最新 [2026年04月] 効果的な学習法でGoShikenの問題集でNSE6_SDW_AD-7.6テストを合格せよ
実績のある受験者のシミュレーションされたNSE6_SDW_AD-7.6試験PDF問題を試そう
質問 # 44
The administrator uses the FortiManager SD-WAN overlay template to prepare an SD-WAN deployment.
Using information provided through the SD-WAN overlay template wizard, FortiManager creates templates ready to install on the spoke and hub devices.
What are the three templates created by the SD-WAN overlay template for a spoke device? (Choose three.)
- A. Rules template
- B. CLI template
- C. BGP template
- D. Static route template
- E. IPsec tunnel template
正解：A、C、E
解説：
Rules template # Defines the SD-WAN rules for traffic steering.
BGP template # Configures dynamic routing for overlay tunnels.
IPsec tunnel template # Builds the IPsec VPN tunnels from the spoke to the hubs.
質問 # 45
You are planning a new SD-WAN deployment with the following criteria:
- Two regions
- Most of the traffic is expected to remain within its region
- No requirement for inter-region ADVPN
To remain within the recommended best practices, which routing protocol should you select for the overlays?
- A. IBGP with BGP per overlays within each region and IBGP with BGP on loopback between the regions.
- B. IBGP within each region and between the regions.
- C. IBGP with BGP on loopback within each region and EBGP between the regions.
- D. OSPF for the routing within each region and EBGP between the regions.
正解：C
解説：
For SD-WAN deployments that span multiple regions-where most traffic is intra-region and there is no requirement for inter-region ADVPN-the best practice is to use IBGP with BGP on loopback interfaces for routing within each region and EBGP between the regions. This approach ensures robust and scalable routing, isolates regional routing domains, and enables policy control at region boundaries. BGP on loopback is preferred for its reliability and flexibility, as it enables peering that is not tied to specific physical interfaces.
EBGP between regions allows each region to maintain independent routing policies and summarization, optimizing performance and manageability. By separating IBGP (intra-region) and EBGP (inter-region), you create a modular architecture that scales easily and simplifies fault isolation and troubleshooting.
References:
[FCSS_SDW_AR-7.4 1-0.docx Q10]
Fortinet SD-WAN Reference Architecture Guide 7.4, "Regional Routing Best Practices" FortiOS 7.4 SD-WAN Overlay Design Guidelines
質問 # 46
Exhibit.
Which action will FortiGate take if it detects SD-WAN members as dead?
- A. FortiGate fails over to the secondary device after it detects port5 as dead.
- B. FortiGate brings down port5 after it detects all SD-WAN members as dead.
- C. FoftiGate bounces port5 after it detects all SD-WAN members as dead.
- D. FortiGate sends alert messages through poft5 when it detects all SD-WAN members as dead
正解：D
質問 # 47
(When you deploy SD-WAN, you can choose from several common designs. Each design best applies to specific contexts.
Which two statements correctly associate a common SD-WAN design with its main indication or constraint?
Choose two answers.)
- A. Use a cloud on-ramp topology to improve the performance of cloud applications.
- B. Use remote breakout to centralize traffic inspection and limit local management requirements.
- C. Use a standalone design for sites with only one WAN link to the cloud.
- D. Use a direct internet access (DIA) design to increase the traffic security and allow local devices with limited capabilities.
正解：A、B
解説：
The FCSS SD-WAN 7.6 curriculum describes multiple standard SD-WAN deployment designs, each mapped to a specific operational goal or constraint.
A cloud on-ramp topology is designed to optimize connectivity to cloud services such as SaaS and IaaS.
This design provides the most efficient and reliable path to cloud applications by establishing direct tunnels to cloud gateways or cloud workloads and by avoiding backhauling traffic through a central data center. As a result, its primary indication is improving the performance of cloud applications, which makes option A correct.
A remote breakout (centralized breakout) design forwards all internet-bound traffic from branch sites to a central hub for security inspection. This allows security policies, inspection, and logging to be centralized on a high-capacity FortiGate at the hub. Because branch devices do not need advanced local security configurations, this design also limits local management requirements, which makes option C correct.
Option B is incorrect because a standalone SD-WAN design is not selected simply because a site has only one WAN link. SD-WAN provides its main benefits when multiple WAN paths exist, and single-link sites do not gain meaningful traffic-steering advantages.
