Exactprep NSE7_FSN_AR-7.6 Questions

" FortiManager offers two approaches to configuring SD-WAN: per-device management and central management. "

The guide also states:

" In per-device management, you configure SD-WAN settings for individual devices. "

Technical Explanation:

FortiManager supports two management approaches for SD-WAN deployments: per-device configuration and centralized SD-WAN management.

Option C is correct because the devices are already managed by FortiManager, and the administrator only needs to configure SD-WAN on a limited number of standalone FortiGate devices.

With per-device management, administrators can configure settings individually through Device Manager without migrating devices to a separate SD-WAN management workflow.

The administrator can access these settings through:

Device Manager → Select Managed FortiGate → Network → SD-WAN

From this interface, administrators can configure SD-WAN zones, members, performance SLAs, and SD-WAN rules according to each device ' s requirements.

The configuration changes are subsequently installed on the managed FortiGate.

Why the other options are incorrect:

Option A: Moving devices into the SD-WAN Manager workflow and using a standalone wizard is not mandatory for basic per-device configuration.

Option B: A dedicated device group is not required simply to configure SD-WAN settings on individual devices.

Option D: FortiManager supports per-device SD-WAN rule configuration without requiring SD-WAN Manager enrollment.

Architectural Consideration:

Centralized SD-WAN management becomes particularly valuable in large deployments requiring consistent templates, automation, and overlay orchestration. However, for a small environment with distinct device configurations, per-device management remains a supported and practical approach.

The 7.6 study guide explains the route selection order:

“Route Selection Process

Most specific route

Lowest distance

Lowest metric (dynamic routes)

Lowest priority (static routes)

ECMP (static, BGP, and OSPF routes)”**

It then states:

“If there are multiple routes with the same netmask, distance, metric, and priority, FortiGate shares the traffic among all of them. This is called equal-cost multi-path (ECMP).”

The FortiOS administration guide confirms the ECMP prerequisite:

“Routes must have the same destination and costs. In the case of static routes costs include distance and priority.”

In the exhibit, the kernel/FIB output shows the two default routes as:

gwy=100.64.1.254 dev=3 (port1) prio=0

gwy=100.64.2.254 dev=6 (port2) prio=10

So although both are default routes, their priorities are different. Since FortiGate uses the FIB/kernel for forwarding traffic, ECMP will not happen until the static-route priorities are the same. The study guide also notes that the FIB is the table used to perform standard routing

Therefore, to make the two default routes eligible for ECMP, the administrator must make the priorities equal. Since port2 is already 10, the needed change is to set the port1 default route priority to 10.

Why the other options are wrong:

A is wrong because snat-route-change affects how existing SNAT sessions react to routing changes, not whether static routes qualify for ECMP

B is wrong because changing port2 to priority 1 still would not match port1 at 0, so the routes still would not have equal cost for ECMP

C is wrong because preserve-session-route affects existing-session route persistence after routing changes, not ECMP qualification

The output explicitly states This router is an ABR. An OSPF area border router has interfaces participating in multiple OSPF areas and provides connectivity between those areas and the backbone. Therefore, A is correct.

The output also states that the RFC1583Compatibility flag is enabled. The Enterprise Firewall 7.6 Administrator Study Guide explains that FortiGate can use RFC 1583-compatible OSPF path selection for ECMP, where eligible external routes of equal cost can be installed concurrently. This makes D correct.

Nothing in the displayed status identifies the FortiGate as a backup designated router, so B cannot be concluded. Option C describes an autonomous system boundary router (ASBR), which originates external LSAs when redistributing routes into OSPF. Being an ABR does not by itself mean the router is injecting external routing information.

================

To determine the cause of the failure, we must analyze the IKEv2 debug output provided in the exhibit (image_ad3dc6.jpg):

Identify the Negotiation Phase:

The debug log shows: responder received CREATE_CHILD exchange.

In IKEv2, the CREATE_CHILD_SA exchange is used to create new Child SAs (Phase 2) or to rekey existing ones.

The fact that the tunnel was previously " brought up successfully " implies the initial IKE SA (Phase 1) is stable, and this error is occurring specifically during a rekey event, which often involves Perfect Forward Secrecy (PFS).

Analyze the Proposals (The Mismatch):

Incoming Proposal (Remote Peer):

The remote peer sends a proposal containing two Diffie-Hellman groups: type=DH_GROUP, val=MODP2048 (Group 14) and type=DH_GROUP, val=MODP1536 (Group 5).

My Proposal (Local FortiGate):

The local FortiGate configuration expects: type=DH_GROUP, val=MODP3072 (Group 15).

Result of the Negotiation:

The debug output concludes with: no proposal chosen and Negotiate SA Error.

This error occurs because the local FortiGate cannot find a common Diffie-Hellman group between what it requires (Group 15) and what the peer is offering (Groups 14 or 5).

While this is technically a mismatch occurring during the Phase 2 (Child SA) creation, " A Diffie-Hellman mismatch " (Option A) is the precise root cause identified in the logs.

Why other options are incorrect:

B: The log shows received create-child request, confirming that UDP traffic is reaching the device and is not blocked.

C: The failure is in the CREATE_CHILD exchange (Phase 2/Rekey), not the IKE_SA_INIT or IKE_AUTH (Phase 1) exchanges.

D: While the mismatch is occurring within the Phase 2 definitions, Option A is the specific technical reason for the no proposal chosen error shown in the DH_GROUP lines.