Download Full Version NSE7_FSN_AR-7.6 Fortinet Exam

FortiOS performs several routing checks before standard forwarding-table processing. The FortiOS 7.6 Administrator Study Guide describes the sequence explicitly. FortiGate first evaluates regular policy routes. If no applicable policy route forwards the packet, FortiGate evaluates Internet Service Database routes, followed by configured SD-WAN rules.

Only after those policy-routing mechanisms have been evaluated does FortiGate perform the standard forwarding information base (FIB) lookup. Static and dynamically learned routes, including BGP routes, are represented in this normal routing stage.

Consequently, among the available choices, the correct ordering is policy routes, ISDB routes, SD-WAN rules, and then static routes through the FIB. Options A and B incorrectly place SD-WAN before ISDB or policy routing, while C incorrectly places SD-WAN ahead of the regular policy-routing stages. Therefore, D is correct.

================

" The file must contain some mandatory values, such as the device serial numbers, the device names, and the associated blueprints "

Technical Explanation:

FortiManager zero-touch provisioning enables centralized deployment of FortiGate devices through device blueprints, provisioning templates, metadata variables, and model-device registration.

The exhibit shows multiple devices identified by serial numbers, including branch1_fgt, branch2_fgt, shop1_fgt, and shop2_fgt. However, the last row does not contain a device name, and the CSV file does not provide an associated device blueprint.

Option B is correct: Every device being imported must have a defined device name. FortiManager uses the name to identify and manage the corresponding model device in the device database.

Option D is correct: A device blueprint defines the provisioning information associated with a device, including templates, policies, and other configuration requirements. The guide specifically identifies the blueprint as mandatory for the documented bulk-import process.

Why the other options are incorrect:

Option A: User-defined metadata variables provide device-specific configuration values, but FortiManager does not require every optional metadata variable to have a value for every device.

Option C: IP-address metadata variables are required only when the associated configuration needs them. There is no universal requirement that every IP-address metadata field in the CSV must be populated.

Architectural Consideration: The branch_id column also matters for SD-WAN branch deployments, unless FortiManager is configured to assign branch IDs automatically. For FortiGate VM model imports, the guide additionally specifies a VM interface-count field.

The SD-WAN 7.6 Enterprise Administrator Study Guide states: “An SD-branch is a site with an SD-WAN spoke FortiGate device and one or multiple extensions.” It explains that FortiSwitch and FortiAP provide wired and wireless LAN connectivity through FortiLink, while FortiExtender supplements WAN connectivity by providing 4G/5G transport.

The guide further explains that the management plane sees extension-device ports as logical interfaces belonging to the controlling FortiGate. Therefore, FortiSwitch, FortiAP, and FortiExtender do not become independent SD-WAN topology nodes and do not require separate topologies. FortiGate devices with FortiLink connections also do not need to be excluded.

FortiExtender is specifically designed as a natural SD-WAN extension that introduces cellular connectivity as another WAN transport. Consequently, a FortiGate using FortiExtender can function as a hub, provided it satisfies the required capacity, routing, and IPsec design requirements. There is no rule requiring hubs to be extension-free. Therefore, option D correctly describes the unified topology shown in the exhibit.