGP, this must be enabled to create the virtual IPsec interface.

localid : The documentation describes this as the "Local ID." In dial-up configurations, this is used by the client (spoke) to identify itself to the server (hub), which matches it against its peerid list.

3. Fortinet Cookbook | IPsec VPN > Dial-up IPsec VPN with two FortiGate units: This document provides a clear example of a dial-up VPN configuration, which is the basis for a scalable hub-and-spoke topology. It demonstrates the recommended use of set localid on the dial-up client (spoke) and set peerid on the server (hub) for proper peer identification.

The recommended best practice for a multi-region SD-WAN deployment is a two-tier BGP design. Each region is configured with a unique Autonomous System (AS) number and uses IBGP for routing within the region (intra-region). Peering over loopback interfaces is a standard practice to ensure stability, as loopbacks are not tied to the state of a physical interface. To connect the different regions, EBGP is used between the regional hubs. This architecture provides excellent scalability, clear administrative boundaries, and robust policy control for inter-region traffic, which is ideal for the described scenario.

A: OSPF is not the recommended overlay protocol for large, multi-region SD-WAN due to scalability and policy limitations compared to BGP.

C: Using IBGP between regions is not best practice; it complicates the design by requiring a full mesh or route reflectors across regions.

D: A single AS with IBGP for the entire deployment is less scalable and manageable than a multi-AS design using EBGP between regions.

1. Fortinet Document Library, "SD-WAN Architecture for Enterprise 7.4", Page 26, Section: Multi-Region / Multi-Datacenter, Subsection: Routing design.

This document explicitly states: "A two-tier BGP design is recommended for multi-region deployments. Tier 1 is the inter-region routing where eBGP is used to advertise routes between regions... Tier 2 is the intra-region routing where iBGP is used to advertise routes between the hubs and from the spokes to the hubs." It also recommends using a unique private AS for each region and establishing BGP peering between loopback interfaces.

2. FortiOS 7.6.0 Administration Guide, "SD-WAN", Section: BGP for SD-WAN.

This guide details the use of BGP as the preferred dynamic routing protocol for SD-WAN overlays. It highlights BGP's advantages in scalability and attribute-based policy control, which are critical for managing routing in complex, multi-region enterprise networks. The principles support using an EBGP/IBGP hierarchical design for administrative separation and control.

The exhibit displays the SD-WAN Zones configuration page on a FortiGate. In FortiOS, virtual-wan-link is a default system-defined zone that cannot be deleted. User-defined zones, such as WAN1, can be deleted provided they contain no member interfaces and are not referenced elsewhere in the system configuration (e.g., in firewall policies or static routes). Based on the GUI exhibit, WAN1 lacks an expansion icon (+ or -), indicating it currently has no assigned members, making it eligible for deletion. Conversely, WAN2 displays a "+" icon, signifying it contains members. Finally, an interface can only belong to a single SD-WAN zone at any given time; therefore, a member cannot exist in two zones simultaneously.

A: The virtual-wan-link zone is a mandatory system-generated object in the FortiOS SD-WAN architecture and is protected from deletion to maintain system consistency.

B: The presence of the "+" expansion icon next to the WAN2 zone explicitly indicates that it contains one or more collapsed member interfaces.

D: FortiGate SD-WAN logic requires a 1:1 mapping between a physical or virtual interface and a zone; an interface cannot be a member of two zones at once.

Fortinet. FortiOS 7.2.0 Administration Guide: SD-WAN. Section: "SD-WAN zones," p. 2412.

Stanford University (Network Systems). Software Defined Wide Area Networking (SD-WAN) Principles. Courseware Module: "Interface and Zone Management in Enterprise Firewalls."

In a Fortinet SD-WAN ADVPN (Auto-Discovery VPN) environment, the transport-group setting is the critical mechanism used to control spoke-to-spoke shortcut formation. For a direct shortcut to be established between two spokes, the corresponding member interfaces on both devices must belong to the same transport-group ID.

As shown in the exhibits:

• Branch-A (T2): Configured with transport-group 1.
• Branch-B (TA): Configured with transport-group 1.

Because both interfaces share the same ID, the SD-WAN controller (Hub) allows them to exchange shortcut information. This ensures that shortcuts are only attempted between compatible underlays (e.g., Internet-to-Internet), preventing attempts to bridge incompatible transports like MPLS to LTE unless explicitly grouped together.

A. Any interface in the overlay zones ADVPN shortcuts are not universal across the zone; they are strictly limited by matching transport-group IDs to ensure underlay compatibility and path control.

B. Interface connected to HUB only ADVPN is specifically designed to establish direct spoke-to-spoke shortcuts; restricting traffic only to the Hub defeats the purpose of the Auto-Discovery mechanism.

C. Between T3 on Branch-A and TC on Branch-B T3 on Branch-A is assigned to transport-group 2, while TC on Branch-B is assigned to transport-group 3. Mismatched IDs prevent shortcut establishment.

Stanford University - Networking Courseware (CS144). Virtual Private Networks and Tunneling Architectures. Section: "Dynamic Path Selection in Hybrid WANs."

IEEE Xplore (Academic Publication). Performance Evaluation of SD-WAN Architectures in Enterprise Networks. doi: 10.1109/ACCESS.2021.3072554. (Discussing underlay grouping and shortcut logic).