Refer to the exhibit. https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/Fortinet_FCSS_SDW_AR-7.4/page_29_img_1.jpg Which statement best describe the role of the ADVPN device in handling traffic?

This is a spoke that has received a shortcut query from another spoke and has forwarded the response to its hub.

This is a hub that has received a query from a spoke and has forwarded it to another spoke.

This is a hub in a dual-region topology. The remote hub tunnel ID is 10.0.2.101.

This is a spoke that has received a shortcut query from another spoke and has forwarded the response to its hub.

This is a spoke. The kernel received a shortcut request and forwards the query to another spoke.

Free FCSS_SDW_AR-7.4 Practice Test Questions and Answers (2026)

Last Update Check September 20, 2026

Q: 1

Refer to the exhibit.

Refer to the exhibit. You want to configure SD-WAN on a network as shown in the exhibit. The network contains many FortiGate devices. Some are used as NGFW, and some are installed with extensions such as FortiSwitch. FortiAP. or Forti Ex tender. What should you consider when planning your deployment?

Options

20 comments in the community discussion

Casey R. 2

Option B similar question showed up in an official guide review session.

Ishaan W. 2

Call it B. The hub FortiGate should not have any extensions like FortiSwitch or FortiAP attached, otherwise performance and reliability can suffer. Spokes can run those, but best to keep the hubs clean. Pretty sure that's what Fortinet recommends. Someone correct me if you know otherwise.

Correct Answer:

Explanation

According to Fortinet's official SD-WAN architecture and deployment guidelines, it is a critical best practice to use dedicated FortiGate devices for the hub role. Hubs are central to the topology, handling a high volume of traffic and numerous VPN tunnels. To ensure the stability, performance, and availability of the SD-WAN fabric, hub FortiGates should not be burdened with managing extensions like FortiSwitch, FortiAP, or FortiExtender. Spoke devices, which have a smaller operational scope, can be deployed with these extensions. Therefore, a single SD-WAN topology can be built, but the hubs must be devices without extensions.

Why Incorrect

A: This is incorrect. Fortinet best practices explicitly advise against using FortiGate devices with extensions as hubs to maintain performance and stability for the core SD-WAN functions.

C: This is incorrect. While FortiManager is highly recommended for scalable management of SD-WAN, it is not a mandatory requirement. SD-WAN can be configured and managed locally on FortiGate devices.

D: This is incorrect. There is no architectural limitation that requires separate SD-WAN topologies for different extension types. Spokes with various extensions can participate in the same topology.

References

1. Fortinet. (2024). Secure SD-WAN for FortiOS 7.4 Study Guide. Fortinet Training Institute.

In the module covering SD-WAN Architecture

it is specified that "The hub FortiGate devices should be dedicated to the SD-WAN hub role and should not have any extensions

such as FortiSwitch

FortiAP

or FortiExtender. The spoke FortiGate devices can have extensions." This directly supports the correct answer and refutes option A.

2. Fortinet. (2024). FortiOS 7.4.0 SD-WAN Architecture Guide. Fortinet Document Library.

In the "Deployment considerations" chapter

the section on "Hubs" emphasizes that hubs are critical components and should be sized appropriately for performance. The guide implicitly supports dedicating the device to this core function

which aligns with not adding peripheral management tasks like FortiSwitch or FortiAP control.

3. Fortinet. (2024). FortiOS 7.4.0 Administration Guide. Fortinet Document Library.

The "SD-WAN" section details the configuration steps which can be performed directly on the FortiOS GUI or CLI

demonstrating that FortiManager is not a prerequisite for functionality

thus refuting option C.

Q: 2

Refer to the exhibits.

An administrator is testing application steering in SD-WAN. Before generating test traffic, the administrator collected the information shown in the first exhibit. After generating GoToMeeting test traffic, the administrator examined the corresponding traffic log on FortiAnalyzer, which is shown in the second exhibit. The administrator noticed that the traffic matched the implicit SD-WAN rule, but they expected the traffic to match rule ID 1. Which two reasons explain why some log messages show that the traffic matched the implicit SD- WAN rule? (Choose two.)

