Fortinet Enterprise Firewall 7.6 FCSS_EFW_AD-7.6 ADVPN Hub Spoke Architecture Practice Test

Practice Exams:

View All

Fortinet Enterprise Firewall 7.6 FCSS_EFW_AD-7.6 ADVPN Hub Spoke Architecture Practice Test

This practice test focuses on advpn hub spoke architecture and dynamic shortcuts through original applied scenarios aligned to the final published Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator 7.6 blueprint. It is intended for study and does not reproduce live exam content. For broader exam preparation, review the Fortinet FCSS_EFW_AD-7.6 Exam Dumps page.

Question 1

Humongous Insurance has verified basic IP reachability. The remaining requirement is to allow spokes to create direct tunnels after initial communication through the hub. Which action should the team take? No unrelated control should be weakened. Only one site is affected; peer sites are healthy.

Deploy the hub-and-spoke ADVPN roles with compatible overlay parameters and shortcut negotiation enabled
Enable and validate dynamic shortcut establishment between eligible spokes
Design dual-hub reachability and routing preference so spokes can fail over while preserving the ADVPN overlay
Assign non-overlapping protected and overlay addressing consistent with the routing design
Run a supported dynamic routing design such as BGP over the overlay and advertise branch prefixes appropriately

Correct answer: A

Explanation

ADVPN uses the hub to facilitate dynamic spoke-to-spoke shortcuts while preserving centralized reachability. This directly addresses the stated requirement.
The defining ADVPN optimization is direct spoke-to-spoke data forwarding after shortcut negotiation. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to allow spokes to create direct tunnels after initial communication through the hub.
Redundant hubs remove a single control-plane or transit dependency from the overlay. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to allow spokes to create direct tunnels after initial communication through the hub.
Unique addressing is necessary for predictable route advertisement and tunnel selection. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to allow spokes to create direct tunnels after initial communication through the hub.
Dynamic routing distributes reachability as branches are added or paths change. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to allow spokes to create direct tunnels after initial communication through the hub.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, deploy the hub-and-spoke ADVPN roles with compatible overlay parameters and shortcut negotiation enabled. ADVPN uses the hub to facilitate dynamic spoke-to-spoke shortcuts while preserving centralized reachability.

Question 2

At Margie Travel, the Fortinet administrator must scale routing across many ADVPN spokes without static routes for every branch. Which action best addresses the requirement? The team will validate the result immediately after the change. The change must be validated on a pilot device before broader rollout.

Deploy the hub-and-spoke ADVPN roles with compatible overlay parameters and shortcut negotiation enabled
Assign non-overlapping protected and overlay addressing consistent with the routing design
Design dual-hub reachability and routing preference so spokes can fail over while preserving the ADVPN overlay
Enable and validate dynamic shortcut establishment between eligible spokes
Run a supported dynamic routing design such as BGP over the overlay and advertise branch prefixes appropriately

Correct answer: E

Explanation

ADVPN uses the hub to facilitate dynamic spoke-to-spoke shortcuts while preserving centralized reachability. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to scale routing across many ADVPN spokes without static routes for every branch.
Unique addressing is necessary for predictable route advertisement and tunnel selection. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to scale routing across many ADVPN spokes without static routes for every branch.
Redundant hubs remove a single control-plane or transit dependency from the overlay. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to scale routing across many ADVPN spokes without static routes for every branch.
The defining ADVPN optimization is direct spoke-to-spoke data forwarding after shortcut negotiation. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to scale routing across many ADVPN spokes without static routes for every branch.
Dynamic routing distributes reachability as branches are added or paths change. This directly addresses the stated requirement.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, run a supported dynamic routing design such as BGP over the overlay and advertise branch prefixes appropriately. Dynamic routing distributes reachability as branches are added or paths change.

Question 3

During an enterprise firewall change at Northwind Health, the team needs to keep the hub from becoming the steady-state data path for spoke-to-spoke traffic. What should it do? The change is taking place in a controlled maintenance window. Existing production IP addressing must remain unchanged.

