Verified & Correct NSE6_SDW_AD-7.6 Practice Test Reliable Source Oct 26, 2026 Updated [Q11-Q32]

Rate this post

Verified & Correct NSE6_SDW_AD-7.6 Practice Test Reliable Source Oct 26, 2026 Updated

Free Fortinet NSE6_SDW_AD-7.6 Exam Files Downloaded Instantly

Fortinet NSE6_SDW_AD-7.6 Exam Syllabus Topics:

Topic	Details
Topic 1	Advanced IPsec: This section covers the deployment of advanced IPsec configurations within SD-WAN environments. It includes implementing hub-and-spoke IPsec topologies, configuring ADVPN, and supporting multihub, multiregion, and large-scale secure SD-WAN deployments.
Topic 2	Rules and routing: This section explains how to design and apply SD-WAN rules to control traffic steering across multiple WAN links. It also includes configuring SD-WAN routing to ensure proper path selection and connectivity between networks.
Topic 3	Centralized management: This domain focuses on deploying and managing SD-WAN using FortiManager for centralized control. It includes implementing branch configuration deployment and using SD-WAN Manager with overlay orchestration to simplify large-scale network management.
Topic 4	SD-WAN troubleshooting: This domain explains how to diagnose and resolve issues related to SD-WAN operation. It includes troubleshooting SD-WAN rules, session behavior, routing problems, and ADVPN connectivity to maintain reliable network performance.
Topic 5	SD-WAN setup: This domain covers how to deploy an enterprise SD-WAN environment by designing SD-WAN members and zones and configuring them for efficient traffic management. It also focuses on implementing Performance SLAs to monitor link quality and ensure applications use the best available path.

Q11. (In the context of SD-WAN, the terms underlay and overlay are commonly used to categorize links.
Which two statements about underlay and overlay links are correct? Choose two answers.)

A VLAN is a type of overlay link.

Overlay links provide routing flexibility.

FortiLink interface is considered an underlay link.

Wireless connections can be used to build overlay links.

Only wired connections can be used as underlay links.

Q12. Refer to the exhibit. Which two conclusions can you draw from the output shown? (Choose two.)

At least one SD-WAN rule is defined with application categories as the destination.

UDP traffic destined to the subnet 10.22.0.0/24 matches a manual SD-WAN rule.

At least one SD-WAN rule allows traffic load balancing.

UDP traffic destined to the subnet 10.22.0.0/24 matches a policy route.

Q13. Refer to the exhibit.

For your ZTP deployment, you review the CSV file shown in exhibit and note that it is missing important information.
Which two elements must you change before you can import it into FortManager? (Choose two.)

You must define a name for each device

You must define a value for each device and each user-defined motadata variable.

You must associate a device blueprint with each device.

You must define a value for each device and each metadata variable that defines an IP address.

Q14. Refer to the exhibit. Which statement best describe the role of the ADVPN device in handling traffic?

This is a hub that has received a query from a spoke and has forwarded it to another spoke.

This is a hub in a dual-region topology. The remote hub tunnel ID is 10.0.2.101.

This is a spoke that has received a shortcut query from another spoke and has forwarded the response to its hub.

This is a spoke. The kernel received a shortcut request and forwards the query to another spoke.

Q15. Refer to the exhibit. What can you conclude from the output shown?

It is a spoke device. SD-WAN rule 4 allows three shortcuts tunnels.

It’s a hub device. It allowed the establishment of three auto-discovery VPN (ADVPN) shortcuts.

It is a spoke device. SD-WAN rule 3 is configured with nine members.

It is a spoke device. The members of SD-WAN rule 3 are grouped into two zones.

Q16. Refer to the exhibit.

Two hub-and-spoke groups are connected through redundant site-to-site IPsec VPNs between Hub 1 and Hub 2.
Which two configuration settings are required for the spoke A1 to establish an ADVPN shortcut with the spoke B2? (Choose two.)