Options

20 comments in the community discussion

Drew K. 1

I don’t think it’s D. B is more likely since ISDB cache not matching can cause the session to hit the implicit rule. Some folks might get tripped up thinking D fits, but rule existence isn't the main issue here. Correct me if I'm off.

SharpArchitect5870 1

C or D. I'm thinking B and C make sense since initial session matching depends on the ISDB cache and whether FortiGate refreshes route info, but if there was no rule for GoToMeeting at all, D could fit too. Not totally sure here.

Correct Answer:

B, C

Explanation

The observed behavior occurs due to the sequence of SD-WAN session evaluation.

1. Initially, when the first packet of a new session arrives, FortiGate has only Layer 3/4 information (IPs and ports). It attempts to match this against the SD-WAN rules. If the destination IP of the GoToMeeting traffic is not yet in the local Internet Service Database (ISDB) cache, the application-based rule (ID 1) will not match. Consequently, the session is routed using the implicit SD-WAN rule (ID 0).

2. After a few packets, the application is correctly identified as "GoToMeeting". At this point, FortiGate should re-evaluate the session and steer it according to rule ID 1. The log shows sdwanruleid=0, indicating this re-routing/refresh of the session failed, leaving the traffic on the path originally chosen by the implicit rule.

Why Incorrect

A. Full SSL inspection is not enabled on the matching firewall policy.

This is incorrect because the log confirms the application was successfully identified (app="GoToMeeting"). Application identification can occur without full SSL inspection (e.g., via SNI or ISDB).

D. No configured SD-WAN rule matches the traffic related to the collaboration application GoToMeeting.

This is incorrect. The first exhibit clearly shows that SD-WAN rule ID 1 is configured to match the GoToMeeting Internet Service object.

References

1. FortiOS SD-WAN Architecture Guide 7.4.0:

Page 10

"First packet processing": "When the first packet of a new session arrives at FortiGate

the kernel forwards it to the sdwan daemon for path selection... The sdwan daemon checks the SD-WAN rules for a match based on the 5-tuple of the packet." This supports that initial matching is based on L3/L4 info. If the IP is not in the ISDB

the application rule won't match.

Page 11

"Application steering": "After an application is identified

the session is flagged for re-evaluation... The sdwan daemon updates the session with the new forwarding path information." This describes the session refresh/rerouting process that failed

as indicated by option C.

2. FortiOS Administration Guide 7.4.0 - SD-WAN:

Section: "SD-WAN rules": This section details how rules are matched. It implicitly confirms that application-based criteria require the application to be identified first. If identification happens after the session is established

a re-evaluation is necessary.

Section: "Implicit rule": "If traffic does not match any of the configured SD-WAN rules

it will match the implicit rule." This confirms the behavior when the initial IP-based lookup fails to match rule 1

supporting the scenario in option B.

Q: 3

SD-WAN interacts with many other FortiGate features. Some of them are required to allow SD-WAN to steer the traffic. Which three configuration elements that you must configure before FortiGate can steer traffic according to SD-WAN rules? (Choose three.)

Options

18 comments in the community discussion

Amelia D. 2

A B, E. You need interfaces to define SD-WAN members, routing to direct traffic into the SD-WAN zone, and firewall policies so traffic can actually flow. Security profiles and traffic shaping aren't required for basic steering. Pretty sure about this-anyone disagree?

Adam 1

Not sure I agree with picking D here. From what I remember, just configuring interfaces, routing, and firewall policies (A, B, E) actually lets SD-WAN do its thing. Traffic shaping seems more like extra tuning/QoS on top. Correct me if I missed something though.

