CCNA System Configuration And Setup Questions — Page 2 of 2

MCQmedium

What is the effect of changing the 'Hold-down' timer in a Performance SLA?

A.It changes the frequency of the probes.

B.It sets the maximum number of failed probes allowed.

C.It prevents route flapping by delaying the transition back to an 'up' state.

D.It determines the timeout duration for a single probe.

AnswerC

The hold-down timer specifies how long the Performance SLA waits before marking a member or route as up again after it recovers. Extending it delays the return to the up state, suppressing rapid up/down transitions that cause route flapping.

Why this answer

The Hold-down timer in a Performance SLA defines how long the SLA must remain in a healthy state before FortiOS marks it as 'up' again after a failure. This delay prevents rapid up/down flapping of the SLA state, which would otherwise cause routes to oscillate between members.

Exam trap

NSE7_SDW often tests the confusion between the four SLA timers — interval, timeout, failtime, and hold-down — candidates frequently swap hold-down with failtime or timeout.

How to eliminate wrong answers

Option A is wrong because probe frequency is controlled by the 'interval' setting, not hold-down. Option B is wrong because the maximum number of failed probes before marking down is controlled by 'failtime' (failure threshold), not hold-down. Option D is wrong because the per-probe timeout is controlled by the 'timeout' setting, which is separate from hold-down.

Practice this question →

MCQmedium

You are configuring an SD-WAN rule that uses the 'lowest-cost (SLA)' strategy. You have three members: wan1 (cost 10), wan2 (cost 20), and wan3 (cost 30). All have Performance SLAs configured. Currently, wan1 and wan2 meet their SLAs, but wan3 does not. Which member will be selected for traffic matching this rule?

A.wan3, because it has the highest cost and thus the highest priority.

B.No member, because wan3 fails its SLA and the rule requires all members to meet SLA.

C.wan2, because it has the next lowest cost after wan1.

D.wan1, because it has the lowest cost and meets the SLA.

AnswerD

The lowest-cost (SLA) strategy selects the member with the lowest cost among those that meet their SLA. wan1 has the lowest cost (10) and meets SLA, so it is selected. wan2 also meets SLA but has a higher cost, so it is not chosen. wan3 fails SLA and is not considered. Thus, wan1 is the correct choice.

Why this answer

With lowest-cost (SLA) strategy, the FortiGate selects the member with the lowest cost that also meets its Performance SLA. wan1 has the lowest cost and meets SLA, so it is chosen. wan2 meets SLA but has a higher cost, and wan3 fails SLA so it is excluded. The rule does not require all members to meet SLA; it only needs at least one eligible member.

Exam trap

The trap here is thinking that a member failing its SLA affects the selection when other members are healthy, or that cost inversely indicates priority.

Practice this question →

MCQhard

An engineer needs to configure an SD-WAN rule that sends traffic out the member with the lowest latency for a specific application, but also wants the rule to automatically fail over to the next-best member if the primary member's latency exceeds a threshold. Which SD-WAN strategy and configuration should be used?

A.Use the lowest-latency strategy and enable the performance SLA on the members.

B.Use the manual strategy and specify a preferred member order.

C.Use the priority strategy and assign priorities to members.

D.Use the volume-based strategy and set a maximum bandwidth threshold.

AnswerA

The lowest-latency strategy selects the member with the best measured latency from the associated performance SLA. When the SLA threshold is breached, the member is considered out of SLA and the rule steers traffic to the next-best member that meets the SLA. This directly satisfies the requirement for automatic failover based on latency.

Why this answer

The lowest-latency strategy is the only one that actively measures latency and selects the member with the best value. When combined with a performance SLA that defines a latency threshold, the member is marked out of SLA if the threshold is exceeded, triggering failover to the next-best member. This provides both optimal path selection and automatic failover.

Exam trap

The trap here is confusing priority-based failover with latency-based selection, when only the lowest-latency strategy dynamically chooses the best-performing member.

Practice this question →

MCQhard

A network administrator is configuring an SD-WAN rule to steer traffic from the internal network to a critical cloud application. The rule uses the 'SLA' strategy and references a Performance SLA that monitors latency and jitter. The administrator notices that traffic is intermittently being sent over a WAN link that does not meet the SLA thresholds. The Performance SLA is configured with a probe interval of 5 seconds and a failure threshold of 3. What is the most likely reason for this intermittent behavior?

A.The SD-WAN rule is incorrectly configured with a manual priority that overrides the SLA status.

B.The Performance SLA probe interval and failure threshold cause a delay in marking the member as out of SLA, allowing traffic to continue briefly after the threshold is exceeded.

C.The Performance SLA is only applied to one member, so the other member's SLA status is unknown and defaults to in-SLA.

D.The SD-WAN rule is using the 'SLA' strategy, which only considers the first member that meets the SLA and does not re-evaluate until the member fails completely.

AnswerB

With a 5-second probe interval and a failure threshold of 3, it takes up to 15 seconds (plus processing) for the SLA to be marked as failed after the first breach. During this window, the member is still considered in SLA, so the SD-WAN rule may continue to use it. This delay explains the intermittent sending of traffic over a link that no longer meets the thresholds. Adjusting these values can make failover more responsive.

Why this answer

The Performance SLA evaluates member health based on probe results. With a probe interval of 5 seconds and a failure threshold of 3, the member is only marked as out of SLA after three consecutive failed probes, which takes at least 15 seconds. During that period, the SD-WAN rule continues to consider the member as meeting the SLA and may route traffic over it.

This delay causes intermittent use of a link that has actually breached the latency or jitter thresholds.

Exam trap

The trap here is assuming that SLA status changes instantly, when in reality the probe interval and failure threshold introduce a delay before a member is marked out of SLA.

Practice this question →

Multi-Selectmedium

You are configuring a Performance SLA on a FortiGate to monitor the quality of two WAN links. You need to ensure that the SLA probe uses HTTP to check a specific URL and that it considers the link healthy only if the round-trip time is below 100 ms and packet loss is below 2%. Which two parameters must you configure in the Performance SLA? (Choose two.)

Select 2 answers

A.Enable 'update-static-route' to automatically adjust routing based on SLA.

B.Configure the SLA to use 'jitter' as the primary metric.

C.Configure the latency threshold to 100 ms and packet loss threshold to 2%.

D.Set the protocol to HTTP and specify the URL to monitor.

E.Set the probe interval to 100 ms to match the latency threshold.

AnswersC, D

The Performance SLA includes thresholds for latency, jitter, and packet loss. To consider the link healthy only when round-trip time is below 100 ms and packet loss below 2%, you must set the latency threshold to 100 ms and the packet loss threshold to 2%. These thresholds are evaluated against the probe results to determine SLA status.

Why this answer

To use HTTP for the SLA probe, you must set the protocol to HTTP and specify the URL. To enforce the health criteria, you must configure the latency threshold to 100 ms and the packet loss threshold to 2%. These two settings are directly required.

Other options like update-static-route, probe interval, or jitter are not necessary to meet the stated monitoring conditions.

Exam trap

The trap here is assuming that enabling update-static-route or adjusting the probe interval is necessary for the SLA to function, when actually only the protocol/URL and thresholds are needed for the specified monitoring.

Practice this question →

Multi-Selecthard

An administrator is validating a new SD-WAN deployment before going live. The design requires that the FortiGate detect link degradation before users notice it and that failover decisions be based on measured path quality rather than physical link state. Which two configuration elements are required to meet these goals? (Choose two.)

Select 2 answers

A.A Performance SLA attached to the SD-WAN members, with latency, jitter, and packet-loss thresholds configured.

B.Dead peer detection enabled on each IPsec tunnel member.

C.Interface role set to WAN on every member interface.

D.An SD-WAN rule that references the members or zone and is configured to react to the SLA state.

E.A static route for each member pointing to its gateway, with equal distance values.

AnswersA, D

A Performance SLA with quality thresholds is what allows the FortiGate to declare a member degraded based on measured latency, jitter, and packet loss rather than waiting for the physical link to go down. Without it, the SD-WAN rule engine has no quality signal, so proactive detection of degradation before users notice is impossible in this deployment.

Why this answer

Proactive, quality-based failover requires two things working together: a Performance SLA that measures latency, jitter, and packet loss per member, and an SD-WAN rule that references those members and reacts to the SLA state. The SLA supplies the health signal, and the rule acts on it. Static routes, dead peer detection, and interface role labels do not provide quality measurement or trigger path changes based on degradation.

Exam trap

The trap here is believing that physical link state or dead peer detection provides the quality signal, when only a Performance SLA measures jitter and loss.

Practice this question →

MCQhard

An engineer is troubleshooting an SD-WAN rule that is not steering traffic as expected. The rule is configured with the 'Lowest Cost (SLA)' strategy and includes two members: member1 (cost 10) and member2 (cost 20). Both members are passing their SLA health checks. However, all traffic is going out member1, and member2 is not used. What is the most likely explanation?

A.Member2 is not being used because its health check is failing, even though it appears to be passing in the GUI.

B.Member2 is not being used because it is not included in the SD-WAN rule, even though it is in the zone.

C.Member2 is not being used because its cost is higher than member1's, and the strategy requires equal costs for load balancing.

D.The 'Lowest Cost (SLA)' strategy always selects the member with the lowest cost and does not load-balance, so member2 is only used if member1 fails its SLA.

AnswerD

The Lowest Cost (SLA) strategy selects the member with the lowest configured cost among those that meet the SLA. It does not distribute traffic across multiple members; it is a primary/backup approach. Since member1 has a lower cost and is healthy, all traffic uses member1. Member2 would only be used if member1 failed its SLA or if its cost were lower.

Why this answer

The Lowest Cost (SLA) strategy selects the healthy member with the lowest cost. It does not load-balance; it is designed to prefer the cheapest path that meets the SLA. Since member1 has a lower cost and is healthy, it is always chosen.

Member2 remains idle unless member1 fails its SLA. This is the intended behavior, not a misconfiguration.

Exam trap

The trap here is assuming that Lowest Cost (SLA) load-balances across members, when it actually selects the single lowest-cost healthy member and only fails over if that member becomes unhealthy.

Practice this question →

MCQeasy

You are setting up an SD-WAN configuration on a FortiGate. You want to ensure that the SD-WAN rules you create will be able to use the WAN interfaces. You have already configured the interfaces with IP addresses and default gateways. Which additional configuration object must you create to group the interfaces for use in SD-WAN rules?

A.A software switch.

B.An SD-WAN zone.

C.A virtual domain (VDOM) for each WAN interface.

D.A link aggregation group (LAG).

AnswerB

An SD-WAN zone is a logical grouping of one or more SD-WAN members (interfaces). It simplifies configuration by allowing you to reference the zone in SD-WAN rules instead of individual interfaces. You must create a zone and add the member interfaces to it. This is the standard method to group WAN links for SD-WAN rule selection in FortiOS.

Why this answer

SD-WAN zones are the correct configuration object to group member interfaces for use in SD-WAN rules. They allow you to manage multiple WAN links as a single entity in rules, simplifying policy creation and enabling dynamic path selection based on performance SLAs.

Exam trap

The trap here is confusing SD-WAN zones with other interface grouping methods like software switches or LAGs, which serve different purposes and are not used for SD-WAN rule selection.

Practice this question →

MCQmedium

A network administrator is setting up an SD-WAN rule to steer traffic to a SaaS application. The rule uses a performance SLA that monitors the SaaS application's IP address. The administrator wants the SD-WAN rule to prefer the member with the lowest latency. Which SD-WAN rule strategy should be selected?

A.Lowest Latency (SLA)

B.Best Quality (SLA)

C.Maximize Bandwidth (SLA)

D.Lowest Cost (SLA)

AnswerA

Lowest Latency (SLA) selects the member with the lowest measured latency among those that meet the SLA. This directly matches the requirement to prefer the member with the lowest latency for the SaaS application. It uses the performance SLA metrics to make the decision.

Why this answer

The Lowest Latency (SLA) strategy is designed to pick the member with the lowest latency that also meets the SLA. It directly aligns with the goal of preferring the lowest latency path for the SaaS application. Other strategies consider cost, bandwidth, or a composite quality score, which do not guarantee the lowest latency.

Exam trap

The trap here is assuming that Best Quality (SLA) always equals lowest latency, when it actually balances multiple metrics and may not choose the absolute lowest latency link.

Practice this question →