Option D is incorrect because a direct internet access (DIA) design performs local internet breakout at the branch and therefore requires strong local security capabilities. DIA does not inherently increase traffic security and is not intended for devices with limited capabilities.
Therefore, the two correct associations are A and C.
質問 # 48
Refer to the exhibits.
You use FortiManager to configure SD-WAN on three branch devices.
When you install the device settings. FortiManager prompts you with the error "Copy Failed" for the device branch1_fat When you click the log button. FortiManager displays the message shown in the exhibit.
- A. Based on the exhibits, which statement best describes the issue and how you can resolve it?
- B. Gateways for all members in a zone must be defined the same way. Specify the gateway of the SD- WAN member port! without metadata variables.
- C. Check the metadata variable definitions, and review the per-device mapping configuration.
- D. Check the connection between branch1_fgt and FortiManager
- E. Remove the installation target for the SD-WAN member port4. You cannot combine metadata variable and installation targets.
正解：C
質問 # 49
Which three characteristics apply to provisioning templates available on FortiManager? (Choose three.)
- A. A template group can include a system template and an SD-WAN template.
- B. CLI templates are applied in order, from top to bottom
- C. Each template group can contain up to three IPsec tunnel templates.
- D. A CLI template can be of type CLI script or Perl script.
- E. A CLI template group can contain CLI templates of both types.
正解：A、B、E
解説：
The provisioning templates in FortiManager are designed for flexible, scalable configuration of large SD- WAN deployments. The official documentation explains:
"Template groups can consist of both system and SD-WAN templates, providing a way to apply consistent settings across multiple devices. CLI templates are evaluated and executed in order from top to bottom within the template group, which is crucial for managing dependencies. Furthermore, CLI template groups can contain both regular CLI templates and advanced (Perl-script-based) templates, allowing complex or conditional configuration logic." This modular design streamlines large deployments by separating system, SD-WAN, and CLI logic into reusable building blocks.
References:
[FCSS_SDW_AR-7.4 1-0.docx Q17]
FortiManager Administration Guide 7.4, "Template Groups and CLI Template Processing"
質問 # 50
You are tasked with configuring ADVPN 2.0 on an SD-WAN topology already configured for ADVPN. What should you do to implement ADVPN 2.0 in this scenario?
- A. Update the IPsec tunnel configuration on the branches.
- B. Update the SD-WAN configuration on the branches.
- C. Update the IPsec tunnel configurations on the hub.
- D. Delete the existing ADVPN configuration and configure ADVPN 2.0.
正解：C
質問 # 51
(Refer to the exhibit. The administrator configured two SD-WAN rules to load balance the traffic.
Which interfaces does FortiGate use to steer the traffic from 10.0.1.124 to 10.0.0.254? Choose one answer.)
- A. port1 or port2
- B. HUB2-VPN2
- C. HUB1-VPN2 or HUB2-VPN2
- D. Any interface in the HUB1 or HUB2 zones
正解：C
解説：
The exhibit shows the runtime details of two SD-WAN services (rules):
Service(2)
* Mode(manual hash-mode=inbandwidth)
* Members(2): port2 (WAN2), port1 (WAN1)
* Application matching: Facebook, LinkedIn, Game
* Source: 10.0.1.0-10.0.1.255This rule is clearly intended for internet/DIA application steering and does not show a corporate destination range.
Service(3)
* Mode(sla hash-mode=round-robin)
* Members(6): HUB1-VPN1/2/3 and HUB2-VPN1/2/3
* Source: 10.0.1.0-10.0.1.255
* Destination: 10.0.0.0-10.255.255.255
Traffic from 10.0.1.124 to 10.0.0.254 matches Service(3) because the destination IP 10.0.0.254 falls within the destination range 10.0.0.0-10.255.255.255.
Within Service(3), the member list shows SLA results per interface:
* HUB1-VPN2 has sla(0x1) and num of pass(1)
* HUB2-VPN2 has sla(0x2) and num of pass(1)
* The remaining members (HUB1-VPN1, HUB2-VPN1, HUB1-VPN3, HUB2-VPN3) show sla(0x0) and num of pass(0) This indicates that, for Service(3), only HUB1-VPN2 and HUB2-VPN2 are currently meeting the SLA requirements (passing), and because the rule uses hash-mode=round-robin, FortiGate load-balances sessions across the passing members.
Therefore, FortiGate will steer the traffic using HUB1-VPN2 or HUB2-VPN2, which corresponds to Option B.
質問 # 52
You want FortiGate to use SD-WAN rules to steer local-out traffic.
