Free FCSS_SDW_AR-7.4: FCSS - SD-WAN 7.4 Architect Exam Questions and Answers

An administrator is troubleshooting SD-WAN routing on a FortiGate. Match each command with the information it displays. Commands: Item A: get router info routing-table all Item B: diagnose firewall proute list Item C: diagnose sys sdwan service4 Item D: diagnose sys sdwan health-check Information: Target 1: Policy routes that FortiGate generated from the SD-WAN rules Target 2: Each IPv4 SD-WAN rule with its members in the selection order Target 3: Active routes in the routing table with their egress interfaces Target 4: Probe results per member, such as latency, jitter, and packet loss

Drag or tap each item onto its target, then reveal.

Refer to the exhibit. A hub-and-spoke ADVPN deployment uses Hub1 and the spokes Spoke1 and Spoke2. Traffic between hosts behind Spoke1 and Spoke2 always passes through Hub1, and no shortcut tunnel is ever created. The tunnels to the hub are up and BGP routes are exchanged. The exhibit shows the phase 1 configuration on Hub1 and Spoke1. The configuration on Spoke2 matches Spoke1. Exhibit: Hub1 # show vpn ipsec phase1-interface HUB1-VPN config vpn ipsec phase1-interface edit "HUB1-VPN" set type dynamic set interface "port1" set peertype any set net-device disable set add-route disable set psksecret ENC ****** next end Spoke1 # show vpn ipsec phase1-interface HUB1-VPN config vpn ipsec phase1-interface edit "HUB1-VPN" set interface "port1" set peertype any set auto-discovery-receiver enable set remote-gw 203.0.113.10 set psksecret ENC ****** next end Which change enables the creation of shortcut tunnels between the spokes?

• AA. Enable auto-discovery-sender on the Hub1 phase 1 interface HUB1-VPN
• BB. Enable add-route on the Hub1 phase 1 interface HUB1-VPN
• CC. Enable auto-discovery-forwarder on the Spoke1 and Spoke2 phase 1 interfaces
• DD. Enable auto-discovery-receiver on the Hub1 phase 1 interface HUB1-VPN

Refer to the exhibit. An SD-WAN rule named Branch-Apps uses the Lowest Cost (SLA) strategy with the performance SLA Corp_Probe, which has a latency target of 100 ms. All three members are alive. The exhibit shows the member cost and the measured latency. Exhibit: Member Cost Latency (ms) port1 10 40 port2 5 120 port3 20 70 Which two statements about the traffic matching this rule are correct? (Choose two.)

Select 2 answers.

• AA. If port1 stops meeting the SLA, FortiGate sends new sessions to port3.
• BB. FortiGate sends new sessions to port2 because it has the lowest cost value.
• CC. FortiGate load balances new sessions between port1 and port3 because both members meet the SLA.
• DD. FortiGate sends new sessions to port1 because it is the lowest-cost member that meets the SLA.

Refer to the exhibit. An SD-WAN template is assigned to a device group of 30 branch FortiGate devices in FortiManager 7.4. The template sets the gateway of the member ISP1 to the metadata variable $(isp1_gw). The installation succeeds on 29 devices. The preview for BR-07 shows the error below. Exhibit: Install preview: BR-07 Status: Failed Error: metadata variable isp1_gw has no value for device BR-07 Which action fixes the installation for BR-07 without affecting the other branches?

• AA. Create a CLI template for BR-07 that defines the gateway, and assign it before the SD-WAN template
• BB. Assign a value to isp1_gw for BR-07 in the metadata variable settings of the device, then install again
• CC. Change the metadata variable to an ADOM-wide value so that all devices share one gateway address
• DD. Remove the gateway setting from the template so that the member uses the DHCP-assigned gateway on all branches

An administrator lowers the latency target in the performance SLA of an SD-WAN template that is assigned to a device group of 25 branch FortiGate devices. Another administrator has unapproved edits in the policy package that is also assigned to these devices. Only the SD-WAN template change must reach the branches now, and the policy package must stay untouched. Which deployment method meets the requirement?

