Fortinet FCP_FGT_AD-7.6 Questions & Answers

Review specific-to-general rule precedence during changes reduces recurrence of sd-wan rule first-match ordering, rather than the observed route monitoring across vdoms issue. The relevant preventive control for Lakeview Aviation is: Label VDOM context in all routing work instructions. This distinction matters because vDOMs maintain independent route contexts and do not automatically share forwarding entries.

Verify markings and rule order across the path reduces recurrence of sd-wan dscp handling, rather than the observed route monitoring across vdoms issue. The relevant preventive control for Lakeview Aviation is: Label VDOM context in all routing work instructions. This distinction matters because vDOMs maintain independent route contexts and do not automatically share forwarding entries.

Review steering and security policy together during service launches reduces recurrence of sd-wan policy and firewall permit, rather than the observed route monitoring across vdoms issue. The relevant preventive control for Lakeview Aviation is: Label VDOM context in all routing work instructions. This distinction matters because vDOMs maintain independent route contexts and do not automatically share forwarding entries.

Add or correct the precise destination static route toward the intended private tunnel is a relevant remedy for a DIFFERENT problem—longest-prefix route selection—when traffic to a specific data center subnet follows the internet gateway even though a broad private summary route exists. In this Merriton Financial Services case that is not the failing component. Here the correct intervention is to add the supported WAN interface to the intended SD-WAN zone and verify its gateway settings because an up physical interface is not automatically eligible for SD-WAN service selection.

Correct the relevant static routes and reciprocal paths to preserve intended session symmetry is a relevant remedy for a DIFFERENT problem—asymmetric return route—when a remote branch reaches an internal service but replies exit a different FortiGate WAN and are rejected by stateful security. In this Merriton Financial Services case that is not the failing component. Here the correct intervention is to add the supported WAN interface to the intended SD-WAN zone and verify its gateway settings because an up physical interface is not automatically eligible for SD-WAN service selection.

Configure supported SLA-aware primary and fallback member behavior is a relevant remedy for a DIFFERENT problem—sd-wan preferred-member failover—when a rule forces all finance traffic onto one provider and keeps attempting the unhealthy member during a fault. In this Merriton Financial Services case that is not the failing component. Here the correct intervention is to add the supported WAN interface to the intended SD-WAN zone and verify its gateway settings because an up physical interface is not automatically eligible for SD-WAN service selection.

Route selection prefers a longest matching destination prefix ahead of less-specific alternatives explains a different situation, longest-prefix route selection, where traffic to a specific data center subnet follows the internet gateway even though a broad private summary route exists. It does not account for the specific observed sd-wan member underlay onboarding condition at Merriton Financial Services. The decisive mechanism here is: An up physical interface is not automatically eligible for SD-WAN service selection.

Stateful forwarding expects return packets to traverse the same usable security session path explains a different situation, asymmetric return route, where a remote branch reaches an internal service but replies exit a different FortiGate WAN and are rejected by stateful security. It does not account for the specific observed sd-wan member underlay onboarding condition at Merriton Financial Services. The decisive mechanism here is: An up physical interface is not automatically eligible for SD-WAN service selection.

A fixed preferred member without relevant health conditions can remain selected despite degraded service explains a different situation, sd-wan preferred-member failover, where a rule forces all finance traffic onto one provider and keeps attempting the unhealthy member during a fault. It does not account for the specific observed sd-wan member underlay onboarding condition at Merriton Financial Services. The decisive mechanism here is: An up physical interface is not automatically eligible for SD-WAN service selection.

A route lookup selects the intended tunnel for the specific subnet and internet destinations still use default would validate the separate control longest-prefix route selection, not the fault reported for Merriton Financial Services. To confirm this correction, the team instead needs: The link appears as a healthy SD-WAN member and receives an approved test flow. That is the observable check related to sd-wan member underlay onboarding.

A bidirectional packet trace follows the expected ingress and return interfaces would validate the separate control asymmetric return route, not the fault reported for Merriton Financial Services. To confirm this correction, the team instead needs: The link appears as a healthy SD-WAN member and receives an approved test flow. That is the observable check related to sd-wan member underlay onboarding.