On hubs, auto-discovery-receiver must be enabled on the IPsec VPNs to spokes.

On hubs, auto-discovery-forwarder must be enabled on the IPsec VPNs to spokes.

On hubs, auto-discovery-forwarder must be enabled on the IPsec VPNs to hubs.

On hubs, auto-discovery-sender must be enabled on the IPsec VPNs to spokes.

Q17. You configured an SD-WAN rule with the best quality strategy and selected the predefined health check, Default_FortiGuard, to check the link performances against FortiGuard servers.
For the quality criteria, you selected Custom-profile-1.
Which factors does FortiGate use, and in which order. to determine the link that it should use to steer the traffic?

Latency – Member configuration order – Link cost threshold

Link quality index – Member configuration order – Link cost threshold

Links that meet the SLA targets – Member configuration order – Member local cost

Latency – Jitter – Packet loss – Bibandwidth – Member configuration order

Q18. The administrator uses the FortiManager SD-WAN overlay template to prepare an SD-WAN deployment. Using information provided through the SD-WAN overlay template wizard, FortiManager creates templates ready to install on the spoke and hub devices.
What are the three templates created by the SD-WAN overlay template for a spoke device?
(Choose three.)

Static route template

Rules template

CLI template

BGP template

IPsec tunnel template

Q19. Refer to the exhibits.

You use FortiManager to configure SD-WAN on three branch devices.
When you install the device settings, FortiManager prompts you with the error “Copy Failed” for the device branch1_fgt. When you click Log, FortiManager displays the message shown in the exhibit.
Based on the exhibits, which statement best describes the root cause of the issue?

You cannot combine metadata variables and installation targets.

The metadata variable definitions are incomplete or incorrect.

The connection between branch1_fgt and FortiManager failed.

Gateways for all members in a zone must be of the same type.

Q20. (Refer to the exhibit.

What can you conclude from the output shown? Choose one answer.)

It is a spoke device. SD-WAN rule 3 is configured with nine members.

It is a spoke device. The members of SD-WAN rule 3 are grouped into two zones.

It is a hub device. It allowed the establishment of three auto-discovery VPN (ADVPN) shortcuts.

It is a spoke device. SD-WAN rule 4 allows three shortcut tunnels.

Q21. Exhibit.

The administrator configured the IPsec tunnel VPN1 on a FortiGate device with the parameters shown in exhibit.
Based on the configuration, which three conclusions can you draw about the characteristics and requirements of the VPN tunnel? (Choose three.)

The tunnel interface IP address on the spoke side is provided by the hub.

The remote end can be a third-party IPsec device.

The administrator must manually assign the tunnel interface IP address on the hub side

The remote end must support IKEv2.

This configuration allows user-defined overlay IP addresses.

Q22. Refer to the exhibits. The exhibits show an SD-WAN event log, the member status, and the SD- WAN rule configuration.
Which two conclusions can you draw from the information shown? (Choose two.)

The administrator configured the service ID 1 with the highest priority member for port2.

Port2 has a lower latency than port1.

FortiGate updated the outgoing interface list on the rule so it prefers port2.

The administrator configured the SD-WAN rule ID 1 with the default strategy mode.

Q23. Refer to the exhibit.

You are using the FortiManager SD-WAN monitor menus to check the status of an SD-WAN topology. When you place the mouse next to branch1_fgt, you receive the output shown in the exhibit.
Which two conclusions can you draw from the output shown in the exhibit? (Choose two.)

branch1_fgt is configured with six SD-WAN overlay tunnels and three are down.

The three spokes have tunnels that are out of SLA.

The template Corp-SOT defines a dual-hub topology.

branch3_fgt is configured with three SD-WAN overlay tunnels and one is down.

Q24. Refer to the exhibit. Two hub-and-spoke groups are connected through redundant site-to-site IPsec VPNs between Hub 1 and Hub 2.
Which two configuration settings are required for the spoke A1 to establish an ADVPN shortcut with the spoke B2? (Choose two.)