Deploy the hub-and-spoke ADVPN roles with compatible overlay parameters and shortcut negotiation enabled
Run a supported dynamic routing design such as BGP over the overlay and advertise branch prefixes appropriately
Design dual-hub reachability and routing preference so spokes can fail over while preserving the ADVPN overlay
Assign non-overlapping protected and overlay addressing consistent with the routing design
Enable and validate dynamic shortcut establishment between eligible spokes

Correct answer: E

Explanation

ADVPN uses the hub to facilitate dynamic spoke-to-spoke shortcuts while preserving centralized reachability. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to keep the hub from becoming the steady-state data path for spoke-to-spoke traffic.
Dynamic routing distributes reachability as branches are added or paths change. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to keep the hub from becoming the steady-state data path for spoke-to-spoke traffic.
Redundant hubs remove a single control-plane or transit dependency from the overlay. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to keep the hub from becoming the steady-state data path for spoke-to-spoke traffic.
Unique addressing is necessary for predictable route advertisement and tunnel selection. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to keep the hub from becoming the steady-state data path for spoke-to-spoke traffic.
The defining ADVPN optimization is direct spoke-to-spoke data forwarding after shortcut negotiation. This directly addresses the stated requirement.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, enable and validate dynamic shortcut establishment between eligible spokes. The defining ADVPN optimization is direct spoke-to-spoke data forwarding after shortcut negotiation.

Question 4

A production review at Blue Yonder Airlines identifies this requirement: avoid overlapping spoke overlay addressing that prevents unambiguous route selection. Which Fortinet action is most appropriate? Choose the smallest targeted change. The resulting configuration must remain centrally auditable.

Enable and validate dynamic shortcut establishment between eligible spokes
Deploy the hub-and-spoke ADVPN roles with compatible overlay parameters and shortcut negotiation enabled
Design dual-hub reachability and routing preference so spokes can fail over while preserving the ADVPN overlay
Run a supported dynamic routing design such as BGP over the overlay and advertise branch prefixes appropriately
Assign non-overlapping protected and overlay addressing consistent with the routing design

Correct answer: E

Explanation

The defining ADVPN optimization is direct spoke-to-spoke data forwarding after shortcut negotiation. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid overlapping spoke overlay addressing that prevents unambiguous route selection.
ADVPN uses the hub to facilitate dynamic spoke-to-spoke shortcuts while preserving centralized reachability. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid overlapping spoke overlay addressing that prevents unambiguous route selection.
Redundant hubs remove a single control-plane or transit dependency from the overlay. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid overlapping spoke overlay addressing that prevents unambiguous route selection.
Dynamic routing distributes reachability as branches are added or paths change. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid overlapping spoke overlay addressing that prevents unambiguous route selection.
Unique addressing is necessary for predictable route advertisement and tunnel selection. This directly addresses the stated requirement.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, assign non-overlapping protected and overlay addressing consistent with the routing design. Unique addressing is necessary for predictable route advertisement and tunnel selection.

Question 5

While troubleshooting at Trey Research, the NOC engineer needs to provide redundant hubs for branch connectivity. What is the best next step? The answer must address the stated cause rather than a different feature. A known-good rollback point is available before the change.

Deploy the hub-and-spoke ADVPN roles with compatible overlay parameters and shortcut negotiation enabled
Assign non-overlapping protected and overlay addressing consistent with the routing design
Design dual-hub reachability and routing preference so spokes can fail over while preserving the ADVPN overlay
Enable and validate dynamic shortcut establishment between eligible spokes
Run a supported dynamic routing design such as BGP over the overlay and advertise branch prefixes appropriately

Correct answer: C

Explanation

ADVPN uses the hub to facilitate dynamic spoke-to-spoke shortcuts while preserving centralized reachability. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to provide redundant hubs for branch connectivity.
Unique addressing is necessary for predictable route advertisement and tunnel selection. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to provide redundant hubs for branch connectivity.
Redundant hubs remove a single control-plane or transit dependency from the overlay. This directly addresses the stated requirement.
The defining ADVPN optimization is direct spoke-to-spoke data forwarding after shortcut negotiation. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to provide redundant hubs for branch connectivity.
Dynamic routing distributes reachability as branches are added or paths change. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to provide redundant hubs for branch connectivity.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, design dual-hub reachability and routing preference so spokes can fail over while preserving the ADVPN overlay. Redundant hubs remove a single control-plane or transit dependency from the overlay.

Question 6

Apex Retail is standardizing a FortiOS 7.6 enterprise deployment. Which approach should it use to allow spokes to create direct tunnels after initial communication through the hub? Preserve the existing design unless the requirement says otherwise. The design must preserve the current segmentation boundaries.