Which two constraints should you consider? (Choose two.)
- A. You must configure each local-out feature individually to use SD-WAN.
- B. By default, local-out traffic does not use SD-WAN.
- C. You can steer local-out traffic only with SD-WAN rules that use the manual strategy.
- D. By default, FortiGate uses SD-WAN rules only for local-out traffic that corresponds to ping and traceroute.
正解：A、B
解説：
By default, local-out traffic does not use SD-WAN # FortiGate normally sends local-out traffic (e.g., DNS, NTP, FortiGuard updates) directly through its interfaces without applying SD-WAN rules.
You must configure each local-out feature individually to use SD-WAN # To steer local-out traffic via SD- WAN, you must explicitly configure the desired local-out features (e.g., DNS, FortiGuard, CAPWAP) to use SD-WAN rules.
質問 # 53
Refer to the exhibit.
The exhibit shows output of the command diagnose sys adwan aervice4 collected on a FortiGate device.
The administrator wants to know through which interface FortiGate will steer traffic from local users on subnet 10.0.1.0/255.255.255.192 and with a destination of the social media application Facebook.
Based on the exhibits, which two statements are correct? (Choose two.)
- A. When FortiGate cannot recognize the application of the flow, it steers the traffic through the preferred member of rule 3, HQ_T1.
- B. When FortiGate cannot recognize the application of the flow, it load balances the traffic through the tunnels HQ_T1. HQ_T2. HQ_T3.
- C. FortiGate steers traffic for social media applications according to the service rule 2 and steers traffic through port2.
- D. There is no service defined for the Facebook application, so FortiGate appliesservice rule 3 and directs the traffic to headquarters.
正解：B、C
解説：
Application-based SD-WAN rules enable intelligent traffic steering. The guide specifies:
"If a flow is identified as belonging to a defined application category (such as social media), FortiGate will match it to the corresponding service rule (rule 2) and route it through the specified interface, such as port2.
However, if the application is not recognized during the session setup, the system defaults to load balancing the traffic using the available tunnels according to the policy for unclassified traffic, ensuring continuous connectivity while waiting for application classification." This guarantees both performance and resilience.
質問 # 54
Exhibit.
Refer to the exhibit, which shows the SD-WAN rule status and configuration.
Based on the exhibit, which change in the measured packet loss will make HUB1-VPN3 the new preferred member?
- A. When HUB1-VPN1 has 4% packet loss
- B. When HUB1-VPN3 has 4% packet loss
- C. When HUB1-VPN1 has 12% packet loss
- D. When all three members have the same packet loss
正解：D
質問 # 55
(You want to configure two static routes: one that references an SD-WAN zone and a second one that references an SD-WAN member that belongs to that zone.
Which statement about this scenario is true? Choose one answer.)
- A. The source subnets must be different.
- B. You cannot create static routes that reference an SD-WAN zone.
- C. The destination subnets must be different.
- D. You cannot create static routes for individual SD-WAN members.
正解：C
解説：
In FortiOS 7.6, static routes can reference either:
* an SD-WAN zone (for example, virtual-wan-link or a user-defined SD-WAN zone), or
* a specific SD-WAN member interface that belongs to that zone.
However, FortiOS enforces a routing constraint to avoid ambiguity during route resolution. Two static routes cannot have the same destination prefix if one points to an SD-WAN zone and the other points to an SD- WAN member within that zone. This would create an overlapping and conflicting forwarding decision.
Therefore, if you configure:
* one static route that references an SD-WAN zone, and
* another static route that references an SD-WAN member belonging to that same zone, the destination subnets of the two static routes must be different.
Why the other options are incorrect:
* Option A is incorrect because FortiOS does allow static routes that reference individual SD-WAN members.
* Option B is incorrect because static routes can reference SD-WAN zones.
* Option D is incorrect because static routing decisions in FortiOS are based on destination prefixes, not source prefixes.
Thus, the correct answer is C.
質問 # 56
(You want FortiGate to use SD-WAN rules to steer ping local-out traffic.
Which two constraints should you consider? Choose two answers.)
- A. By default, local-out traffic does not use SD-WAN.
- B. You can steer local-out traffic only with SD-WAN rules that use the manual strategy.
- C. You must configure each local-out feature individually to use SD-WAN.
- D. By default, FortiGate uses SD-WAN rules only for local-out traffic that corresponds to ping and traceroute.
