Courseiva

CCNA System Configuration And Setup Questions

75 of 84 questions · Page 1/2 · System Configuration And Setup topic · Answers revealed

Practice these questionsExam hubAll questions
1
MCQhard

You are configuring an SD-WAN rule to steer traffic to a business-critical application. The rule uses the 'Lowest Cost (SLA)' strategy with two members: a low-cost broadband link and an expensive MPLS link. The broadband link meets the SLA most of the time but occasionally experiences high latency. You want traffic to prefer the broadband link but fail over to MPLS when broadband violates the SLA. Which additional configuration is required to ensure the rule behaves as intended?

A.Enable 'SLA Target' on the rule and specify the required latency threshold.
B.Set the broadband member's priority to a lower value than the MPLS member.
C.Configure a Performance SLA and associate it with the SD-WAN rule.
D.Set the MPLS member's cost to a lower value than the broadband member.
AnswerC

The 'Lowest Cost (SLA)' strategy selects the lowest-cost member that meets the SLA defined in an associated Performance SLA. Without a Performance SLA, the rule cannot determine SLA compliance, so it may always use the lowest-cost member regardless of latency. Creating a Performance SLA with appropriate thresholds and linking it to the rule ensures failover to MPLS when broadband violates the SLA.

Why this answer

The 'Lowest Cost (SLA)' strategy chooses the lowest-cost member that satisfies the SLA defined in a Performance SLA. The Performance SLA must be created separately and then referenced by the SD-WAN rule. Without it, the rule has no way to evaluate link health, so it may not fail over when the broadband link degrades.

Associating a Performance SLA with appropriate thresholds ensures the rule dynamically selects the MPLS link when broadband violates the SLA.

Exam trap

The trap here is assuming that the SD-WAN rule itself contains SLA thresholds, when in fact they are defined in a separate Performance SLA object.

Practice this question →
2
Multi-Selecthard

An administrator is configuring SD-WAN on a FortiGate with two WAN interfaces: port1 and port2. They need to ensure that the SD-WAN can properly direct traffic based on application type and link performance. Which two configuration steps are required to enable application-based steering with SLA enforcement? (Choose two.)

Select 2 answers
A.Create a firewall policy that includes the SD-WAN zone as the outgoing interface and enable NAT.
B.Configure a static route for each WAN interface with the same distance.
C.Create an SD-WAN zone and add port1 and port2 as members.
D.Configure a Performance SLA and apply it to the SD-WAN zone.
E.Enable application control on the firewall policy that references the SD-WAN zone.
AnswersC, D

An SD-WAN zone is a logical grouping of member interfaces. It is required to apply SD-WAN rules and Performance SLAs to the members. Without a zone, the interfaces cannot be referenced collectively in SD-WAN policies. The zone simplifies configuration and allows rules to dynamically select among members. This is a fundamental step for any SD-WAN deployment that uses multiple links.

Why this answer

To enable application-based steering with SLA enforcement, the administrator must first create an SD-WAN zone and add the WAN interfaces as members. Then, a Performance SLA must be configured and applied to the zone to monitor link health. These two steps provide the foundation for SD-WAN rules to match applications and steer traffic based on SLA status.

Without the zone, members cannot be managed collectively; without the SLA, there is no performance data to enforce.

Exam trap

The trap here is assuming that application control or firewall policies are required for SD-WAN steering, when the core requirements are the SD-WAN zone and Performance SLA.

Practice this question →
3
MCQeasy

You are setting up an SD-WAN zone and need to add two interfaces, port1 and port2. However, the FortiGate GUI does not allow you to add them to the zone. What is the most likely cause?

A.The interfaces are already assigned to another SD-WAN zone.
B.The interfaces are configured with dynamic IP addresses.
C.The interfaces are not physical interfaces.
D.The interfaces have administrative distance set to 0.
AnswerA

An interface can only belong to one SD-WAN zone at a time. If port1 or port2 is already assigned to a different SD-WAN zone, the GUI will prevent adding them to a new zone. You must first remove them from the existing zone. This is a common oversight when reconfiguring SD-WAN zones, as the system enforces exclusive membership to avoid conflicts.

Why this answer

The most likely cause is that the interfaces are already members of another SD-WAN zone. FortiGate enforces that an interface can only belong to one SD-WAN zone at a time. To resolve this, you must remove the interfaces from the existing zone before adding them to the new one.

Other options are either supported configurations or unrelated to zone membership.

Exam trap

The trap here is assuming that dynamic IP addresses or non-physical interfaces are unsupported, when in fact the common blocker is existing zone membership.

Practice this question →
4
MCQmedium

A FortiGate has two SD-WAN members, wan1 and wan2, both in the same zone. The administrator wants sessions that already use wan1 to remain on wan1 even if wan2 becomes the preferred member due to better SLA results, while new sessions should follow the preferred member. Which setting controls this behavior?

A.The member's link cost value
B.The SD-WAN rule's strategy
C.The Performance SLA probe interval
D.The 'Preserve session' or sticky session option in the SD-WAN rule
AnswerD

Session preservation, often exposed as a sticky-session setting in the SD-WAN rule, keeps established flows on their current member even when the preferred member changes. New sessions are still placed according to the current best member, which exactly matches the requirement to keep existing wan1 sessions while letting new ones follow the preferred link.

Why this answer

Session preservation, commonly configured as a sticky-session option within the SD-WAN rule, keeps established flows bound to their current member while allowing new sessions to be placed on the currently preferred member. The rule's strategy, member link cost, and probe interval all influence which member is preferred or how quickly changes are detected, but none of them controls whether existing sessions are migrated.

Exam trap

The trap here is assuming that changing the strategy or link cost will automatically keep existing sessions in place, when session persistence is governed by a separate sticky-session setting.

Practice this question →
5
Multi-Selecthard

Which TWO of the following can be used as a 'Source' in an SD-WAN rule?

Select 2 answers
A.Source IP address object.
B.SLA target name.
C.Interface MAC address.
D.Firewall policy ID.
E.User group.
AnswersA, E

An SD-WAN rule matches traffic by source, and a source IP address object is a valid source criterion, letting the rule identify traffic originating from specific hosts or subnets. Source port, destination and service objects serve other match fields, not the source selector.

Why this answer

In an SD-WAN rule, the Source field matches traffic by the origin of the flow, and a Source IP address object (Option A) is a valid match criterion because SD-WAN rules can select traffic based on source address objects defined in the firewall address book. A User group (Option E) is also valid as a Source, since FortiGate SD-WAN rules can match traffic by authenticated user or user group identity, allowing policy-based steering per user population. SLA target name (Option B) is not a source match; it is a performance SLA object referenced in the rule's outgoing interface/strategy configuration to measure link health.

Interface MAC address (Option C) is not a supported Source match criterion in SD-WAN rules, and Firewall policy ID (Option D) is not a source selector either, as policy IDs identify firewall policies rather than traffic origin.

Exam trap

NSE7_SDW often tests the misconception that SLA target names or firewall policy IDs can be used as source match criteria in SD-WAN rules, when in fact only source IP objects, user groups, and similar identity-based objects are valid.

Practice this question →
6
MCQmedium

You are deploying a new FortiGate SD-WAN solution with two WAN links: wan1 and wan2. You want SD-WAN rules to be able to select members based on performance SLAs, but you also need to ensure that the SD-WAN configuration is synchronized across a pair of FortiGates in an HA cluster. Which configuration step is required before you can create an SD-WAN rule that references wan1 and wan2?

A.Create a static route for each WAN interface and enable 'SD-WAN' in the route settings.
B.Add wan1 and wan2 as SD-WAN members and assign them to an SD-WAN zone.
C.Configure a Performance SLA for each interface before adding them to SD-WAN.
D.Enable SD-WAN on each interface under Network > Interfaces.
AnswerB

SD-WAN rules reference SD-WAN zones or members, not raw interfaces. You must first configure wan1 and wan2 as SD-WAN members and assign them to a zone (for example, virtual-wan-link). This makes them available for rule selection and performance SLA monitoring. Without this step, the interfaces cannot be used in SD-WAN rules.

Why this answer

To use interfaces in SD-WAN rules, they must first be configured as SD-WAN members and placed into an SD-WAN zone. This membership is what allows the rule to select them and apply performance SLAs. Static routes, interface-level SD-WAN toggles, and SLAs do not replace this step.

Exam trap

The trap here is assuming that enabling SD-WAN on an interface or creating a static route is sufficient to make it available for SD-WAN rules.

Practice this question →
7
MCQmedium

You are configuring an SD-WAN rule that must use a specific member interface only when its measured latency is below 50 ms, and otherwise fall back to another member. Which configuration element directly defines the latency threshold that the FortiGate evaluates for that member?

A.The priority value assigned to the SD-WAN member
B.The link-cost value of the SD-WAN member
C.The SLA target configured in the Performance SLA
D.The health-check interval configured on the member interface
AnswerC

The Performance SLA holds the probe type, probe target, and the threshold values such as latency, jitter, and packet loss. When the SD-WAN rule references that SLA, the FortiGate compares each member's live measurements against these targets and marks a member out of SLA when latency exceeds the configured value, which drives the required fallback behavior.

Why this answer

The latency limit that determines whether a member is considered healthy is stored as an SLA target inside the Performance SLA object. The SD-WAN rule then references that SLA, so the FortiGate compares live probe measurements against the configured threshold and removes members that exceed it from consideration. Static attributes such as link cost, priority, and probe interval influence selection or detection speed but never define the numeric latency boundary.

Exam trap

The trap here is assuming that a member-level attribute such as link cost or priority sets the latency boundary, when the threshold actually lives in the Performance SLA that the rule references.

Practice this question →
8
MCQmedium

What is the purpose of the 'Inbound' interface setting in an SD-WAN rule?

A.To restrict the rule to traffic originating from a specific interface.
B.To enable reverse path forwarding checks.
C.To define the WAN gateway.
D.To specify the egress interface.
AnswerA

The Inbound setting binds an SD-WAN rule to traffic entering through a specified interface, so the rule matches only flows originating from that member link. This scopes policy enforcement to the intended ingress path rather than all traffic.

Why this answer

The 'Inbound' interface setting in an SD-WAN rule restricts the rule to traffic that originates from (ingresses) a specific interface. It is used to scope the rule so that only traffic entering via that interface is matched, which is useful when the same destination is reachable from multiple ingress points. It does not define the egress interface or gateway — those are determined by the SD-WAN member selection.

Exam trap

The trap is confusing the Inbound interface (source ingress scoping) with the egress interface or gateway selection; candidates pick the egress-related option because they conflate rule matching with member selection.

How to eliminate wrong answers

Option B is wrong because reverse path forwarding (RPF) checks are a separate routing/anti-spoofing mechanism, not the purpose of the Inbound interface setting in an SD-WAN rule. Option C is wrong because the WAN gateway is defined in the interface configuration or SD-WAN member settings, not by the Inbound field. Option D is wrong because the egress interface is selected by the SD-WAN rule's member/priority/SLA logic, not by the Inbound setting, which only constrains the source ingress.

Practice this question →
9
MCQmedium

An administrator needs to configure an SD-WAN rule that load-balances traffic across two WAN links based on the volume of traffic, ensuring that both links are utilized proportionally to their configured weights. Which SD-WAN rule strategy should be selected?

A.Maximize Bandwidth (SLA)
B.Priority
C.Lowest Cost (SLA)
D.Weighted Load Balance
AnswerD

The 'Weighted Load Balance' strategy distributes traffic across members based on their configured weight values. This allows the administrator to allocate a larger share of traffic to a higher-capacity link and a smaller share to a lower-capacity link, achieving proportional utilization. It is the only strategy that directly uses weights for load balancing, making it the correct choice for this scenario.

Why this answer

The 'Weighted Load Balance' strategy is designed to distribute traffic across SD-WAN members according to their configured weights. This is the only strategy that allows the administrator to specify a proportional split, such as 70% on one link and 30% on another. It ensures both links are utilized in proportion to their weights, which matches the scenario's requirement.

Exam trap

The trap here is confusing 'Maximize Bandwidth (SLA)' with weighted load balancing; the former uses all links but not in a weighted manner.

Practice this question →
10
Multi-Selectmedium

Which THREE of the following are valid strategies for SD-WAN rules?

Select 3 answers
A.Priority
B.Maximize Bandwidth
C.Load Balance
D.SLA Target
E.Round Robin
AnswersA, B, D

Priority rules let SD-WAN steer traffic by ranking member links, so latency-sensitive flows such as voice take the preferred circuit while lower-priority traffic falls back to remaining links. This satisfies the requirement for valid SD-WAN rule strategies alongside service, SaaS and application-based criteria.

