Fortinet Enterprise Firewall 7.6 FCSS_EFW_AD-7.6 ADVPN Routing Policy Troubleshooting Practice Test

Practice Exams:

View All

Fortinet Enterprise Firewall 7.6 FCSS_EFW_AD-7.6 ADVPN Routing Policy Troubleshooting Practice Test

This practice test focuses on advpn routing policy troubleshooting and resilience through original applied scenarios aligned to the final published Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator 7.6 blueprint. It is intended for study and does not reproduce live exam content. For broader exam preparation, review the Fortinet FCSS_EFW_AD-7.6 Exam Dumps page.

Question 1

At Lucerne Publishing, the Fortinet administrator must diagnose why two spokes continue sending traffic through the hub instead of using a shortcut. Which action best addresses the requirement? The team needs an auditable result. Only one site is affected; peer sites are healthy.

Confirm IKE and child-SA state first, then validate route advertisements, next hops, and policy if the SAs are healthy
Use the BGP next-hop behavior required by the ADVPN design and confirm the resolved overlay next hop on each spoke
Use the supported shortcut and routing design so the direct path becomes the preferred resolved path and the hub remains a backup
Inspect IKE peer addressing, NAT-T, shortcut negotiation, dynamic DNS or endpoint reachability, and routing updates
Verify shortcut negotiation, routing advertisements, next-hop handling, spoke reachability, and ADVPN debug state

Correct answer: E

Explanation

Layered troubleshooting avoids changing routing when the tunnel is down or changing crypto when the control plane is the real issue. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to diagnose why two spokes continue sending traffic through the hub instead of using a shortcut.
ADVPN routing depends on next-hop information that can resolve to a usable tunnel endpoint. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to diagnose why two spokes continue sending traffic through the hub instead of using a shortcut.
ADVPN should optimize the data path without removing the hub-based fallback path. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to diagnose why two spokes continue sending traffic through the hub instead of using a shortcut.
Changed endpoint translation can invalidate direct peer reachability even while the hub tunnel remains usable. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to diagnose why two spokes continue sending traffic through the hub instead of using a shortcut.
A shortcut requires both control-plane discovery and usable direct spoke-to-spoke path information. This directly addresses the stated requirement.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, verify shortcut negotiation, routing advertisements, next-hop handling, spoke reachability, and ADVPN debug state. A shortcut requires both control-plane discovery and usable direct spoke-to-spoke path information.

Question 2

During an enterprise firewall change at Bellows College, the team needs to prevent BGP next-hop information from making spoke routes unreachable. What should it do? Use normal enterprise Fortinet administration practice. The change must be validated on a pilot device before broader rollout.

Use the BGP next-hop behavior required by the ADVPN design and confirm the resolved overlay next hop on each spoke
Verify shortcut negotiation, routing advertisements, next-hop handling, spoke reachability, and ADVPN debug state
Use the supported shortcut and routing design so the direct path becomes the preferred resolved path and the hub remains a backup
Confirm IKE and child-SA state first, then validate route advertisements, next hops, and policy if the SAs are healthy
Inspect IKE peer addressing, NAT-T, shortcut negotiation, dynamic DNS or endpoint reachability, and routing updates

Correct answer: A

Explanation

ADVPN routing depends on next-hop information that can resolve to a usable tunnel endpoint. This directly addresses the stated requirement.
A shortcut requires both control-plane discovery and usable direct spoke-to-spoke path information. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prevent BGP next-hop information from making spoke routes unreachable.
ADVPN should optimize the data path without removing the hub-based fallback path. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prevent BGP next-hop information from making spoke routes unreachable.
Layered troubleshooting avoids changing routing when the tunnel is down or changing crypto when the control plane is the real issue. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prevent BGP next-hop information from making spoke routes unreachable.
Changed endpoint translation can invalidate direct peer reachability even while the hub tunnel remains usable. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prevent BGP next-hop information from making spoke routes unreachable.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, use the BGP next-hop behavior required by the ADVPN design and confirm the resolved overlay next hop on each spoke. ADVPN routing depends on next-hop information that can resolve to a usable tunnel endpoint.

Question 3

A production review at Tailspin Toys identifies this requirement: prefer a direct spoke shortcut once it is established while retaining hub reachability as fallback. Which Fortinet action is most appropriate? Assume the platform versions are compatible with the feature. Existing production IP addressing must remain unchanged.

Confirm IKE and child-SA state first, then validate route advertisements, next hops, and policy if the SAs are healthy
Verify shortcut negotiation, routing advertisements, next-hop handling, spoke reachability, and ADVPN debug state
Inspect IKE peer addressing, NAT-T, shortcut negotiation, dynamic DNS or endpoint reachability, and routing updates
Use the BGP next-hop behavior required by the ADVPN design and confirm the resolved overlay next hop on each spoke
Use the supported shortcut and routing design so the direct path becomes the preferred resolved path and the hub remains a backup

Correct answer: E

Explanation

Layered troubleshooting avoids changing routing when the tunnel is down or changing crypto when the control plane is the real issue. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prefer a direct spoke shortcut once it is established while retaining hub reachability as fallback.
A shortcut requires both control-plane discovery and usable direct spoke-to-spoke path information. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prefer a direct spoke shortcut once it is established while retaining hub reachability as fallback.
Changed endpoint translation can invalidate direct peer reachability even while the hub tunnel remains usable. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prefer a direct spoke shortcut once it is established while retaining hub reachability as fallback.
ADVPN routing depends on next-hop information that can resolve to a usable tunnel endpoint. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prefer a direct spoke shortcut once it is established while retaining hub reachability as fallback.
ADVPN should optimize the data path without removing the hub-based fallback path. This directly addresses the stated requirement.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, use the supported shortcut and routing design so the direct path becomes the preferred resolved path and the hub remains a backup. ADVPN should optimize the data path without removing the hub-based fallback path.