正解：A、B
解説：
In FortiOS 7.6, local-out traffic is traffic generated by the FortiGate itself, such as ping, traceroute, FortiGuard updates, DNS, NTP, and SNMP. Local-out traffic does not traverse the firewall policy engine and therefore behaves differently from forwarded traffic in SD-WAN.
According to the FCSS SD-WAN 7.6 curriculum and Fortinet SD-WAN architecture documentation, local- out traffic does not use SD-WAN by default. Instead, it follows the routing table (static and dynamic routes). To allow local-out traffic to be evaluated by SD-WAN rules, the administrator must explicitly enable local-out SD-WAN processing.
The curriculum also states that only SD-WAN rules using the manual strategy are supported for local-out traffic. SLA-based, application-based, and dynamic strategies are not evaluated for traffic generated by the FortiGate itself. This is a fundamental architectural limitation of SD-WAN in FortiOS 7.6.
Option B is incorrect because FortiGate does not automatically apply SD-WAN rules to ping or traceroute traffic by default. Even these tools follow the routing table unless local-out SD-WAN is enabled.
Option D is incorrect because local-out SD-WAN configuration is global. Individual local-out features do not require separate SD-WAN enablement.
質問 # 57
Refer to the exhibit.
Which statement best describe the role of the ADVPN device in handling traffic?
- A. This is a spoke that has received a direct shortcut query from a remote spoke.
- B. This is a spoke that has received a shortcut query from a remote hub.
- C. This is a hub that has received a shortcut query from a spoke and has forwarded it to another spoke.
- D. This is a hub, and two spokes, 192.2.0.1 and 10.0.3.101, establish a shortcut.
正解：D
解説：
The log shows messages on HUB1-VPN1 where the device processes a SHORTCUT_QUERY and performs NAT hole punching (peer at 192.2.0.1:4500). This indicates that the device is acting as a hub, helping two spokes (192.2.0.1 and 10.0.3.101) establish a direct ADVPN shortcut tunnel between each other, instead of routing their traffic through the hub.
質問 # 58
Refer to the exhibit.
An administrator configures SD-WAN rules for a DIA setup using the FortiGate GUI. The page to configure the source and destination part of the rule looks as shown in the exhibit. The GUI page shows no option to configure an application as the destination of the SD-WAN rule Why?
- A. You must enable the feature first using the GUI menu System > Feature Visibility.
- B. FortiGate allows the configuration of applications as the destination of SD-WAN rules only on the CLI.
- C. You cannot use applications as the destination when FortiGate is used for a DIA setup.
- D. You must enable the feature on the CLI.
正解：A
質問 # 59
Refer to the exhibits.
The first exhibit shows the SD-WAN zone HUB1 and SD-WAN member configuration from an SD-WAN template, and the second exhibit shows the output of command diagnose sys sdwan member collected on a FortiGate device.
Which statement best describes what the diagnose output shows?
- A. The diagnose output was collected on the device branch1_fgt
- B. The diagnose output does not correspond to a device configured with the SD-WAN template shown in the exhibit.
- C. The diagnose output shows that HUB1-VPN1 and all HUBx-VPNy members are dead.
- D. The diagnose output was collected on the device branch2_fgt.
正解：A
解説：
The diagnose output lists SD-WAN members 4(HUB1-VPN1), 5(HUB1-VPN2), 7(HUB2-VPN1), 8(HUB2- VPN2), and 9(HUB2-VPN3). It does not include member 6 (HUB1-VPN3). From the template, HUB1-VPN3 is installed only on branch2_fgt and branch3_fgt - not on branch1_fgt. Therefore, the output must be from branch1_fgt.
質問 # 60
Refer to the exhibits.
You use FortiManager to manage the branch devices and configure the SD-WAN template. You have configured direct internet access (DIA) for the IT department users. Now. you must configure secure internet access (SIA) for all local LAN users and have set the firewall policies as shown in the second exhibit.
Then, when you use the install wizard to install the configuration and the policy package on the branch devices, FortiManager reports an error as shown in the third exhibit.
Which statement describes why FortiManager could not install the configuration on the branches?
- A. You cannot install SIA and DIA rules on the same device.
- B. You cannot install firewall policies that reference an SD-WAN zone.
- C. You must direct SIA traffic to a VPN tunnel.
- D. You cannot install firewall policies that reference an SD-WAN member.