Why this answer

In FortiGate SD-WAN, the strategy field of an SD-WAN rule determines how traffic is distributed across the selected members, and the valid strategies include Priority, Maximize Bandwidth (formerly Maximize Bandwidth (SLA)), and SLA Target. Option A (Priority) is correct because it sends traffic through the highest-priority member that is up and meets any configured SLA, falling back to lower-priority members only when the preferred one fails. Option B (Maximize Bandwidth) is correct because it distributes sessions across all eligible members to aggregate their available bandwidth rather than using a single link.

Option D (SLA Target) is correct because it selects the member that best satisfies the configured SLA targets (such as latency, jitter, and packet loss) measured by performance SLAs. Option C (Load Balance) is not a valid SD-WAN rule strategy in FortiOS, and Option E (Round Robin) is likewise not an available strategy, since session-based distribution is handled by Maximize Bandwidth instead.

Exam trap

NSE7_SDW often tests the exact list of valid SD-WAN strategies; candidates mistakenly include generic load-balancing terms like 'Load Balance' or 'Round Robin' that are not actual FortiGate strategy options.

Practice this question →
11
Multi-Selectmedium

You are deploying a new SD-WAN topology and must ensure that SD-WAN rules can distinguish business-critical traffic from bulk traffic. Which two rule match conditions can you configure to classify traffic for this purpose? (Choose two.)

Select 2 answers
A.The administrative distance of the static route covering the destination.
B.The Performance SLA probe interval configured on the member.
C.Internet service database entry, such as a specific cloud service.
D.Interface duplex and speed settings of the egress member.
E.Application category, such as Business or Social Media.
AnswersC, E

Internet service database entries represent known services and their associated addresses and protocols, allowing rules to match traffic destined for a specific cloud or SaaS service. This gives precise classification for critical services without maintaining manual address objects. It is a supported match condition and complements application-category matching for the described requirement.

Why this answer

Application category and internet service database entries are both supported match conditions that identify traffic by what it is, enabling rules to treat business-critical flows differently from bulk flows. Physical link attributes, route administrative distance, and probe interval describe infrastructure or health-check behaviour and cannot classify traffic. Only the two traffic-identification conditions satisfy the requirement.

Exam trap

The trap here is selecting infrastructure attributes like link speed or probe interval as match conditions, when only traffic-identification fields can classify flows in an SD-WAN rule.

Practice this question →
12
MCQmedium

A FortiGate is deployed in an SD-WAN environment with two WAN links: port1 (static, 100 Mbps) and port2 (DHCP, 50 Mbps). The administrator wants SD-WAN rules to automatically prefer port1 for all traffic unless its measured latency exceeds 150 ms, in which case traffic should fail over to port2. Which configuration element must be defined and referenced by the SD-WAN rule to achieve this behavior?

A.A static route with a distance of 10 for port1 and a distance of 20 for port2, combined with a route map that monitors latency.
B.A Performance SLA named 'WAN_MONITOR' with a latency threshold of 150 ms, applied to the SD-WAN zone members.
C.A link health monitor configured under the SD-WAN interface settings with a latency threshold of 150 ms.
D.An SD-WAN rule with the 'lowest cost' strategy and a manual priority set on port1.
AnswerB

A Performance SLA defines the latency threshold and probe parameters. When attached to the SD-WAN zone, the FortiGate continuously measures latency on each member. The SD-WAN rule can then use the SLA target to select the member that meets the threshold. If port1 exceeds 150 ms, it is considered out of SLA, and the rule automatically fails over to port2, achieving the desired behavior.

Why this answer

The Performance SLA is the SD-WAN feature that actively probes members and measures metrics like latency, jitter, and packet loss. When an SD-WAN rule references this SLA, the rule dynamically selects a member that meets the SLA targets. The administrator must configure the SLA with the 150 ms latency threshold and apply it to the SD-WAN zone so that port1 is used while it meets the threshold, and port2 takes over when it does not.

Exam trap

The trap here is confusing link health monitors with Performance SLAs, assuming that a traditional health check can drive SD-WAN rule selection.

Practice this question →
13
Multi-Selectmedium

You are configuring an SD-WAN member for an IPsec tunnel that terminates on a remote FortiGate. The tunnel interface is named 'vpn_to_dc'. You want the SD-WAN member to be usable and to be monitored by a Performance SLA. Which two configuration elements must be present for this member to function correctly in the SD-WAN zone? (Choose two.)

Select 2 answers
A.The IPsec tunnel interface must be up and have an IP address assigned.
B.The Performance SLA must reference the member so its probes are sent over the tunnel.
C.The member must be assigned a cost value and a priority value in its SD-WAN member configuration.
D.The tunnel must be configured with a unique SD-WAN zone name that differs from the physical WAN zone.
E.A static route to the remote subnet must point to the SD-WAN zone rather than the tunnel interface directly.
AnswersA, B

An SD-WAN member must reference an interface that exists with an IP address, and for an IPsec tunnel this means the tunnel must be established and the tunnel interface must have its IP configured. Without an address, the interface cannot be added as a member or used for routing decisions. This is a foundational requirement for any SD-WAN member.

Why this answer

An SD-WAN member requires an existing, addressed interface, so the IPsec tunnel must be up with an IP address. To be monitored, the Performance SLA must include that member so probes are sent across the tunnel. Cost, priority, routing via the zone, and unique zone naming are design choices or optional attributes, not prerequisites for the member to function and be health-checked.

Exam trap

The trap here is assuming that a routed path or cost and priority values are mandatory for an SD-WAN member, when the true prerequisites are simply an addressed interface and inclusion in the Performance SLA for monitoring.

Practice this question →
14
MCQmedium

You are building a new SD-WAN template in FortiManager to push to 40 branch FortiGates. The template must define two SD-WAN zones, the member interfaces, and the Performance SLA health checks, but the branch WAN IP addresses differ per site and must not be part of the template. Which FortiManager object type should you use to package the shared SD-WAN configuration?

A.A firewall address group object bound to the ADOM
B.A normalized interface template with SD-WAN member mappings
C.A CLI script template assigned through a policy package
D.An SD-WAN template in the FortiManager device manager
AnswerD

FortiManager provides a dedicated SD-WAN template object that holds zones, member interface mappings, Performance SLA health checks, and SD-WAN rules. Because it is a normalized object, per-site values such as WAN IP addresses stay in the interface or device settings, while the template references the interfaces by name. This lets one template be assigned to many FortiGates without embedding site-specific addressing.

Why this answer

The SD-WAN template is the FortiManager object designed to normalize SD-WAN zones, member mappings, Performance SLA checks, and rules across many FortiGates. Keeping per-site WAN addressing out of the template is exactly what the normalized object model enables, since interface references resolve on each managed device. A CLI script or an address group cannot provide that reusable, metadata-aware structure.

Exam trap

The trap here is assuming any centralized provisioning object can carry SD-WAN configuration, when only the dedicated SD-WAN template exposes zones, members, and Performance SLA settings as first-class normalized fields.

Practice this question →
15
MCQeasy

An administrator is configuring an SD-WAN member on a FortiGate. The member's interface has a default gateway of 192.168.1.1, but the ISP requires that all traffic from this member be sent to a next-hop of 192.168.1.254 instead. Which SD-WAN member setting should the administrator configure to meet this requirement?

A.Priority
B.Cost
C.Weight
D.Gateway
AnswerD

The 'Gateway' setting in an SD-WAN member configuration allows you to override the next-hop IP address for that member. By specifying 192.168.1.254, all traffic routed through this member will use that next-hop instead of the interface's default gateway. This is exactly what the ISP requires. It is a common configuration when the ISP provides a separate next-hop for specific services.

Why this answer

The 'Gateway' setting in an SD-WAN member configuration is specifically designed to override the next-hop IP address. When the ISP requires traffic to be sent to a different next-hop than the interface's default gateway, the administrator sets the 'Gateway' field to the desired IP. This ensures that all traffic egressing through that member uses the specified next-hop.

Exam trap

The trap here is confusing the 'Gateway' override with other member attributes like cost or priority, which affect path selection but not the next-hop address.

Practice this question →
16
MCQmedium

A company has an SD-WAN deployment with three members: port1 (MPLS), port2 (Broadband), and port3 (LTE). The administrator wants to ensure that business-critical traffic uses port1 whenever it meets the SLA, but if port1 fails the SLA, traffic should use port2. If both port1 and port2 fail, traffic should use port3. Which SD-WAN rule strategy should be used to achieve this?

A.Priority
B.Lowest Cost
C.Best Quality
D.Maximize Bandwidth
AnswerA

The 'Priority' strategy allows the administrator to assign a priority order to members. The FortiGate will use the highest-priority member that meets the SLA. If it fails the SLA, the next priority member is used, and so on. This exactly matches the requirement: port1 first, then port2, then port3. The priority is configured on each member within the SD-WAN zone or in the rule.

Why this answer

The 'Priority' strategy is designed for active/standby failover based on SLA status. The administrator assigns a priority value to each member; lower values indicate higher priority. The SD-WAN rule will select the highest-priority member that meets the referenced Performance SLA.

If that member fails the SLA, the next priority member is chosen. This provides the exact behavior described: port1 preferred, then port2, then port3, all conditional on SLA compliance.

Exam trap

The trap here is confusing 'Priority' with 'Best Quality' or 'Lowest Cost', which do not enforce a strict preference order based on SLA compliance.

Practice this question →
17
MCQhard

You need to ensure that VoIP traffic stays on the interface with the lowest jitter. Which strategy should you use?

A.Load Balance
B.Lowest Cost (SLA)
C.SLA Target
D.Manual
AnswerC

An SLA Target measures per-link jitter against a defined threshold and steers traffic to the member satisfying it. This satisfies the lowest-jitter constraint because forwarding decisions follow measured link quality, keeping VoIP on the interface with acceptable delay variation.

Why this answer

The SLA Target strategy in an SD-WAN rule selects the member link that best meets the configured SLA target for the specified metric — in this case, lowest jitter. By defining a Performance SLA with a jitter threshold and using SLA Target as the strategy, the FortiGate steers VoIP traffic to the interface with the lowest jitter that satisfies the SLA. This is the correct approach for latency/jitter-sensitive applications like VoIP.

Exam trap

NSE7_SDW often tests the distinction between SLA-based strategies (Lowest Cost, SLA Target, Best Quality) and non-SLA strategies (Load Balance, Manual), tricking candidates who pick Lowest Cost (SLA) when the question specifically asks for the lowest jitter rather than the cheapest SLA-compliant link.

How to eliminate wrong answers

Option A (Load Balance) is wrong because load balancing distributes traffic across links without regard to jitter, which would send VoIP packets over high-jitter links and degrade call quality. Option B (Lowest Cost (SLA)) is wrong because this strategy prioritizes the cheapest link that meets the SLA, not the one with the lowest jitter — cost, not quality, drives the selection. Option D (Manual) is wrong because manual strategy requires static interface selection and does not dynamically respond to changing jitter conditions, defeating the purpose of SLA-driven steering.

Practice this question →
18
Multi-Selecthard

A network engineer is designing an SD-WAN rule that must steer real-time voice traffic to the member with the best measured quality rather than a fixed link. The rule will use Performance SLA results to make the decision. Which two Performance SLA configuration elements directly influence whether a member is considered healthy for this voice rule? (Choose two.)

Select 2 answers
A.The DSCP marking applied to the voice traffic by the firewall policy
B.The latency, jitter, and packet-loss thresholds defined in the SLA
C.The participants (probe targets) configured in the SLA
D.The administrative distance of the default route on each member
E.The source interface selected for the SLA probes
AnswersB, C

These thresholds define the pass/fail criteria for the probe. A member is considered healthy only while its measured latency, jitter, and packet loss stay within the configured limits. For voice steering, tuning these values tightly ensures a member that cannot sustain real-time quality is marked down and excluded from selection by the rule.

Why this answer

A Performance SLA decides member health by probing designated targets and comparing results to configured thresholds. The targets determine what is measured, and the latency, jitter, and packet-loss limits determine whether the measurements pass. Together they directly govern whether the voice rule sees a member as healthy and eligible for selection.

Exam trap

The trap here is treating routing or QoS settings as part of the health verdict, when the SLA's own targets and thresholds are what actually mark a member up or down.

Practice this question →
19
MCQhard

An administrator wants an SD-WAN rule to select the member with the best measured quality for Microsoft 365 traffic, and also to ensure that if the best member degrades, traffic moves to the next-best member without manual intervention. The rule must continuously evaluate all eligible members. Which strategy satisfies these requirements?

A.Manual
B.Best quality
C.Lowest cost
D.Maximize bandwidth
AnswerB

The best quality strategy ranks all in-SLA members by their Performance SLA measurements and selects the one with the best value for the monitored criteria, such as latency or jitter. Because the evaluation is continuous, a degrading member is replaced by the next-best healthy member automatically, which matches the requirement for dynamic reselection based on measured quality.

Why this answer

Best quality evaluates every in-SLA member using the Performance SLA measurements and steers traffic to the member currently offering the best value for the monitored metric. Because the comparison repeats as new probe results arrive, a member that degrades is automatically bypassed in favor of the next-best healthy member. Strategies such as manual, lowest cost, and maximize bandwidth either ignore live quality or optimize for a different objective.

Exam trap

The trap here is confusing lowest cost with best quality, since both appear to rank members, but only best quality uses live probe measurements rather than a static cost value.

Practice this question →
20
MCQhard

An SD-WAN rule is configured with 'Lowest Cost (SLA)' strategy. If all members in the SLA meet the requirements, how does the FortiGate select the outgoing interface?

A.The member with the lowest interface cost value defined in the SD-WAN member configuration.
B.Round Robin
C.The interface with the highest bandwidth.
D.The interface that was most recently added to the zone.
AnswerA

With Lowest Cost (SLA), FortiGate first filters members meeting the SLA targets, then breaks ties by the configured interface cost value in the SD-WAN member settings. The lowest-cost member among those passing SLA becomes the selected outgoing interface.

Why this answer

With the 'Lowest Cost (SLA)' strategy, FortiGate first filters members that meet the SLA targets, then among those selects the member with the lowest configured cost value in the SD-WAN member configuration. Cost is a numeric value (default 0) that admins set per member to express preference — lower cost means preferred. So if all members meet SLA, the one with the lowest cost wins.

Exam trap

NSE7_SDW often tests the confusion between 'cost' and 'priority' in SD-WAN member settings, and between rule strategies — candidates must remember that Lowest Cost (SLA) uses the member's cost value, not bandwidth, priority, or round-robin rotation.

How to eliminate wrong answers

Option B (Round Robin) is wrong because Round Robin is a separate SD-WAN strategy that rotates traffic across members regardless of cost or SLA. Option C is wrong because 'highest bandwidth' is not a selection criterion for Lowest Cost (SLA) — bandwidth is not a configurable cost metric in this strategy. Option D is wrong because member age/order of addition has no bearing on Lowest Cost (SLA) selection.

Practice this question →
21
MCQmedium

You are configuring an SD-WAN rule that must load-balance traffic across two WAN links while guaranteeing that both links meet a 100 ms latency SLA. Which strategy should you select for the rule?

A.Maximum Bandwidth (SLA)
B.Best Quality
C.SLA
D.Lowest Cost (SLA)
AnswerC

The SLA strategy selects members that currently satisfy the referenced Performance SLA and distributes sessions across those members, so both links are used only while each meets the 100 ms latency threshold. If a member stops meeting the SLA, it is removed from the eligible set, preserving the guarantee. This matches the requirement for load balancing with a per-link SLA guarantee.

Why this answer

The SLA strategy is the only one that both filters members by the referenced Performance SLA and spreads sessions over all qualifying members. Lowest Cost (SLA), Maximum Bandwidth (SLA), and Best Quality all pick a single preferred member, so they fail the load-balancing half of the requirement. Only the SLA strategy keeps both links in use while each meets the 100 ms latency threshold.

Exam trap

The trap here is assuming any strategy with the word SLA in it will load-balance, when most SLA-aware strategies actually pin traffic to one preferred member.

Practice this question →
22
MCQeasy

A network administrator is adding a new WAN interface to an existing SD-WAN deployment. The interface is currently not referenced by any SD-WAN zone. What is the required first step before the interface can be used as an SD-WAN member?

A.Add the interface to a virtual wire pair.
B.Enable DHCP client on the interface.
C.Create a static route pointing to the interface.
D.Assign the interface to an SD-WAN zone.
AnswerD

In FortiOS, an interface must belong to an SD-WAN zone before it can be referenced by an SD-WAN member. The zone groups one or more interfaces logically, and members are created within a zone. Without zone membership, the interface cannot participate in SD-WAN rules, health checks, or steering.

Why this answer

SD-WAN members are defined within SD-WAN zones. Before an interface can be configured as a member, it must be placed into a zone. This zone construct allows multiple interfaces to share the same steering and health-check logic.

Only after zone assignment can the member be created and referenced by SD-WAN rules.

Exam trap

The trap here is thinking that any WAN interface can be directly added as an SD-WAN member without first assigning it to a zone.

Practice this question →
23
MCQmedium

An engineer is configuring a new SD-WAN deployment on a FortiGate running FortiOS 7.2. The SD-WAN zone named 'virtual-wan-link' already exists with two members, but the engineer needs to add a third member that is a VLAN sub-interface named 'WAN3_VLAN'. After adding the interface to the zone, traffic still does not traverse the new member. What is the most likely reason?

A.The VLAN interface was added to the zone but is not configured as a member of the SD-WAN rule, so it is not eligible for selection.
B.The VLAN interface must be assigned an IP address and have an administrative distance lower than the existing members before it can be used in the zone.
C.The VLAN interface does not have a gateway configured or the next-hop gateway is unreachable, causing the member to be marked as down by the health check.
D.The VLAN interface is not referenced in any firewall policy, so the FortiGate cannot forward traffic through it.
AnswerC

For an SD-WAN member to be used, it must pass its associated Performance SLA health check. A VLAN sub-interface requires a valid next-hop gateway for the health check probes to reach the SLA target. Without a reachable gateway, the member is marked down and traffic will not be steered to it. This is the most common oversight when adding a new member to an existing zone.

Why this answer

Adding an interface to an SD-WAN zone does not automatically make it usable. The member must have a working next-hop gateway and pass the Performance SLA health check. If the gateway is missing or unreachable, the member remains down and the SD-WAN rule will not select it.

Verifying the gateway and SLA status is the first troubleshooting step.

Exam trap

The trap here is assuming that adding an interface to an SD-WAN zone is sufficient for it to carry traffic, when the member must also pass its health check and have a valid next-hop gateway.

Practice this question →
24
MCQeasy

When using SD-WAN zones, what is the primary benefit of grouping multiple physical interfaces into a single zone?

A.It increases the throughput of individual physical links.
B.It prevents the need for performance SLAs.
C.It automatically enables load balancing between interfaces.
D.It allows you to apply a single firewall policy to the entire group.
AnswerD

Grouping physical interfaces into one SD-WAN zone lets a single firewall policy govern all member interfaces, since policy is applied per zone rather than per link. This satisfies the stem's aim of simplified, consistent policy enforcement across multiple WAN links.

Why this answer

SD-WAN zones allow multiple physical interfaces to be grouped and referenced as a single logical interface in firewall policies and SD-WAN rules. The primary benefit is that a single firewall policy can be applied to the entire group, simplifying configuration and ensuring consistent security and routing treatment across all member links. This reduces policy sprawl and administrative overhead.

Exam trap

NSE7_SDW often tests whether candidates mistakenly believe zones automatically provide load balancing or increase link throughput, rather than recognizing the policy simplification benefit.

How to eliminate wrong answers

Option A is wrong because grouping interfaces into a zone does not increase the throughput of individual physical links; each link retains its own capacity. Option B is wrong because SD-WAN zones do not eliminate the need for performance SLAs; SLAs are still configured to monitor and steer traffic. Option C is wrong because load balancing is not automatically enabled by zone membership; it requires SD-WAN rules or load-balance configuration to distribute traffic.

Practice this question →
25
Multi-Selectmedium

You are preparing a FortiGate for SD-WAN and need to verify that the underlying system settings will support SD-WAN rule processing and health monitoring. Which two configuration items must be present for SD-WAN to function? (Choose two.)

Select 2 answers
A.A Performance SLA if health-based steering is required
B.A VDOM operating in multi-VDOM mode
C.BGP configured between the FortiGate and each WAN provider
D.At least one SD-WAN zone containing member interfaces
E.An IPsec tunnel to a remote hub for every member link
AnswersA, D

Health-based strategies and failover decisions depend on Performance SLA results, so an SLA object must exist and be referenced by the rule when link quality matters. It supplies the probe type, servers, and thresholds that determine whether a member is in or out of SLA, making it essential for any deployment that steers on measured conditions.

Why this answer

A functional SD-WAN configuration requires member interfaces organized into at least one SD-WAN zone, and it requires a Performance SLA whenever steering or failover depends on link health. Multi-VDOM mode, BGP peering, and IPsec overlays are design choices that add capabilities or segmentation but are not mandatory for SD-WAN rules and health monitoring to work on a FortiGate.

Exam trap

The trap here is assuming that advanced features such as BGP or IPsec overlays are mandatory, when the base SD-WAN feature set only needs a zone with members and, for health-based steering, a Performance SLA.

Practice this question →
26
MCQmedium

When configuring an SD-WAN rule, what is the purpose of the 'Source' address field?

A.To define the gateway IP for the route.
B.To force traffic to a specific SD-WAN zone.
C.To determine which ISP the traffic exits through regardless of SLA.
D.To match traffic based on the source IP or user.
AnswerD

Matching on source IP or user lets the rule identify which traffic the SD-WAN policy governs, so only flows originating from the specified address or identity are steered. This satisfies the requirement to define the traffic source before applying path selection and SLA actions.

Why this answer

In an SD-WAN rule, the Source field is a match condition that identifies traffic by source IP address, source user (via FSSO or LDAP), or source address group. It does not control routing or egress; it simply narrows which traffic the rule applies to, alongside destination, application, and service matches.

Exam trap

The trap here is confusing the rule's match criteria (Source) with the rule's action or routing outcome (gateway, zone, ISP), causing candidates to pick an answer that describes egress selection rather than traffic identification.

How to eliminate wrong answers

Option A is wrong because the gateway IP for a route is defined in the static route or SD-WAN member configuration, not in the rule's Source field. Option B is wrong because forcing traffic to a specific SD-WAN zone is done via the Destination/Interface or the rule's outgoing interface selection, not the Source match. Option C is wrong because ISP selection is determined by the SD-WAN strategy (priority, load-balance, SLA) and member configuration, not by the Source address field.

Practice this question →
27
MCQmedium

An engineer is configuring an SD-WAN member on a FortiGate to use a static gateway that differs from the interface's detected next-hop. Which CLI configuration correctly applies this override?

A.config system interface / edit wan1 / set gateway 203.0.113.1
B.config router static / edit 0 / set gateway 203.0.113.1 / set interface wan1
C.config system sdwan / config members / edit 1 / set gateway 203.0.113.1
D.config system sdwan / config health-check / edit "ping" / set gateway 203.0.113.1
AnswerC

The gateway parameter under config system sdwan members explicitly sets the next-hop used for health checks and traffic steering on that member. It is the supported way to override the auto-detected gateway when the ISP uses an atypical topology, such as a routed subnet where the FortiGate must send probes to a specific upstream address.

Why this answer

The SD-WAN member gateway setting under config system sdwan members is the designated override for the detected next-hop. It applies to both health-check probing and traffic forwarding decisions for that member. Configuring it elsewhere, such as on the interface or in a static route, does not change the SD-WAN member's gateway and will not produce the intended behavior.

Exam trap

The trap here is assuming that a static route or interface setting can override the SD-WAN member gateway, when only the member's own gateway parameter does so.

Practice this question →
28
MCQmedium

You are troubleshooting an SD-WAN deployment where a rule configured for VoIP traffic is not being matched. The rule uses a Performance SLA named 'VoIP_SLA' and is set to use the lowest-latency strategy. You have verified that the traffic matches the source and destination criteria, and that the SLA is up on both members. However, the traffic is still using the default route instead of the SD-WAN rule. What is the most likely cause?

A.The SD-WAN rule is configured with a higher sequence number than the default route.
B.The SD-WAN rule is missing a matching firewall policy that allows the traffic to use the SD-WAN zone.
C.The SD-WAN members are not configured with a gateway, so the SLA cannot determine the next hop.
D.The Performance SLA probes are using the wrong protocol for VoIP traffic.
AnswerB

For an SD-WAN rule to take effect, the traffic must be allowed by a firewall policy that references the SD-WAN zone as the outgoing interface. If the existing firewall policy uses a physical interface or the default route instead of the SD-WAN zone, the SD-WAN rule will not be applied. This is a common oversight: the SD-WAN rule only influences member selection within the zone, but the zone must be referenced in the firewall policy to be used at all.

Why this answer

The most common reason an SD-WAN rule appears to be ignored is that the firewall policy does not use the SD-WAN zone as the outgoing interface. The SD-WAN rule only selects among members within the zone; it does not override the firewall policy's interface selection. If the policy points to a physical interface or the default route, the SD-WAN rule is never consulted.

Ensuring the policy references the SD-WAN zone is essential for the rule to take effect.

Exam trap

The trap here is focusing on the SD-WAN rule's internal settings, such as sequence or SLA protocol, when the real issue is that the firewall policy is not directing traffic to the SD-WAN zone.

Practice this question →
29
MCQmedium

A network engineer is deploying a new SD-WAN on a FortiGate. The design requires a single overlay tunnel that carries multiple VLANs between the branch and the hub, and each VLAN must be mapped to its own SD-WAN zone so that different SD-WAN rules can steer traffic per VLAN. Which configuration element must the engineer create on the overlay interface to support this design?

A.A VLAN sub-interface on the IPsec tunnel interface, assigned to a dedicated SD-WAN zone.
B.A second IPsec phase 1 with the same remote gateway but a different preshared key.
C.An SD-WAN zone that contains the physical WAN interfaces and the tunnel interface together.
D.A VXLAN interface bound to the IPsec tunnel interface, with one VNI per VLAN.
AnswerA

Creating 802.1Q VLAN sub-interfaces on the IPsec tunnel interface lets one overlay carry multiple VLANs. Each sub-interface can be placed in its own SD-WAN zone, so SD-WAN rules and performance SLAs can be scoped per VLAN. This matches the design requirement of one tunnel with per-VLAN steering.

Why this answer

The requirement is one overlay carrying multiple VLANs, each in a separate SD-WAN zone. The only option that directly produces per-VLAN SD-WAN zones on the tunnel is creating VLAN sub-interfaces on the IPsec tunnel interface and assigning each to its own zone. Other options either create separate tunnels or fail to provide VLAN-level zone separation.

Exam trap

The trap here is assuming that an SD-WAN zone can be subdivided by VLAN automatically, when in fact you must create VLAN sub-interfaces on the overlay and place each sub-interface in its own zone.

Practice this question →
30
MCQeasy

A network administrator is deploying a new FortiGate for SD-WAN and needs to verify that the FortiGate has the required license to use SD-WAN features. Which license is required to enable SD-WAN on a FortiGate?

A.FortiGuard SD-WAN Security Subscription
B.FortiManager license
C.FortiCare Support
D.No additional license is required; SD-WAN is included in FortiOS.
AnswerD

SD-WAN is a core feature of FortiOS and is available on all FortiGate models without any extra license. Administrators can configure SD-WAN zones, members, performance SLAs, and rules directly from the GUI or CLI. No subscription or add-on is needed to enable or use SD-WAN functionality.

Why this answer

SD-WAN is a built-in capability of FortiOS, available on all FortiGate appliances and virtual machines without any additional licensing. This means an administrator can configure SD-WAN zones, members, performance SLAs, and rules immediately after setting up the FortiGate, without purchasing a separate subscription.

Exam trap

The trap here is assuming that a security subscription or support contract is needed to unlock SD-WAN, when it is actually included in the base FortiOS feature set.

Practice this question →
31
MCQhard

A FortiGate is configured with an SD-WAN zone containing two members: 'wan1' (static IP, gateway 203.0.113.1) and 'wan2' (DHCP, learned gateway 198.51.100.1). You need to verify the current SD-WAN member health and the measured latency, jitter, and packet loss for each member from the CLI. Which command displays the live SD-WAN health-check results for all members?

A.get system sdwan health-check
B.diagnose sys sdwan member
C.diagnose sys sdwan service
D.diagnose sys sdwan health-check
AnswerD

This command prints the current state of every Performance SLA health check and the per-member measurements it has collected, including latency, jitter, packet loss, and whether each member is up or down. It is the primary CLI tool for confirming that SD-WAN members are passing their SLA thresholds and for seeing the exact values used by the rule engine.

Why this answer

Live SD-WAN health data is exposed through the health-check diagnose command, which reports each Performance SLA's state and the per-member latency, jitter, and packet-loss values. Member and service commands show configuration and rule selection respectively, while 'get' shows only static configuration. To confirm measured SLA values, the health-check output is the correct source.

Exam trap

The trap here is confusing configuration display commands such as 'get system sdwan health-check' with runtime diagnose commands that actually show measured latency, jitter, and loss.

Practice this question →
32
Multi-Selectmedium

Which THREE of the following criteria are used for SD-WAN rule traffic matching?

Select 3 answers
A.Interface speed
B.Destination address
C.VLAN priority
D.Application/Service
E.Source address
AnswersB, D, E

Destination address is a supported SD-WAN rule matching criterion, allowing traffic steering based on the target IP subnet or address object. This satisfies the traffic-matching requirement by identifying flows destined for particular remote networks or services.

Why this answer

In FortiGate SD-WAN rules, traffic is matched using criteria such as destination address (B), application/service (D), and source address (E), which are all standard SD-WAN rule match fields used to steer traffic to the appropriate member link. Destination address (B) is correct because SD-WAN rules can match on the destination IP/subnet to route specific traffic. Application/Service (D) is correct because SD-WAN rules commonly match on application signatures or service objects to steer application traffic.

Source address (E) is correct because SD-WAN rules can match on the source IP/subnet to differentiate traffic from specific hosts or networks. Interface speed (A) is not a match criterion; it is a link attribute used for SLA/load-balancing decisions, not traffic matching. VLAN priority (C) is not a standard SD-WAN rule match criterion; QoS/priority handling is separate from SD-WAN traffic matching.

Exam trap

NSE7_SDW often tests the confusion between SD-WAN rule match criteria (traffic classification) and SD-WAN member attributes (interface speed, cost, priority) used by load-balancing algorithms.

Practice this question →
33
MCQmedium

You are configuring an SD-WAN rule for a branch office that must use the lowest-latency path for Microsoft 365 traffic. You have already created a Performance SLA named 'M365_SLA' that measures latency to several Microsoft 365 endpoints. You want the SD-WAN rule to select the member with the best latency among those that meet the SLA. Which SD-WAN rule strategy should you configure?

A.lowest-cost (SLA)
B.lowest-latency (SLA)
C.maximize-bandwidth (SLA)
D.priority (SLA)
AnswerB

The lowest-latency strategy selects the SD-WAN member that has the lowest measured latency among those that meet the Performance SLA. This directly matches the requirement to use the lowest-latency path for Microsoft 365 traffic. The FortiGate continuously monitors latency through the Performance SLA and dynamically switches to the best member, ensuring that real-time applications like Microsoft 365 get the best possible network performance.

Why this answer

For latency-sensitive applications such as Microsoft 365, the SD-WAN rule strategy must dynamically select the member with the lowest measured latency. The lowest-latency strategy uses the Performance SLA results to compare members and choose the one with the best latency, ensuring optimal user experience. Other strategies focus on cost, bandwidth, or static priority, which do not directly optimize for latency and may select a suboptimal path.

Exam trap

The trap here is confusing lowest-cost with lowest-latency; lowest-cost uses a static cost metric, not real-time latency measurements.

Practice this question →
34
MCQeasy

Where do you configure the 'Gateway' IP address for an SD-WAN member?

A.Under Firewall Policy.
B.Under Network > Static Routes.
C.Under Network > SD-WAN > SD-WAN Members.
D.Under System > Interfaces.
AnswerC

The Gateway IP is configured per member under Network > SD-WAN > SD-WAN Members, where each member's interface settings include the gateway address. This satisfies the stem's requirement by placing the gateway at the member level, not the interface or template level, matching FortiManager SD-WAN member configuration.

Why this answer

The Gateway IP address for an SD-WAN member is configured in the member's settings under Network > SD-WAN > SD-WAN Members. This gateway is the next-hop IP address used for health checks and for forwarding traffic over that member, and it is specific to the SD-WAN member configuration rather than the interface or static route table.

Exam trap

NSE7_SDW often tests the confusion between interface IP configuration (System > Interfaces) and SD-WAN member gateway configuration (Network > SD-WAN > SD-WAN Members), causing candidates to pick the interface screen.

How to eliminate wrong answers

Option A is wrong because firewall policies define security and traffic handling, not the next-hop gateway for an SD-WAN member. Option B is wrong because static routes define destination-based forwarding, not the per-member gateway used by SD-WAN health checks and SLA probes. Option D is wrong because System > Interfaces configures the interface IP address and administrative settings, but the SD-WAN gateway is a separate parameter defined in the SD-WAN member configuration.

Practice this question →
35
MCQhard

An SD-WAN rule uses the lowest-cost (SLA) strategy with two members, wan1 and wan2. wan1 has a lower configured cost than wan2, and both currently meet the SLA. A network engineer observes that all matching traffic egresses wan1. The engineer now wants traffic to prefer wan2 whenever wan2 meets the SLA, while still failing over to wan1 if wan2 degrades. What should the engineer change?

A.Set the rule strategy to priority and give wan2 a lower priority value than wan1
B.Increase the cost value configured on wan2 above the cost on wan1
C.Add a Performance SLA probe on wan2 with a shorter probe interval than wan1
D.Lower the cost value configured on wan1 below the cost on wan2
AnswerA

The priority strategy selects the member with the lowest priority number among those that satisfy the SLA, and it fails over to the next priority when the preferred member degrades. Assigning wan2 the lower priority value makes it the preferred egress while wan1 remains the standby. Changing the strategy is required because the lowest-cost strategy ranks by cost, not by an explicit preference.

Why this answer

Preference between healthy members is expressed by the rule strategy. The lowest-cost strategy always favors the lower-cost member, so no cost or probe tuning produces a manual preference. Switching to the priority strategy and giving the desired member the lowest priority number makes it preferred while it passes the SLA, with automatic failover to the higher-numbered member.

Exam trap

The trap here is trying to express a manual preference by tuning cost or probe timing, when only a strategy change to priority (with priority values) makes one healthy member preferred over another.

Practice this question →
36
MCQmedium

When setting up a Performance SLA, what is the 'Participant' setting?

A.The monitoring interval.
B.The user group assigned to the probe.
C.The destination IP address.
D.The SD-WAN member that originates the probe.
AnswerD

The Participant is the SD-WAN member that generates the probe traffic, so the SLA measures reachability and quality from that specific device's perspective. Choosing the correct member ensures the health check reflects the actual path and egress point being monitored.

Why this answer

The Participant setting in a Performance SLA defines which SD-WAN member (interface or link) originates the probe traffic. This determines the source of the health-check probes used to measure latency, jitter, and packet loss for that SLA.

Exam trap

NSE7_SDW often tests the confusion between the Participant (source interface) and the Server (destination), causing candidates to select the destination IP address when the question asks about the probe origin.

How to eliminate wrong answers

Option A is wrong because the monitoring interval is configured separately as the probe frequency, not as the Participant. Option B is wrong because user groups are not assigned to Performance SLA probes; the SLA operates at the network link level. Option C is wrong because the destination IP address is configured as the probe target, not the Participant.

Practice this question →
37
MCQhard

You are configuring an SD-WAN rule to load-balance traffic across three WAN links. You want to ensure that the rule uses all available links while respecting the SLA status of each member. Which strategy should you select?

A.Maximize Bandwidth (SLA)
B.Priority
C.Best Quality
D.Lowest Cost (SLA)
AnswerA

Maximize Bandwidth (SLA) distributes traffic across all members that meet the SLA, aggregating their bandwidth. It load-balances sessions across the eligible links, ensuring that all available capacity is used while avoiding links that fail the SLA. This directly matches the requirement to use all links while respecting SLA status.

Why this answer

Maximize Bandwidth (SLA) is designed to load-balance traffic across all SD-WAN members that satisfy the SLA, effectively combining their bandwidth. The other strategies either select a single best or cheapest link, or use a priority order, none of which distribute traffic across all links. Thus, only Maximize Bandwidth (SLA) fulfills the requirement.

Exam trap

The trap here is assuming that any SLA-aware strategy will load-balance, but only Maximize Bandwidth (SLA) distributes traffic across multiple members.

Practice this question →
38
MCQmedium

You are troubleshooting an SD-WAN deployment where a rule configured with the 'Best Quality' strategy is not selecting the expected member. The Performance SLA shows that member1 has lower latency and jitter than member2, yet traffic is using member2. Which factor should you verify first?

A.Confirm that member1 has a lower cost than member2.
B.Ensure that the Performance SLA is configured with the 'Best Quality' algorithm.
C.Check whether the SD-WAN rule is placed above a conflicting rule in the rule list.
D.Verify that the 'Best Quality' strategy is supported on the FortiGate model.
AnswerC

SD-WAN rules are evaluated in order, and the first matching rule is applied. If a rule above the intended rule matches the same traffic, it will take precedence, causing traffic to use a different member. Verifying rule order is the first step because a higher rule can override the 'Best Quality' selection. This is a common cause of unexpected member selection.

Why this answer

SD-WAN rules are processed sequentially, and the first rule that matches the traffic is used. If an earlier rule matches the same traffic, it will dictate member selection, potentially overriding the intended 'Best Quality' rule. Therefore, checking rule order is the logical first step.

Other factors like cost or SLA algorithm are not relevant to the 'Best Quality' strategy, which selects the member with the best measured performance.

Exam trap

The trap here is focusing on SLA metrics or cost when the actual cause is a higher-priority rule intercepting the traffic.

Practice this question →
39
MCQeasy

A network engineer is adding a new physical interface to an existing SD-WAN zone on a FortiGate. The interface is currently used for management access. Which prerequisite must be met before the interface can be added to the SD-WAN zone?

A.The interface must have a performance SLA bound to it.
B.The interface must have an IP address and be administratively up.
C.The interface must be assigned to a VDOM in NAT mode.
D.The interface must be part of a redundant interface pair.
AnswerB

An interface must have an IP address and be administratively up before it can be added to an SD-WAN zone. The SD-WAN member requires an operational interface to send and receive traffic and to participate in health checks. This is a basic prerequisite for any SD-WAN member.

Why this answer

Before an interface can be added to an SD-WAN zone, it must have an IP address and be administratively up. These are fundamental requirements for the interface to function as an SD-WAN member. Other options describe global settings or optional features that are not prerequisites for zone membership.

Exam trap

The trap here is assuming that a performance SLA must be bound to an interface before it can join an SD-WAN zone, when in fact SLAs are optional at the membership stage and are configured separately.

Practice this question →
40
MCQmedium

You are deploying an SD-WAN solution with two WAN links: port1 (primary) and port2 (secondary). You need to ensure that when port1 fails its Performance SLA, the FortiGate automatically removes it from the SD-WAN zone until it recovers. Which configuration step is required to achieve this behavior?

A.Set the interface's priority to 0 to enable automatic failover
B.Enable 'SLA Target' on the SD-WAN interface
C.Enable 'Dynamic Zone Membership' globally under SD-WAN settings
D.Configure a Performance SLA and reference it in the SD-WAN member settings
AnswerD

To have an interface removed from the SD-WAN zone upon SLA failure, you must first create a Performance SLA and then associate it with the SD-WAN member. The FortiGate then monitors the SLA and, if the member fails, it is dynamically removed from the zone. This is the standard method for link health-based membership control.

Why this answer

The correct approach is to configure a Performance SLA and assign it to the SD-WAN member. This allows the FortiGate to monitor the link's health and automatically remove the member from the SD-WAN zone if the SLA fails, ensuring traffic is not routed over a degraded link. Other options either misrepresent features or are not part of the SD-WAN configuration workflow.

Exam trap

The trap here is assuming that a simple priority setting or a global toggle can achieve dynamic membership, when in fact a Performance SLA must be explicitly linked to the member.

Practice this question →
41
Multi-Selectmedium

You are configuring an SD-WAN rule to route VoIP traffic. You want the rule to select the member with the best quality for voice, considering both latency and jitter. You have enabled Performance SLA on both WAN1 and WAN2, monitoring latency and jitter. You need to ensure the rule uses the appropriate strategy and that the SLA is correctly referenced. Which two actions must you perform to achieve this? (Choose two.)

Select 2 answers
A.Enable 'Link Health Monitor' on the SD-WAN rule.
B.Configure the Performance SLA to use HTTP probes to measure jitter.
C.Set the SD-WAN rule strategy to 'Lowest Latency'.
D.Set the SD-WAN rule strategy to 'Best Quality'.
E.Assign the Performance SLA to the SD-WAN members (WAN1 and WAN2).
AnswersD, E

'Best Quality' is a strategy that selects the member with the best overall performance based on the Performance SLA metrics, including latency and jitter. For VoIP traffic, which is sensitive to both, this strategy is appropriate. It dynamically chooses the link that meets the quality criteria, ensuring voice quality. This is a required configuration step to achieve the desired behavior.

Why this answer

To route VoIP traffic based on both latency and jitter, set the SD-WAN rule strategy to 'Best Quality' and ensure the Performance SLA that monitors these metrics is assigned to the relevant SD-WAN members. This allows the SD-WAN engine to evaluate the quality of each link and select the best one for voice traffic.

Exam trap

The trap here is thinking that 'Lowest Latency' is sufficient for VoIP, when jitter is equally important; 'Best Quality' is the strategy that considers multiple performance metrics.

Practice this question →
42
MCQhard

You are troubleshooting an issue where traffic is not using an SD-WAN rule despite meeting criteria. What is the most likely cause?

A.A higher-priority SD-WAN rule is matching the traffic first.
B.The SD-WAN rule is disabled.
C.The Performance SLA has timed out.
D.The interface is not in an SD-WAN zone.
AnswerA

SD-WAN rules are evaluated sequentially by priority, so the first matching rule wins and subsequent rules are never assessed. If a higher-priority rule already matches the traffic, the intended rule cannot take effect regardless of its own criteria. This directly explains why traffic bypasses the expected rule.

Why this answer

SD-WAN rules are evaluated top-down in the rule list, and the first rule whose match criteria (source, destination, application, user, etc.) are satisfied wins. If a higher-priority rule matches the same traffic, the intended rule is never reached, so the traffic is steered by the earlier rule instead. This is the most common cause of 'rule not being used' symptoms in production.

Exam trap

The trap here is assuming the rule is broken (disabled, SLA failed, zone missing) when the actual issue is rule ordering — candidates forget that SD-WAN rules are first-match, not best-match.

How to eliminate wrong answers

Option B is wrong because a disabled rule would simply not appear in the evaluation list, and the administrator would typically notice its disabled state immediately — it's not the subtle cause of traffic matching a different path. Option C is wrong because a Performance SLA timeout affects member selection within a rule (marking a link dead), not whether the rule itself matches traffic. Option D is wrong because if the interface weren't in an SD-WAN zone, the rule referencing that zone couldn't be configured or would fail validation, and the symptom would be a configuration error rather than silent misrouting.

Practice this question →
43
MCQmedium

A network engineer is configuring an SD-WAN rule to route VoIP traffic. The requirement is to always use the member with the lowest jitter, even if other members have higher bandwidth. The engineer wants to avoid manual priority configuration. Which SD-WAN strategy should be selected for this rule?

A.Best Quality
B.Maximize Bandwidth (SLA)
C.Priority
D.Lowest Cost (SLA)
AnswerA

Best Quality selects the member that meets the SLA and has the best overall quality, which is determined by the lowest latency, jitter, and packet loss. For VoIP, jitter is critical, and Best Quality will favor the member with the lowest jitter, satisfying the requirement without manual priority settings.

Why this answer

The Best Quality strategy automatically selects the SD-WAN member that meets the SLA and has the best quality metrics, including the lowest jitter. This aligns with the requirement to always use the member with the lowest jitter for VoIP traffic without manual intervention. Other strategies focus on cost, bandwidth, or manual priority.

Exam trap

The trap here is confusing Best Quality with Lowest Cost or Maximize Bandwidth, which may also consider SLA but prioritize different metrics.

Practice this question →
44
MCQeasy

A network administrator is deploying SD-WAN on a FortiGate and needs to ensure that the SD-WAN zone can be referenced in firewall policies. Which configuration step is mandatory before the zone can be used in a policy?

A.Assign an IP address to the SD-WAN zone interface.
B.Create a static route pointing to the SD-WAN zone.
C.Enable SD-WAN in Feature Visibility under System > Feature Visibility.
D.Configure a Performance SLA and bind it to the zone.
AnswerC

SD-WAN is a feature that must be enabled in Feature Visibility before the SD-WAN menu and configuration options become available. Without enabling it, the administrator cannot create or manage SD-WAN zones, members, or rules. This is a mandatory first step in any SD-WAN deployment on FortiGate, and it is often overlooked when setting up a new device.

Why this answer

Before SD-WAN zones can be created or used in firewall policies, the SD-WAN feature must be enabled in System > Feature Visibility. This is a global setting that reveals the SD-WAN configuration menu. Without it, the administrator cannot define zones, members, or rules, and the zone will not appear as an option in policy interfaces.

Exam trap

The trap here is thinking that a static route or SLA configuration is required before using an SD-WAN zone in a policy, when the actual prerequisite is enabling the SD-WAN feature in Feature Visibility.

Practice this question →
45
MCQhard

You are deploying an SD-WAN rule that must prioritize VoIP traffic over the best available link based on real-time performance. You have configured a Performance SLA with strict latency and jitter thresholds. Which SD-WAN rule strategy ensures that VoIP traffic uses the link with the lowest jitter that meets the SLA?

A.Maximize Bandwidth (SLA)
B.Lowest Cost (SLA)
C.Priority
D.Best Quality
AnswerD

Best Quality selects the member with the best measured quality according to the SLA metrics, which include latency and jitter. For VoIP, jitter is critical, so this strategy will choose the link with the lowest jitter that still meets the SLA. It dynamically adapts to changing conditions, ensuring optimal voice quality. This directly matches the requirement.

Why this answer

Best Quality is the only strategy that actively selects the member with the best measured quality, including jitter. It continuously evaluates the SLA metrics and chooses the optimal link for real-time traffic like VoIP. The other strategies either prioritize cost, load-balancing, or static priority, none of which guarantee the lowest jitter link.

Therefore, Best Quality is correct.

Exam trap

The trap here is thinking that any SLA-aware strategy will optimize for jitter, but only Best Quality dynamically selects the link with the best measured quality.

Practice this question →
46
MCQhard

An engineer is configuring an SD-WAN rule that must load-balance traffic across two members based on the volume of traffic, but also must ensure that if one member's health check fails, traffic is redistributed to the remaining healthy member. Which strategy should be selected in the SD-WAN rule?

A.SLA
B.Best Quality
C.Maximize Bandwidth (SLA)
D.Priority
AnswerC

The Maximize Bandwidth (SLA) strategy distributes traffic across all members that meet the SLA, proportionally to their available bandwidth. It provides load balancing based on volume and automatically removes failed members from the pool. This matches the requirement to load-balance while maintaining resilience to health-check failures.

Why this answer

The Maximize Bandwidth (SLA) strategy is designed to load-balance traffic across all SD-WAN members that meet the SLA, using their available bandwidth as the weight. It also automatically reroutes traffic if a member fails its health check. This satisfies both the load-balancing and resilience requirements described in the scenario.

Exam trap

The trap here is confusing the SLA health-check object with the rule strategy, or assuming that 'SLA' is a strategy, when the correct load-balancing strategy is Maximize Bandwidth (SLA).

Practice this question →
47
Multi-Selecthard

Which TWO of the following can cause an SD-WAN member to be marked as 'down' in an SLA?

Select 2 answers
A.The probe times out.
B.The system clock is updated.
C.The packet loss exceeds the threshold.
D.The firewall policy is disabled.
E.The interface IP address is changed.
AnswersA, C

A probe timeout directly breaches the SLA health-check threshold: FortiGate marks a member down when consecutive probes receive no reply within the configured interval, exhausting the retry count. This satisfies the stem's requirement for an SLA-triggered down state, since the member's measured latency, jitter and packet loss become unverifiable.

Why this answer

Option A is correct because an SD-WAN SLA probe (such as a bidirectional forwarding detection or performance-monitoring probe) that times out means the member stops receiving replies, so the health check fails and the member is marked down. Option C is correct because SLA criteria include packet-loss thresholds; when measured loss on the member exceeds the configured threshold, the SLA is violated and the member is marked down. Option B is not correct because a system clock update affects timestamps and logging but does not itself fail an SLA probe.

Option D is not correct because disabling a firewall policy changes traffic handling, not the SLA health-check result for the member. Option E is not correct because changing an interface IP address is a configuration change that may disrupt connectivity, but it is not the SLA condition that directly marks the member down.

Exam trap

NSE7_SDW often tests the misconception that administrative changes like disabling a policy or changing an IP address mark a member down — candidates must remember SLA state is driven solely by health-check probe results and thresholds.

Practice this question →
48
Multi-Selectmedium

Which THREE of the following are parameters that can be monitored in a Performance SLA?

Select 3 answers
A.Packet Loss
B.CPU load
C.Jitter
D.Disk usage
E.Latency
AnswersA, C, E

Packet loss is one of the three metrics a Performance SLA monitors, alongside latency and jitter. It measures the percentage of dropped packets across the SD-WAN member link, satisfying the stem's requirement to identify a valid Performance SLA parameter.

Why this answer

In a Performance SLA (as used by SD-WAN/performance-monitoring features such as Fortinet's Performance SLA), the monitored parameters are the network-quality metrics measured by probes: Packet Loss (A), Jitter (C), and Latency (E). Packet Loss (A) is correct because the SLA tracks the percentage of probe packets that never arrive, which directly reflects link reliability. Jitter (C) is correct because it measures the variation in delay between probe packets, a key indicator of voice/video quality.

Latency (E) is correct because it measures the round-trip or one-way delay of the probe traffic, the primary SLA threshold metric. CPU load (B) and Disk usage (D) are not part of a Performance SLA; they are system-resource metrics monitored by device health/SNMP or resource-usage tools, not by the SLA probe mechanism.

Exam trap

NSE7_SDW often tests the confusion between link-quality metrics (latency, jitter, packet loss) and device-health metrics (CPU, memory, disk), tricking candidates into selecting system resource parameters that are not part of Performance SLA monitoring.

Practice this question →
49
MCQeasy

A network engineer is adding two WAN links to a new SD-WAN deployment on a FortiGate. The interfaces are already configured with IP addresses and default gateways. What must be done before these interfaces can participate in SD-WAN rules?

A.Assign each interface to an SD-WAN zone
B.Convert each interface to a VLAN subinterface
C.Enable asymmetric routing on each interface
D.Configure a static route for each interface in the SD-WAN routing table
AnswerA

SD-WAN members are grouped into zones, and an interface must belong to a zone before SD-WAN rules can reference it. Creating the zone and adding the interfaces establishes them as SD-WAN members, which is the required step that makes them eligible for steering, health checks, and rule membership in this deployment.

Why this answer

Before an interface can be used by SD-WAN rules, it must be a member of an SD-WAN zone. Creating the zone and adding the physical or logical interfaces is what registers them with the SD-WAN feature set. Other settings such as asymmetric routing, VLAN tagging, or static routes affect forwarding behavior but do not perform the membership step that makes the interface selectable in rules.

Exam trap

The trap here is believing that any routed interface automatically becomes an SD-WAN member, when it must first be explicitly placed into an SD-WAN zone.

Practice this question →
50
MCQmedium

A security administrator needs to allow branch users to reach an internal application server through the SD-WAN overlay. The SD-WAN rule already matches the correct source and destination, and both members pass their Performance SLA checks. Traffic is still being dropped before it reaches the SD-WAN rule. Which configuration must the administrator verify?

A.The MTU value configured on each SD-WAN member interface
B.The administrative distance of the static routes toward each member
C.The probe frequency of the Performance SLA attached to the rule
D.The firewall policy that references the SD-WAN zone as its outgoing interface
AnswerD

SD-WAN rules choose among members, but a firewall policy must permit the traffic and use the SD-WAN zone as its destination interface for that selection to apply. If no policy references the zone, or the policy is placed after a deny, traffic is dropped before SD-WAN logic matters. Verifying the permitting policy and its position is the correct check.

Why this answer

SD-WAN rules only influence member selection for traffic that a firewall policy already permits and forwards out the SD-WAN zone. A missing or misordered policy that references the zone causes the drop, independent of rule matching or member health. Confirming the permitting policy and its placement resolves the issue.

Exam trap

The trap here is focusing on SD-WAN rule criteria and member health while overlooking that firewall policy must permit the flow and direct it out the SD-WAN zone.

Practice this question →
51
MCQhard

When configuring an SD-WAN rule for a specific application, how does the FortiGate identify the traffic?

A.By analyzing the packet payload size.
B.By looking at the source MAC address.
C.By using the Application Control database.
D.By forcing traffic through a specific VLAN.
AnswerC

Application Control signatures inspect payload and protocol behaviour, matching the specific application regardless of port, IP or user. This satisfies the stem's constraint of identifying traffic for a specific application, since SD-WAN rules can reference application signatures directly, unlike port-based or address-based definitions.

Why this answer

FortiOS SD-WAN rules identify application traffic by referencing the Application Control database, which classifies traffic based on signatures and behavioral analysis. This allows the rule to match specific applications (e.g., Microsoft 365, Zoom) and apply the appropriate path selection.

Exam trap

NSE7_SDW often tests the misconception that SD-WAN identifies applications by payload size or MAC address, when in fact it relies on the Application Control database and signature-based inspection.

How to eliminate wrong answers

Option A is wrong because packet payload size alone is not a reliable or used method for application identification in FortiOS SD-WAN. Option B is wrong because source MAC address is a Layer 2 attribute and is not used to identify applications. Option D is wrong because forcing traffic through a VLAN is a Layer 2 segmentation technique, not an application identification method.

Practice this question →
52
MCQmedium

What is the default behavior when all SD-WAN members in a rule fail their SLA?

A.The traffic uses all members.
B.The traffic is routed to the management interface.
C.The rule becomes inactive.
D.The traffic is dropped.
AnswerA

When every SD-WAN member in a rule breaches its SLA, FortiGate falls back to using all members rather than dropping the traffic, preserving connectivity. This default satisfies the stem's scenario where no member meets its SLA threshold, so forwarding continues across the full member set.

Why this answer

By default, when all SD-WAN members in a rule fail their SLA, FortiOS falls back to using all members in the rule rather than dropping traffic. This 'best effort' behaviour ensures connectivity is maintained even when no member meets the SLA thresholds.

Exam trap

NSE7_SDW often tests the default fallback behaviour, and candidates incorrectly assume traffic is dropped or the rule is disabled when all members fail SLA, rather than falling back to all members.

How to eliminate wrong answers

Option B is wrong because traffic is not routed to the management interface; management interfaces are out-of-band and not part of SD-WAN member selection. Option C is wrong because the rule does not become inactive; it remains active and simply changes member selection behaviour. Option D is wrong because traffic is not dropped by default; dropping would require explicit configuration or a different rule action.

Practice this question →
53
MCQmedium

You are deploying a new FortiGate for an SD-WAN branch. The branch uses a single physical WAN link that is delivered as a VLAN-tagged subinterface on port1 (VLAN ID 100). You want to add this link to an SD-WAN zone named 'virtual-wan-link'. Which configuration step must be completed before the VLAN subinterface can be selected as an SD-WAN member?

A.The VLAN subinterface must be placed in a separate VDOM that is dedicated to SD-WAN.
B.The VLAN subinterface must be added to a Performance SLA before it can join the SD-WAN zone.
C.The VLAN subinterface must be assigned a role of WAN in its interface configuration.
D.The VLAN subinterface must be created and have an IP address assigned.
AnswerD

FortiOS only allows interfaces that already exist and have an IP address to be added as SD-WAN members. A VLAN subinterface must first be defined under the parent physical interface with a VLAN ID and then given an IP address (static or DHCP). Until it exists as an addressable interface, it cannot be referenced by the SD-WAN member list.

Why this answer

An SD-WAN member can only reference an interface that already exists and has an IP address configured. For a VLAN-based WAN link, that means creating the VLAN subinterface under the physical interface and assigning it an IP address before adding it to the SD-WAN zone. Role labels, Performance SLA objects, and VDOM placement are not prerequisites for membership.

Exam trap

The trap here is assuming that assigning an interface role of WAN is what makes an interface eligible to become an SD-WAN member, when eligibility actually depends on the interface existing with an IP address.

Practice this question →
54
MCQhard

You have an SD-WAN zone named 'virtual-wan-link' with members 'wan1' and 'wan2'. You notice that a member interface is administratively up and has a valid IP address, but it is not appearing as a selectable member when you edit the SD-WAN member list. Which condition most likely explains why the interface cannot be added?

A.The interface is currently assigned to a different SD-WAN zone.
B.The interface has not been added to a Performance SLA.
C.The interface is already referenced by a static route that points to the SD-WAN zone.
D.The interface is assigned an administrative role of LAN rather than WAN.
AnswerA

An interface can belong to only one SD-WAN zone at a time. If it is already a member of another zone, it will not appear as available when editing a different zone's member list. Removing it from the other zone first makes it selectable again. This exclusivity is the most likely reason the interface is missing here.

Why this answer

An interface can be a member of only one SD-WAN zone. If it already belongs to another zone, it will not be offered as a selectable member when editing a different zone. Administrative role, static routes pointing to the zone, and Performance SLA membership do not restrict member selectability, so zone exclusivity is the condition that explains the symptom.

Exam trap

The trap here is attributing member list absence to role or SLA configuration, when the actual constraint is that an interface can belong to only one SD-WAN zone at a time.

Practice this question →
55
MCQhard

You are configuring an SD-WAN rule to route business-critical traffic (HTTP and HTTPS) over the best available link based on lowest latency. You have two members in the SD-WAN zone: WAN1 and WAN2. You create a Performance SLA named 'Latency-SLA' that monitors 8.8.8.8 using ICMP probes with a threshold of 150 ms. You apply this SLA to both members. In the SD-WAN rule, you set the strategy to 'Lowest Latency' and select the SLA. After applying the configuration, you notice that HTTP traffic is still using WAN1 even though WAN2 has lower latency according to the SLA monitor. What is the most likely cause?

A.The SD-WAN rule is missing a required 'Gateway' configuration for each member, so it cannot determine the next-hop for the lower-latency path.
B.The SD-WAN rule is configured with a manual order or priority that overrides the latency-based selection, or the rule is not matching the HTTP traffic due to a missing service definition.
C.The SD-WAN rule's 'Lowest Latency' strategy only considers latency if the members are in the same SD-WAN zone and the rule is applied to that zone; otherwise it defaults to the first member.
D.The Performance SLA must be configured with TCP probes on port 80 and 443 to accurately measure latency for HTTP and HTTPS traffic.
AnswerB

If the rule is set to 'Lowest Latency' but the members are also assigned a priority or manual order that takes precedence, or if the rule's match criteria (e.g., service) do not correctly identify HTTP/HTTPS traffic, the rule will not select the lower-latency member. Additionally, if the rule is not the first matching rule, another rule may be handling the traffic. The most likely cause is a misconfiguration in the rule's match or an overriding strategy.

Why this answer

For an SD-WAN rule using 'Lowest Latency' strategy to select the best member, the rule must correctly match the traffic and not be overridden by another rule or manual priority settings. If the rule's service definition does not include HTTP/HTTPS, or if a higher-priority rule matches first, the latency-based selection will not apply. Verify rule order and match criteria.

Exam trap

The trap here is assuming that the 'Lowest Latency' strategy automatically overrides all other rule settings, when in fact rule matching order and manual priorities can prevent the strategy from taking effect.

Practice this question →
56
MCQmedium

Which SD-WAN rule strategy should you choose if you want to distribute traffic across multiple interfaces based on their bandwidth weights?

A.Manual
B.Maximize Bandwidth (SLA)
C.Lowest Cost (SLA)
D.SLA Target
AnswerB

Maximize Bandwidth (SLA) distributes traffic proportionally across member interfaces according to their configured bandwidth weights, provided SLA targets are met. This directly satisfies the stem's requirement to spread traffic based on bandwidth weights rather than latency or link priority.

Why this answer

The Maximize Bandwidth (SLA) strategy distributes traffic across multiple eligible members proportionally to their configured bandwidth weights, provided the members meet the SLA targets. This is the only strategy that uses weight-based load distribution across interfaces. Manual, Lowest Cost, and SLA Target strategies select members based on fixed priority, cost, or SLA compliance rather than bandwidth weighting.

Exam trap

NSE7_SDW often tests whether candidates confuse 'Maximize Bandwidth (SLA)' with 'Lowest Cost (SLA)' or 'SLA Target', assuming any SLA-related strategy performs weighted load distribution when only Maximize Bandwidth does.

How to eliminate wrong answers

Option A is wrong because Manual strategy requires the administrator to explicitly select a single member or ordered preference, with no automatic weight-based distribution. Option C is wrong because Lowest Cost (SLA) selects the member with the lowest cost that still meets the SLA, not one weighted by bandwidth. Option D is wrong because SLA Target selects the member that best meets the configured SLA target metrics (latency, jitter, packet loss), without distributing by bandwidth weight.

Practice this question →
57
MCQeasy

You are preparing a FortiGate for SD-WAN deployment and need to confirm that the device supports the required features. Which FortiGate hardware or virtual platform characteristic is required to use SD-WAN on FortiOS 7.x?

A.The FortiGate must have an active FortiCare Elite subscription to enable SD-WAN features.
B.The FortiGate must be running FortiOS 6.0 or later and have at least two WAN interfaces.
C.The FortiGate must be managed by FortiManager before SD-WAN can be configured locally.
D.The FortiGate must be a model that supports SD-WAN, which in FortiOS 7.x includes most current physical and virtual platforms.
AnswerD

FortiOS 7.x supports SD-WAN on the broad range of current FortiGate physical appliances and virtual machines. There is no separate SD-WAN license or special hardware module required; the feature is part of the standard FortiOS feature set. This makes platform support essentially universal across supported models, which is the accurate prerequisite.

Why this answer

SD-WAN is a standard FortiOS 7.x feature available on supported physical and virtual FortiGate platforms without a special license or management dependency. It does not require two WAN interfaces, an Elite subscription, or FortiManager. The accurate prerequisite is simply a supported FortiGate running a FortiOS version that includes SD-WAN.

