[2025年11月19日]FCSS_SDW_AR-7.4試験問題集でリアル試験と100%同じ問題と解答 [Q16-Q37]

[2025年11月19日]FCSS_SDW_AR-7.4試験問題集でリアル試験と100%同じ問題と解答

FCSS_SDW_AR-7.4テストエンジン問題集トレーニングには51問あります

質問 # 16
Refer to the exhibit.

Which statement best describe the role of the ADVPN device in handling traffic?

A. This is a hub that has received a query from a spoke and has forwarded it to another spoke.
B. This is a spoke. The kernel received a shortcut request and forwards the query to another spoke.
C. This is a hub in a dual-region topology. The remote hub tunnel ID is 10.0.2.101.
D. This is a spoke that has received a shortcut query from another spoke and has forwarded the response to its hub.

正解：D

質問 # 17
Which statement describes FortiGate behavior when you reference a zone in a static route?

A. FortiGate routes the traffic through the best performing member of the zone.
B. FoftiGate installs ECMP static routes for the first two members of the zone.
C. FortiGate ignores the static routes defined through members referenced in the zone.
D. FortiGate installs a static route for each member in the zone.

正解：D

質問 # 18
Refer to the exhibits. The exhibits show two IPsec templates to define Branch IPsec 1 and Branch_IPsec_2. Each template defines a VPN tunnel. The error message that FortiManager displayed when the administrator tried to assign the second template to the FortiGate device is also shown. Which statement best describes the cause of the issue?

A. You can assign only one template with a tunnel type of static to each FortiGate device.
B. You can assign only one IPsec template to each FortiGate device.
C. You should use the same outgoing interface of both templates.
D. You should review the branch1_fgt configuration for configured tunnels in the rootVDOM.

正解：B

質問 # 19
Refer to the exhibit. The administrator configured the IPsec tunnel VPN1 on a FortiGate device with the parameters shown in exhibit.
Based on the configuration, which three conclusions can you draw about the characteristics and requirements of the VPN tunnel? (Choose three.)

A. The tunnel interface IP address on the spoke side is provided by the hub.
B. This configuration allows user-defined overlay IP addresses.
C. The administrator must manually assign the tunnel interface IP address on the hub side
D. The remote end can be a third-party IPsec device.
E. The remote end must support IKEv2.

正解：B、C、D

質問 # 20
Refer to the exhibits. You use FortiManager to manage the branch devices and configure the SD- WAN template. You have configured direct internet access (DIA) for the IT department users.
Now. you must configure secure internet access (SIA) for all local LAN users and have set the firewall policies as shown in the second exhibit.
Then, when you use the install wizard to install the configuration and the policy package on the branch devices, FortiManager reports an error as shown in the third exhibit. Which statement describes why FortiManager could not install the configuration on the branches?

A. You cannot install firewall policies that reference an SD-WAN zone.
B. You cannot install SIA and DIA rules on the same device.
C. You cannot install firewall policies that reference an SD-WAN member.
D. You must direct SIA traffic to a VPN tunnel.

正解：C

質問 # 21
Refer to the exhibits. The exhibits show the configuration for SD-WAN performance. SD-WAN rule, the application IDs of Facebook and YouTube along with the firewall policy configuration and the underlay zone status. Which two statements are true about the health and performance of SD-WAN members 3 and 4? (Choose two.)

A. The performance is an average of the metrics measured for Facebook and YouTube traffic passing through the member.
B. Encrypted traffic is not used for the performance measurement.
C. FortiGate identifies the member as dead when there is no Facebook and YouTube traffic passing through the member.
D. Only related TCP traffic is used for performance measurement.

正解：A、D

質問 # 22
What is true about SD-WAN multiregion topologies?

A. Regions must correspond to geographical areas.
B. Routing between the hub and spokes must be BGP.
C. Each region has its own SD-WAN topology.
D. It is not compatible with ADVPN.

正解：C

質問 # 23
Refer to the exhibit.

Refer to the exhibit that shows event logs on FortiGate.
Based on the output shown in the exhibit, what can you say about the tunnels on this device?

A. The device steers voice traffic through the VPN tunnel HUB1-VPN3.
B. The VPN tunnel HUB1-VPN1_0 is a shortcut tunnel.
C. There is one shortcut tunnel built from master tunnel VPN4.
D. The master tunnel HU82-VPN3 cannot accept ADVPN shortcuts.