On hubs, auto-discovery-forwarder must be enabled on the IPsec VPNs to hubs.

On hubs, auto-discovery-receiver must be enabled on the IPsec VPNs to spokes.

On hubs, auto-discovery-forwarder must be enabled on the IPsec VPNs to spokes.

On hubs, auto-discovery-sender must be enabled on the IPsec VPNs to spokes.

Q25. Refer to the exhibits.

The exhibits show two IPsec templates to define Branch IPsec 1 and Branch_IPsec_2. Each template defines a VPN tunnel. The error message that FortiManager displayed when the administrator tried to assign the second template to the FortiGate device is also shown.
Which statement best describes the cause of the issue?

You can assign only one template with a tunnel type of static to each FortiGate device.

You can assign only one IPsec template to each FortiGate device.

You should review the branch1_fgt configuration for configured tunnels in the rootVDOM.

You should use the same outgoing interface of both templates.

Q26. You have a FortiGate configuration with three user-defined SD-WAN zones and two members in each of these zones. One SD-WAN member is no longer in use in health-check and SD-WAN rules. You want to delete it.
What happens if you delete the SD-WAN member from the FortiGate GUI?

FodiGate accepts the deletion and removes routes as required.

FortiGate displays an error message. You must use the CLI to delete an SD-WAN member.

FortiGate displays an error message. SD-WAN zones must contain at least two members

FortiGate accepts the deletion and places the member in the default SD-WAN zone.

Q27. When you use the command diagnose sys session list, how do you identify the sessions that correspond to traffic steered according to SD-WAN rules?

You identify sessions steered according to SD-WAN rules with the flag vwl.

You cannot identify SD-WAN sessions. You must use the sdwar. session filter.

You identify sessions steered according to SD-WAN rules with the data vwl_mbr_seq.

You identify sessions steered according to SD-WAN rules with the data 3dwan_service_id.

Q28. Refer to the exhibit.

How does FortiGate handle the traffic with the source IP address 10.0.1.125 and the destination IP address 128.66.0.125?

FortiGate routes the traffic flow according to the forwarding information base (FIB).

FortiGate steers the traffic flow through port7.

FortiGate load balances the traffic flow through port7 and port8.

FortiGate drops the traffic flow.

Q29. Refer to the exhibit that shows a diagnose output on FortiGate.

Based on the output shown in the exhibit, what can you say about the device role and how it handles health checks?

The device is a spoke. It receives health-check measures for the tunnels of another spoke.

The device is a hub. It receives embedded health-check measures for each tunnel from the spoke.

The device is a spoke. It provides embedded health-check measures for each tunnel to the hub.

The device is a hub. It receives health-check measures for the tunnels of a spoke.

Q30. Which two statements are correct when traffic matches the implicit SD-WAN rule? (Choose two.)

The session information output displays no SD-WAN-specific details.

All SD-WAN rules have the default and gateway setting enabled.

Traffic does not match any of the entries in the policy route table.

Traffic is load balanced using the algorithm set for the v4-ecmp-mode setting.

Q31. You manage an SD-WAN topology. You will soon deploy 50 new branches.
Which three tasks can you do in advance to simplify this deployment? (Choose three.)

Create a ZTP template.

Create policy blueprint.

Update the DHCP server configuration.

Create model devices.

Define metadata variables value for each device.

Q32. Refer to the exhibit.

The administrator analyzed the traffic between a branch FortiGate and the server located in the data center, and noticed the behavior shown in the diagram.
When the LAN clients located behind FGT1 establish a session to a server behind DC-1, the administrator observes that, on DC-1, the reply traffic is routed overT2. even though T1 is the preferred member in the matching SD-WAN rule.
What can the administrator do to instruct DC-1 to route the reply traffic through the member with the best performance?