NSE4 System and Network Administration Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Disable wan2 in the SD-WAN zone

  Why it's wrong here

  Disabling wan2 in the SD-WAN zone removes it from all SD-WAN egress decisions globally, which would force every session — not just the server's traffic — to use wan1. This action changes the zone membership for all destination networks and applications, eliminating the ability to load-balance or fail over other traffic to wan2. Since the requirement is specifically to steer traffic for one server, this approach is far too broad and would unnecessarily degrade utilization and resilience for all other flows.

• ✗

  Use policy routing with a higher priority for wan1

  Why it's wrong here

  Policy routing with a higher priority for wan1 could match the server's destination IP and direct its traffic, but policy routes are evaluated before SD-WAN rules and rely strictly on configured selectors such as source/destination addresses or interfaces, without application-level awareness. This makes the configuration less flexible and more cumbersome to maintain, especially when traffic patterns change, and it bypasses the SD-WAN controller's ability to perform health-check-based failover or performance-SLA-driven selection. While technically possible, this is not the modern recommended method for per-flow egress steering in an SD-WAN deployment.

• ✗

  Configure a static route with a higher distance for wan2

  Why it's wrong here

  Configuring a static route with a higher distance for wan2 is ineffective because static routes select the egress interface based on the longest prefix match for the destination, not on the specific server's identity or the application. A higher distance for wan2 would only make wan1 the preferred next-hop for an entire subnet or host prefix, which would affect all traffic destined to that network, not just the traffic to the server in question. Additionally, static routes cannot be combined with application-based or policy-based matching, so this approach cannot satisfy the requirement of steering only the server's traffic.

• ✓

  Create an SD-WAN rule to match the server's traffic and set the preferred member to wan1

  Why this is correct

  Creating an SD-WAN rule that matches the server's traffic (e.g., by destination IP address) and setting the preferred member to wan1 is the correct solution because SD-WAN rules are evaluated after policy routes and allow granular, application-aware egress selection. The preferred member setting ensures that wan1 is used for matching sessions, while other traffic can still be load-balanced or failed over across the WAN interfaces based on SD-WAN health-check and performance SLA. This approach is the recommended, flexible, and maintainable way to steer specific traffic in a Fortinet SD-WAN design.

Go deeper

Related to this question