FCSS SD-WAN 7.4 Architect study plan

Map each of the four exam domains to a personal weak-spot list by writing down which FortiGate SD-WAN features you have actually configured versus only read about

Describe the FortiOS 7.4 SD-WAN architecture end to end, naming where SD-WAN rules, health checks, and the WAN link load-balancing engine sit in the packet path

Compare IPsec-based overlays against ADVPN and explain when each is chosen, including the role of BGP in the shortcut path

Draw from memory a two-hub, four-branch topology that satisfies a stated requirement for redundant overlays and dynamic shortcut tunnels

Configure an SD-WAN zone, add member interfaces, and verify status output for each member

Build IPsec overlays between a hub and two branches using a repeatable template, then confirm tunnel status and route exchange

Configure ADVPN with BGP so that branch-to-branch traffic takes a shortcut, and prove the shortcut appears in session and routing output

Explain how SD-WAN members interact with zones, VLANs, and policy routes so that traffic is not silently bypassing the SD-WAN rule

Configure SLA health checks with latency, jitter, and packet-loss thresholds and tune probe interval and failure retry counts for a stated SLA

Write SD-WAN rules that steer by application, by source-destination pair, and by SLA status, and rank the rules so precedence is unambiguous

Explain and demonstrate the difference between the priority, manual, and volume-based load-balancing strategies

Diagnose a case where traffic sticks to a failing member and correct the rule, health-check, or strategy responsible

Configure forward error correction and per-link WAN optimization on an overlay and measure the effect on lossy-link throughput

Apply traffic shaping to SD-WAN traffic and explain how shaping interacts with per-link egress limits

Tune TCP and session parameters that affect WAN performance, and state which settings are safe to change on a production branch

Explain how route selection, asymmetric routing, and SD-WAN rules can conflict, and resolve one such conflict in the lab

Build security profiles for a branch policy, including IPS, application control, web filtering, and antivirus, and bind them in the correct policy order

Explain how FortiGate SD-WAN sends traffic to FortiSASE or a cloud security service and configure the tunnel and policy for one such path

Configure local breakout versus backhauling through the hub and justify the choice for SaaS, trusted internal, and untrusted traffic

Use application control to steer SaaS traffic onto the preferred member and verify the match in logs

Configure an SD-WAN rule that fails over to a backup path when an SLA is breached and confirm the failover and failback timing

Explain how to steer encrypted traffic you cannot inspect and what policy and certificate options exist

Set up logging and a log-forwarding path so that SD-WAN and security events reach a central collector

Review a policy set for shadowed or overly permissive rules and correct at least one finding

Enroll a device in FortiManager, push a policy package and SD-WAN template, and explain which objects are managed centrally versus locally

Use the SD-WAN monitor and FortiView to identify which member carried a given session and why

Run through a structured troubleshooting sequence for a down overlay, a failed health check, and a rule that never matches

Collect and interpret the diagnostic commands and logs needed to prove where an SD-WAN decision was made

Re-run every domain's lab deliverable from a clean configuration to confirm the steps are reproducible without notes

Answer timed practice questions across all four domains and tag each miss to a domain and a specific feature

Close every tagged miss by returning to the relevant documentation section and re-testing the concept in the lab

Write a one-page pre-exam summary of the decisions you most often get wrong, phrased as rules rather than topics