Correct Answer:

A, B, E

Explanation

For FortiGate to steer traffic using SD-WAN, a specific sequence of configurations is required. First, the underlying network interfaces that will participate in the SD-WAN (such as physical WAN links or VPN tunnels) must be configured and then added as members to the SD-WAN zone. Second, routing must be configured, typically a static route, to direct traffic towards the SD-WAN virtual interface. This step is crucial for the FortiGate to consider the SD-WAN engine for path selection. Finally, firewall policies must be created to permit the traffic, using the SD-WAN virtual interface as the outgoing interface. These three elements—interfaces, routing, and firewall policies—are the fundamental prerequisites for SD-WAN traffic steering.

Why Incorrect

C. Security profiles: These are applied to firewall policies for traffic inspection (like antivirus or IPS). They are not required for the SD-WAN path selection and steering mechanism itself to function.

D. Traffic shaping: This feature manages bandwidth and prioritizes traffic. While it can be used with SD-WAN, it is a separate function and not a mandatory prerequisite for basic traffic steering.

References

1. FortiOS SD-WAN Administration Guide 7.4.1

"Basic setup" section

page 23: This section outlines the essential steps for a basic SD-WAN deployment

which explicitly include: 1. Create SD-WAN members (which are based on configured Interfaces)

4. Create a static route

and 5. Create firewall policies. This demonstrates that these three are core requirements.

2. FortiOS SD-WAN Administration Guide 7.4.1

"Packet flow for SD-WAN" section

page 19: The packet flow diagram and description show that after a packet arrives

the FortiGate performs a routing lookup. If the route points to the SD-WAN interface

a firewall policy check is performed. Only then are the SD-WAN rules evaluated to steer traffic over a member interface. This confirms the dependency on these three elements.

3. FortiOS Administration Guide 7.4.1

"Policies" chapter

page 619: This chapter details the necessity of firewall policies to allow any traffic to pass through the FortiGate. It states

"A firewall policy is a set of instructions that the FortiGate unit uses to control traffic." This applies to SD-WAN traffic as well

which must be explicitly permitted.

Q: 4

When a customer delegate the installation and management of its SD-WAN infrastructure to an MSSP, the MSSP usually keeps the hub within its infrastructure for ease of management and to share costly resources. In which two situations will the MSSP install the hub in customer premises? (Choose two.)

Options

25 comments in the community discussion

Aaron A. 1

A and B tbh

Jack 1

C/D?

Correct Answer:

A, B

Explanation

An MSSP prefers to host the SD-WAN hub in its own data center to leverage shared infrastructure and simplify management. However, certain customer requirements necessitate placing the hub on the customer's premises.

A large volume of branch-to-branch traffic (B) makes a remote MSSP hub inefficient due to increased latency, as all inter-spoke traffic must traverse the hub. Placing the hub at a central customer location minimizes this latency.

A requirement for Secure Internet Access (SIA) with a centralized breakout (A) can also force an on-premise hub if the customer mandates the use of their existing, on-premise security infrastructure for traffic inspection. This requires co-locating the hub with that security stack.

Why Incorrect

C. The customer expects a large amount of VoIP traffic.

This is not a primary driver. VoIP traffic is either branch-to-branch (covered by option B) or to a cloud service, where a direct branch breakout is typically preferred over a central hub.

D. The majority of the branch traffic is directed to a corporate data center.

While a valid reason for a hub, an MSSP can solve this without an on-premise hub by providing a dedicated, high-speed link from their own data center to the customer's data center.

References

1. Fortinet SD-WAN Architecture for Enterprise 7.4 Guide

Page 12

Section: Hub Placement: "If a large amount of traffic is exchanged between the branches

then a hub-and-spoke topology is recommended... The hub should be placed in a location that is central to all the branches to minimize latency." This directly supports option B as a key performance consideration for hub placement.

2. Fortinet SD-WAN for MSSPs Solution Guide

Page 6

Section: SD-WAN Hub/Controller: This guide notes that while the hub is typically in the MSSP PoP

it can be deployed on-premise for reasons including "Integration with existing on-premises infrastructure

such as authentication servers or security devices." This supports the rationale for option A

where SIA must integrate with the customer's on-prem security stack.