An authorized loss test moves new finance sessions to the approved healthy backup would validate the separate control sd-wan preferred-member failover, not the fault reported for Merriton Financial Services. To confirm this correction, the team instead needs: The link appears as a healthy SD-WAN member and receives an approved test flow. That is the observable check related to sd-wan member underlay onboarding.

Test overlapping route summaries when adding private networks reduces recurrence of longest-prefix route selection, rather than the observed sd-wan member underlay onboarding issue. The relevant preventive control for Merriton Financial Services is: Review membership when adding or replacing WAN circuits. This distinction matters because an up physical interface is not automatically eligible for SD-WAN service selection.

Check both directions when static routes change reduces recurrence of asymmetric return route, rather than the observed sd-wan member underlay onboarding issue. The relevant preventive control for Merriton Financial Services is: Review membership when adding or replacing WAN circuits. This distinction matters because an up physical interface is not automatically eligible for SD-WAN service selection.

Practice controlled failover for business-critical services reduces recurrence of sd-wan preferred-member failover, rather than the observed sd-wan member underlay onboarding issue. The relevant preventive control for Merriton Financial Services is: Review membership when adding or replacing WAN circuits. This distinction matters because an up physical interface is not automatically eligible for SD-WAN service selection.

Review and set compatible administrative distance values for the preferred route is a relevant remedy for a DIFFERENT problem—static route distance preference—when two routes to the same destination use different WANs but traffic chooses the unintended carrier. In this Merriton Healthcare case that is not the failing component. Here the correct intervention is to align supported static or dynamic routes with the intended SD-WAN zone and service rules because sD-WAN link steering needs a viable route to the SD-WAN context as well as a matching service rule.

Review the effective FortiGate routing table and session details rather than only saved route configuration is a relevant remedy for a DIFFERENT problem—route diagnostic table versus session—when an engineer inspects configured static routes but misses that the currently active forwarding table selects a different path. In this Merriton Healthcare case that is not the failing component. Here the correct intervention is to align supported static or dynamic routes with the intended SD-WAN zone and service rules because sD-WAN link steering needs a viable route to the SD-WAN context as well as a matching service rule.

Use supported SD-WAN spillover or load-based behavior consistent with the utilization objective is a relevant remedy for a DIFFERENT problem—spillover on link utilization—when bulk backups saturate the primary ISP while the second healthy circuit remains idle. In this Merriton Healthcare case that is not the failing component. Here the correct intervention is to align supported static or dynamic routes with the intended SD-WAN zone and service rules because sD-WAN link steering needs a viable route to the SD-WAN context as well as a matching service rule.

For otherwise equivalent destinations, route preference depends on route distance and eligibility explains a different situation, static route distance preference, where two routes to the same destination use different WANs but traffic chooses the unintended carrier. It does not account for the specific observed sd-wan routing into zone condition at Merriton Healthcare. The decisive mechanism here is: SD-WAN link steering needs a viable route to the SD-WAN context as well as a matching service rule.

Configured candidate routes may be inactive or shadowed by preferred and connected routes explains a different situation, route diagnostic table versus session, where an engineer inspects configured static routes but misses that the currently active forwarding table selects a different path. It does not account for the specific observed sd-wan routing into zone condition at Merriton Healthcare. The decisive mechanism here is: SD-WAN link steering needs a viable route to the SD-WAN context as well as a matching service rule.

A priority-only rule may keep sending new sessions to one member regardless of load explains a different situation, spillover on link utilization, where bulk backups saturate the primary ISP while the second healthy circuit remains idle. It does not account for the specific observed sd-wan routing into zone condition at Merriton Healthcare. The decisive mechanism here is: SD-WAN link steering needs a viable route to the SD-WAN context as well as a matching service rule.

The expected primary route is installed and a controlled failure selects the backup would validate the separate control static route distance preference, not the fault reported for Merriton Healthcare. To confirm this correction, the team instead needs: A route lookup and test session both select the configured SD-WAN path. That is the observable check related to sd-wan routing into zone.