正解：D
解説：
FortiManager enforces a strict distinction:
"Firewall policies must reference SD-WAN zones, not individual SD-WAN members, when used in conjunction with SD-WAN templates. Attempting to install a policy that references a specific member (interface) will result in a deployment error, as member-level targeting is not supported in SD-WAN policy abstraction. This enforces centralized policy consistency and proper SD-WAN operation." Ensuring policies target zones allows FortiGate to dynamically select the optimal member.
質問 # 61
When you use the command diagnose sys session list, how do you identify the sessions that correspond to traffic steered according to SD-WAN rules?
- A. You identify sessions steered according to SD-WAN rules with the data vwl_mbr_seq.
- B. You cannot identify SD-WAN sessions. You must use the sdwar. session filter.
- C. You identify sessions steered according to SD-WAN rules with the data 3dwan_service_id.
- D. You identify sessions steered according to SD-WAN rules with the flag vwl.
正解：C
解説：
When using the diagnose sys session list command, SD-WAN-specific session steering is indicated by the presence of the sdwan_service_id field in the session data. This identifier ties the session directly to a specific SD-WAN rule or service. As noted in the Fortinet documentation: "Sessions that are handled according to SD- WAN rules will include a service ID tag (sdwan_service_id) in their session listing. This allows administrators to correlate live sessions with SD-WAN policy matches for troubleshooting and visibility." This is a crucial diagnostic tool, as it distinguishes between traffic managed by traditional routing and that explicitly controlled by SD-WAN steering logic, aiding in operational insight and troubleshooting.
References:
[FCSS_SDW_AR-7.4 1-0.docx Q15]
FortiOS 7.4 CLI Reference, "diagnose sys session list: SD-WAN Service ID Tagging" SD-WAN 7.4 Concept Guide, Section: "Session Identification for SD-WAN Traffic"
質問 # 62
Exhibit.
Two hub-and-spoke groups are connected through redundant site-to-site IPsec VPNs between Hub 1 and Hub
2
Which two configuration settings are required for the spoke A1 to establish an ADVPN shortcut with the spoke B2? (Choose two.)
- A. On hubs, auto-diacovery-sender must be enabled on the IPsec VPNs to spokes
- B. On hubs, auto-discovery-forwarder must be enabled on the IPsec VPNs to hubs.
- C. On hubs, auto-discovery-receiver must be enabled on the IPsec VPNs to spokes.
- D. On hubs, auto-discovery-forwarder must be enabled on the IPsec VPNs to spokes.
正解：A、B
解説：
To allow spokes in different hub-and-spoke groups to establish ADVPN shortcuts, the hubs must be configured to forward and send ADVPN shortcut offers. The key required settings on the hub are auto- discovery-forwarder (for VPNs to hubs) and auto-discovery-sender (for VPNs to spokes). This ensures the hub can facilitate and advertise ADVPN shortcut offers between spokes.
References:
[FCSS_SDW_AR-7.4 1-0.docx Q1]
Fortinet SD-WAN 7.4 ADVPN Guide (Auto-discovery settings for hub-and-spoke topologies)
質問 # 63 
Refer to the exhibit.
You want to configure SD-WAN on a network as shown in the exhibit.
The network contains many FortiGate devices. Some are used as NGFW, and some are installed with extensions such as FortiSwitch. FortiAP. or Forti Ex tender.
What should you consider when planning your deployment?
- A. You must build multiple SD-WAN topologies. Each topology must contain only one type of extension.
- B. You must use FortiManager to manage your SD-WAN topology.
- C. You can build an SD-WAN topology that includes all devices. The hubs can be FortiGate devices with Forti Extender.
- D. You can build an SD-WAN topology that includes all devices. The hubs must be devices without extensions.
正解：D
解説：
In Fortinet SD-WAN, hubs should not have extensions like FortiSwitch, FortiAP, or FortiExtender installed, as these can affect hub functionality and scalability. While all device types can be included in the topology, the hubs must be "clean" FortiGate devices without such extensions to ensure proper ADVPN and overlay management.
References:
[FCSS_SDW_AR-7.4 1-0.docx Q3]
Fortinet SD-WAN Reference Architecture Guide 7.4 - Hub requirements
質問 # 64
......
シミュレーションされた材料でNSE6_SDW_AD-7.6テストエンジンで学習：https://www.goshiken.com/Fortinet/NSE6_SDW_AD-7.6-mondaishu.html
合格には必要なるNSE6_SDW_AD-7.6試験問題集：https://drive.google.com/open?id=17ojhElyWFprhWmMp8A0oFAMpdjgdVObK