Question 4

While troubleshooting at Humongous Insurance, the NOC engineer needs to troubleshoot intermittent shortcut failure after NAT changes at one branch. What is the best next step? No unrelated control should be weakened. The resulting configuration must remain centrally auditable.

Use the BGP next-hop behavior required by the ADVPN design and confirm the resolved overlay next hop on each spoke
Use the supported shortcut and routing design so the direct path becomes the preferred resolved path and the hub remains a backup
Inspect IKE peer addressing, NAT-T, shortcut negotiation, dynamic DNS or endpoint reachability, and routing updates
Confirm IKE and child-SA state first, then validate route advertisements, next hops, and policy if the SAs are healthy
Verify shortcut negotiation, routing advertisements, next-hop handling, spoke reachability, and ADVPN debug state

Correct answer: C

Explanation

ADVPN routing depends on next-hop information that can resolve to a usable tunnel endpoint. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot intermittent shortcut failure after NAT changes at one branch.
ADVPN should optimize the data path without removing the hub-based fallback path. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot intermittent shortcut failure after NAT changes at one branch.
Changed endpoint translation can invalidate direct peer reachability even while the hub tunnel remains usable. This directly addresses the stated requirement.
Layered troubleshooting avoids changing routing when the tunnel is down or changing crypto when the control plane is the real issue. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot intermittent shortcut failure after NAT changes at one branch.
A shortcut requires both control-plane discovery and usable direct spoke-to-spoke path information. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot intermittent shortcut failure after NAT changes at one branch.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, inspect IKE peer addressing, NAT-T, shortcut negotiation, dynamic DNS or endpoint reachability, and routing updates. Changed endpoint translation can invalidate direct peer reachability even while the hub tunnel remains usable.

Question 5

Margie Travel is standardizing a FortiOS 7.6 enterprise deployment. Which approach should it use to separate an ADVPN routing problem from an IPsec negotiation problem? The team will validate the result immediately after the change. A known-good rollback point is available before the change.

Use the BGP next-hop behavior required by the ADVPN design and confirm the resolved overlay next hop on each spoke
Use the supported shortcut and routing design so the direct path becomes the preferred resolved path and the hub remains a backup
Confirm IKE and child-SA state first, then validate route advertisements, next hops, and policy if the SAs are healthy
Verify shortcut negotiation, routing advertisements, next-hop handling, spoke reachability, and ADVPN debug state
Inspect IKE peer addressing, NAT-T, shortcut negotiation, dynamic DNS or endpoint reachability, and routing updates

Correct answer: C

Explanation

ADVPN routing depends on next-hop information that can resolve to a usable tunnel endpoint. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to separate an ADVPN routing problem from an IPsec negotiation problem.
ADVPN should optimize the data path without removing the hub-based fallback path. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to separate an ADVPN routing problem from an IPsec negotiation problem.
Layered troubleshooting avoids changing routing when the tunnel is down or changing crypto when the control plane is the real issue. This directly addresses the stated requirement.
A shortcut requires both control-plane discovery and usable direct spoke-to-spoke path information. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to separate an ADVPN routing problem from an IPsec negotiation problem.
Changed endpoint translation can invalidate direct peer reachability even while the hub tunnel remains usable. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to separate an ADVPN routing problem from an IPsec negotiation problem.

Learning point: For this Fortinet NSE 7 – Enterprise Firewall 7.6 Administrator scenario, confirm IKE and child-SA state first, then validate route advertisements, next hops, and policy if the SAs are healthy. Layered troubleshooting avoids changing routing when the tunnel is down or changing crypto when the control plane is the real issue.

Question 6

A change ticket for Northwind Health states that administrators must diagnose why two spokes continue sending traffic through the hub instead of using a shortcut. Which choice is correct? The change is taking place in a controlled maintenance window. The design must preserve the current segmentation boundaries.