Enable and validate dynamic shortcut establishment between eligible spokes
Assign non-overlapping protected and overlay addressing consistent with the routing design
Deploy the hub-and-spoke ADVPN roles with compatible overlay parameters and shortcut negotiation enabled
Run a supported dynamic routing design such as BGP over the overlay and advertise branch prefixes appropriately
Design dual-hub reachability and routing preference so spokes can fail over while preserving the ADVPN overlay

Correct answer: C

Explanation

The defining ADVPN optimization is direct spoke-to-spoke data forwarding after shortcut negotiation. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to allow spokes to create direct tunnels after initial communication through the hub.
Unique addressing is necessary for predictable route advertisement and tunnel selection. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to allow spokes to create direct tunnels after initial communication through the hub.
ADVPN uses the hub to facilitate dynamic spoke-to-spoke shortcuts while preserving centralized reachability. This directly addresses the stated requirement.
Dynamic routing distributes reachability as branches are added or paths change. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to allow spokes to create direct tunnels after initial communication through the hub.
Redundant hubs remove a single control-plane or transit dependency from the overlay. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to allow spokes to create direct tunnels after initial communication through the hub.

Question 7

A change ticket for Proseware Media states that administrators must scale routing across many ADVPN spokes without static routes for every branch. Which choice is correct? Prefer a change that is reversible and easy to verify. The team is not allowed to disable the security feature globally.

Run a supported dynamic routing design such as BGP over the overlay and advertise branch prefixes appropriately
Assign non-overlapping protected and overlay addressing consistent with the routing design
Enable and validate dynamic shortcut establishment between eligible spokes
Deploy the hub-and-spoke ADVPN roles with compatible overlay parameters and shortcut negotiation enabled
Design dual-hub reachability and routing preference so spokes can fail over while preserving the ADVPN overlay

Correct answer: A

Explanation

Dynamic routing distributes reachability as branches are added or paths change. This directly addresses the stated requirement.
Unique addressing is necessary for predictable route advertisement and tunnel selection. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to scale routing across many ADVPN spokes without static routes for every branch.
The defining ADVPN optimization is direct spoke-to-spoke data forwarding after shortcut negotiation. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to scale routing across many ADVPN spokes without static routes for every branch.
ADVPN uses the hub to facilitate dynamic spoke-to-spoke shortcuts while preserving centralized reachability. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to scale routing across many ADVPN spokes without static routes for every branch.
Redundant hubs remove a single control-plane or transit dependency from the overlay. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to scale routing across many ADVPN spokes without static routes for every branch.

Question 8

The security team at City Power & Light wants to keep the hub from becoming the steady-state data path for spoke-to-spoke traffic. Which configuration or operational action most directly satisfies that goal? The team needs an auditable result. The symptom appeared immediately after a planned configuration change.

Enable and validate dynamic shortcut establishment between eligible spokes
Run a supported dynamic routing design such as BGP over the overlay and advertise branch prefixes appropriately
Deploy the hub-and-spoke ADVPN roles with compatible overlay parameters and shortcut negotiation enabled
Design dual-hub reachability and routing preference so spokes can fail over while preserving the ADVPN overlay
Assign non-overlapping protected and overlay addressing consistent with the routing design

Correct answer: A

Explanation

The defining ADVPN optimization is direct spoke-to-spoke data forwarding after shortcut negotiation. This directly addresses the stated requirement.
Dynamic routing distributes reachability as branches are added or paths change. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to keep the hub from becoming the steady-state data path for spoke-to-spoke traffic.
ADVPN uses the hub to facilitate dynamic spoke-to-spoke shortcuts while preserving centralized reachability. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to keep the hub from becoming the steady-state data path for spoke-to-spoke traffic.
Redundant hubs remove a single control-plane or transit dependency from the overlay. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to keep the hub from becoming the steady-state data path for spoke-to-spoke traffic.
Unique addressing is necessary for predictable route advertisement and tunnel selection. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to keep the hub from becoming the steady-state data path for spoke-to-spoke traffic.

Question 9

An incident at VanArsdel requires the network operations engineer to avoid overlapping spoke overlay addressing that prevents unambiguous route selection. What should be done first? Use normal enterprise Fortinet administration practice. Logs from the affected traffic are available for verification.

Deploy the hub-and-spoke ADVPN roles with compatible overlay parameters and shortcut negotiation enabled
Design dual-hub reachability and routing preference so spokes can fail over while preserving the ADVPN overlay
Enable and validate dynamic shortcut establishment between eligible spokes
Run a supported dynamic routing design such as BGP over the overlay and advertise branch prefixes appropriately
Assign non-overlapping protected and overlay addressing consistent with the routing design

Correct answer: E

Explanation

ADVPN uses the hub to facilitate dynamic spoke-to-spoke shortcuts while preserving centralized reachability. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid overlapping spoke overlay addressing that prevents unambiguous route selection.
Redundant hubs remove a single control-plane or transit dependency from the overlay. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid overlapping spoke overlay addressing that prevents unambiguous route selection.
The defining ADVPN optimization is direct spoke-to-spoke data forwarding after shortcut negotiation. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid overlapping spoke overlay addressing that prevents unambiguous route selection.
Dynamic routing distributes reachability as branches are added or paths change. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid overlapping spoke overlay addressing that prevents unambiguous route selection.
Unique addressing is necessary for predictable route advertisement and tunnel selection. This directly addresses the stated requirement.

