VendorsExamsEnterprise
Support
Request an ExamContact UsFAQ

Fortinet NSE 6 - SD-WAN 7.6 Enterprise Administrator Free Sample Questions

Description

Covers enterprise SD-WAN setup with members, zones, and SLAs, SD-WAN rules and routing, centralized deployment from FortiManager, hub-and-spoke IPsec topologies, and troubleshooting.

12 free sample questions117 in the full practice test

Try simulator

NSE6_SDW_AD-7.6 Sample Questions

  1. Question 1

    Beginner

    SD-WAN Setup · Design SD-WAN members and zones

    An administrator is configuring an SD-WAN zone on a FortiGate device running FortiOS 7.6. The goal is to group two physical WAN interfaces and one IPsec VPN tunnel interface into a single zone for simplified policy management.

    Which statement correctly describes the restriction or behavior when adding these interfaces to an SD-WAN zone?

    Answer and explanation

    Correct answer: C

    Before an interface can be added to an SD-WAN zone (or used as an SD-WAN member), it must not be referenced in any existing firewall policies, routes, or other configurations. You must remove all references first.

  2. Question 2

    Intermediate

    Centralized Management · Implement branch configuration deployment

    A network architect is designing an SD-WAN deployment using FortiManager 7.6 to manage 500 branch locations. The branches use a standardized hardware model but have unique WAN IP addresses and gateway configurations.

    Which FortiManager feature should be used to apply a single SD-WAN template to all devices while handling the unique addressing requirements?

    Answer and explanation

    Correct answer: A

    Meta fields (variables) allow you to define per-device values (like WAN IPs and gateways) that are referenced in a shared template. When the template is installed, FortiManager substitutes the variable with the specific device's value.

  3. Question 3

    Intermediate

    Rules and Routing · Design SD-WAN rules

    An organization requires an SD-WAN rule for VoIP traffic. The requirement is to always use the link with the lowest latency, but if the latency difference between the best and second-best link is less than 5ms, the traffic should not switch to prevent instability.

    Which configuration setting in the SD-WAN rule handles this requirement?

    Answer and explanation

    Correct answer: D

    The 'link-cost-threshold' (or sometimes referred to as quality comparison threshold depending on context, though often configured as part of the SLA or rule logic) defines the minimum difference required to switch links in a Lowest Cost or Best Quality strategy to prevent flapping.

  4. Question 4

    Intermediate

    Advanced IPsec · Configure ADVPN

    Examine the following diagram showing an ADVPN topology.

    Which protocol is primarily responsible for allowing Spoke A to learn the dynamic public IP address of Spoke B to establish a direct shortcut tunnel?

    Answer and explanation

    Correct answer: B

    NHRP (Next Hop Resolution Protocol) is used in ADVPN. The Hub acts as the NHRP server and Spokes as clients. When Spoke A wants to send traffic to Spoke B, it queries the Hub via NHRP to resolve Spoke B's physical (NBMA) IP address.

  5. Question 5

    Advanced

    SD-WAN Setup · Implement Performance SLAs

    A FortiGate administrator needs to configure a Performance SLA to monitor a SaaS application (e.g., Salesforce). The requirement is to use a method that does not generate synthetic traffic but relies on actual user traffic to measure latency and packet loss.

    Which type of probe should be configured?

    Answer and explanation

    Correct answer: D

    Passive WAN health measurement uses actual user traffic (TCP sessions) passing through the FortiGate to calculate latency and packet loss, rather than generating synthetic probes like Ping or HTTP.

  6. Question 6

    Intermediate

    SD-WAN Troubleshooting · Troubleshoot SD-WAN rules and sessions behavior

    While troubleshooting an SD-WAN deployment, an administrator notices that traffic is not matching the expected SD-WAN rule.

    Which command is best suited to view the specific SD-WAN rule that a particular traffic flow is matching in real-time?

    Answer and explanation

    Correct answer: D

    While 'diagnose sys session list' shows the final result, 'diagnose firewall proute list' (policy route list) displays the SD-WAN rules (which are implemented as policy routes in the kernel) and their hit counts. However, for a specific flow, analyzing the session table filter is often used. But between the options, verifying the rules themselves is done via proute or viewing the configuration. Self-Correction: The question asks for the rule a flow matches. The most definitive way is diagnose sys session list with a filter, looking for the policy_route field. Let's reconsider. Actually, diagnose sys sdwan service lists the rules configuration. diagnose firewall proute list lists the kernel policy routes. To see what a flow matches, you use diagnose sys session list. Let's rephrase the question to be about checking the rule configuration status vs flow. If the question asks for the command to verify rule configuration and status, it's diagnose sys sdwan service. If it asks what rule a packet hit, it's a debug flow or session list. Let's assume the question asks to see the rule configuration and health status.

Register free for 6 more questions

Or unlock all 117 NSE6_SDW_AD-7.6 questions with explanations, timed mode and flashcards.

Related practice tests

All Fortinet practice exams