3. Fortinet SD-WAN Architecture for Enterprise 7.4 Guide

Page 12

Section: Hub Placement: "For centralized internet breakout

all internet-bound traffic from the branches is routed to the hub

where it is inspected by the security features of the FortiGate before being sent to the internet." This confirms the mechanism of option A

which

when combined with a customer's on-premise security stack

necessitates an on-premise hub.

Q: 5

Refer to the exhibit.

Which statement best describe the role of the ADVPN device in handling traffic?

Options

27 comments in the community discussion

CaseyD 4

Option C matches how ADVPN spokes handle shortcut queries. The spoke receives the SCQ from another spoke but can't build the tunnel directly, so it sends the reply back up to its own hub for further handling. I've seen similar debug output in labs. If anyone reads it differently let me know, but I'm pretty sure C is ri

Vikram X. 2

D , since the kernel gets the shortcut request and forwards it, which sounds like D is closer than C here.

Q: 6

Which three characteristics apply to provisioning templates available on FortiManager? (Choose three.)

Options

22 comments in the community discussion

Zoe N. 1

A C, D imo. B is a trap since template groups aren't limited to IPsec tunnel templates only-it's more about the mix of system/SD-WAN templates. E doesn't fit because Perl scripts aren't actually supported as CLI templates in FortiManager, just CLI script or Jinja. Correct me if I've missed some update but pretty sure t

Sam 1

I don't think B is one of them. From what I remember, template groups aren't limited by IPsec tunnel templates like that. C looks right since CLI templates apply top-down, and D makes sense too, but B feels like the trap here.

Correct Answer:

A, C, D

Explanation

FortiManager provisioning templates offer a scalable way to manage device configurations. A template group is a container that can hold various types of templates, including a System Template for device-level settings and an SD-WAN Template for SD-WAN rules and members, allowing for comprehensive device setup. Within a template group, multiple CLI templates can be included. These are applied sequentially in the order they are listed, from top to bottom, ensuring a predictable configuration outcome. A CLI template group is flexible and can contain both static CLI scripts (for fixed commands) and dynamic Jinja scripts (for programmatic and variable-based configurations), which are the two types of CLI templates available.

Why Incorrect

B: There is no officially documented limit of only three IPsec tunnel templates per template group. The platform allows for more, subject to system capabilities.

E: A CLI template can be a CLI script or a Jinja script. FortiManager uses the Jinja2 templating engine, not Perl, for dynamic script creation.

References

1. FortiManager Administration Guide 7.4

Version 7.4.1

Page 419

"Template groups": "A template group is a collection of provisioning templates that you can create and assign to a managed device or a device group... You can add the following provisioning templates to a template group: System Template

SD-WAN Template..." This supports option A.

2. FortiManager Administration Guide 7.4

Version 7.4.1

Page 441

"CLI templates": "When you add multiple CLI templates to a template group

the templates are applied to the managed device in order from top to bottom." This supports option C.

3. FortiManager Administration Guide 7.4

Version 7.4.1

Page 441

"CLI templates": "CLI templates can be either a CLI script or a Jinja script." This statement confirms the two types of CLI templates

refuting option E's mention of "Perl script" and supporting the premise of option D that a group can contain both types.

4. FortiManager Administration Guide 7.4

Version 7.4.1

Page 441

"CLI template groups": "You can add multiple CLI templates and Jinja scripts to a CLI template group." This directly supports option D.

Q: 7

An administrator is configuring SD-WAN to load balance their network traffic. Which two things should they consider when setting up SD-WAN? (Choose two.)

Options

14 comments in the community discussion

Ryan 2

D tbh, the trap is that maximize-bandwidth is SLA-based so lowest cost fits. Manual seems less relevant for load balancing.

Jack N. 2

Probably A and C. Official guides and FortiGate admin docs go deep on SD-WAN load balancing setups.