Use the supported shortcut and routing design so the direct path becomes the preferred resolved path and the hub remains a backup
Verify shortcut negotiation, routing advertisements, next-hop handling, spoke reachability, and ADVPN debug state
Inspect IKE peer addressing, NAT-T, shortcut negotiation, dynamic DNS or endpoint reachability, and routing updates
Use the BGP next-hop behavior required by the ADVPN design and confirm the resolved overlay next hop on each spoke
Confirm IKE and child-SA state first, then validate route advertisements, next hops, and policy if the SAs are healthy

Correct answer: B

Explanation

ADVPN should optimize the data path without removing the hub-based fallback path. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to diagnose why two spokes continue sending traffic through the hub instead of using a shortcut.
A shortcut requires both control-plane discovery and usable direct spoke-to-spoke path information. This directly addresses the stated requirement.
Changed endpoint translation can invalidate direct peer reachability even while the hub tunnel remains usable. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to diagnose why two spokes continue sending traffic through the hub instead of using a shortcut.
ADVPN routing depends on next-hop information that can resolve to a usable tunnel endpoint. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to diagnose why two spokes continue sending traffic through the hub instead of using a shortcut.
Layered troubleshooting avoids changing routing when the tunnel is down or changing crypto when the control plane is the real issue. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to diagnose why two spokes continue sending traffic through the hub instead of using a shortcut.

Question 7

The security team at Blue Yonder Airlines wants to prevent BGP next-hop information from making spoke routes unreachable. Which configuration or operational action most directly satisfies that goal? Choose the smallest targeted change. The team is not allowed to disable the security feature globally.

Inspect IKE peer addressing, NAT-T, shortcut negotiation, dynamic DNS or endpoint reachability, and routing updates
Verify shortcut negotiation, routing advertisements, next-hop handling, spoke reachability, and ADVPN debug state
Use the BGP next-hop behavior required by the ADVPN design and confirm the resolved overlay next hop on each spoke
Confirm IKE and child-SA state first, then validate route advertisements, next hops, and policy if the SAs are healthy
Use the supported shortcut and routing design so the direct path becomes the preferred resolved path and the hub remains a backup

Correct answer: C

Explanation

Changed endpoint translation can invalidate direct peer reachability even while the hub tunnel remains usable. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prevent BGP next-hop information from making spoke routes unreachable.
A shortcut requires both control-plane discovery and usable direct spoke-to-spoke path information. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prevent BGP next-hop information from making spoke routes unreachable.
ADVPN routing depends on next-hop information that can resolve to a usable tunnel endpoint. This directly addresses the stated requirement.
Layered troubleshooting avoids changing routing when the tunnel is down or changing crypto when the control plane is the real issue. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prevent BGP next-hop information from making spoke routes unreachable.
ADVPN should optimize the data path without removing the hub-based fallback path. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prevent BGP next-hop information from making spoke routes unreachable.

Question 8

An incident at Trey Research requires the network operations engineer to prefer a direct spoke shortcut once it is established while retaining hub reachability as fallback. What should be done first? The answer must address the stated cause rather than a different feature. The symptom appeared immediately after a planned configuration change.

Use the BGP next-hop behavior required by the ADVPN design and confirm the resolved overlay next hop on each spoke
Inspect IKE peer addressing, NAT-T, shortcut negotiation, dynamic DNS or endpoint reachability, and routing updates
Verify shortcut negotiation, routing advertisements, next-hop handling, spoke reachability, and ADVPN debug state
Confirm IKE and child-SA state first, then validate route advertisements, next hops, and policy if the SAs are healthy
Use the supported shortcut and routing design so the direct path becomes the preferred resolved path and the hub remains a backup

Correct answer: E

Explanation

ADVPN routing depends on next-hop information that can resolve to a usable tunnel endpoint. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prefer a direct spoke shortcut once it is established while retaining hub reachability as fallback.
Changed endpoint translation can invalidate direct peer reachability even while the hub tunnel remains usable. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prefer a direct spoke shortcut once it is established while retaining hub reachability as fallback.
A shortcut requires both control-plane discovery and usable direct spoke-to-spoke path information. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prefer a direct spoke shortcut once it is established while retaining hub reachability as fallback.
Layered troubleshooting avoids changing routing when the tunnel is down or changing crypto when the control plane is the real issue. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prefer a direct spoke shortcut once it is established while retaining hub reachability as fallback.
ADVPN should optimize the data path without removing the hub-based fallback path. This directly addresses the stated requirement.

Question 9

For a FortiGate/FortiManager/FortiAnalyzer 7.6 deployment at Apex Retail, which option correctly addresses the need to troubleshoot intermittent shortcut failure after NAT changes at one branch? Preserve the existing design unless the requirement says otherwise. Logs from the affected traffic are available for verification.

Use the supported shortcut and routing design so the direct path becomes the preferred resolved path and the hub remains a backup
Confirm IKE and child-SA state first, then validate route advertisements, next hops, and policy if the SAs are healthy
Use the BGP next-hop behavior required by the ADVPN design and confirm the resolved overlay next hop on each spoke
Inspect IKE peer addressing, NAT-T, shortcut negotiation, dynamic DNS or endpoint reachability, and routing updates
Verify shortcut negotiation, routing advertisements, next-hop handling, spoke reachability, and ADVPN debug state

Correct answer: D

Explanation

ADVPN should optimize the data path without removing the hub-based fallback path. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot intermittent shortcut failure after NAT changes at one branch.
Layered troubleshooting avoids changing routing when the tunnel is down or changing crypto when the control plane is the real issue. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot intermittent shortcut failure after NAT changes at one branch.
ADVPN routing depends on next-hop information that can resolve to a usable tunnel endpoint. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot intermittent shortcut failure after NAT changes at one branch.
Changed endpoint translation can invalidate direct peer reachability even while the hub tunnel remains usable. This directly addresses the stated requirement.
A shortcut requires both control-plane discovery and usable direct spoke-to-spoke path information. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot intermittent shortcut failure after NAT changes at one branch.