正解：A

質問 # 24
You manage an SD-WAN topology. You will soon deploy 50 new branches.
Which three tasks can you do in advance to simplify this deployment? (Choose three.)

A. Create a ZTP template.
B. Create policy blueprint.
C. Update the DHCP server configuration.
D. Create model devices.
E. Define metadata variables value for each device.

正解：A、B、D

質問 # 25
Refer to the exhibit. Which action will FortiGate take if it detects SD-WAN members as dead?

A. FoftiGate bounces port5 after it detects all SD-WAN members as dead.
B. FortiGate sends alert messages through poft5 when it detects all SD-WAN members as dead.
C. FortiGate fails over to the secondary device after it detects port5 as dead.
D. FortiGate brings down port5 after it detects all SD-WAN members as dead.

正解：D

質問 # 26
Refer to the exhibits. You use FortiManager to configure SD-WAN on three branch devices.
When you install the device settings. FortiManager prompts you with the error "Copy Failed" for the device branch1_fat When you click the log button. FortiManager displays the message shown in the exhibit.
Based on the exhibits, which statement best describes the issue and how you can resolve it?

A. Gateways for all members in a zone must be defined the same way. Specify the gateway of the SD- WAN member port! without metadata variables.
B. Check the metadata variable definitions, and review the per-device mapping configuration.
C. Check the connection between branch1_fgt and FortiManager
D. Remove the installation target for the SD-WAN member port4. You cannot combine metadata variable and installation targets.

正解：D

質問 # 27
The SD-WAN overlay template helps to prepare SD-WAN deployments. To complete the tasks performed by the SD-WAN overlay template, the administrator must perform some post-run tasks.
What are two mandatory post-run tasks that must be performed? (Choose two.)

A. Assign an sdwan_id metadata variable to each device (branch and hub)
B. Configure SD-WAN rules
C. Assign a hub id metadata variable to each hub device.
D. Configure routing through the overlay tunnels created by the SD-WAN overlay template.
E. Create policy packages and assign them to the branch devices.

正解：B、E

質問 # 28
Refer to the exhibit.

An administrator is troubleshooting SD-WAN on FortiGate. A device behind branch1_fgt generates traffic to the 10.0.0.0/8 network.
The administrator expects the traffic to match SD-WAN rule ID 1 and be routed over HUB1-VPN1. However, the traffic is routed over HUB1-VPN3.
Based on the output shown in the exhibit, which two reasons, individually or together, could explain the observed behavior? (Choose two.)

A. HUB1-VPN1 does not have a valid route to the destination
B. HUB1-VPN3 has a lower route priority value (higher priority) than HUB1-VPN1.
C. HUB1-VPN3 has a higher member configuration priority than HUB1-VPN1.
D. The traffic matches a regular policy route configured with HUB1-VPN3 as the outgoing device

正解：B、C

質問 # 29
Exhibit.

The administrator configured the IPsec tunnel VPN1 on a FortiGate device with the parameters shown in exhibit.
Based on the configuration, which three conclusions can you draw about the characteristics and requirements of the VPN tunnel? (Choose three.)

A. The tunnel interface IP address on the spoke side is provided by the hub.
B. This configuration allows user-defined overlay IP addresses.
C. The administrator must manually assign the tunnel interface IP address on the hub side
D. The remote end can be a third-party IPsec device.
E. The remote end must support IKEv2.

正解：B、C、D

質問 # 30
Refer to the exhibits. An administrator is testing application steering in SD-WAN. Before generating test traffic, the administrator collected the information shown in the first exhibit. After generating GoToMeeting test traffic, the administrator examined the corresponding traffic log on FortiAnalyzer, which is shown in the second exhibit.
The administrator noticed that the traffic matched the implicit SD-WAN rule, but they expected the traffic to match rule ID 1.
Which two reasons explain why some log messages show that the traffic matched the implicit SD- WAN rule? (Choose two.)

A. Full SSL inspection is not enabled on the matching firewall policy.
B. No configured SD-WAN rule matches the traffic related to the collaboration application GoToMeeting
C. The session 3-tuple did not match any of the existing entries in the ISDB application cache.
D. FortiGate could not refresh the routing information on the session after the application was detected.