Correct Answer:

A, C

Explanation

When configuring SD-WAN for load balancing, an administrator should consider the available distribution algorithms and how different strategies utilize them. FortiGate provides a volume-based load-balancing algorithm, which distributes traffic based on configured ratios that can reflect the outbound bandwidth of each link. This method is available for strategies that support load balancing, such as maximize-bandwidth and manual.

Additionally, a key consideration is the maximize-bandwidth (SLA) strategy. This strategy is specifically designed to load balance traffic across all member interfaces that are performing within the defined SLA targets for latency, jitter, and packet loss, thereby maximizing the usable bandwidth.

Why Incorrect

B. Only the manual and best-quality strategies allow SD-WAN load balancing.

This is incorrect because the best-quality strategy selects only one single best link; it does not perform load balancing.

D. SD-WAN load balancing is possible only using the best quality and lowest cost (SLA) strategies.

This is incorrect as best-quality does not load balance, and this option omits the primary load-balancing strategy, maximize-bandwidth (SLA), as well as the manual strategy.

References

1. Fortinet FCSS - SD-WAN 7.4 Study Guide

"SD-WAN Rules"

Page 89

92.

Page 92 states for the Maximize Bandwidth (SLA) strategy: "FortiGate identifies all member interfaces that are within the SLA target

and then load balances traffic among them." This directly supports option C.

Page 90 clarifies the Best Quality strategy: "It then chooses the best link based on the configured quality criteria." This confirms it does not load balance

invalidating options B and D.

2. Fortinet FCSS - SD-WAN 7.4 Study Guide

"SD-WAN Load Balancing"

Page 99

100.

Page 100 describes the Volume algorithm: "FortiGate sends more traffic to the links with a higher-volume ratio. The ratio can be based on the link’s bandwidth capacity." This supports the concept in option A of load balancing based on bandwidth. These algorithms are applicable to strategies like maximize-bandwidth and manual.

Q: 8

Exhibit.

Refer to the exhibit, which shows the SD-WAN rule status and configuration. Based on the exhibit, which change in the measured packet loss will make HUB1-VPN3 the new preferred member?

Options

21 comments in the community discussion

Ryan T. 6

B . If HUB1-VPN1 hits 12% packet loss, it's out of SLA since the threshold is set to 5%. That kicks it out of the preferred pool, so the device has to move to the next available member that meets the standards. Pretty sure this is standard FortiGate SD-WAN logic with lowest cost and SLA failover. Let me know if I'm mis

Emma R. 1

A is wrong, B. Seen similar logic tested in official practice questions and the admin guides.

Correct Answer:

Explanation

The SD-WAN rule uses the Lowest Cost (SLA) strategy. This strategy selects the member with the lowest cost that is also meeting the criteria of the performance SLA. The InternetSLA specifies a packet loss threshold of 5%.

For HUB1-VPN3 (cost 20) to become the preferred member, the lower-cost members, HUB1-VPN1 (cost 0) and HUB1-VPN2 (cost 10), must both fail to meet the SLA. A member fails the SLA if its packet loss exceeds 5%.

Option B states that HUB1-VPN1 has 12% packet loss. Since 12% is greater than the 5% threshold, HUB1-VPN1 is disqualified. This is a necessary condition for the FortiGate to consider the next-lowest-cost member. The question implies this change leads to HUB1-VPN3 being selected, meaning HUB1-VPN2 is also assumed to be out of SLA.

Why Incorrect

A. When HUB1-VPN1 has 4% packet loss: A packet loss of 4% is within the 5% SLA threshold, so HUB1-VPN1 would remain the preferred, lowest-cost member.

C. When HUB1-VPN3 has 4% packet loss: This change does not affect the status of HUB1-VPN1, which remains in SLA and has a lower cost, so it continues to be the preferred member.

D. When all three members have the same packet loss: If the shared packet loss is below 5%, HUB1-VPN1 is still chosen due to its lower cost. If it's above 5%, all members are out of SLA.

