Free FCSS_SDW_AR-7.6: FCSS - SD-WAN 7.6 Architect Exam Questions and Answers

Refer to the exhibit. An administrator tries to add port2 as an SD-WAN member and receives an error stating that the interface is in use. The exhibit shows the configuration that references port2. Exhibit: config router static edit 3 set dst 10.20.0.0 255.255.0.0 set gateway 172.16.8.1 set device "port2" next end config firewall policy edit 12 set name "LAN-to-WAN2" set srcintf "port5" set dstintf "port2" set srcaddr "all" set dstaddr "all" set action accept set schedule "always" set service "ALL" set nat enable next end Which action must the administrator take so that port2 can be added as an SD-WAN member?

• AA. Set the role of port2 to WAN and disable the interface before adding it as a member
• BB. Create the member in the default virtual-wan-link zone first, then move it to a new SD-WAN zone
• CC. Delete the static route and the firewall policy that reference port2, then recreate them using the SD-WAN zone
• DD. Raise the administrative distance of the static route above the distance used by the SD-WAN routes

Which command should an administrator run on a FortiGate to display, for each SD-WAN rule, the members that currently meet the SLA and the member that is selected?

• AA. diagnose sys sdwan member
• BB. diagnose sys sdwan health-check
• CC. diagnose sys sdwan intf-sla-log
• DD. diagnose sys sdwan service

Refer to the exhibit. SD-WAN rule 1 uses the Lowest Cost (SLA) strategy with port1 and port2 as members and the SLA target DNS_Probe#1. The cost of port1 is 5 and the cost of port2 is 10. The exhibit shows the performance SLA configuration and the health-check output. Exhibit: config health-check edit "DNS_Probe" set server "4.2.2.1" set members 1 2 config sla edit 1 set latency-threshold 100 set jitter-threshold 30 set packetloss-threshold 2 next end next end # diagnose sys sdwan health-check DNS_Probe Health Check(DNS_Probe): Seq(1 port1): state(alive), packet-loss(0.000%) latency(142.318), jitter(6.054), mos(4.126), sla_map=0x0 Seq(2 port2): state(alive), packet-loss(0.000%) latency(38.442), jitter(2.110), mos(4.380), sla_map=0x1 Which statement describes how new sessions that match rule 1 are steered?

• AA. Traffic uses port1 because it has the lowest cost and its state is alive
• BB. Traffic is dropped because the rule does not match once any member exceeds an SLA threshold
• CC. Traffic uses port2 because port1 exceeds the latency threshold and is not eligible for the rule
• DD. Traffic is load balanced across port1 and port2 because both members are alive

A hub FortiGate peers with its spokes using IBGP through a neighbor group. Which BGP neighbor-group setting allows the hub to readvertise routes learned from one spoke to the other spokes?

• AA. set next-hop-self enable
• BB. set ebgp-enforce-multihop enable
• CC. set soft-reconfiguration enable
• DD. set route-reflector-client enable

An administrator is configuring an SD-WAN rule that uses the Best Quality strategy. Which two statements are true? (Choose two.)

Select 2 answers.

• AA. The quality criteria can be latency, jitter, packet loss, or bandwidth, depending on the measurement to compare
• BB. The rule must reference a performance SLA that probes all members in its interface preference list
• CC. The rule evaluates quality only for members that currently meet every SLA target in the performance SLA
• DD. Each member in the preference list must have a cost value, because the rule selects the member with the lowest cost

An administrator edits an SD-WAN rule so that traffic to 198.51.100.50 uses port2 instead of port1. A continuous TCP transfer to that server started before the change is still leaving through port1, although the rule now selects port2. Which action lets the administrator confirm that the new rule steers the traffic?

• AA. Filter and clear the existing session with diagnose sys session, then restart the transfer
• BB. Lower the health-check interval so that existing sessions are re-evaluated against the rule
• CC. Disable and re-enable the performance SLA used by the rule before restarting the transfer
• DD. Run execute router restart to force SD-WAN to reselect the member for every session

A hub FortiGate terminates dial-up IPsec tunnels from branch FortiGate devices and exchanges routes with them using BGP. The administrator finds IKE-injected static routes for the spoke subnets in the hub routing table, next to the BGP routes. Which phase 1 setting should the administrator configure on the hub to stop IKE from adding these routes?

• AA. set add-route disable
• BB. set exchange-interface-ip enable
• CC. set net-device enable
• DD. set auto-discovery-sender enable

Refer to the exhibit. config system sdwan set status enable config zone edit "virtual-wan-link" next edit "underlay" next edit "overlay" next end config members edit 1 set interface "port1" set zone "underlay" next edit 2 set interface "port3" set zone "underlay" next edit 3 set interface "HUB1-VPN1" set zone "overlay" next edit 4 set interface "HUB1-VPN2" set zone "overlay" next end end Which two statements are true about this configuration? (Choose two.)

Select 2 answers.

• AA. Interface port1 can also be a member of the overlay zone if the second member entry uses a different sequence ID
• BB. A firewall policy with overlay as destination interface applies to traffic that leaves through HUB1-VPN1 or HUB1-VPN2
• CC. Moving port3 from the underlay zone to the overlay zone changes which firewall policies match traffic leaving port3
• DD. A firewall policy with port1 as destination interface still matches traffic while port1 is a member of the underlay zone

Refer to the exhibit. Hub-1 phase1 (show full-configuration): config vpn ipsec phase1-interface edit "HUB1-VPN1" set type dynamic set interface "port1" set net-device disable set auto-discovery-sender enable next end Spoke-1 phase1 (show full-configuration): config vpn ipsec phase1-interface edit "HUB1-VPN1" set interface "port1" set remote-gw 203.0.113.10 set net-device enable set auto-discovery-sender disable set auto-discovery-receiver disable next end Spoke-2 has the same phase1 settings as Spoke-1. Both spokes are connected to Hub-1 and have learned each other's LAN subnets through BGP. Traffic between the two spokes always passes through Hub-1, and no shortcut tunnel is ever created. Which configuration change on the FortiGate devices will fix the problem?

• AA. Set net-device to disable on the phase1 interface of each spoke
• BB. Enable auto-discovery-receiver on the phase1 interface of each spoke
• CC. Enable auto-discovery-sender on the phase1 interface of each spoke
• DD. Enable auto-discovery-forwarder on the Hub-1 phase1 interface

Refer to the exhibit. config system sdwan config health-check edit "DNS_HC" set server "8.8.8.8" set protocol ping set interval 1000 set probe-timeout 500 set failtime 3 set recoverytime 8 set members 0 next end end port1 is marked dead by this health check. The ISP then restores the link, and every probe sent after that moment receives a reply. Approximately how long will it take before FortiGate marks port1 as alive again?

• AA. 1 second
• BB. 3 seconds
• CC. 8 seconds
• DD. 11 seconds