Question 10

For a FortiGate/FortiManager/FortiAnalyzer 7.6 deployment at Woodgrove Bank, which option correctly addresses the need to provide redundant hubs for branch connectivity? Assume the platform versions are compatible with the feature. The equivalent configuration works correctly at a separate site.

Deploy the hub-and-spoke ADVPN roles with compatible overlay parameters and shortcut negotiation enabled
Assign non-overlapping protected and overlay addressing consistent with the routing design
Run a supported dynamic routing design such as BGP over the overlay and advertise branch prefixes appropriately
Design dual-hub reachability and routing preference so spokes can fail over while preserving the ADVPN overlay
Enable and validate dynamic shortcut establishment between eligible spokes

Correct answer: D

Explanation

ADVPN uses the hub to facilitate dynamic spoke-to-spoke shortcuts while preserving centralized reachability. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to provide redundant hubs for branch connectivity.
Unique addressing is necessary for predictable route advertisement and tunnel selection. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to provide redundant hubs for branch connectivity.
Dynamic routing distributes reachability as branches are added or paths change. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to provide redundant hubs for branch connectivity.
Redundant hubs remove a single control-plane or transit dependency from the overlay. This directly addresses the stated requirement.
The defining ADVPN optimization is direct spoke-to-spoke data forwarding after shortcut negotiation. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to provide redundant hubs for branch connectivity.

Question 11

Alpine Ski House has verified basic IP reachability. The remaining requirement is to allow spokes to create direct tunnels after initial communication through the hub. Which action should the team take? No unrelated control should be weakened. The change must be reversible within the same maintenance window.

Run a supported dynamic routing design such as BGP over the overlay and advertise branch prefixes appropriately
Assign non-overlapping protected and overlay addressing consistent with the routing design
Enable and validate dynamic shortcut establishment between eligible spokes
Design dual-hub reachability and routing preference so spokes can fail over while preserving the ADVPN overlay
Deploy the hub-and-spoke ADVPN roles with compatible overlay parameters and shortcut negotiation enabled

Correct answer: E

Explanation

Dynamic routing distributes reachability as branches are added or paths change. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to allow spokes to create direct tunnels after initial communication through the hub.
Unique addressing is necessary for predictable route advertisement and tunnel selection. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to allow spokes to create direct tunnels after initial communication through the hub.
The defining ADVPN optimization is direct spoke-to-spoke data forwarding after shortcut negotiation. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to allow spokes to create direct tunnels after initial communication through the hub.
Redundant hubs remove a single control-plane or transit dependency from the overlay. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to allow spokes to create direct tunnels after initial communication through the hub.
ADVPN uses the hub to facilitate dynamic spoke-to-spoke shortcuts while preserving centralized reachability. This directly addresses the stated requirement.

Question 12

At Datum Corporation, the enterprise firewall engineer must scale routing across many ADVPN spokes without static routes for every branch. Which action best addresses the requirement? The team will validate the result immediately after the change. The device is already synchronized with its central-management database.

Enable and validate dynamic shortcut establishment between eligible spokes
Assign non-overlapping protected and overlay addressing consistent with the routing design
Design dual-hub reachability and routing preference so spokes can fail over while preserving the ADVPN overlay
Deploy the hub-and-spoke ADVPN roles with compatible overlay parameters and shortcut negotiation enabled
Run a supported dynamic routing design such as BGP over the overlay and advertise branch prefixes appropriately

Correct answer: E

Explanation

The defining ADVPN optimization is direct spoke-to-spoke data forwarding after shortcut negotiation. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to scale routing across many ADVPN spokes without static routes for every branch.
Unique addressing is necessary for predictable route advertisement and tunnel selection. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to scale routing across many ADVPN spokes without static routes for every branch.
Redundant hubs remove a single control-plane or transit dependency from the overlay. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to scale routing across many ADVPN spokes without static routes for every branch.
ADVPN uses the hub to facilitate dynamic spoke-to-spoke shortcuts while preserving centralized reachability. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to scale routing across many ADVPN spokes without static routes for every branch.
Dynamic routing distributes reachability as branches are added or paths change. This directly addresses the stated requirement.