The selected active route agrees with an observed test session's egress interface would validate the separate control route diagnostic table versus session, not the fault reported for Merriton Healthcare. To confirm this correction, the team instead needs: A route lookup and test session both select the configured SD-WAN path. That is the observable check related to sd-wan routing into zone.

New bulk test flows use the alternate member after the documented threshold would validate the separate control spillover on link utilization, not the fault reported for Merriton Healthcare. To confirm this correction, the team instead needs: A route lookup and test session both select the configured SD-WAN path. That is the observable check related to sd-wan routing into zone.

Document route-distance intent before changing secondary links reduces recurrence of static route distance preference, rather than the observed sd-wan routing into zone issue. The relevant preventive control for Merriton Healthcare is: Test route and SD-WAN rule interaction during WAN migrations. This distinction matters because sD-WAN link steering needs a viable route to the SD-WAN context as well as a matching service rule.

Use effective-table checks in routing acceptance tests reduces recurrence of route diagnostic table versus session, rather than the observed sd-wan routing into zone issue. The relevant preventive control for Merriton Healthcare is: Test route and SD-WAN rule interaction during WAN migrations. This distinction matters because sD-WAN link steering needs a viable route to the SD-WAN context as well as a matching service rule.

Measure member utilization and tune spillover thresholds reduces recurrence of spillover on link utilization, rather than the observed sd-wan routing into zone issue. The relevant preventive control for Merriton Healthcare is: Test route and SD-WAN rule interaction during WAN migrations. This distinction matters because sD-WAN link steering needs a viable route to the SD-WAN context as well as a matching service rule.

Use supported route priority settings to choose among otherwise comparable static routes is a relevant remedy for a DIFFERENT problem—static route priority tie-breaker—when equal-destination static routes have the same distance but operations needs deterministic primary and standby forwarding. In this Merriton University case that is not the failing component. Here the correct intervention is to configure suitable performance SLA packet-loss thresholds and a rule that respects service quality because a link can remain up while packet loss makes real-time applications unusable.

Configure the approved IPv6 default route and compatible IPv6 security policy is a relevant remedy for a DIFFERENT problem—ipv6 default route separate from ipv4—when dual-stack clients can reach external IPv4 servers but IPv6 connections fail after only an IPv4 default route was added. In this Merriton University case that is not the failing component. Here the correct intervention is to configure suitable performance SLA packet-loss thresholds and a rule that respects service quality because a link can remain up while packet loss makes real-time applications unusable.

Select suitable supported bandwidth-aware SD-WAN load-balancing weights is a relevant remedy for a DIFFERENT problem—bandwidth-based load distribution—when two ISP links have very different capacities but an equal distribution policy sends too much traffic to the smaller link. In this Merriton University case that is not the failing component. Here the correct intervention is to configure suitable performance SLA packet-loss thresholds and a rule that respects service quality because a link can remain up while packet loss makes real-time applications unusable.

Priority influences selection of eligible routes with matching specificity and distance explains a different situation, static route priority tie-breaker, where equal-destination static routes have the same distance but operations needs deterministic primary and standby forwarding. It does not account for the specific observed sla packet loss threshold condition at Merriton University. The decisive mechanism here is: A link can remain up while packet loss makes real-time applications unusable.

IPv4 route entries do not forward IPv6 packets and both protocol families need valid paths explains a different situation, ipv6 default route separate from ipv4, where dual-stack clients can reach external IPv4 servers but IPv6 connections fail after only an IPv4 default route was added. It does not account for the specific observed sla packet loss threshold condition at Merriton University. The decisive mechanism here is: A link can remain up while packet loss makes real-time applications unusable.

Equal traffic distribution does not necessarily reflect different link bandwidth and congestion budgets explains a different situation, bandwidth-based load distribution, where two ISP links have very different capacities but an equal distribution policy sends too much traffic to the smaller link. It does not account for the specific observed sla packet loss threshold condition at Merriton University. The decisive mechanism here is: A link can remain up while packet loss makes real-time applications unusable.