Free FCSS-SDW-AR-7.4 sample questions

Correct answers: Configure a BGP neighborship between the NA and EU hub FortiGates.; Enable `auto-discovery-sender` and `auto-discovery-receiver` on the inter-hub IPsec tunnels.

Establishing a BGP neighborship between the regional hubs is crucial for them to exchange spoke routing information. This allows a hub in one region to learn about the spokes connected to the hub in the other region, which is a prerequisite for shortcut negotiation.

Enabling auto-discovery sender and receiver roles on the IPsec tunnel connecting the two hubs allows them to forward IKE messages related to shortcut negotiation on behalf of their respective spokes. This is the core mechanism that facilitates inter-region shortcuts.

Correct answer: A metadata variable.

A metadata variable (e.g., `$(lan_subnet)`) is the correct feature. The architect can define this variable in the template's address object and then assign the specific subnet value for each branch in the device manager settings. FortiManager will substitute the correct value during deployment.

Correct answer: The Phase 1 or Phase 2 encryption/authentication algorithm settings are mismatched.

The "no proposal chosen" error message specifically indicates that the IKE peers (hub and spoke) could not agree on a common set of security parameters during either Phase 1 or Phase 2 negotiation. This is caused by a mismatch in the configured encryption algorithms, authentication methods, Diffie-Hellman groups, or key lifetimes.

Correct answer: It will load-balance new sessions between DIA-1 and DIA-2 based on their individual latency values.

When using the 'Best Quality' strategy, FortiGate first disqualifies any member that violates the SLA (in this case, MPLS). From the remaining members that are within SLA (DIA-1 and DIA-2), it will select the one with the best performance based on the SLA criteria (latency). If multiple links are viable, it may load-balance or prefer the best one, but it will only use the links that meet the SLA.

Correct answer: True

True. The SD-WAN Overlay Template in FortiManager is a powerful automation tool. It can be configured to not only create the IPsec tunnels but also to automatically generate the corresponding BGP configurations for the hub and spokes, significantly simplifying the deployment of dynamic routing across the overlay.

Correct answer: Create a Performance SLA that only measures jitter. Create an SD-WAN rule for EHR/VoIP traffic using the 'Best Quality' strategy and select this SLA.

This is the correct approach. The 'Best Quality' strategy makes its decision based on the metrics defined in the selected Performance SLA. By creating an SLA that exclusively measures jitter, the architect ensures that the path selection for the specified applications will be based solely on which active link has the lowest jitter.

Correct answer: The traffic will be processed by the implicit SD-WAN rule, which load-balances based on source IP.

In the absence of any explicit SD-WAN rules, traffic is matched by the default implicit rule. The default behavior of this rule is to load-balance traffic across all available SD-WAN member interfaces using a source IP-based algorithm.

Correct answer: The `auto-discovery-forwarder` setting is not enabled on the hub FortiGates' IPsec Phase 1 configuration.

For hubs to facilitate shortcuts for spokes that are not their direct clients, they must be able to forward the IKE information messages used for negotiation. The `set auto-discovery-forwarder enable` command on the hub's Phase 1 interface allows it to forward these messages to the other hub, which is essential for inter-hub shortcut establishment.

Correct answers: DHCP; DNS

A new FortiGate, by default, will act as a DHCP client on its WAN interface. It can receive the FortiManager's IP address via DHCP option 240, which is one of the primary methods for ZTP discovery.

If DHCP discovery fails or is not configured, the FortiGate will attempt to resolve a predefined FQDN (e.g., `fortimanager.fortinet.net` or a custom one) to find the IP address of its FortiManager, making DNS a key part of the ZTP discovery process.

Correct answer: To show the real-time status and measured metrics (latency, jitter, packet loss) for all configured Performance SLAs.

This command provides a detailed, real-time view of each configured Performance SLA health check, showing which member interfaces are being monitored, their current status (alive or dead), and the measured values for latency, jitter, and packet loss.