Question 13

During an enterprise firewall change at Contoso Finance, the team needs to keep the hub from becoming the steady-state data path for spoke-to-spoke traffic. What should it do? The change is taking place in a controlled maintenance window. The current routing table contains the expected connected networks.

Enable and validate dynamic shortcut establishment between eligible spokes
Run a supported dynamic routing design such as BGP over the overlay and advertise branch prefixes appropriately
Deploy the hub-and-spoke ADVPN roles with compatible overlay parameters and shortcut negotiation enabled
Assign non-overlapping protected and overlay addressing consistent with the routing design
Design dual-hub reachability and routing preference so spokes can fail over while preserving the ADVPN overlay

Correct answer: A

Explanation

The defining ADVPN optimization is direct spoke-to-spoke data forwarding after shortcut negotiation. This directly addresses the stated requirement.
Dynamic routing distributes reachability as branches are added or paths change. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to keep the hub from becoming the steady-state data path for spoke-to-spoke traffic.
ADVPN uses the hub to facilitate dynamic spoke-to-spoke shortcuts while preserving centralized reachability. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to keep the hub from becoming the steady-state data path for spoke-to-spoke traffic.
Unique addressing is necessary for predictable route advertisement and tunnel selection. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to keep the hub from becoming the steady-state data path for spoke-to-spoke traffic.
Redundant hubs remove a single control-plane or transit dependency from the overlay. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to keep the hub from becoming the steady-state data path for spoke-to-spoke traffic.

Question 14

A production review at Litware Logistics identifies this requirement: avoid overlapping spoke overlay addressing that prevents unambiguous route selection. Which Fortinet action is most appropriate? Choose the smallest targeted change. Basic IP reachability to the remote endpoint has already been verified.

Run a supported dynamic routing design such as BGP over the overlay and advertise branch prefixes appropriately
Enable and validate dynamic shortcut establishment between eligible spokes
Design dual-hub reachability and routing preference so spokes can fail over while preserving the ADVPN overlay
Assign non-overlapping protected and overlay addressing consistent with the routing design
Deploy the hub-and-spoke ADVPN roles with compatible overlay parameters and shortcut negotiation enabled

Correct answer: D

Explanation

Dynamic routing distributes reachability as branches are added or paths change. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid overlapping spoke overlay addressing that prevents unambiguous route selection.
The defining ADVPN optimization is direct spoke-to-spoke data forwarding after shortcut negotiation. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid overlapping spoke overlay addressing that prevents unambiguous route selection.
Redundant hubs remove a single control-plane or transit dependency from the overlay. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid overlapping spoke overlay addressing that prevents unambiguous route selection.
Unique addressing is necessary for predictable route advertisement and tunnel selection. This directly addresses the stated requirement.
ADVPN uses the hub to facilitate dynamic spoke-to-spoke shortcuts while preserving centralized reachability. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid overlapping spoke overlay addressing that prevents unambiguous route selection.

Question 15

While troubleshooting at Wide World Importers, the network operations engineer needs to provide redundant hubs for branch connectivity. What is the best next step? The answer must address the stated cause rather than a different feature. Hardware replacement is outside the approved change scope.

Deploy the hub-and-spoke ADVPN roles with compatible overlay parameters and shortcut negotiation enabled
Enable and validate dynamic shortcut establishment between eligible spokes
Run a supported dynamic routing design such as BGP over the overlay and advertise branch prefixes appropriately
Design dual-hub reachability and routing preference so spokes can fail over while preserving the ADVPN overlay
Assign non-overlapping protected and overlay addressing consistent with the routing design

Correct answer: D

Explanation

ADVPN uses the hub to facilitate dynamic spoke-to-spoke shortcuts while preserving centralized reachability. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to provide redundant hubs for branch connectivity.
The defining ADVPN optimization is direct spoke-to-spoke data forwarding after shortcut negotiation. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to provide redundant hubs for branch connectivity.
Dynamic routing distributes reachability as branches are added or paths change. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to provide redundant hubs for branch connectivity.
Redundant hubs remove a single control-plane or transit dependency from the overlay. This directly addresses the stated requirement.
Unique addressing is necessary for predictable route advertisement and tunnel selection. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to provide redundant hubs for branch connectivity.

Question 16

Relecloud is standardizing a FortiOS 7.6 enterprise deployment. Which approach should it use to allow spokes to create direct tunnels after initial communication through the hub? Preserve the existing design unless the requirement says otherwise. The requirement applies only to one policy, peer, or managed device group.

