NSE4 Firewall Policies and NAT Practice Question
A company has a FortiGate with two ISPs: wan1 (primary) and wan2 (backup). They want all outbound traffic from internal users to use wan1, and if wan1 fails, traffic should automatically fail over to wan2. The administrator configures static routes: default route via wan1 gateway with distance 10 and default route via wan2 gateway with distance 20. They also configure an SD-WAN zone with both interfaces and set a strategy of 'Manual' with 'Best Quality' for wan1. After testing, failover does not occur when wan1 goes down. What is the most likely reason?
⚠ Common exam trap
It's easy for candidates to assume static route distance alone handles failover, but when SD-WAN is configured with a Manual strategy, the SD-WAN rule overrides the routing table and prevents automatic failover unless link health monitoring is enabled.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SD-WAN strategy is set to Manual, which does not automatically failover; the administrator should use an automatic strategy or configure link health monitoring.
When the SD-WAN strategy is set to 'Manual', the FortiGate does not automatically perform failover based on interface or link health. Manual mode requires explicit administrator action or must be combined with link health monitoring to trigger a switch. Without an automatic strategy or configured health checks, the SD-WAN zone will continue to use wan1 even if it goes down, preventing failover to wan2.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The SD-WAN zone does not include the backup interface wan2.
Why it's wrong here
The SD-WAN zone was created with both wan1 and wan2 as member interfaces, so wan2 is absolutely included in the zone. A zone is a logical container that groups multiple physical WAN links; as long as wan2 is a member, it remains available for failover or load balancing. The administrator's statement that the zone lacks wan2 contradicts the stated configuration, making this option incorrect.
- ✓
The SD-WAN strategy is set to Manual, which does not automatically failover; the administrator should use an automatic strategy or configure link health monitoring.
Why this is correct
With the SD-WAN strategy set to Manual, FortiGate uses the configured static routes and does not automatically re-evaluate link health to move traffic away from a failed interface. Automatic failover requires either an automatic strategy such as Lowest Cost or Best Quality combined with a performance SLA, or explicit link health monitoring to trigger a route update when wan1 goes down. Since neither is configured, the manual strategy explains why failover does not occur; this is the correct resolution.
- ✗
The static routes have the same distance, so failover does not occur.
Why it's wrong here
The static routes in this scenario do not have the same distance; wan1's route is set to distance 10 while wan2's route is distance 20. In FortiGate routing, lower administrative distance is preferred, so the 10-distance route is used first, and if that route becomes unreachable the 20-distance route automatically takes over—provided the firewall is not using SD-WAN. Because the distances are different, the static route configuration would support failover, so this option is wrong.
- ✗
The firewall policy does not bind to the SD-WAN zone; it binds to wan1 interface directly.
Why it's wrong here
Firewall policies in an SD-WAN deployment are bound to the SD-WAN zone, not to an individual physical interface such as wan1. When a policy references the zone, the FortiGate's SD-WAN engine selects the most appropriate member link based on the configured strategy and health checks. Therefore, the policy's interface binding does not prevent failover, making this option incorrect.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.