正解：C、D

質問 # 31
Refer to the exhibit that shows VPN event logs on FortiGate.

Based on the output shown in the exhibit, which statement is true?

A. There are no IPsec tunnel statistics log messages for ADVPN shortcuts.
B. There is one shortcut tunnel built from master tunnel T_MPLS_0.
C. The VPN tunnel T_MPLS_0 is a shortcut tunnel.
D. The master tunnel T_INET_0 cannot accept the ADVPN shortcut.

正解：C

解説：
When reviewing VPN log messages, the field advpnsc will help you identify the shortcut VPN tunnels.
FortiGate will set advpnsc value 1 for any log messages related to shortcut tunnels; for any other tunnel, the advpnsc value is set to 0.

質問 # 32
Which three characteristics apply to provisioning templates available on FortiManager? (Choose three.)

A. A CLI template group can contain CLI templates of both types.
B. A template group can include a system template and an SD-WAN template.
C. A CLI template can be of type CLI script or Perl script.
D. Each template group can contain up to three IPsec tunnel templates.
E. CLI templates are applied in order, from top to bottom

正解：A、B、E

質問 # 33
Refer to the exhibit. Which SD-WAN rule and interface uses FortiGate to steer the traffic from the LAN subnet 10.0.1.0/24 to the corporate server 10.2.5.254?

A. SD-WAN service rule 4 and port1 or port2.
B. SD-WAN service rule 4 and interface port2.
C. SD-WAN service rule 3 and interface HUB1-VPN2.
D. SD-WAN service rule 3 and interface HUB1-VPN3.

正解：D

質問 # 34
Refer to the exhibit. You want to configure SD-WAN on a network as shown in the exhibit. The network contains many FortiGate devices. Some are used as NGFW, and some are installed with extensions such as FortiSwitch, FortiAP or FortiExtender. What should you consider when planning your deployment?

A. You must use FortiManager to manage your SD-WAN topology.
B. You can build an SD-WAN topology that includes all devices. The hubs can be FortiGate devices with Forti Extender.
C. You must build multiple SD-WAN topologies. Each topology must contain only one type of extension.
D. You can build an SD-WAN topology that includes all devices. The hubs must be devices without extensions.

正解：D

質問 # 35
Refer to the exhibit.

Which SD-WAN rule and interface uses FortiGate to steer the traffic from the LAN subnet 10.0.1.0/24 to the corporate server 10.2.5.254?

A. SD-WAN service rule 4 and port1 or port2.
B. SD-WAN service rule 4 and interface port2.
C. SD-WAN service rule 3 and interface HUB1-VPN2.
D. SD-WAN service rule 3 and interface HUB1-VPN3.

正解：D

質問 # 36
An administrator is configuring SD-WAN to load balance their network traffic. Which two things should they consider when setting up SD-WAN? (Choose two.)

A. SD-WAN load balancing is possible only using the best quality and lowest cost (SLA) strategies.
B. You can select the outbandwidth hash mode with all strategies that allow load balancing.
C. When applicable. FortiGate load balances the traffic through all members that meet the SLA target.
D. Only the manual and best-quality strategies allow SD-WAN load balancing.

正解：A、B

質問 # 37
......

Fortinet FCSS_SDW_AR-7.4 認定試験の出題範囲：

トピック	出題範囲
トピック 1	Configure Performances SLAs: Designed for network administrators, this part focuses on setting up performance Service Level Agreements (SLAs) within SD-WAN environments. Candidates must show proficiency in defining criteria to monitor and maintain network performance and reliability.
トピック 2	Advanced IPsec: Intended for security engineers, this section covers the deployment of advanced IPsec topologies for SD-WAN, including hub-and-spoke models, ADVPN configurations, and complex multi-hub or multi-region deployments. Candidates need to demonstrate expertise in securing wide-area networks using IPsec technologies.
トピック 3	SD-WAN Configuration: This section of the exam measures the skills of network engineers and covers configuring a basic SD-WAN setup. Candidates are expected to demonstrate their ability to define SD-WAN members and zones effectively, ensuring foundational network segmentation and management.
トピック 4	SD-WAN Troubleshooting: This part assesses the troubleshooting skills of network support specialists. Candidates should be able to diagnose and resolve issues related to SD-WAN rules, session behaviors, routing inconsistencies, and ADVPN connectivity problems to maintain seamless network operations.