Enable and validate dynamic shortcut establishment between eligible spokes
Run a supported dynamic routing design such as BGP over the overlay and advertise branch prefixes appropriately
Design dual-hub reachability and routing preference so spokes can fail over while preserving the ADVPN overlay
Assign non-overlapping protected and overlay addressing consistent with the routing design
Deploy the hub-and-spoke ADVPN roles with compatible overlay parameters and shortcut negotiation enabled

Correct answer: E

Explanation

The defining ADVPN optimization is direct spoke-to-spoke data forwarding after shortcut negotiation. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to allow spokes to create direct tunnels after initial communication through the hub.
Dynamic routing distributes reachability as branches are added or paths change. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to allow spokes to create direct tunnels after initial communication through the hub.
Redundant hubs remove a single control-plane or transit dependency from the overlay. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to allow spokes to create direct tunnels after initial communication through the hub.
Unique addressing is necessary for predictable route advertisement and tunnel selection. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to allow spokes to create direct tunnels after initial communication through the hub.
ADVPN uses the hub to facilitate dynamic spoke-to-spoke shortcuts while preserving centralized reachability. This directly addresses the stated requirement.

Question 17

A change ticket for Adventure Works states that administrators must scale routing across many ADVPN spokes without static routes for every branch. Which choice is correct? Prefer a change that is reversible and easy to verify. The team must avoid broadening administrative trust or permissions.

Assign non-overlapping protected and overlay addressing consistent with the routing design
Design dual-hub reachability and routing preference so spokes can fail over while preserving the ADVPN overlay
Deploy the hub-and-spoke ADVPN roles with compatible overlay parameters and shortcut negotiation enabled
Run a supported dynamic routing design such as BGP over the overlay and advertise branch prefixes appropriately
Enable and validate dynamic shortcut establishment between eligible spokes

Correct answer: D

Explanation

Unique addressing is necessary for predictable route advertisement and tunnel selection. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to scale routing across many ADVPN spokes without static routes for every branch.
Redundant hubs remove a single control-plane or transit dependency from the overlay. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to scale routing across many ADVPN spokes without static routes for every branch.
ADVPN uses the hub to facilitate dynamic spoke-to-spoke shortcuts while preserving centralized reachability. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to scale routing across many ADVPN spokes without static routes for every branch.
Dynamic routing distributes reachability as branches are added or paths change. This directly addresses the stated requirement.
The defining ADVPN optimization is direct spoke-to-spoke data forwarding after shortcut negotiation. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to scale routing across many ADVPN spokes without static routes for every branch.

Question 18

The security team at Fourth Coffee wants to keep the hub from becoming the steady-state data path for spoke-to-spoke traffic. Which configuration or operational action most directly satisfies that goal? The team needs an auditable result. The design must preserve existing centralized logging and telemetry.

Run a supported dynamic routing design such as BGP over the overlay and advertise branch prefixes appropriately
Enable and validate dynamic shortcut establishment between eligible spokes
Design dual-hub reachability and routing preference so spokes can fail over while preserving the ADVPN overlay
Assign non-overlapping protected and overlay addressing consistent with the routing design
Deploy the hub-and-spoke ADVPN roles with compatible overlay parameters and shortcut negotiation enabled

Correct answer: B

Explanation

Dynamic routing distributes reachability as branches are added or paths change. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to keep the hub from becoming the steady-state data path for spoke-to-spoke traffic.
The defining ADVPN optimization is direct spoke-to-spoke data forwarding after shortcut negotiation. This directly addresses the stated requirement.
Redundant hubs remove a single control-plane or transit dependency from the overlay. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to keep the hub from becoming the steady-state data path for spoke-to-spoke traffic.
Unique addressing is necessary for predictable route advertisement and tunnel selection. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to keep the hub from becoming the steady-state data path for spoke-to-spoke traffic.
ADVPN uses the hub to facilitate dynamic spoke-to-spoke shortcuts while preserving centralized reachability. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to keep the hub from becoming the steady-state data path for spoke-to-spoke traffic.

Question 19

An incident at Coho Winery requires the network security architect to avoid overlapping spoke overlay addressing that prevents unambiguous route selection. What should be done first? Use normal enterprise Fortinet administration practice. Production subnets cannot be renumbered as part of this change.

Enable and validate dynamic shortcut establishment between eligible spokes
Assign non-overlapping protected and overlay addressing consistent with the routing design
Deploy the hub-and-spoke ADVPN roles with compatible overlay parameters and shortcut negotiation enabled
Run a supported dynamic routing design such as BGP over the overlay and advertise branch prefixes appropriately
Design dual-hub reachability and routing preference so spokes can fail over while preserving the ADVPN overlay

Correct answer: B

Explanation

The defining ADVPN optimization is direct spoke-to-spoke data forwarding after shortcut negotiation. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid overlapping spoke overlay addressing that prevents unambiguous route selection.
Unique addressing is necessary for predictable route advertisement and tunnel selection. This directly addresses the stated requirement.
ADVPN uses the hub to facilitate dynamic spoke-to-spoke shortcuts while preserving centralized reachability. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid overlapping spoke overlay addressing that prevents unambiguous route selection.
Dynamic routing distributes reachability as branches are added or paths change. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid overlapping spoke overlay addressing that prevents unambiguous route selection.
Redundant hubs remove a single control-plane or transit dependency from the overlay. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid overlapping spoke overlay addressing that prevents unambiguous route selection.

Question 20

For a FortiGate/FortiManager/FortiAnalyzer 7.6 deployment at Fabrikam Manufacturing, which option correctly addresses the need to provide redundant hubs for branch connectivity? Assume the platform versions are compatible with the feature. A maintenance window is open, but service interruption must be minimized.

Enable and validate dynamic shortcut establishment between eligible spokes
Design dual-hub reachability and routing preference so spokes can fail over while preserving the ADVPN overlay
Run a supported dynamic routing design such as BGP over the overlay and advertise branch prefixes appropriately
Assign non-overlapping protected and overlay addressing consistent with the routing design
Deploy the hub-and-spoke ADVPN roles with compatible overlay parameters and shortcut negotiation enabled

Correct answer: B

Explanation

The defining ADVPN optimization is direct spoke-to-spoke data forwarding after shortcut negotiation. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to provide redundant hubs for branch connectivity.
Redundant hubs remove a single control-plane or transit dependency from the overlay. This directly addresses the stated requirement.
Dynamic routing distributes reachability as branches are added or paths change. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to provide redundant hubs for branch connectivity.
Unique addressing is necessary for predictable route advertisement and tunnel selection. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to provide redundant hubs for branch connectivity.
ADVPN uses the hub to facilitate dynamic spoke-to-spoke shortcuts while preserving centralized reachability. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to provide redundant hubs for branch connectivity.

Question 21

Wingtip Energy has verified basic IP reachability. The remaining requirement is to allow spokes to create direct tunnels after initial communication through the hub. Which action should the team take? No unrelated control should be weakened. The team must preserve existing certificate-trust relationships unless the requirement explicitly changes them.

Assign non-overlapping protected and overlay addressing consistent with the routing design
Design dual-hub reachability and routing preference so spokes can fail over while preserving the ADVPN overlay
Enable and validate dynamic shortcut establishment between eligible spokes
Deploy the hub-and-spoke ADVPN roles with compatible overlay parameters and shortcut negotiation enabled
Run a supported dynamic routing design such as BGP over the overlay and advertise branch prefixes appropriately

Correct answer: D

Explanation

Unique addressing is necessary for predictable route advertisement and tunnel selection. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to allow spokes to create direct tunnels after initial communication through the hub.
Redundant hubs remove a single control-plane or transit dependency from the overlay. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to allow spokes to create direct tunnels after initial communication through the hub.
The defining ADVPN optimization is direct spoke-to-spoke data forwarding after shortcut negotiation. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to allow spokes to create direct tunnels after initial communication through the hub.
ADVPN uses the hub to facilitate dynamic spoke-to-spoke shortcuts while preserving centralized reachability. This directly addresses the stated requirement.
Dynamic routing distributes reachability as branches are added or paths change. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to allow spokes to create direct tunnels after initial communication through the hub.

Question 22

At Lucerne Publishing, the security infrastructure engineer must scale routing across many ADVPN spokes without static routes for every branch. Which action best addresses the requirement? The team will validate the result immediately after the change. The change will be reviewed later using the configuration and event audit trail.

Assign non-overlapping protected and overlay addressing consistent with the routing design
Design dual-hub reachability and routing preference so spokes can fail over while preserving the ADVPN overlay
Run a supported dynamic routing design such as BGP over the overlay and advertise branch prefixes appropriately
Enable and validate dynamic shortcut establishment between eligible spokes
Deploy the hub-and-spoke ADVPN roles with compatible overlay parameters and shortcut negotiation enabled

Correct answer: C

Explanation

Unique addressing is necessary for predictable route advertisement and tunnel selection. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to scale routing across many ADVPN spokes without static routes for every branch.
Redundant hubs remove a single control-plane or transit dependency from the overlay. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to scale routing across many ADVPN spokes without static routes for every branch.
Dynamic routing distributes reachability as branches are added or paths change. This directly addresses the stated requirement.
The defining ADVPN optimization is direct spoke-to-spoke data forwarding after shortcut negotiation. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to scale routing across many ADVPN spokes without static routes for every branch.
ADVPN uses the hub to facilitate dynamic spoke-to-spoke shortcuts while preserving centralized reachability. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to scale routing across many ADVPN spokes without static routes for every branch.

Question 23

During an enterprise firewall change at Bellows College, the team needs to keep the hub from becoming the steady-state data path for spoke-to-spoke traffic. What should it do? The change is taking place in a controlled maintenance window. The chosen approach must continue to work as additional branch sites are added.

Run a supported dynamic routing design such as BGP over the overlay and advertise branch prefixes appropriately
Assign non-overlapping protected and overlay addressing consistent with the routing design
Enable and validate dynamic shortcut establishment between eligible spokes
Deploy the hub-and-spoke ADVPN roles with compatible overlay parameters and shortcut negotiation enabled
Design dual-hub reachability and routing preference so spokes can fail over while preserving the ADVPN overlay

Correct answer: C

Explanation

Dynamic routing distributes reachability as branches are added or paths change. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to keep the hub from becoming the steady-state data path for spoke-to-spoke traffic.
Unique addressing is necessary for predictable route advertisement and tunnel selection. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to keep the hub from becoming the steady-state data path for spoke-to-spoke traffic.
The defining ADVPN optimization is direct spoke-to-spoke data forwarding after shortcut negotiation. This directly addresses the stated requirement.
ADVPN uses the hub to facilitate dynamic spoke-to-spoke shortcuts while preserving centralized reachability. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to keep the hub from becoming the steady-state data path for spoke-to-spoke traffic.
Redundant hubs remove a single control-plane or transit dependency from the overlay. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to keep the hub from becoming the steady-state data path for spoke-to-spoke traffic.

Question 24

A production review at Tailspin Toys identifies this requirement: avoid overlapping spoke overlay addressing that prevents unambiguous route selection. Which Fortinet action is most appropriate? Choose the smallest targeted change. A second engineer will verify the result using independent operational evidence.

Deploy the hub-and-spoke ADVPN roles with compatible overlay parameters and shortcut negotiation enabled
Design dual-hub reachability and routing preference so spokes can fail over while preserving the ADVPN overlay
Run a supported dynamic routing design such as BGP over the overlay and advertise branch prefixes appropriately
Assign non-overlapping protected and overlay addressing consistent with the routing design
Enable and validate dynamic shortcut establishment between eligible spokes

Correct answer: D

Explanation

ADVPN uses the hub to facilitate dynamic spoke-to-spoke shortcuts while preserving centralized reachability. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid overlapping spoke overlay addressing that prevents unambiguous route selection.
Redundant hubs remove a single control-plane or transit dependency from the overlay. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid overlapping spoke overlay addressing that prevents unambiguous route selection.
Dynamic routing distributes reachability as branches are added or paths change. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid overlapping spoke overlay addressing that prevents unambiguous route selection.
Unique addressing is necessary for predictable route advertisement and tunnel selection. This directly addresses the stated requirement.
The defining ADVPN optimization is direct spoke-to-spoke data forwarding after shortcut negotiation. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to avoid overlapping spoke overlay addressing that prevents unambiguous route selection.

Question 25

While troubleshooting at Humongous Insurance, the network security architect needs to provide redundant hubs for branch connectivity. What is the best next step? The answer must address the stated cause rather than a different feature. The team requires a deterministic rollback path if validation fails.

Deploy the hub-and-spoke ADVPN roles with compatible overlay parameters and shortcut negotiation enabled
Enable and validate dynamic shortcut establishment between eligible spokes
Run a supported dynamic routing design such as BGP over the overlay and advertise branch prefixes appropriately
Design dual-hub reachability and routing preference so spokes can fail over while preserving the ADVPN overlay
Assign non-overlapping protected and overlay addressing consistent with the routing design

Correct answer: D

Explanation

ADVPN uses the hub to facilitate dynamic spoke-to-spoke shortcuts while preserving centralized reachability. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to provide redundant hubs for branch connectivity.
The defining ADVPN optimization is direct spoke-to-spoke data forwarding after shortcut negotiation. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to provide redundant hubs for branch connectivity.
Dynamic routing distributes reachability as branches are added or paths change. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to provide redundant hubs for branch connectivity.
Redundant hubs remove a single control-plane or transit dependency from the overlay. This directly addresses the stated requirement.
Unique addressing is necessary for predictable route advertisement and tunnel selection. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to provide redundant hubs for branch connectivity.

Related posts: