Fortinet publishes no pass mark for this exam. Not a percentage, not a scaled score, not a range. The result comes back as pass or fail, and none of the five sections carries a weighting either.
That absence is the first thing worth understanding about FCSS_SDW_AR-7.6, the Fortinet FCSS SD-WAN 7.6 Architect exam. It is 38 questions in 75 minutes at 200 US dollars, delivered through Pearson VUE, and it sits in the FCSS Network Security track alongside the Enterprise Firewall and LAN Edge exams. Without weightings there is no cheap way to rank the five sections by importance, so every one of them, from basic member and zone setup through to ADVPN troubleshooting, has to be treated as fully examinable. This guide works through what the Fortinet SD-WAN certification actually asks, why the timing is tighter than it looks, and where an experienced FortiGate administrator tends to lose marks.
What Does the Fortinet SD-WAN Certification Cover?
FCSS_SDW_AR-7.6 covers five published sections: basic SD-WAN setup, rules and routing, centralised management through FortiManager, advanced IPsec, and SD-WAN troubleshooting. The scope runs from configuring members, zones and performance SLAs on a single FortiGate up to orchestrating overlays across a multiregion deployment.
The shape of that list tells you what Fortinet means by architect. Three of the five sections are about building something at scale, and two are about proving it works when it does not. There is no section on strategy, vendor selection or business case. This is a hands-on exam about a specific implementation of SD-WAN inside FortiOS.
The security framing is not decoration either. Fortinet places the exam in its network security track rather than a routing one, and its product leadership has been explicit about why that distinction exists.
“Most of the original SD-WAN vendors were focused on the routing stack. A lot of them forgot that when you open up that wide area network you’re then creating an edge that needs to be protected.”
Anyone coming from a pure routing background should read the section list with that in mind. Fortinet’s SD-WAN administration guide is the reference the objectives track most closely, and its ordering matches the exam’s own.
What Are the FCSS_SDW_AR-7.6 Exam Details?
FCSS_SDW_AR-7.6 is 38 questions in 75 minutes, priced at 200 US dollars and scheduled through Pearson VUE. Questions are multiple choice and multiple select, answers must be fully correct to score, and there is no partial credit and no penalty for a wrong answer. The result is reported as pass or fail with no number attached.
| Field | Value |
|---|---|
| Exam name | Fortinet FCSS SD-WAN 7.6 Architect |
| Exam number | FCSS_SDW_AR-7.6 |
| Questions | 38 |
| Duration | 75 minutes |
| Passing score | Pass / Fail, no figure published |
| Price | $200 USD |
| Delivery | Pearson VUE |
| Question types | Multiple choice and multiple select |
| Published sections | 5, unweighted |
Divide the clock by the paper and you get 118 seconds a question. That sounds generous until you remember what a multiple select question looks like at this level: a topology, a set of requirements, and four or five candidate configurations of which more than one may be right. Getting three of four selections correct scores nothing.
The full track listing, including the sibling exams and the exams that count toward the same certification, is published on the Fortinet Network Security track page.
Why Does Fortinet Publish No Pass Mark or Weightings?
Fortinet reports FCSS_SDW_AR-7.6 as pass or fail and attaches no percentage to any of the five sections. In practice that means you cannot rank the sections by value and study accordingly, and you cannot tell after a fail whether you missed by one question or by ten. Both consequences change how preparation should be planned.
The first is the useful one. On a weighted exam it is rational to spend most of the time on the 25 percent domain. Here, a section with three objectives and a section with two are worth an unknown amount each, so the safe assumption is that they are roughly comparable and that no section can be written off. Troubleshooting has three objectives and is the last item on the list, which is exactly the position candidates tend to under-prepare.
What the scoring rules do tell you
Fortinet is specific on one point that matters more than a pass percentage would. An answer must be entirely correct to earn credit, there is no partial credit on multiple select items, and a wrong answer costs nothing beyond the mark itself. That combination rewards attempting everything and punishes half-knowledge of a topic much more heavily than complete ignorance of it.