Question 10

Proseware Media has verified basic IP reachability. The remaining requirement is to separate an ADVPN routing problem from an IPsec negotiation problem. Which action should the team take? Prefer a change that is reversible and easy to verify. The equivalent configuration works correctly at a separate site.

Confirm IKE and child-SA state first, then validate route advertisements, next hops, and policy if the SAs are healthy
Use the BGP next-hop behavior required by the ADVPN design and confirm the resolved overlay next hop on each spoke
Inspect IKE peer addressing, NAT-T, shortcut negotiation, dynamic DNS or endpoint reachability, and routing updates
Verify shortcut negotiation, routing advertisements, next-hop handling, spoke reachability, and ADVPN debug state
Use the supported shortcut and routing design so the direct path becomes the preferred resolved path and the hub remains a backup

Correct answer: A

Explanation

Layered troubleshooting avoids changing routing when the tunnel is down or changing crypto when the control plane is the real issue. This directly addresses the stated requirement.
ADVPN routing depends on next-hop information that can resolve to a usable tunnel endpoint. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to separate an ADVPN routing problem from an IPsec negotiation problem.
Changed endpoint translation can invalidate direct peer reachability even while the hub tunnel remains usable. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to separate an ADVPN routing problem from an IPsec negotiation problem.
A shortcut requires both control-plane discovery and usable direct spoke-to-spoke path information. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to separate an ADVPN routing problem from an IPsec negotiation problem.
ADVPN should optimize the data path without removing the hub-based fallback path. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to separate an ADVPN routing problem from an IPsec negotiation problem.

Question 11

At City Power & Light, the enterprise firewall engineer must diagnose why two spokes continue sending traffic through the hub instead of using a shortcut. Which action best addresses the requirement? The team needs an auditable result. The change must be reversible within the same maintenance window.

Verify shortcut negotiation, routing advertisements, next-hop handling, spoke reachability, and ADVPN debug state
Confirm IKE and child-SA state first, then validate route advertisements, next hops, and policy if the SAs are healthy
Use the supported shortcut and routing design so the direct path becomes the preferred resolved path and the hub remains a backup
Use the BGP next-hop behavior required by the ADVPN design and confirm the resolved overlay next hop on each spoke
Inspect IKE peer addressing, NAT-T, shortcut negotiation, dynamic DNS or endpoint reachability, and routing updates

Correct answer: A

Explanation

A shortcut requires both control-plane discovery and usable direct spoke-to-spoke path information. This directly addresses the stated requirement.
Layered troubleshooting avoids changing routing when the tunnel is down or changing crypto when the control plane is the real issue. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to diagnose why two spokes continue sending traffic through the hub instead of using a shortcut.
ADVPN should optimize the data path without removing the hub-based fallback path. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to diagnose why two spokes continue sending traffic through the hub instead of using a shortcut.
ADVPN routing depends on next-hop information that can resolve to a usable tunnel endpoint. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to diagnose why two spokes continue sending traffic through the hub instead of using a shortcut.
Changed endpoint translation can invalidate direct peer reachability even while the hub tunnel remains usable. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to diagnose why two spokes continue sending traffic through the hub instead of using a shortcut.

Question 12

During an enterprise firewall change at VanArsdel, the team needs to prevent BGP next-hop information from making spoke routes unreachable. What should it do? Use normal enterprise Fortinet administration practice. The device is already synchronized with its central-management database.

Inspect IKE peer addressing, NAT-T, shortcut negotiation, dynamic DNS or endpoint reachability, and routing updates
Use the supported shortcut and routing design so the direct path becomes the preferred resolved path and the hub remains a backup
Verify shortcut negotiation, routing advertisements, next-hop handling, spoke reachability, and ADVPN debug state
Confirm IKE and child-SA state first, then validate route advertisements, next hops, and policy if the SAs are healthy
Use the BGP next-hop behavior required by the ADVPN design and confirm the resolved overlay next hop on each spoke

Correct answer: E

Explanation

Changed endpoint translation can invalidate direct peer reachability even while the hub tunnel remains usable. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prevent BGP next-hop information from making spoke routes unreachable.
ADVPN should optimize the data path without removing the hub-based fallback path. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prevent BGP next-hop information from making spoke routes unreachable.
A shortcut requires both control-plane discovery and usable direct spoke-to-spoke path information. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prevent BGP next-hop information from making spoke routes unreachable.
Layered troubleshooting avoids changing routing when the tunnel is down or changing crypto when the control plane is the real issue. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prevent BGP next-hop information from making spoke routes unreachable.
ADVPN routing depends on next-hop information that can resolve to a usable tunnel endpoint. This directly addresses the stated requirement.

