Free FCSS_SDW_AR-7.4: FCSS - SD-WAN 7.4 Architect Exam Questions and Answers

Last updated: September 19, 2026

Provider

Fortinet

Questions in our bank

1000+

Free to read

First 10, with answers

Our test mode duration & pass mark

130 mins · 70%

Verified answers

Reviewed weekly

Practice format

Multiple choice

Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.

1. Question #1

   Which two statements correctly describe what happens when traffic matches the implicit SD-WAN rule? (Choose two.)

   Select 2 answers.

   • A. The session information output displays no SD-WAN service id.
   • B. Traffic is load balanced using the algorithm set for the v4-ecmp-mode setting.
   • C. The traffic is distributed, regardless of weight, through all available static routes.
   • D. Traffic does not match any of the entries in the policy route table.
   • E. FortiGate flags the session with may_dirty and vwl_def ault.
   Reveal Answer

2. Question #2

   Exhibit. Which action will FortiGate take if it detects SD-WAN members as dead?

   
   • A. FoftiGate bounces port5 after it detects all SD-WAN members as dead.
   • B. FortiGate fails over to the secondary device after it detects port5 as dead.
   • C. FortiGate sends alert messages through poft5 when it detects all SD-WAN members as dead
   • D. FortiGate brings down port5 after it detects all SD-WAN members as dead.
   Reveal Answer

3. Question #3

   You are planning a large SD-WAN deployment with approximately 1000 spokes and want to allow ADVPN between the spokes. Some remote sites use FortiSASE to connect to the company's SD-WAN hub. Which overlay routing configuration should you use?

   • A. BGP on loopback with dynamic BGP for ADVPN shortcut routing.
   • B. BGP on loopback with IPsec phase2 selectors for ADVPN shortcut routing.
   • C. BGP per overlay with dynamic BGP for ADVPN shortcut routing.
   • D. BGP per overlay with BGP next-hop convergence for ADVPN shortcut routing.
   Reveal Answer

4. Question #4

   Refer to the exhibits. The exhibits show the source NAT (SNAT) global setting. port2 interface settings, and the routing table on FortiGate. The administrator increases the member priority on port2 to 20. Upon configuration changes and the receipt of new packets, which two actions does FortiGate perform on existing sessions established over port2? (Choose two.)

   

   Select 2 answers.

   • A. FortiGate continues routing all existing sessions over port2.
   • B. FortiGate routes only new sessions over port2.
   • C. FortiGate flags the SNAT session as dirty only if the administrator has assigned an IP pool to the firewall policies with NAT.
   • D. FortiGate flags the sessions as dirty.
   • E. FortiGate updates the gateway information of the sessionswith SNAT so that they use port1instead of port2.
   Reveal Answer

5. Question #5

   Refer to the exhibit. Which statement best describe the role of the ADVPN device in handling traffic?

   
   • A. This is a hub that has received a query from a spoke and has forwarded it to another spoke.
   • B. This is a hub in a dual-region topology. The remote hub tunnel ID is 10.0.2.101.
   • C. This is a spoke that has received a shortcut query from another spoke and has forwarded the response to its hub.
   • D. This is a spoke. The kernel received a shortcut request and forwards the query to another spoke.
   Reveal Answer

6. Question #6

   Refer to the exhibits. The exhibits show two IPsec templates to define Branch IPsec 1 and Branch_IPsec_2. Each template defines a VPN tunnel. The error message that FortiManager displayed when the administrator tried to assign the second template to the FortiGate device is also shown. Which statement best describes the cause of the issue?

   
   • A. You can assign only one template with a tunnel type of static to each FortiGate device.
   • B. You can assign only one IPsec template to each FortiGate device.
   • C. You should review the branch1_fgt configuration for configured tunnels in the rootVDOM.
   • D. You should use the same outgoing interface of both templates.
   Reveal Answer

7. Question #7

   Which statement describes FortiGate behavior when you reference a zone in a static route?

   • A. FoftiGate installs ECMP static routes for the first two members of the zone.
   • B. FortiGate ignores the static routes defined through members referenced in the zone.
   • C. FortiGate routes the traffic through the best performing member of the zone.
   • D. FortiGate installs a static route for each member in the zone.
   Reveal Answer

8. Question #8

   Refer to the exhibit. An administrator is troubleshooting SD-WAN on FortiGate. A device behind branch1_fgtgenerates traffic to the 10.0.0.0/8 network. The administrator expects the traffic to match SD-WAN rule ID 1 and be routed over HUB1- VPN1. However, the traffic is routed over HUB1-VPN3. Based on the output shown in the exhibit, which two reasons, individually or together, could explain the observed behavior? (Choose two.)

   

   Select 2 answers.

   • A. HUB1-VPN3 has a higher member configuration priority than HUB1-VPN1.
   • B. The traffic matches a regular policy route configured with HUB1-VPN3 as the outgoing device
   • C. HUB1-VPN1 does not have a valid route to the destination
   • D. HUB1-VPN3 has a lower route priority value (higher priority) than HUB1-VPN1.
   Reveal Answer

9. Question #9

   Refer to the exhibit. Which SD-WAN rule and interface uses FortiGate to steer the traffic from the LAN subnet 10.0.1.0/24 to the corporate server 10.2.5.254?

   
   • A. SD-WAN service rule 3 and interface HUB1-VPN2.
   • B. SD-WAN service rule 3 and interface HUB1-VPN3.
   • C. SD-WAN service rule 4 and port1or port2.
   • D. SD-WAN service rule 4 and interface port2.
   Reveal Answer

10. Question #10

    You are tasked with configuring ADVPN 2.0 on an SD-WAN topology already configured for ADVPN. What should you do to implement ADVPN 2.0 in this scenario?

    • A. Update the IPsec tunnel configurations on the hub.
    • B. Update the SD-WAN configuration on the branches.
    • C. Update the IPsec tunnel configuration on the branches.
    • D. Delete the existing ADVPN configuration and configure ADVPN 2.0.
    Reveal Answer