• AA. Use the Install Wizard on the device group with Install Device Settings (only), then check the install preview
• BB. Edit the SLA target on each branch FortiGate and run Retrieve Config so that the device database matches
• CC. Use the Install Wizard on the device group with Install Interface Policy Only, then check the install preview
• DD. Use the Install Wizard on the device group with Install Policy Package & Device Settings after locking the ADOM

An administrator must deploy one SD-WAN template to 30 branch FortiGate devices from FortiManager. The primary internet link is port1 on some branches and wan1 on others. The template must define the ISP1 member once. Which configuration allows a single template to be used on all of the branches?

• AA. An SD-WAN template member that is set to the zone name, with the interface chosen later on each FortiGate
• BB. A CLI template that renames wan1 to port1 on the branches before the SD-WAN template is installed
• CC. A normalized interface as the member, mapped to port1 or wan1 for each branch
• DD. One SD-WAN template for each interface name, assigned to the matching devices

Refer to the exhibit. FGT-Branch # get router info routing-table all B 10.0.0.0/8 [200/0] via 10.255.1.1 (recursive is directly connected, HUB1-VPN1), 02:14:05 A branch FortiGate has IBGP sessions in AS 65000 with a hub over three overlay tunnels: HUB1-VPN1, HUB1-VPN2 and HUB1-VPN3. The BGP table contains three paths for 10.0.0.0/8, learned from 10.255.1.1, 10.255.2.1 and 10.255.3.1. All three paths have identical weight, local preference, AS path, origin and MED, but only the path through HUB1-VPN1 is installed. Which setting under config router bgp installs all three paths in the routing table?

• AA. set recursive-next-hop enable
• BB. set additional-path enable
• CC. set always-compare-med enable
• DD. set ibgp-multipath enable

A hub FortiGate terminates dial-up IPsec tunnels from 120 spokes and uses IBGP over the overlay. Each spoke receives its tunnel address from 10.255.1.0/24. The administrator does not want to create a neighbor entry for every spoke on the hub. What should the administrator configure under config router bgp on the hub?

• AA. An additional-path setting that accepts sessions from any address in 10.255.1.0/24
• BB. A single neighbor entry for 10.255.1.0 that uses a 24-bit mask
• CC. A network statement for 10.255.1.0/24 with redistribution of connected routes
• DD. A neighbor group and a neighbor range for 10.255.1.0/24 that references the group

Refer to the exhibit. Exhibit: config system sdwan config zone edit "ISP" next edit "LTE" next end config members edit 1 set interface "port1" set zone "ISP" next edit 2 set interface "port2" set zone "LTE" next end end config firewall policy edit 1 set name "LAN-to-Internet" set srcintf "port3" set dstintf "ISP" set srcaddr "all" set dstaddr "all" set action accept set schedule "always" set service "ALL" set nat enable next end An SD-WAN rule steers a session that enters on port3 to port2. Which statement describes what FortiGate does with this session?

• AA. FortiGate accepts the session and creates a temporary policy for the LTE zone from policy 1
• BB. FortiGate accepts the session with policy 1 because port2 is also reachable through the ISP zone
• CC. FortiGate denies the session because no firewall policy has the LTE zone as destination interface
• DD. FortiGate accepts the session with policy 1 and applies source NAT with the IP address of port1

A branch FortiGate has iBGP sessions with Hub1 and Hub2 over the overlays HUB1-VPN1 and HUB2-VPN1, both members of the SD-WAN zone overlay. Both hubs advertise 10.0.0.0/8 with identical local preference, AS path, and MED. The routing table shows 10.0.0.0/8 only through HUB1-VPN1, so an SD-WAN rule that prefers HUB2-VPN1 never selects it. Which setting should the administrator enable on the branch?

• AA. set graceful-restart enable under config router bgp
• BB. set ebgp-multipath enable under config router bgp
• CC. set ibgp-multipath enable under config router bgp
• DD. set additional-path enable under config router bgp