Question 13

A production review at Woodgrove Bank identifies this requirement: prefer a direct spoke shortcut once it is established while retaining hub reachability as fallback. Which Fortinet action is most appropriate? Assume the platform versions are compatible with the feature. The current routing table contains the expected connected networks.

Inspect IKE peer addressing, NAT-T, shortcut negotiation, dynamic DNS or endpoint reachability, and routing updates
Verify shortcut negotiation, routing advertisements, next-hop handling, spoke reachability, and ADVPN debug state
Use the BGP next-hop behavior required by the ADVPN design and confirm the resolved overlay next hop on each spoke
Confirm IKE and child-SA state first, then validate route advertisements, next hops, and policy if the SAs are healthy
Use the supported shortcut and routing design so the direct path becomes the preferred resolved path and the hub remains a backup

Correct answer: E

Explanation

Changed endpoint translation can invalidate direct peer reachability even while the hub tunnel remains usable. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prefer a direct spoke shortcut once it is established while retaining hub reachability as fallback.
A shortcut requires both control-plane discovery and usable direct spoke-to-spoke path information. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prefer a direct spoke shortcut once it is established while retaining hub reachability as fallback.
ADVPN routing depends on next-hop information that can resolve to a usable tunnel endpoint. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prefer a direct spoke shortcut once it is established while retaining hub reachability as fallback.
Layered troubleshooting avoids changing routing when the tunnel is down or changing crypto when the control plane is the real issue. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prefer a direct spoke shortcut once it is established while retaining hub reachability as fallback.
ADVPN should optimize the data path without removing the hub-based fallback path. This directly addresses the stated requirement.

Question 14

While troubleshooting at Alpine Ski House, the network operations engineer needs to troubleshoot intermittent shortcut failure after NAT changes at one branch. What is the best next step? No unrelated control should be weakened. Basic IP reachability to the remote endpoint has already been verified.

Use the BGP next-hop behavior required by the ADVPN design and confirm the resolved overlay next hop on each spoke
Use the supported shortcut and routing design so the direct path becomes the preferred resolved path and the hub remains a backup
Verify shortcut negotiation, routing advertisements, next-hop handling, spoke reachability, and ADVPN debug state
Inspect IKE peer addressing, NAT-T, shortcut negotiation, dynamic DNS or endpoint reachability, and routing updates
Confirm IKE and child-SA state first, then validate route advertisements, next hops, and policy if the SAs are healthy

Correct answer: D

Explanation

ADVPN routing depends on next-hop information that can resolve to a usable tunnel endpoint. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot intermittent shortcut failure after NAT changes at one branch.
ADVPN should optimize the data path without removing the hub-based fallback path. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot intermittent shortcut failure after NAT changes at one branch.
A shortcut requires both control-plane discovery and usable direct spoke-to-spoke path information. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot intermittent shortcut failure after NAT changes at one branch.
Changed endpoint translation can invalidate direct peer reachability even while the hub tunnel remains usable. This directly addresses the stated requirement.
Layered troubleshooting avoids changing routing when the tunnel is down or changing crypto when the control plane is the real issue. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot intermittent shortcut failure after NAT changes at one branch.

Question 15

Datum Corporation is standardizing a FortiOS 7.6 enterprise deployment. Which approach should it use to separate an ADVPN routing problem from an IPsec negotiation problem? The team will validate the result immediately after the change. Hardware replacement is outside the approved change scope.

Verify shortcut negotiation, routing advertisements, next-hop handling, spoke reachability, and ADVPN debug state
Inspect IKE peer addressing, NAT-T, shortcut negotiation, dynamic DNS or endpoint reachability, and routing updates
Confirm IKE and child-SA state first, then validate route advertisements, next hops, and policy if the SAs are healthy
Use the BGP next-hop behavior required by the ADVPN design and confirm the resolved overlay next hop on each spoke
Use the supported shortcut and routing design so the direct path becomes the preferred resolved path and the hub remains a backup

Correct answer: C

Explanation

A shortcut requires both control-plane discovery and usable direct spoke-to-spoke path information. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to separate an ADVPN routing problem from an IPsec negotiation problem.
Changed endpoint translation can invalidate direct peer reachability even while the hub tunnel remains usable. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to separate an ADVPN routing problem from an IPsec negotiation problem.
Layered troubleshooting avoids changing routing when the tunnel is down or changing crypto when the control plane is the real issue. This directly addresses the stated requirement.
ADVPN routing depends on next-hop information that can resolve to a usable tunnel endpoint. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to separate an ADVPN routing problem from an IPsec negotiation problem.
ADVPN should optimize the data path without removing the hub-based fallback path. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to separate an ADVPN routing problem from an IPsec negotiation problem.

Question 16

A change ticket for Contoso Finance states that administrators must diagnose why two spokes continue sending traffic through the hub instead of using a shortcut. Which choice is correct? The change is taking place in a controlled maintenance window. The requirement applies only to one policy, peer, or managed device group.