Because the two strongest search signals for this exam are candidates typing whole questions about performance SLAs and about ECMP behaviour, the fastest calibration available is working FCSS SD-WAN sample questions in the same multiple select format rather than reading the objectives again.
What Does the Advanced IPsec Section Expect?
The advanced IPsec section has three objectives: deploying a hub-and-spoke IPsec topology for SD-WAN, configuring ADVPN, and configuring IPsec multihub, multiregion and large deployments. It is the section that separates a branch administrator from an architect, because every objective is about what happens when the number of sites stops being small.
ADVPN is the pivot. A conventional hub-and-spoke design sends spoke to spoke traffic through the hub, which is fine at ten sites and painful at two hundred. Auto Discovery VPN lets spokes build shortcuts directly to each other on demand, and the exam expects you to know how those shortcuts are negotiated and what has to be in place for them to form.
Multiregion is where the design questions get harder. Once there is more than one hub, routing has to prefer the right one, failover has to behave predictably, and the shortcut logic has to work across regions rather than only within them. Fortinet’s ADVPN configuration reference covers the mechanics, and the underlying protocol behaviour is defined in the IETF’s IPsec security architecture.
Candidates who have only ever built two-site tunnels find this section the hardest, and it is the one where lab time cannot be substituted with reading.
How Does FortiManager Change an SD-WAN Deployment?
The centralised management section covers deploying SD-WAN from FortiManager, implementing branch configuration deployment, and using SD-WAN Manager with overlay orchestration. It assumes the estate is large enough that per-device configuration has stopped being viable, which is the practical definition of the architect tier.
Three ideas sit behind those objectives. Templates push a consistent configuration to many branches. Branch deployment turns a new site into a repeatable process rather than a project. Overlay orchestration builds and maintains the tunnel mesh so nobody has to hand-configure it as the estate grows.
The examinable subtlety is the relationship between what FortiManager pushes and what a device holds locally. An engineer used to configuring FortiGates directly has to think in terms of what the manager owns and what remains device-specific, because a question about a misapplied branch template is really a question about that boundary.
Which Troubleshooting Skills Does the Exam Test?
Troubleshooting is one of the five sections and carries three objectives: SD-WAN rules and session behaviour, SD-WAN routing, and ADVPN. Each mirrors a build objective elsewhere in the syllabus, so the section is effectively asking whether you understand the earlier material well enough to explain it failing rather than only to configure it working.
Session behaviour is the one people underestimate. An SD-WAN rule chooses a path for a new session, and existing sessions do not necessarily move when conditions change. A question about traffic that did not fail over is usually a question about session tables rather than about the rule itself.
Routing troubleshooting expects fluency in how SD-WAN service rules interact with the routing table underneath them. In most real deployments that means BGP, whose behaviour the IETF defines in the BGP-4 specification, and the exam is interested in the interaction rather than the protocol in isolation.
ADVPN troubleshooting closes the loop with the advanced IPsec section. Shortcuts that never form, form and then collapse, or form in one direction only are the classic scenarios, and each has a different root cause.
How Should You Prepare for the SD-WAN Architect Exam?
Preparation for an unweighted exam works differently. With no percentages to optimise against, the plan should follow the dependency order of the technology instead: build correctly, scale it, manage it centrally, then break it deliberately. Fortinet publishes no prerequisite for this exam, but the objectives assume working FortiGate experience throughout.
- Build a basic SD-WAN by hand first, configuring members, zones and performance SLAs until the SLA thresholds and their effect on path selection are second nature.
- Move on to rules and routing, and make sure you can explain why a given session took the path it did rather than only that it did.
- Lab a hub-and-spoke IPsec topology and then enable ADVPN on it, watching the shortcuts form so the negotiation is something you have seen rather than read about.
- Extend that lab to a second hub and a second region, because multiregion behaviour is where the architect-level questions live.
- Deploy the same design from FortiManager using templates and branch configuration, paying attention to what the manager owns and what stays local to the device.
- Break each piece on purpose and diagnose it, covering rules and session behaviour, routing, and ADVPN shortcuts that fail to form.
- Drill multiple select questions specifically, since a partly correct answer scores zero and that is a different skill from knowing the topic.
- Sit timed practice at roughly two minutes a question so the longer topology items do not eat the clock.
If you are still working at administrator level, the FortiSASE and SD-WAN administrator exam covers the same product from the operational side and is the more natural first step.
Where Does FCSS SD-WAN Architect Sit in the Fortinet Track?
FCSS_SDW_AR-7.6 is one of three exams in the Fortinet Certified Solution Specialist Network Security track, alongside the Enterprise Firewall Administrator and LAN Edge Architect credentials. Fortinet also counts NSE 7 SD-WAN, in any version, toward the same certification, which matters to anyone holding the older credential.
That equivalence is worth checking before booking. An engineer who passed an NSE 7 SD-WAN exam under the previous scheme may already hold what this exam awards, and the sensible move is then a different exam in the track rather than a repeat of the same subject in a newer version.
For everyone else the track reads as a set of specialisms rather than a ladder. The LAN Edge Architect exam sits at the same level and covers switching and wireless instead of the wide area network, so the choice is about which part of the estate you actually run.
Frequently Asked Questions
How many questions are on the FCSS_SDW_AR-7.6 exam?
38 questions in 75 minutes, which works out at roughly 118 seconds each. Both figures appear on the Fortinet Training Institute track page and on the NWExam syllabus page for the exam.
What is the passing score for the Fortinet SD-WAN certification?
Fortinet does not publish one. The result is reported as pass or fail with no percentage and no scaled score, and none of the five sections carries a published weighting either.
How much does the FCSS SD-WAN Architect exam cost?
200 US dollars per attempt, scheduled through Pearson VUE. Local taxes and currency conversion apply depending on where the appointment is booked.
Is there partial credit on multiple select questions?
No. Fortinet states that an answer must be fully correct to earn credit, that there is no partial credit, and that a wrong answer carries no additional deduction beyond the lost mark.
Does NSE 7 SD-WAN still count toward this certification?
Yes. Fortinet lists NSE 7 SD-WAN in any version as an exam that counts toward the same certification, so holders of the older credential should check their status before booking the newer exam.
What does the advanced IPsec section cover?
Three objectives: deploying a hub-and-spoke IPsec topology for SD-WAN, configuring ADVPN, and configuring IPsec multihub, multiregion and large deployments. It is the most design-heavy section on the paper.
Do you need FortiManager experience to pass?
One of the five sections is centralised management, covering SD-WAN deployment from FortiManager, branch configuration deployment, and SD-WAN Manager with overlay orchestration. Skipping it leaves a fifth of the syllabus untouched.
Which section do candidates find hardest?
Advanced IPsec, because multiregion and multihub behaviour cannot be learned from documentation alone. Troubleshooting comes second, largely because it sits last on the list and gets the least study time.
Are there prerequisites for the FCSS SD-WAN Architect exam?
None are published on the syllabus page. The objectives assume working FortiGate administration experience throughout, so it is an architect exam in scope rather than an entry point to the platform.
Which other exams sit in the same Fortinet track?
The FCSS Network Security track holds three exams: SD-WAN Architect, Enterprise Firewall Administrator and LAN Edge Architect. They are peers covering different parts of the estate rather than a sequence.
Conclusion
An exam with no published pass mark and no section weightings takes away the shortcut most candidates rely on. There is no 25 percent domain to prioritise here, and no way to tell after a fail how close you were.
What replaces it is the dependency order of the technology itself. Get members, zones and performance SLAs right, understand why a session took the path it took, then scale the design through ADVPN into multihub and multiregion territory where the architect-level questions actually live. Add FortiManager once the design is sound, because centralised management is a fifth of the syllabus and the boundary between template and device is exactly what gets asked about. Then break everything deliberately, since troubleshooting mirrors every build objective on the paper. With 118 seconds a question and no partial credit on multiple select items, timed practice in the real question format is the step that turns a working lab into a pass.