Exam trap

The trap here is assuming SD-WAN requires a special license or extra WAN interfaces, when it is a built-in FortiOS feature on supported platforms.

Practice this question →
58
MCQeasy

You are adding a new physical interface to an existing SD-WAN deployment. Which step must be completed before the interface can be referenced by an SD-WAN rule?

A.Enable the interface as a dedicated management port.
B.Assign the interface to an SD-WAN zone.
C.Create a static route that points to the interface.
D.Bind the interface to a virtual wire pair.
AnswerB

An interface must belong to an SD-WAN zone before SD-WAN rules can reference it, because rules match on zones rather than raw interfaces. Adding the member to a zone makes it a candidate for rule selection and health checking. Until that assignment is done, the interface is invisible to the SD-WAN rule engine.

Why this answer

SD-WAN rules match on zones, so an interface must first be assigned to an SD-WAN zone before it can be selected by any rule. Static routes, management designation, and virtual wire pairing do not confer rule eligibility. Zone membership is the mandatory prerequisite in the configuration workflow.

Exam trap

The trap here is treating routing or interface-mode configuration as the gate for SD-WAN membership, when the actual gate is zone assignment.

Practice this question →
59
MCQeasy

Where are SD-WAN zones managed in the FortiGate GUI?

A.Interface > Physical Interfaces.
B.System > Network > Zones.
C.Firewall > Policy > Objects.
D.Network > SD-WAN > SD-WAN Zones.
AnswerD

SD-WAN zones are configured under Network > SD-WAN > SD-WAN Zones in the FortiGate GUI, where members and zone membership are defined. This location is where the zone objects referenced by SD-WAN rules are created and edited.

Why this answer

In FortiGate's GUI, SD-WAN zones are configured under Network > SD-WAN > SD-WAN Zones. This is where administrators create and manage the logical zones that group SD-WAN member interfaces for policy and steering decisions. The SD-WAN Zones page is distinct from the general interface and zone configuration pages.

Exam trap

NSE7_SDW often tests the distinction between traditional firewall zones (System > Network > Zones) and SD-WAN zones (Network > SD-WAN > SD-WAN Zones), so candidates who default to the general zone page pick option B.

How to eliminate wrong answers

Option A is wrong because Interface > Physical Interfaces is where physical port settings (IP, speed, role) are configured, not SD-WAN zone membership. Option B is wrong because System > Network > Zones is where traditional firewall zones (used for policy matching) are defined, not SD-WAN-specific zones. Option C is wrong because Firewall > Policy > Objects contains address, service, and schedule objects used in policies, not SD-WAN zone definitions.

Practice this question →
60
MCQhard

You are configuring an SD-WAN rule to route traffic to a critical SaaS application. You want the rule to select the best link based on multiple performance metrics: latency, jitter, and packet loss. You have created a Performance SLA that monitors these metrics. Which SD-WAN rule strategy should you use to achieve this?

A.Manual
B.Load Balance
C.Priority
D.Best Quality
AnswerD

The Best Quality strategy selects the member with the best performance based on the configured SLA metrics, such as latency, jitter, and packet loss. It evaluates all members and chooses the one with the optimal score, making it ideal for critical applications that require the best available link quality.

Why this answer

The Best Quality strategy is designed to select the SD-WAN member that offers the best performance according to the SLA metrics. It continuously monitors latency, jitter, and packet loss, and dynamically chooses the link with the highest quality. This ensures that critical traffic always uses the optimal path, improving user experience.

Exam trap

The trap here is confusing Load Balance with Best Quality; Load Balance distributes traffic but does not necessarily pick the single best-performing link based on multiple metrics.

Practice this question →
61
MCQhard

What is the purpose of the 'Gateway' override in an SD-WAN member configuration?

A.To force the use of a secondary ISP.
B.To specify a manual gateway for the SD-WAN member.
C.To bypass the firewall policy.
D.To enable load balancing.
AnswerB

The Gateway override sets a static next-hop address for the SD-WAN member, bypassing the gateway learned dynamically from the interface's DHCP or routing table. This satisfies the scenario's requirement to force traffic through a specific upstream device when automatic gateway detection selects an unsuitable path.

Why this answer

The Gateway override in an SD-WAN member configuration lets the administrator manually specify the next-hop gateway IP for that member interface, overriding the gateway learned via DHCP or the interface's default. This is used when the SD-WAN member's traffic must be sent to a specific next-hop — for example, when the ISP provides a gateway that differs from the DHCP-assigned one, or when the interface is in a non-standard topology. It does not change which ISP is used or bypass policies; it only pins the next-hop.

Exam trap

NSE7_SDW often tests the confusion between member-level settings (Gateway override, cost, priority) and rule-level settings (strategy, SLA targets) — candidates must recognize that Gateway override is purely a next-hop pinning feature, not a traffic-steering or policy feature.

How to eliminate wrong answers

Option A is wrong because forcing a secondary ISP is achieved through SD-WAN rule member selection or priority, not the Gateway override. Option C is wrong because bypassing firewall policy is not a function of any SD-WAN member setting — firewall policies always apply to SD-WAN traffic. Option D is wrong because load balancing is controlled by SD-WAN rule strategy (e.g., Lowest Cost, Maximize Bandwidth), not by the Gateway override.

Practice this question →
62
MCQeasy

You are deploying a new SD-WAN interface. What is the mandatory step before you can add an interface to an SD-WAN zone?

A.Configure a performance SLA for that specific interface.
B.Remove all firewall policy, static route, and DHCP references from the interface.
C.Assign a VLAN ID to the interface.
D.Enable SD-WAN on the global system settings.
AnswerB

SD-WAN zones require interfaces free of existing references, so firewall policy, static route, and DHCP bindings must be detached first. This satisfies the mandatory prerequisite before zone membership can be assigned, since the interface must be unbound from those configurations to be claimed by the zone.

Why this answer

Before an interface can be added to an SD-WAN zone, it must be free of references from firewall policies, static routes, and DHCP server configurations. FortiOS enforces this because SD-WAN zones take over the routing and policy handling for member interfaces, and conflicting references would create ambiguous or broken behavior. Removing these references is therefore the mandatory prerequisite step.

Exam trap

NSE7_SDW often tests the misconception that a Performance SLA or VLAN ID is required before adding an interface to an SD-WAN zone, when the actual mandatory step is removing existing firewall policy, static route, and DHCP references.

How to eliminate wrong answers

Option A is wrong because a Performance SLA is configured after the interface is in an SD-WAN zone and is used to monitor link health, not as a prerequisite for zone membership. Option C is wrong because VLAN ID assignment is only relevant for VLAN sub-interfaces and is not a universal requirement for adding an interface to an SD-WAN zone. Option D is wrong because SD-WAN is enabled by configuring SD-WAN zones and rules, not by a global system setting toggle — there is no such mandatory global enable step.

Practice this question →
63
MCQhard

A Performance SLA bound to an SD-WAN zone is configured with a 200 ms latency threshold and a 5% packet-loss threshold. A member reports 180 ms latency but 8% packet loss. What is the member's SLA state, and how does it affect rule selection?

A.The member is considered in SLA because latency is within threshold, so it remains eligible for rules.
B.The member is in SLA but is flagged with a warning that only affects logging, not rule selection.
C.The member is out of SLA only if latency and packet loss both exceed their thresholds simultaneously.
D.The member is considered out of SLA because packet loss exceeds the threshold, so rules exclude it from selection.
AnswerD

A member must meet every configured threshold to be in SLA; exceeding any single threshold marks it out of SLA. With 8% loss against a 5% limit, the member fails, and SD-WAN rules that reference this SLA will not select it while it remains out of SLA. This protects traffic from being placed on a lossy link.

Why this answer

Performance SLA health requires every configured threshold to be met, so exceeding the packet-loss limit alone marks the member out of SLA even though latency is acceptable. Rules referencing that SLA then skip the member, steering traffic to healthier links. The member is not merely warned, and both thresholds do not need to fail together.

Exam trap

The trap here is assuming thresholds are evaluated independently for eligibility, when a single breach of any threshold marks the member out of SLA.

Practice this question →
64
Multi-Selecthard

Which TWO of the following steps are required to correctly configure a Performance SLA?

Select 2 answers
A.Configure a firewall address object for the probe.
B.Enable BGP on the interface.
C.Select the probe protocol.
D.Define the destination IP address.
E.Assign the probe to a VPN tunnel.
AnswersC, D

The probe protocol determines how the SLA measures link health — ICMP ping, TCP, HTTP, or UDP echo — so it must be selected before the SLA can generate meaningful latency and jitter metrics. Without it, the Performance SLA cannot evaluate member link quality.

Why this answer

Option C is correct because a Performance SLA health check must specify the probe protocol (e.g., Ping, HTTP, TCP-echo, or UDP-echo) so FortiGate knows how to generate and evaluate the probe traffic. Option D is correct because the SLA requires a destination IP address (the server or target being monitored) to which the probes are sent and against which latency, jitter, and packet loss are measured. Option A is not required, since the probe destination is defined directly in the SLA configuration rather than through a firewall address object.

Option B is not required, as BGP is unrelated to Performance SLA probing and is only needed for dynamic routing. Option E is not required, because an SLA probe is bound to a specific outgoing interface or link, not to a VPN tunnel.

Exam trap

NSE7_SDW often tests the misconception that a firewall address object or BGP is required for Performance SLA — candidates must remember that the SLA is self-contained with a protocol and destination, and that routing protocols are independent of SLA configuration.

Practice this question →
65
MCQmedium

Which command is used to verify the current status of SD-WAN members and their SLA health from the CLI?

A.diagnose sys sdwan health-check
B.show router info bgp
C.get system interface
D.get system sdwan member
AnswerA

This command reports each SD-WAN member's SLA health-check status, including latency, jitter and packet loss against configured thresholds. It directly satisfies the stem's requirement to verify member status and SLA health from the CLI, rather than inspecting interface state or routing tables.

Why this answer

On FortiGate SD-WAN, the health of each member link and its SLA probes is inspected with 'diagnose sys sdwan health-check', which shows per-SLA state (up/down), latency, jitter, and packet loss for each member. This is the canonical CLI command for verifying that SLA-based steering decisions are being made on accurate telemetry.

Exam trap

NSE7_SDW often tests confusion between configuration commands ('get system sdwan ...') and diagnostic commands ('diagnose sys sdwan ...'), tricking candidates into picking a config-view command when the question asks for live SLA status.

How to eliminate wrong answers

Option B is wrong because 'show router info bgp' is a FortiOS-style BGP neighbor/route display and has nothing to do with SD-WAN SLA health-check state. Option C is wrong because 'get system interface' only lists interface configuration and status, not SD-WAN member SLA metrics. Option D is wrong because 'get system sdwan member' is not the correct FortiOS syntax for querying live SLA health; the diagnose command under 'sys sdwan health-check' is what returns probe results.

Practice this question →
66
MCQmedium

You are configuring SD-WAN on a FortiGate that will be managed by FortiManager. You want to ensure that the SD-WAN configuration is consistent across multiple devices and that changes can be deployed centrally. Which action must you take in FortiManager to support SD-WAN configuration?

A.Enable 'Central Management' on each FortiGate under System > Settings.
B.Install a 'SD-WAN' license on the FortiGate.
C.Create a firewall policy on FortiManager that references SD-WAN zones.
D.Use the SD-WAN template in FortiManager.
AnswerD

FortiManager provides an SD-WAN template that allows you to define SD-WAN settings centrally and assign them to managed FortiGates. This template simplifies consistent configuration and deployment across multiple devices. It is the correct tool for centralized SD-WAN management and ensures that changes are propagated uniformly.

Why this answer

FortiManager's SD-WAN template is designed for centralized configuration of SD-WAN settings. It allows you to define members, zones, performance SLAs, and rules once and assign them to multiple FortiGates. This ensures consistency and simplifies deployment.

Other options do not provide the centralized SD-WAN configuration capability required.

Exam trap

The trap here is thinking that a license or a simple central management toggle is needed for SD-WAN in FortiManager, rather than the dedicated SD-WAN template.

Practice this question →
67
Multi-Selecthard

An administrator is configuring an SD-WAN rule that must ensure business-critical traffic always uses the best path based on measured latency and jitter, while also allowing the rule to fail over to a secondary link if the primary link's SLA is violated. The rule includes three members: wan1, wan2, and wan3. Which two actions must be performed to achieve this? (Choose two.)

Select 2 answers
A.Configure the SD-WAN rule to use the 'Best Quality' strategy.
B.Create a Performance SLA that monitors latency and jitter for all three members.
C.Enable 'Gateway' override on all three members to ensure they are prioritized equally.
D.Set the SD-WAN rule strategy to 'Lowest Cost (SLA)' and assign costs based on link quality.
E.Assign the same cost value to all three members to allow the rule to choose based on quality.
AnswersA, B

The 'Best Quality' strategy selects the member with the best measured quality (lowest latency and jitter) among those that meet the SLA. This directly aligns with the requirement to use the best path based on latency and jitter. It also provides failover: if the best member fails the SLA, the next best is chosen. This strategy is designed for exactly this use case.

Why this answer

To dynamically select the best path based on latency and jitter, the SD-WAN rule must use the 'Best Quality' strategy, which relies on a Performance SLA that monitors those metrics. The Performance SLA must be created and associated with the members. Together, these two actions allow the rule to choose the member with the best measured quality and fail over if the SLA is violated.

Exam trap

The trap here is assuming that 'Lowest Cost (SLA)' can dynamically select the best path based on real-time latency and jitter, when it actually uses static costs.

Practice this question →
68
MCQmedium

A network engineer is adding a new WAN link to an existing SD-WAN deployment on a FortiGate. The physical interface 'wan3' has been configured with an IP address and is up, but it does not appear in the list of available interfaces when the engineer tries to add it to an SD-WAN zone. Which action should the engineer take to resolve this?

A.Assign the interface to a virtual WAN link (vwan) before adding it to the SD-WAN zone.
B.Set the interface role to 'WAN' in the interface configuration.
C.Ensure the interface is not used by any firewall policy.
D.Enable 'sdwan' on the interface under Network > Interfaces.
AnswerB

In FortiOS, an interface must have its role set to 'WAN' to be eligible for inclusion in an SD-WAN zone. The role is configured under the interface settings. Without this role assignment, the interface will not be listed as an available member when configuring SD-WAN zones.

Why this answer

For a physical interface to be available as an SD-WAN member, it must have its role set to 'WAN' in the interface configuration. This is a mandatory prerequisite in FortiOS. Once the role is set, the interface becomes selectable when adding members to an SD-WAN zone.

Exam trap

The trap here is assuming that any up interface can be added to an SD-WAN zone without explicitly setting its role to WAN.

Practice this question →
69
Multi-Selecthard

You are configuring an SD-WAN rule to route business-critical traffic. You want to ensure that the rule uses the best available link based on performance SLAs, and that it can fail over to a secondary link if the primary link's SLA is violated. Which two configuration elements are required to achieve this? (Choose two.)

Select 2 answers
A.Set the rule's strategy to 'SLA' and specify the SLA targets.
B.Assign a Performance SLA to each SD-WAN member used by the rule.
C.Configure a static route with equal distance for both WAN links.
D.Set the rule's strategy to 'Lowest Cost' and assign costs to each member.
E.Enable 'Link Health Monitor' on the SD-WAN zone.
AnswersA, B

The 'SLA' strategy instructs the SD-WAN rule to choose members that meet the SLA targets. You must also specify which SLA targets to use. This combination allows the rule to select the best link and fail over when the primary link violates the SLA. Other strategies do not provide SLA-based selection.

Why this answer

To route based on SLA and fail over when the SLA is violated, you must configure Performance SLAs on the members and use the 'SLA' strategy in the rule, specifying the SLA targets. This enables the rule to monitor link health and switch to a secondary link when the primary fails to meet the SLA.

Exam trap

The trap here is assuming that any strategy with SLA monitoring will automatically fail over, or that a zone-level health monitor is needed.

Practice this question →
70
Multi-Selectmedium

Which THREE of the following are benefits of using SD-WAN?

Select 3 answers
A.Built-in physical layer cabling.
B.Simplified WAN management through zones.
C.Automated failover between WAN links.
D.Automatic hardware replacement.
E.Dynamic path selection based on application performance.
AnswersB, C, E

Zone-based abstraction groups interfaces by role, so WAN links are managed as logical zones rather than per-interface rules. This reduces configuration duplication and simplifies policy changes across many branches, directly delivering the simplified WAN management benefit the question asks for.

Why this answer

Option B is correct because SD-WAN controllers abstract WAN transport links into logical zones (e.g., VPN zones, service zones), letting administrators apply consistent policy and routing across many sites from a single management plane instead of configuring each device individually. Option C is correct because SD-WAN continuously monitors link health (via BFD, IP SLA, or similar probes) and automatically reroutes traffic to a backup WAN link—LTE, broadband, or MPLS—when the primary link degrades or fails, without manual intervention. Option E is correct because SD-WAN's application-aware routing engine classifies traffic by application and steers it over the path with the best measured performance (latency, jitter, packet loss), enforcing policies such as sending VoIP over the lowest-latency link.

Option A does not belong because SD-WAN is a software overlay/control technology and does not provide or install physical layer cabling. Option D does not belong because automatic hardware replacement is a vendor support/logistics function, not a capability of the SD-WAN software itself.

Exam trap

NSE7_SDW often tests whether candidates confuse SD-WAN's software-defined benefits (zones, failover, dynamic path selection) with unrelated operational services like hardware replacement or physical cabling.

Practice this question →
71
MCQeasy

An administrator is setting up a new SD-WAN deployment on a FortiGate. They have two interfaces, port1 and port2, that will be part of the SD-WAN. They want to group these interfaces into a single SD-WAN zone named 'virtual-wan-link' to simplify rule configuration. Which step is required before adding the interfaces to the SD-WAN zone?

A.Assign static IP addresses to both interfaces.
B.Enable SD-WAN on the FortiGate under System > Feature Visibility.
C.Create a firewall address object for each interface's subnet.
D.Configure each interface as a VLAN subinterface with a unique VLAN ID.
AnswerB

SD-WAN is a feature that must be enabled in the FortiGate GUI via System > Feature Visibility before SD-WAN configuration options become available. Once enabled, the administrator can create SD-WAN zones and add interfaces. Without this step, the SD-WAN menu and related settings are hidden, preventing any SD-WAN zone creation. This is a mandatory first step in a new deployment.

Why this answer

In FortiOS, the SD-WAN feature is not enabled by default in the GUI. The administrator must first enable it under System > Feature Visibility. After that, they can create an SD-WAN zone and add member interfaces.

This step is mandatory regardless of interface type or addressing. Without enabling the feature, the SD-WAN configuration options are unavailable, so the zone cannot be created.

Exam trap

The trap here is assuming that SD-WAN is enabled by default or that interface-level prerequisites like VLANs or static IPs are required, when the actual first step is enabling the feature in Feature Visibility.

Practice this question →
72
MCQhard

An SD-WAN rule is configured with the Best Quality strategy and includes two members: WAN1 and WAN2. The Performance SLA for both members is set to monitor latency, jitter, and packet loss. The SLA thresholds are latency 100 ms, jitter 20 ms, and packet loss 1%. Currently, WAN1 has latency 80 ms, jitter 10 ms, and packet loss 0.5%; WAN2 has latency 90 ms, jitter 25 ms, and packet loss 0.2%. Both members are up. Which member will be selected by the Best Quality strategy?

A.WAN2, because it has lower packet loss than WAN1, which is the most important metric.
B.WAN2, because it has the lowest latency among the members that meet the packet loss threshold.
C.WAN1, because it meets all SLA thresholds while WAN2 exceeds the jitter threshold.
D.Neither member will be selected because both must meet all SLA thresholds for any to be chosen.
AnswerC

Best Quality selects the member that meets all SLA thresholds and has the best quality metric. WAN1 meets all thresholds, but WAN2 exceeds the jitter threshold (25 ms > 20 ms). Since WAN2 fails the SLA, it is not considered, leaving WAN1 as the only eligible member, so it is selected.

Why this answer

The Best Quality strategy selects the member that meets all SLA thresholds and has the best overall quality. WAN1 satisfies latency, jitter, and packet loss thresholds, while WAN2 violates the jitter threshold. Therefore, WAN2 is excluded, and WAN1 is chosen as the only compliant member.

Exam trap

The trap here is thinking that Best Quality picks the member with the best individual metric even if it fails another threshold, when actually it requires all thresholds to be met first.

Practice this question →
73
MCQmedium

What is the impact of checking the 'Interface Preference' box in an SD-WAN rule?

A.It overrides the SLA strategy selection.
B.It enables failover to the default gateway.
C.It enables load balancing across interfaces.
D.It increases the probe frequency.
AnswerA

Enabling Interface Preference makes the rule select the outgoing interface directly, bypassing the SLA strategy's link-quality evaluation entirely. This satisfies the scenario's requirement to force traffic onto a specific member, since SLA-driven selection would otherwise choose the best-performing link and ignore the configured preference.

Why this answer

In Fortinet SD-WAN, the 'Interface Preference' option in an SD-WAN rule forces traffic to use a specific preferred interface (or set of interfaces) regardless of what the SLA strategy would otherwise select. This effectively overrides the SLA-based path selection, ensuring the rule's traffic egresses through the chosen member(s) even if another member has better SLA scores. It is used when business policy requires a specific WAN link for certain applications.

Exam trap

NSE7_SDW often tests whether candidates understand that Interface Preference overrides SLA-based selection rather than enhancing it — the trap is assuming it improves load balancing or failover when it actually pins traffic to a chosen interface.

How to eliminate wrong answers

Option B is wrong because failover to the default gateway is governed by routing and SD-WAN rule configuration, not by the Interface Preference checkbox — that option does not enable default-gateway failover. Option C is wrong because load balancing across interfaces is controlled by the SD-WAN rule's strategy (e.g., load-balance) and related settings, not by Interface Preference, which actually restricts path selection rather than distributing it. Option D is wrong because probe frequency is configured under the SLA target/health-check settings (probe interval, failtime, recoverytime), not by the Interface Preference option.

Practice this question →
74
MCQmedium

You are configuring a Performance SLA to monitor reachability to a SaaS application. Which parameter determines the threshold for an interface to be considered 'unhealthy' in the SD-WAN routing table?

A.Probe Mode
B.Sequence Number
C.Packet Loss Threshold
D.Update Interval
AnswerC

The Performance SLA's packet loss threshold defines the percentage of lost probes above which the interface is marked unhealthy and removed from the SD-WAN routing table. Latency and jitter thresholds affect path preference, but packet loss is the reachability health determinant.

Why this answer

The Packet Loss Threshold is one of the SLA criteria (along with latency and jitter) that determines when a member is marked unhealthy in the SD-WAN routing table. When the measured packet loss exceeds the configured threshold, the Performance SLA marks that member as out-of-SLA, and SD-WAN rules that require SLA compliance will stop selecting it. This is the parameter that directly defines the 'unhealthy' boundary for loss-based SLA evaluation.

Exam trap

NSE7_SDW often tests the confusion between parameters that define how probes are sent (Probe Mode, Update Interval) and parameters that define the health threshold (Packet Loss, Latency, Jitter thresholds) — candidates must map the question's 'threshold' wording to the SLA metric, not the probe mechanics.

How to eliminate wrong answers

Option A (Probe Mode) is wrong because Probe Mode (ping, tcp-echo, udp-echo, http, twamp) defines how the probe is sent, not the threshold for health. Option B (Sequence Number) is wrong because sequence numbers are internal to probe packets for matching replies and detecting loss — they are not a configurable threshold. Option D (Update Interval) is wrong because it controls how often probes are sent and how frequently SLA status is recalculated, not the value that determines healthy vs. unhealthy.

Practice this question →
75
MCQhard

You have an SD-WAN rule with 'Priority' strategy. What happens if the highest priority member fails its SLA?

A.Traffic is dropped.
B.The FortiGate enters an error state.
C.Traffic is load balanced across all remaining members.
D.Traffic fails over to the member with the next highest priority value.
AnswerD

Under the Priority strategy, members are ranked by priority value, and the highest-priority member is preferred while its SLA is met. When that member breaches its SLA, FortiGate immediately redirects traffic to the next-highest-priority member, satisfying the rule's requirement for deterministic ordered failover rather than load balancing.

Why this answer

In an SD-WAN rule using the Priority strategy, members are ranked by priority value (lower number = higher priority). If the highest-priority member fails its SLA, FortiOS fails over to the next highest-priority member that is still SLA-compliant, preserving service continuity.

Exam trap

NSE7_SDW often tests the confusion between Priority and Load Balance strategies; candidates may incorrectly assume Priority load-balances or drops traffic instead of performing ordered failover.

How to eliminate wrong answers

Option A is wrong because traffic is not dropped; the priority strategy is designed to provide failover, not blackholing. Option B is wrong because the FortiGate does not enter an error state; it simply selects the next eligible member. Option C is wrong because load balancing across all remaining members is the behaviour of the Load Balance strategy, not Priority.

Practice this question →
Page 1 of 2 · 84 questions totalNext →

Ready to test yourself?

Try a timed practice session using only System Configuration And Setup questions.

Start 20-question session