Use the supported shortcut and routing design so the direct path becomes the preferred resolved path and the hub remains a backup
Use the BGP next-hop behavior required by the ADVPN design and confirm the resolved overlay next hop on each spoke
Inspect IKE peer addressing, NAT-T, shortcut negotiation, dynamic DNS or endpoint reachability, and routing updates
Confirm IKE and child-SA state first, then validate route advertisements, next hops, and policy if the SAs are healthy
Verify shortcut negotiation, routing advertisements, next-hop handling, spoke reachability, and ADVPN debug state

Correct answer: E

Explanation

ADVPN should optimize the data path without removing the hub-based fallback path. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to diagnose why two spokes continue sending traffic through the hub instead of using a shortcut.
ADVPN routing depends on next-hop information that can resolve to a usable tunnel endpoint. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to diagnose why two spokes continue sending traffic through the hub instead of using a shortcut.
Changed endpoint translation can invalidate direct peer reachability even while the hub tunnel remains usable. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to diagnose why two spokes continue sending traffic through the hub instead of using a shortcut.
Layered troubleshooting avoids changing routing when the tunnel is down or changing crypto when the control plane is the real issue. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to diagnose why two spokes continue sending traffic through the hub instead of using a shortcut.
A shortcut requires both control-plane discovery and usable direct spoke-to-spoke path information. This directly addresses the stated requirement.

Question 17

The security team at Litware Logistics wants to prevent BGP next-hop information from making spoke routes unreachable. Which configuration or operational action most directly satisfies that goal? Choose the smallest targeted change. The team must avoid broadening administrative trust or permissions.

Verify shortcut negotiation, routing advertisements, next-hop handling, spoke reachability, and ADVPN debug state
Use the supported shortcut and routing design so the direct path becomes the preferred resolved path and the hub remains a backup
Inspect IKE peer addressing, NAT-T, shortcut negotiation, dynamic DNS or endpoint reachability, and routing updates
Use the BGP next-hop behavior required by the ADVPN design and confirm the resolved overlay next hop on each spoke
Confirm IKE and child-SA state first, then validate route advertisements, next hops, and policy if the SAs are healthy

Correct answer: D

Explanation

A shortcut requires both control-plane discovery and usable direct spoke-to-spoke path information. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prevent BGP next-hop information from making spoke routes unreachable.
ADVPN should optimize the data path without removing the hub-based fallback path. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prevent BGP next-hop information from making spoke routes unreachable.
Changed endpoint translation can invalidate direct peer reachability even while the hub tunnel remains usable. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prevent BGP next-hop information from making spoke routes unreachable.
ADVPN routing depends on next-hop information that can resolve to a usable tunnel endpoint. This directly addresses the stated requirement.
Layered troubleshooting avoids changing routing when the tunnel is down or changing crypto when the control plane is the real issue. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prevent BGP next-hop information from making spoke routes unreachable.

Question 18

An incident at Wide World Importers requires the network security architect to prefer a direct spoke shortcut once it is established while retaining hub reachability as fallback. What should be done first? The answer must address the stated cause rather than a different feature. The design must preserve existing centralized logging and telemetry.

Use the BGP next-hop behavior required by the ADVPN design and confirm the resolved overlay next hop on each spoke
Confirm IKE and child-SA state first, then validate route advertisements, next hops, and policy if the SAs are healthy
Verify shortcut negotiation, routing advertisements, next-hop handling, spoke reachability, and ADVPN debug state
Inspect IKE peer addressing, NAT-T, shortcut negotiation, dynamic DNS or endpoint reachability, and routing updates
Use the supported shortcut and routing design so the direct path becomes the preferred resolved path and the hub remains a backup

Correct answer: E

Explanation

ADVPN routing depends on next-hop information that can resolve to a usable tunnel endpoint. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prefer a direct spoke shortcut once it is established while retaining hub reachability as fallback.
Layered troubleshooting avoids changing routing when the tunnel is down or changing crypto when the control plane is the real issue. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prefer a direct spoke shortcut once it is established while retaining hub reachability as fallback.
A shortcut requires both control-plane discovery and usable direct spoke-to-spoke path information. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prefer a direct spoke shortcut once it is established while retaining hub reachability as fallback.
Changed endpoint translation can invalidate direct peer reachability even while the hub tunnel remains usable. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prefer a direct spoke shortcut once it is established while retaining hub reachability as fallback.
ADVPN should optimize the data path without removing the hub-based fallback path. This directly addresses the stated requirement.

Question 19

For a FortiGate/FortiManager/FortiAnalyzer 7.6 deployment at Relecloud, which option correctly addresses the need to troubleshoot intermittent shortcut failure after NAT changes at one branch? Preserve the existing design unless the requirement says otherwise. Production subnets cannot be renumbered as part of this change.