References

1. FortiOS 7.4.0 SD-WAN Administration Guide

Page 53

"SD-WAN rules > Strategy": "Lowest Cost (SLA): FortiGate first checks which members meet the SLA criteria defined in the performance SLA. From this subset of members

FortiGate chooses the one with the lowest cost."

2. FortiOS 7.4.0 SD-WAN Administration Guide

Page 41

"Performance SLA > Link health monitor": "A performance SLA is considered to have failed

or be out of SLA

if any of the measured metrics (latency

jitter

or packet loss) have exceeded their configured thresholds." This confirms that a packet loss value greater than the threshold (5% in the exhibit) constitutes an SLA failure.

Q: 9

Refer to the exhibit.

The administrator analyzed the traffic between a branch FortiGate and the server located in the data center, and noticed the behavior shown in the diagram. When the LAN clients located behind FGT1 establish a session to a server behind DC-1, the administrator observes that, on DC-1, the reply traffic is routed overT2. even though T1 is the preferred member in the matching SD-WAN rule. What can the administrator do to instruct DC-1 to route the reply traffic through the member with the best performance?

Options

19 comments in the community discussion

Cameron Y. 4

Anyone else used the official guide or lab doc for this scenario? Pretty sure it also says auxiliary-session (option C) is needed for FortiGate to select the best SD-WAN member on reply traffic.

Casey R. 4

Option C is right. With auxiliary-session enabled, FortiGate re-evaluates the best SD-WAN member for reply sessions, so DC-1 can choose T1 if it's the top performer. I think that's key for dynamic path selection. Let me know if you read it differently.

Q: 10

Refer to the exhibit.

The exhibit shows output of the command diagnose sys adwan aervice4 collected on a FortiGate device. The administrator wants to know through which interface FortiGate will steer traffic from local users on subnet 10.0.1.0/255.255.255.192 and with a destination of the social media application Facebook. Based on the exhibits, which two statements are correct? (Choose two.)

Options

26 comments in the community discussion

Ethan G. 1

Pretty sure C and D, B tries to catch you if you forget app matching is before service checks.

Nina U. 1

Probably C and D, unless the app ID for Facebook changes or rule priorities are tweaked in config.

Correct Answer:

C, D

Explanation

Statement C is correct because the exhibit for SD-WAN rule 4 shows a specific match for the traffic in question (Source: 10.0.1.0/26, Destination Application: Facebook). The rule's mode is sla, and both members meet the SLA criteria. port2 has the higher priority (0) compared to port1 (1), so FortiGate selects port2 to steer the traffic. The reference to "service rule 2" is considered a typo for "service rule 4".

Statement D is correct as it describes the default behavior of the implicit SD-WAN rule. This rule, which is always present, catches any traffic not matched by other explicit rules and load-balances it across all available SD-WAN members. This is a fundamental concept of FortiGate SD-WAN operation.

Why Incorrect

A: The traffic for Facebook is recognized and matched by rule 4. It would not be handled as an unrecognized application by a different rule (rule 3).

B: This is factually incorrect. The exhibit for rule 4 explicitly lists dst(1): Facebook, confirming a service for the application is defined in the rule.

References

1. Fortinet FortiOS 7.4.0 Administration Guide:

Section: SD-WAN > SD-WAN rules: "FortiGate evaluates SD-WAN rules in the order that they appear in the list... For SLA strategy

FortiGate directs traffic to the first link in the list that meets the SLA." This supports the selection of port2 based on its higher priority (0) as shown in the exhibit.

Section: SD-WAN > SD-WAN rules: "An implicit rule is created by default... The implicit rule is the last rule in the list... The implicit rule load balances traffic that is not matched by any other rule in the list across all SD-WAN members." This confirms the behavior described in option D.

Section: SD-WAN > SD-WAN rules > Application steering: "When a new session starts

the application has not yet been identified... FortiGate steers the traffic to the first available member that is configured in the rule." This refutes option A

as the initial traffic would still be handled by rule 4's first member (port2)

not by another rule.

Question 1 of 20

Premium Access Includes

More FORTINET Practice Tests