Free FCSS-SDW-AR-7.4 sample questions

Correct answer: The Phase 1 or Phase 2 encryption/authentication algorithm settings are mismatched.

The "no proposal chosen" error message specifically indicates that the IKE peers (hub and spoke) could not agree on a common set of security parameters during either Phase 1 or Phase 2 negotiation. This is caused by a mismatch in the configured encryption algorithms, authentication methods, Diffie-Hellman groups, or key lifetimes.

Correct answer: It will load-balance new sessions between DIA-1 and DIA-2 based on their individual latency values.

When using the 'Best Quality' strategy, FortiGate first disqualifies any member that violates the SLA (in this case, MPLS). From the remaining members that are within SLA (DIA-1 and DIA-2), it will select the one with the best performance based on the SLA criteria (latency). If multiple links are viable, it may load-balance or prefer the best one, but it will only use the links that meet the SLA.

Correct answer: True

True. The SD-WAN Overlay Template in FortiManager is a powerful automation tool. It can be configured to not only create the IPsec tunnels but also to automatically generate the corresponding BGP configurations for the hub and spokes, significantly simplifying the deployment of dynamic routing across the overlay.

Correct answer: Create a Performance SLA that only measures jitter. Create an SD-WAN rule for EHR/VoIP traffic using the 'Best Quality' strategy and select this SLA.

This is the correct approach. The 'Best Quality' strategy makes its decision based on the metrics defined in the selected Performance SLA. By creating an SLA that exclusively measures jitter, the architect ensures that the path selection for the specified applications will be based solely on which active link has the lowest jitter.

Correct answer: The traffic will be processed by the implicit SD-WAN rule, which load-balances based on source IP.

In the absence of any explicit SD-WAN rules, traffic is matched by the default implicit rule. The default behavior of this rule is to load-balance traffic across all available SD-WAN member interfaces using a source IP-based algorithm.

Correct answer: The `auto-discovery-forwarder` setting is not enabled on the hub FortiGates' IPsec Phase 1 configuration.

For hubs to facilitate shortcuts for spokes that are not their direct clients, they must be able to forward the IKE information messages used for negotiation. The `set auto-discovery-forwarder enable` command on the hub's Phase 1 interface allows it to forward these messages to the other hub, which is essential for inter-hub shortcut establishment.

Correct answers: DHCP; DNS

A new FortiGate, by default, will act as a DHCP client on its WAN interface. It can receive the FortiManager's IP address via DHCP option 240, which is one of the primary methods for ZTP discovery.

If DHCP discovery fails or is not configured, the FortiGate will attempt to resolve a predefined FQDN (e.g., `fortimanager.fortinet.net` or a custom one) to find the IP address of its FortiManager, making DNS a key part of the ZTP discovery process.

Correct answer: To show the real-time status and measured metrics (latency, jitter, packet loss) for all configured Performance SLAs.

This command provides a detailed, real-time view of each configured Performance SLA health check, showing which member interfaces are being monitored, their current status (alive or dead), and the measured values for latency, jitter, and packet loss.

Correct answer: Local Preference

Local Preference is the ideal attribute for this scenario. The primary hub should advertise routes with a higher Local Preference value (e.g., 200), and the secondary hub should advertise the same routes with a lower Local Preference value (e.g., 150). The spoke's BGP process will prefer the path with the highest Local Preference, directing traffic to the primary hub. If the primary hub fails, its routes are withdrawn, and the spoke then uses the next best path, which is to the secondary hub.

Correct answer: Configure an SD-WAN Inbound Load Balancing (Virtual Server) using the SD-WAN zone as the interface.

FortiGate's Virtual Server feature can be configured with an SD-WAN zone as its interface. This allows it to accept inbound traffic from any member interface within that zone. Combined with health checks for the internal server, it can provide high availability for inbound services across multiple ISP links. If one link fails, the service remains accessible via the other.