Confirm IKE and child-SA state first, then validate route advertisements, next hops, and policy if the SAs are healthy
Use the supported shortcut and routing design so the direct path becomes the preferred resolved path and the hub remains a backup
Verify shortcut negotiation, routing advertisements, next-hop handling, spoke reachability, and ADVPN debug state
Use the BGP next-hop behavior required by the ADVPN design and confirm the resolved overlay next hop on each spoke
Inspect IKE peer addressing, NAT-T, shortcut negotiation, dynamic DNS or endpoint reachability, and routing updates

Correct answer: E

Explanation

Layered troubleshooting avoids changing routing when the tunnel is down or changing crypto when the control plane is the real issue. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot intermittent shortcut failure after NAT changes at one branch.
ADVPN should optimize the data path without removing the hub-based fallback path. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot intermittent shortcut failure after NAT changes at one branch.
A shortcut requires both control-plane discovery and usable direct spoke-to-spoke path information. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot intermittent shortcut failure after NAT changes at one branch.
ADVPN routing depends on next-hop information that can resolve to a usable tunnel endpoint. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot intermittent shortcut failure after NAT changes at one branch.
Changed endpoint translation can invalidate direct peer reachability even while the hub tunnel remains usable. This directly addresses the stated requirement.

Question 20

Adventure Works has verified basic IP reachability. The remaining requirement is to separate an ADVPN routing problem from an IPsec negotiation problem. Which action should the team take? Prefer a change that is reversible and easy to verify. A maintenance window is open, but service interruption must be minimized.

Verify shortcut negotiation, routing advertisements, next-hop handling, spoke reachability, and ADVPN debug state
Use the supported shortcut and routing design so the direct path becomes the preferred resolved path and the hub remains a backup
Confirm IKE and child-SA state first, then validate route advertisements, next hops, and policy if the SAs are healthy
Inspect IKE peer addressing, NAT-T, shortcut negotiation, dynamic DNS or endpoint reachability, and routing updates
Use the BGP next-hop behavior required by the ADVPN design and confirm the resolved overlay next hop on each spoke

Correct answer: C

Explanation

A shortcut requires both control-plane discovery and usable direct spoke-to-spoke path information. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to separate an ADVPN routing problem from an IPsec negotiation problem.
ADVPN should optimize the data path without removing the hub-based fallback path. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to separate an ADVPN routing problem from an IPsec negotiation problem.
Layered troubleshooting avoids changing routing when the tunnel is down or changing crypto when the control plane is the real issue. This directly addresses the stated requirement.
Changed endpoint translation can invalidate direct peer reachability even while the hub tunnel remains usable. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to separate an ADVPN routing problem from an IPsec negotiation problem.
ADVPN routing depends on next-hop information that can resolve to a usable tunnel endpoint. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to separate an ADVPN routing problem from an IPsec negotiation problem.

Question 21

At Fourth Coffee, the security infrastructure engineer must diagnose why two spokes continue sending traffic through the hub instead of using a shortcut. Which action best addresses the requirement? The team needs an auditable result. The team must preserve existing certificate-trust relationships unless the requirement explicitly changes them.

Use the supported shortcut and routing design so the direct path becomes the preferred resolved path and the hub remains a backup
Inspect IKE peer addressing, NAT-T, shortcut negotiation, dynamic DNS or endpoint reachability, and routing updates
Verify shortcut negotiation, routing advertisements, next-hop handling, spoke reachability, and ADVPN debug state
Confirm IKE and child-SA state first, then validate route advertisements, next hops, and policy if the SAs are healthy
Use the BGP next-hop behavior required by the ADVPN design and confirm the resolved overlay next hop on each spoke

Correct answer: C

Explanation

ADVPN should optimize the data path without removing the hub-based fallback path. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to diagnose why two spokes continue sending traffic through the hub instead of using a shortcut.
Changed endpoint translation can invalidate direct peer reachability even while the hub tunnel remains usable. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to diagnose why two spokes continue sending traffic through the hub instead of using a shortcut.
A shortcut requires both control-plane discovery and usable direct spoke-to-spoke path information. This directly addresses the stated requirement.
Layered troubleshooting avoids changing routing when the tunnel is down or changing crypto when the control plane is the real issue. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to diagnose why two spokes continue sending traffic through the hub instead of using a shortcut.
ADVPN routing depends on next-hop information that can resolve to a usable tunnel endpoint. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to diagnose why two spokes continue sending traffic through the hub instead of using a shortcut.

Question 22

During an enterprise firewall change at Coho Winery, the team needs to prevent BGP next-hop information from making spoke routes unreachable. What should it do? Use normal enterprise Fortinet administration practice. The change will be reviewed later using the configuration and event audit trail.

Verify shortcut negotiation, routing advertisements, next-hop handling, spoke reachability, and ADVPN debug state
Use the supported shortcut and routing design so the direct path becomes the preferred resolved path and the hub remains a backup
Use the BGP next-hop behavior required by the ADVPN design and confirm the resolved overlay next hop on each spoke
Inspect IKE peer addressing, NAT-T, shortcut negotiation, dynamic DNS or endpoint reachability, and routing updates
Confirm IKE and child-SA state first, then validate route advertisements, next hops, and policy if the SAs are healthy

Correct answer: C

Explanation

A shortcut requires both control-plane discovery and usable direct spoke-to-spoke path information. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prevent BGP next-hop information from making spoke routes unreachable.
ADVPN should optimize the data path without removing the hub-based fallback path. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prevent BGP next-hop information from making spoke routes unreachable.
ADVPN routing depends on next-hop information that can resolve to a usable tunnel endpoint. This directly addresses the stated requirement.
Changed endpoint translation can invalidate direct peer reachability even while the hub tunnel remains usable. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prevent BGP next-hop information from making spoke routes unreachable.
Layered troubleshooting avoids changing routing when the tunnel is down or changing crypto when the control plane is the real issue. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prevent BGP next-hop information from making spoke routes unreachable.

Question 23

A production review at Fabrikam Manufacturing identifies this requirement: prefer a direct spoke shortcut once it is established while retaining hub reachability as fallback. Which Fortinet action is most appropriate? Assume the platform versions are compatible with the feature. The chosen approach must continue to work as additional branch sites are added.

Use the BGP next-hop behavior required by the ADVPN design and confirm the resolved overlay next hop on each spoke
Verify shortcut negotiation, routing advertisements, next-hop handling, spoke reachability, and ADVPN debug state
Use the supported shortcut and routing design so the direct path becomes the preferred resolved path and the hub remains a backup
Confirm IKE and child-SA state first, then validate route advertisements, next hops, and policy if the SAs are healthy
Inspect IKE peer addressing, NAT-T, shortcut negotiation, dynamic DNS or endpoint reachability, and routing updates

Correct answer: C

Explanation

ADVPN routing depends on next-hop information that can resolve to a usable tunnel endpoint. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prefer a direct spoke shortcut once it is established while retaining hub reachability as fallback.
A shortcut requires both control-plane discovery and usable direct spoke-to-spoke path information. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prefer a direct spoke shortcut once it is established while retaining hub reachability as fallback.
ADVPN should optimize the data path without removing the hub-based fallback path. This directly addresses the stated requirement.
Layered troubleshooting avoids changing routing when the tunnel is down or changing crypto when the control plane is the real issue. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prefer a direct spoke shortcut once it is established while retaining hub reachability as fallback.
Changed endpoint translation can invalidate direct peer reachability even while the hub tunnel remains usable. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to prefer a direct spoke shortcut once it is established while retaining hub reachability as fallback.

Question 24

While troubleshooting at Wingtip Energy, the network security architect needs to troubleshoot intermittent shortcut failure after NAT changes at one branch. What is the best next step? No unrelated control should be weakened. A second engineer will verify the result using independent operational evidence.

Use the BGP next-hop behavior required by the ADVPN design and confirm the resolved overlay next hop on each spoke
Verify shortcut negotiation, routing advertisements, next-hop handling, spoke reachability, and ADVPN debug state
Inspect IKE peer addressing, NAT-T, shortcut negotiation, dynamic DNS or endpoint reachability, and routing updates
Use the supported shortcut and routing design so the direct path becomes the preferred resolved path and the hub remains a backup
Confirm IKE and child-SA state first, then validate route advertisements, next hops, and policy if the SAs are healthy

Correct answer: C

Explanation

ADVPN routing depends on next-hop information that can resolve to a usable tunnel endpoint. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot intermittent shortcut failure after NAT changes at one branch.
A shortcut requires both control-plane discovery and usable direct spoke-to-spoke path information. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot intermittent shortcut failure after NAT changes at one branch.
Changed endpoint translation can invalidate direct peer reachability even while the hub tunnel remains usable. This directly addresses the stated requirement.
ADVPN should optimize the data path without removing the hub-based fallback path. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot intermittent shortcut failure after NAT changes at one branch.
Layered troubleshooting avoids changing routing when the tunnel is down or changing crypto when the control plane is the real issue. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to troubleshoot intermittent shortcut failure after NAT changes at one branch.

Question 25

Lucerne Publishing is standardizing a FortiOS 7.6 enterprise deployment. Which approach should it use to separate an ADVPN routing problem from an IPsec negotiation problem? The team will validate the result immediately after the change. The team requires a deterministic rollback path if validation fails.

Use the supported shortcut and routing design so the direct path becomes the preferred resolved path and the hub remains a backup
Use the BGP next-hop behavior required by the ADVPN design and confirm the resolved overlay next hop on each spoke
Confirm IKE and child-SA state first, then validate route advertisements, next hops, and policy if the SAs are healthy
Inspect IKE peer addressing, NAT-T, shortcut negotiation, dynamic DNS or endpoint reachability, and routing updates
Verify shortcut negotiation, routing advertisements, next-hop handling, spoke reachability, and ADVPN debug state

Correct answer: C

Explanation

ADVPN should optimize the data path without removing the hub-based fallback path. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to separate an ADVPN routing problem from an IPsec negotiation problem.
ADVPN routing depends on next-hop information that can resolve to a usable tunnel endpoint. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to separate an ADVPN routing problem from an IPsec negotiation problem.
Layered troubleshooting avoids changing routing when the tunnel is down or changing crypto when the control plane is the real issue. This directly addresses the stated requirement.
Changed endpoint translation can invalidate direct peer reachability even while the hub tunnel remains usable. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to separate an ADVPN routing problem from an IPsec negotiation problem.
A shortcut requires both control-plane discovery and usable direct spoke-to-spoke path information. This can be correct in another enterprise firewall scenario, but it does not directly satisfy the requirement to separate an ADVPN routing problem from an IPsec negotiation problem.

Related posts: