Courseiva

CCNA Nse7 SD Wan System Configuration And Setup Questions

26 questions · Nse7 SD Wan System Configuration And Setup · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQhard

What is the purpose of the 'Gateway' override in an SD-WAN member configuration?

A.To force the use of a secondary ISP.
B.To specify a manual gateway for the SD-WAN member.
C.To bypass the firewall policy.
D.To enable load balancing.
AnswerB

The Gateway override replaces the SD-WAN member's automatically detected next-hop with an administrator-specified manual gateway address. This is required when the member's traffic must egress through a particular router or next-hop that FortiGate cannot infer from the interface configuration.

Why this answer

The 'Gateway' override in an SD-WAN member configuration lets you manually specify the next-hop gateway IP address for that member interface. This is needed when the interface is on a subnet where the default gateway cannot be auto-detected, or when you want to force traffic through a specific next-hop (for example, a secondary router). It overrides the automatically learned gateway for that SD-WAN member.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the purpose of the gateway override, and candidates confuse it with ISP selection or load balancing, which are handled by SD-WAN rules, not the member gateway field.

How to eliminate wrong answers

Option A is wrong because forcing a secondary ISP is achieved through SD-WAN rules and priority/SLA settings, not the gateway override field. Option C is wrong because bypassing a firewall policy is not a function of SD-WAN member configuration; policy is enforced separately. Option D is wrong because load balancing is handled by SD-WAN rules and algorithm selection, not by specifying a manual gateway.

Practice this question →
2
MCQeasy

You are deploying a new SD-WAN interface. What is the mandatory step before you can add an interface to an SD-WAN zone?

A.Configure a performance SLA for that specific interface.
B.Remove all firewall policy, static route, and DHCP references from the interface.
C.Assign a VLAN ID to the interface.
D.Enable SD-WAN on the global system settings.
AnswerB

An interface carrying firewall policy, static route or DHCP references cannot be added to an SD-WAN zone; FortiGate rejects the operation. Removing those references first is mandatory, since SD-WAN zones require interfaces free of such conflicting configuration.

Why this answer

Before an interface can be added to an SD-WAN zone, FortiOS requires that the interface have no existing references — specifically, it must not be referenced by firewall policies, static routes, or DHCP server configurations. This is because SD-WAN zones take over the interface's role in routing and policy, and leftover references cause conflicts or install failures. Removing those references is the mandatory prerequisite.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the prerequisite order — candidates assume a performance SLA or VLAN is required first, but the real gate is removing existing policy/route/DHCP references from the interface.

How to eliminate wrong answers

Option A is wrong because a performance SLA is configured on the SD-WAN members/zone after the interface is added, not as a prerequisite to adding it — you can add an interface to a zone before defining SLAs. Option C is wrong because a VLAN ID is only relevant if the interface is a VLAN subinterface; physical WAN interfaces added to SD-WAN zones don't require a VLAN ID. Option D is wrong because SD-WAN is enabled per-interface/zone, not via a global system setting — there is no 'enable SD-WAN globally' toggle that gates zone membership.

Practice this question →
3
MCQhard

When configuring an SD-WAN rule for a specific application, how does the FortiGate identify the traffic?

A.By analyzing the packet payload size.
B.By looking at the source MAC address.
C.By using the Application Control database.
D.By forcing traffic through a specific VLAN.
AnswerC

Application Control signatures inspect payload and protocol behaviour, so the FortiGate matches traffic by application identity rather than port or IP. This satisfies the stem's requirement to identify a specific application within an SD-WAN rule, since the Application Control database supplies the signatures SD-WAN references when steering that application's sessions.

Why this answer

FortiGate SD-WAN rules match traffic to applications using the Application Control signature database, which identifies applications by inspecting packet contents (DPI) rather than by static IP/port. When you select an 'Application' or 'Application Category' in an SD-WAN rule, the FortiGate leverages the same IPS/App-Ctrl engine signatures to classify the flow. This allows dynamic identification of SaaS and cloud apps whose IPs and ports change frequently.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the misconception that SD-WAN application rules match on IP/port or payload size, when in fact they depend on the Application Control signature database and DPI.

How to eliminate wrong answers

Option A is wrong because packet payload size alone cannot reliably identify an application — many apps share similar payload sizes and encryption hides content size patterns. Option B is wrong because source MAC addresses are only relevant within the local Layer 2 segment and are rewritten at each hop, so they cannot identify applications across a routed SD-WAN topology. Option D is wrong because forcing traffic through a VLAN is a segmentation action, not an identification mechanism — VLANs do not classify application traffic.

Practice this question →
4
Multi-Selectmedium

Which THREE of the following protocols can be used for Performance SLA probes?

Select 3 answers
A.FTP
B.ICMP
C.TCP Echo
D.HTTP
E.DHCP
AnswersB, C, D

ICMP is one of the probe protocols available for Performance SLA health checks, sending echo requests to measure latency, jitter and packet loss. This satisfies the stem's requirement by confirming ICMP as a valid probe type alongside the other supported protocols.

Why this answer

Performance SLA probes in FortiGate SD-WAN support several probe protocols, and ICMP (option B) is correct because it sends echo requests to measure latency, jitter, and packet loss to a target. TCP Echo (option C) is correct because it uses TCP port 7 echo to verify reachability and measure round-trip performance. HTTP (option D) is correct because FortiGate can issue HTTP GET requests to a monitored web server and evaluate response time and availability.

FTP (option A) is not a supported Performance SLA probe type, and DHCP (option E) is a network configuration protocol, not a probe mechanism for SLA monitoring.

Exam trap

FORTINET-NSE7-SPECIALTY often tests whether candidates confuse general network protocols (FTP, DHCP) with the specific probe types supported for SD-WAN Performance SLAs, so the trap is selecting FTP or DHCP as valid probe protocols.

Practice this question →
5
MCQeasy

When using SD-WAN zones, what is the primary benefit of grouping multiple physical interfaces into a single zone?

A.It increases the throughput of individual physical links.
B.It prevents the need for performance SLAs.
C.It automatically enables load balancing between interfaces.
D.It allows you to apply a single firewall policy to the entire group.
AnswerD

A zone groups several physical links so policy is written once against the logical zone rather than per member interface. Traffic is then load-balanced and failed over across members, satisfying the requirement to manage many links as one policy target.

Why this answer

Grouping multiple physical interfaces into a single SD-WAN zone allows you to apply a single firewall policy to the entire group, simplifying management and ensuring consistent security policies across all member interfaces. This is the primary benefit because it reduces administrative overhead and ensures that policies are uniformly enforced. While SD-WAN zones can also facilitate load balancing and failover, those are features of the SD-WAN rules applied to the zone, not the primary purpose of grouping interfaces.

Exam trap

The trap here is confusing the primary benefit of zones with the capabilities of SD-WAN rules; candidates might select load balancing as the primary benefit, but the question asks for the benefit of grouping interfaces into a zone, which is policy simplification.

How to eliminate wrong answers

Option A is wrong because grouping interfaces into a zone does not increase the throughput of individual physical links; throughput is determined by the link capacity and aggregation methods, not by zone membership. Option B is wrong because performance SLAs are still required and are configured within SD-WAN rules; zones do not eliminate the need for SLAs. Option C is wrong because while SD-WAN zones enable load balancing when used with SD-WAN rules, the automatic load balancing is not the primary benefit; the primary benefit is simplified policy application.

Practice this question →
6
MCQmedium

Which SD-WAN rule strategy should you choose if you want to distribute traffic across multiple interfaces based on their bandwidth weights?

A.Manual
B.Maximize Bandwidth (SLA)
C.Lowest Cost (SLA)
D.SLA Target
AnswerB

Maximize Bandwidth (SLA) distributes sessions across members proportionally to their configured bandwidth weights, provided each member passes its SLA targets. This satisfies the stem's requirement to spread traffic by bandwidth weight, unlike Best Quality or Lowest Cost, which pick a single member rather than load-sharing.

Why this answer

The 'Maximize Bandwidth (SLA)' strategy selects SD-WAN members that meet the SLA and then distributes traffic across them proportionally to their configured bandwidth weights. This is the strategy designed to aggregate and load-balance traffic based on link capacity, making it the correct choice when you want weighted distribution by bandwidth.

Exam trap

The trap is that candidates confuse 'Maximize Bandwidth (SLA)' with 'Lowest Cost (SLA)' or invent 'SLA Target' as a strategy, not realizing that bandwidth-weighted distribution is specifically the Maximize Bandwidth (SLA) behavior.

How to eliminate wrong answers

Option A is wrong because 'Manual' strategy requires an administrator to explicitly define the order or selection of members; it does not automatically distribute traffic by bandwidth weights. Option C is wrong because 'Lowest Cost (SLA)' selects the single lowest-cost member that meets the SLA, not a weighted distribution across multiple members. Option D is wrong because 'SLA Target' is not a valid FortiGate SD-WAN strategy name — the actual strategies include Manual, Best Quality, Lowest Cost (SLA), Maximize Bandwidth (SLA), and Load Balance, so 'SLA Target' is a distractor.

Practice this question →
7
MCQmedium

What is the impact of checking the 'Interface Preference' box in an SD-WAN rule?

A.It overrides the SLA strategy selection.
B.It enables failover to the default gateway.
C.It enables load balancing across interfaces.
D.It increases the probe frequency.
AnswerA

Ticking Interface Preference forces the rule to use the specified outgoing interface rather than letting the SLA strategy pick the best member. It therefore overrides SLA-based selection, satisfying the stem's question about the checkbox's impact on SD-WAN rule behaviour.

Why this answer

Checking 'Interface Preference' in an SD-WAN rule forces the rule to use the explicitly selected interface(s) rather than letting the SLA strategy dynamically pick the best-performing member. This effectively overrides the SLA-based path selection for that rule, so traffic egresses the preferred interface even if another member has better SLA metrics. It is used when a specific link must be used for policy, compliance, or cost reasons.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the misconception that Interface Preference enables failover or load balancing, when it actually pins traffic to a chosen member and overrides SLA-driven selection.

How to eliminate wrong answers

Option B is wrong because failover to the default gateway is governed by routing and SD-WAN member configuration, not by the Interface Preference checkbox. Option C is wrong because load balancing across interfaces is achieved through SD-WAN rule strategies and multiple members, not by enabling Interface Preference. Option D is wrong because probe frequency is configured under the performance SLA health-check settings, not by the Interface Preference option.

Practice this question →
8
MCQmedium

What is the purpose of the 'Inbound' interface setting in an SD-WAN rule?

A.To restrict the rule to traffic originating from a specific interface.
B.To enable reverse path forwarding checks.
C.To define the WAN gateway.
D.To specify the egress interface.
AnswerA

The Inbound interface setting constrains rule matching to sessions whose ingress interface equals the specified one. Traffic arriving on any other interface bypasses the rule, so it scopes the SD-WAN rule to flows originating from that particular interface.

Why this answer

The 'Inbound' interface setting in an SD-WAN rule specifies the incoming interface for traffic that the rule should match. It restricts the rule to traffic originating from a specific interface, allowing granular control over which traffic is subject to the SD-WAN rule. This is useful when you want to apply different SD-WAN strategies based on the source of the traffic, such as traffic from the LAN versus traffic from a VPN tunnel.

Exam trap

Candidates often confuse the inbound interface setting with the outbound interface selection, leading them to choose 'egress interface' as the answer.

How to eliminate wrong answers

Option B is wrong because reverse path forwarding (RPF) checks are a security feature configured separately, not through the 'Inbound' interface setting in an SD-WAN rule. Option C is wrong because the WAN gateway is defined in the interface configuration or static routes, not in the SD-WAN rule's inbound setting. Option D is wrong because the egress interface is determined by the SD-WAN rule's outbound interface selection, not by the inbound setting.

Practice this question →
9
Multi-Selectmedium

Which THREE of the following are parameters that can be monitored in a Performance SLA?

Select 3 answers
A.Packet Loss
B.CPU load
C.Jitter
D.Disk usage
E.Latency
AnswersA, C, E

Packet loss is a measurable Performance SLA metric, tracked as a percentage of dropped traffic across the monitored link or member. This satisfies the stem's constraint by being one of the three valid parameters FortiGate SD-WAN health checks evaluate.

Why this answer

In a Performance SLA (as used by SD-WAN/performance-monitoring features such as Fortinet's SD-WAN performance SLAs), the monitored parameters are network-quality metrics measured by probes: Packet Loss (A) is correct because the SLA tracks the percentage of probe packets that never arrive at the remote target, Jitter (C) is correct because it measures the variation in delay between consecutive probe packets, and Latency (E) is correct because it measures the round-trip or one-way delay of the probes. These three metrics are exactly the ones used to decide whether a link meets the SLA and to trigger failover or rule changes. CPU load (B) and Disk usage (D) are host/resource utilization statistics reported by system sensors or SNMP, not link-quality parameters evaluated by a Performance SLA, so they do not belong.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the confusion between network-quality SLA metrics (latency, jitter, loss) and system resource metrics (CPU, memory, disk) that are unrelated to SLA health.

Practice this question →
10
MCQmedium

What is the effect of changing the 'Hold-down' timer in a Performance SLA?

A.It changes the frequency of the probes.
B.It sets the maximum number of failed probes allowed.
C.It prevents route flapping by delaying the transition back to an 'up' state.
D.It determines the timeout duration for a single probe.
AnswerC

Hold-down specifies how long a member must remain healthy before the SLA transitions it back to up. Extending it prevents rapid up/down oscillation, so flapping members do not repeatedly trigger route changes and traffic re-steering.

Why this answer

The Hold-down timer in a Performance SLA specifies how long the SLA remains in a down state before it is allowed to transition back to up, even after probes succeed again. This delay prevents rapid flapping between up and down states when link quality is marginal, stabilizing SD-WAN rule decisions. It is a hysteresis mechanism, not a probe frequency or failure threshold.

Exam trap

FORTINET-NSE7-SPECIALTY often tests confusion between probe interval, failure threshold, timeout, and hold-down, so candidates must map each timer to its exact function.

How to eliminate wrong answers

Option A is wrong because probe frequency is controlled by the probe interval setting, not the hold-down timer. Option B is wrong because the maximum number of failed probes is governed by the failure threshold or retry count, not hold-down. Option D is wrong because the timeout duration for a single probe is a separate probe timeout parameter, not the hold-down timer.

Practice this question →
11
MCQmedium

When setting up a Performance SLA, what is the 'Participant' setting?

A.The monitoring interval.
B.The user group assigned to the probe.
C.The destination IP address.
D.The SD-WAN member that originates the probe.
AnswerD

The Participant identifies the specific SD-WAN member that generates and sends the probe traffic, anchoring the SLA measurement to a defined source. This determines which member's performance is evaluated against the SLA thresholds for latency, jitter and packet loss.

Why this answer

In a FortiGate Performance SLA, the 'Participant' setting specifies which SD-WAN member (interface) originates the health check probes. Each member that should be monitored must be added as a participant, and the SLA measures latency, jitter, and packet loss from that member to the configured server.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the distinction between the SLA 'server' (destination) and 'participant' (source member), causing candidates to confuse the two and select the destination IP as the Participant.

How to eliminate wrong answers

Option A is wrong because the monitoring interval is configured separately as 'interval' and 'timeout' within the SLA settings, not as the Participant. Option B is wrong because user groups are not assigned to Performance SLA probes — identity is not part of health check configuration. Option C is wrong because the destination IP address is configured as the 'server' in the SLA, not the Participant; the Participant is the source member.

Practice this question →
12
MCQmedium

What is the maximum number of members allowed in a single SD-WAN zone?

A.8
B.2
C.4
D.Depends on the model, but generally limited by system resources.
AnswerD

FortiGate does not publish a fixed member ceiling per SD-WAN zone; the practical limit depends on the appliance model's memory and CPU resources. Higher-capacity platforms support more members, so the answer reflects hardware capability rather than a universal numeric maximum.

Why this answer

The maximum number of members in a single SD-WAN zone is not a fixed hard-coded number; it depends on the FortiGate model and is ultimately bounded by available system resources such as memory and CPU. Fortinet does not publish a universal cap like 4 or 8, and different platforms support different scales. Therefore the correct answer is the model/resource-dependent option.

Exam trap

The trap is looking for a fixed numeric answer (4, 8, 2) when Fortinet deliberately leaves the SD-WAN member limit model-dependent — candidates who memorize a number instead of the principle get it wrong.

How to eliminate wrong answers

Option A is wrong because 8 is not a universal limit — some models support more, and it is not a documented fixed maximum. Option B is wrong because 2 is far too low; even entry-level FortiGates support more than two SD-WAN members. Option C is wrong because 4 is also an arbitrary number not tied to FortiOS documentation; the real constraint is platform capacity.

Practice this question →
13
Multi-Selectmedium

Which THREE of the following criteria are used for SD-WAN rule traffic matching?

Select 3 answers
A.Interface speed
B.Destination address
C.VLAN priority
D.Application/Service
E.Source address
AnswersB, D, E

Destination address is one of the SD-WAN rule matching criteria, letting you steer traffic toward specific remote subnets or hosts across member links. It satisfies the stem by matching on the packet's destination IP, evaluated alongside source address and application/service to select the outbound member.

Why this answer

In FortiGate SD-WAN rules, traffic matching is performed using criteria such as destination address (B), application/service (D), and source address (E), which are all standard SD-WAN rule match objects that identify which traffic should be steered. Destination address (B) and source address (E) match on IP prefixes or address objects, while application/service (D) matches on recognized applications or service definitions, allowing policy-based steering. Interface speed (A) is not a match criterion; it is a property of the member interface used for load-balancing decisions, not for classifying traffic.

VLAN priority (C) is also not an SD-WAN rule match criterion; VLAN/802.1p priority is handled through QoS and traffic shaping, not through SD-WAN rule matching.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the distinction between SD-WAN rule match criteria (source, destination, application, service) and link/SLA attributes (interface speed, jitter, latency) that are used for member selection rather than matching.

Practice this question →
14
MCQhard

You are using 'SLA Target' as your strategy. What happens if multiple members meet the SLA?

A.The system selects the first member in the list.
B.The system selects the one with the highest bandwidth capacity.
C.The system selects the member with the best performance (e.g., lowest latency).
D.Traffic is sent through all of them simultaneously.
AnswerC

With SLA Target, FortiGate first filters members meeting the SLA criteria, then applies the secondary metric to break ties. When several members qualify, it picks the one with the best measured performance, such as lowest latency, rather than load-balancing across them.

Why this answer

With the SLA Target strategy, FortiGate selects the member that best meets the SLA criteria — typically the one with the lowest latency or best overall quality among those that satisfy the SLA. It is a quality-based selection, not a first-match or bandwidth-based one.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the confusion between SD-WAN strategies — candidates mix up SLA Target (best performance) with Maximize Bandwidth (highest capacity) or Lowest Cost (cheapest link).

How to eliminate wrong answers

Option A is wrong because selecting the first member in the list describes a static/priority-based selection, not SLA Target — SLA Target actively compares performance. Option B is wrong because highest bandwidth capacity is the criterion for the Maximize Bandwidth strategy, not SLA Target. Option D is wrong because sending traffic through all members simultaneously describes load balancing or per-packet distribution, not SLA Target, which picks a single best member.

Practice this question →
15
MCQhard

You are troubleshooting an issue where traffic is not using an SD-WAN rule despite meeting criteria. What is the most likely cause?

A.A higher-priority SD-WAN rule is matching the traffic first.
B.The SD-WAN rule is disabled.
C.The Performance SLA has timed out.
D.The interface is not in an SD-WAN zone.
AnswerA

SD-WAN rules are evaluated in sequence order, and the first matching rule wins. If a higher-priority rule's criteria also match the traffic, it is applied instead, so the intended lower-priority rule never executes despite its own criteria being met.

Why this answer

SD-WAN rules are evaluated in order, and the first matching rule is applied. If a higher-priority rule matches the traffic first, the intended rule will not be used even if its criteria are met. This is the most likely cause when the rule itself is enabled and correctly configured.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the misconception that SD-WAN rules are evaluated by specificity, when in fact they are evaluated in strict order like firewall policies.

How to eliminate wrong answers

Option B is wrong because if the rule were disabled, it would not be evaluated at all, but the question states traffic meets criteria and the rule is not being used, implying it is active. Option C is wrong because a Performance SLA timeout affects member selection within a rule, not whether the rule matches traffic. Option D is wrong because if the interface were not in an SD-WAN zone, the rule could not reference it, but the question implies the rule is otherwise valid.

Practice this question →
16
MCQmedium

You are configuring a Performance SLA to monitor reachability to a SaaS application. Which parameter determines the threshold for an interface to be considered 'unhealthy' in the SD-WAN routing table?

A.Probe Mode
B.Sequence Number
C.Packet Loss Threshold
D.Update Interval
AnswerC

The packet loss threshold sets the maximum percentage of lost probes a member may incur before FortiOS marks it unhealthy in the SD-WAN routing table. Exceeding it removes the interface from SLA-qualified selection, directly determining the unhealthy state for the monitored SaaS application.

Why this answer

The Packet Loss Threshold in a Performance SLA defines the maximum acceptable percentage of lost probes before the member is marked unhealthy. When packet loss exceeds this threshold (along with latency and jitter thresholds), the SD-WAN engine disqualifies the member from the routing table.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the confusion between probe configuration parameters (Probe Mode, Update Interval) and the actual health thresholds (latency, jitter, packet loss) that determine member status.

How to eliminate wrong answers

Option A is wrong because Probe Mode determines the protocol used for SLA probes (ping, tcp-echo, http, udp-echo, twamp) — it defines how the probe is sent, not the health threshold. Option B is wrong because Sequence Number is not a configurable SLA threshold parameter; it is not used to determine member health. Option D is wrong because Update Interval controls how frequently probes are sent, not the threshold that determines health — a short interval gives faster detection but does not itself define 'unhealthy'.

Practice this question →
17
MCQmedium

Which command is used to verify the current status of SD-WAN members and their SLA health from the CLI?

A.diagnose sys sdwan health-check
B.show router info bgp
C.get system interface
D.get system sdwan member
AnswerA

The diagnose sys sdwan health-check command outputs each member's SLA probe results, including latency, jitter, packet loss and up/down state per health-check. It is the CLI equivalent of the GUI SD-WAN monitor, satisfying the requirement to verify member status and SLA health.

Why this answer

The command 'diagnose sys sdwan health-check' displays the current SLA health status of each SD-WAN member, including latency, jitter, packet loss, and up/down state per health-check. It is the primary CLI tool for verifying SD-WAN member SLA status in real time.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the distinction between configuration-view commands ('get system sdwan') and diagnostic commands ('diagnose sys sdwan health-check') — candidates confuse the two and pick a config command that doesn't show live SLA state.

How to eliminate wrong answers

Option B is wrong because 'show router info bgp' is not a valid FortiGate CLI command for SD-WAN health — BGP neighbor status is checked with 'get router info bgp summary' and does not show SLA metrics. Option C is wrong because 'get system interface' displays interface configuration and status, not SD-WAN SLA health-check results. Option D is wrong because 'get system sdwan member' is not the correct syntax — SD-WAN member configuration is viewed under 'config system sdwan' or via 'diagnose sys sdwan member', but SLA health specifically requires the health-check diagnostic.

Practice this question →
18
MCQeasy

Which protocol is NOT a valid option for Performance SLA probes?

A.TCP Echo
B.UDP Broadcast
C.HTTP
D.ICMP
AnswerB

Performance SLA probes support ICMP, TCP echo, UDP echo, HTTP, HTTPS, DNS, and twamp. UDP Broadcast is not a probe protocol, so it cannot be selected; the FortiGate sends unicast probes to the configured server target.

Why this answer

UDP Broadcast is not a valid protocol for Performance SLA probes in FortiGate SD-WAN. Valid probe protocols include TCP Echo, HTTP, HTTPS, ICMP, and others, but UDP Broadcast is not among them because SLA probes require a response to measure latency, jitter, and packet loss, which broadcast does not provide.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the list of valid Performance SLA probe protocols, causing candidates to confuse generic network protocols with those supported for SLA measurement, and UDP Broadcast is a common distractor because it is a valid network concept but not an SLA probe protocol.

How to eliminate wrong answers

Option A is wrong because TCP Echo is a valid probe protocol used to measure round-trip time by sending a TCP packet and awaiting a response. Option C is wrong because HTTP is a valid probe protocol, commonly used to check web application responsiveness. Option D is wrong because ICMP is a valid probe protocol, using ping to measure latency and packet loss.

Practice this question →
19
Multi-Selecthard

Which TWO of the following can be used as a 'Source' in an SD-WAN rule?

Select 2 answers
A.Source IP address object.
B.SLA target name.
C.Interface MAC address.
D.Firewall policy ID.
E.User group.
AnswersA, E

SD-WAN rules accept firewall address objects as source criteria, so a source IP address object directly satisfies the requirement to match traffic by origin address. FortiGate resolves the object at rule evaluation, letting you steer or steer-select members based on that source.

Why this answer

In an SD-WAN rule, the 'Source' field identifies the traffic origin, and a source IP address object (Option A) is a valid match criterion because SD-WAN rules commonly match on IP address objects (host, subnet, or address group) to steer traffic. A user group (Option E) is also a valid Source match, since SD-WAN rules can classify traffic by user identity/group (typically resolved via FSSO or LDAP integration) so that different users get different path selection. SLA target name (Option B) is not a source; it is a performance/link-quality condition used in the rule's SLA/target definition to select the outgoing link.

Interface MAC address (Option C) is a Layer-2 attribute not used as an SD-WAN rule Source match. Firewall policy ID (Option D) is a policy reference, not a traffic source identifier, so it cannot serve as the Source in an SD-WAN rule.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the distinction between SD-WAN rule match criteria (source, destination, application, user) and SD-WAN member/SLA configuration parameters, causing candidates to confuse SLA targets with source match fields.

Practice this question →
20
MCQeasy

Where are SD-WAN zones managed in the FortiGate GUI?

A.Interface > Physical Interfaces.
B.System > Network > Zones.
C.Firewall > Policy > Objects.
D.Network > SD-WAN > SD-WAN Zones.
AnswerD

SD-WAN zones are configured under Network > SD-WAN > SD-WAN Zones in the FortiGate GUI, where members and zone membership are defined. This is the location for creating and editing the zones used by SD-WAN rules.

Why this answer

SD-WAN zones are configured and managed under Network > SD-WAN > SD-WAN Zones in the FortiGate GUI. This is where administrators create the SD-WAN zone, add member interfaces (physical, IPsec, VLAN), and define the virtual WAN link used by SD-WAN rules and static routes.

Exam trap

The trap is confusing SD-WAN zones with regular firewall zones — candidates pick System > Network > Zones because 'Zones' appears there, but SD-WAN zones live under the SD-WAN menu.

How to eliminate wrong answers

Option A is wrong because Interface > Physical Interfaces only shows physical port configuration, not SD-WAN zone membership. Option B is wrong because System > Network > Zones is for regular firewall zones (security zones), which are distinct from SD-WAN zones. Option C is wrong because Firewall > Policy > Objects contains address, service, and schedule objects, not SD-WAN zone definitions.

Practice this question →
21
MCQhard

An SD-WAN rule is configured with 'Lowest Cost (SLA)' strategy. If all members in the SLA meet the requirements, how does the FortiGate select the outgoing interface?

A.The member with the lowest interface cost value defined in the SD-WAN member configuration.
B.Round Robin
C.The interface with the highest bandwidth.
D.The interface that was most recently added to the zone.
AnswerA

Under Lowest Cost (SLA), FortiGate first filters members meeting every SLA target, then breaks ties by the configured interface cost value. The lowest-cost surviving member becomes the egress interface, so cost only decides once SLA health is satisfied.

Why this answer

With the 'Lowest Cost (SLA)' strategy, FortiGate first filters SD-WAN members to those that meet the SLA targets (latency, jitter, packet loss). Among the qualifying members, it then selects the member with the lowest configured interface cost value in the SD-WAN member configuration. This is a two-stage decision: SLA eligibility first, then cost-based tie-breaking.

Exam trap

The trap is that candidates conflate 'Lowest Cost (SLA)' with 'Maximize Bandwidth (SLA)' and pick the highest-bandwidth option, forgetting that Lowest Cost uses the configured interface cost value after SLA filtering.

How to eliminate wrong answers

Option B is wrong because Round Robin is a separate SD-WAN strategy (or a load-balancing method) that cycles through members regardless of cost; it is not the tie-breaker for Lowest Cost (SLA). Option C is wrong because 'highest bandwidth' is not the selection criterion for Lowest Cost (SLA) — that would be closer to Maximize Bandwidth (SLA), which uses bandwidth weights, not interface cost. Option D is wrong because FortiGate does not select the most recently added member; membership order or addition time is not a documented selection criterion for this strategy.

Practice this question →
22
MCQmedium

When configuring an SD-WAN rule, what is the purpose of the 'Source' address field?

A.To define the gateway IP for the route.
B.To force traffic to a specific SD-WAN zone.
C.To determine which ISP the traffic exits through regardless of SLA.
D.To match traffic based on the source IP or user.
AnswerD

The Source field scopes which traffic the SD-WAN rule evaluates, matching flows by source IP address or identified user. Only traffic originating from those sources is steered by the rule's strategy, letting administrators apply different link-selection policies per subnet or user group.

Why this answer

The Source address field in an SD-WAN rule is used to match traffic based on the source IP address or user identity, allowing the rule to apply only to specific sources. This is part of the rule's matching criteria, alongside destination and service, to determine which traffic is steered by the SD-WAN rule. It does not define gateway IPs or force zones.

Exam trap

FORTINET-NSE7-SPECIALTY often tests confusion between match criteria (source/destination/service) and action/steering settings (zone, gateway, SLA), so candidates must know which field does what.

How to eliminate wrong answers

Option A is wrong because the gateway IP for a route is defined in static routes or the SD-WAN member configuration, not in the rule's source field. Option B is wrong because forcing traffic to a specific SD-WAN zone is done via the destination or the rule's outgoing interface selection, not the source address. Option C is wrong because ISP selection regardless of SLA is not how SD-WAN rules work; rules use SLA targets and priority, and the source field only matches traffic.

Practice this question →
23
MCQhard

You have an SD-WAN rule with 'Priority' strategy. What happens if the highest priority member fails its SLA?

A.Traffic is dropped.
B.The FortiGate enters an error state.
C.Traffic is load balanced across all remaining members.
D.Traffic fails over to the member with the next highest priority value.
AnswerD

With the Priority strategy, members are ranked; the highest-priority member carries traffic until it breaches its SLA health check. Traffic then fails over to the next-highest-priority member, preserving the ordered preference rather than load-balancing across all members.

Why this answer

With the 'Priority' strategy in an SD-WAN rule, members are ranked by their configured priority value, and the FortiGate actively uses the highest-priority member that meets its SLA. When that member fails its SLA health check, the rule automatically fails over to the next-highest-priority member that is still within SLA, preserving connectivity. This is the defining behavior of the Priority strategy — strict ordered failover rather than load distribution.

Exam trap

The trap here is confusing the 'Priority' strategy with 'Load Balance' or 'Maximize Bandwidth' — candidates often assume SD-WAN always spreads traffic, but Priority enforces strict ordered failover.

How to eliminate wrong answers

Option A is wrong because SD-WAN is designed for resilience; dropping traffic on SLA failure defeats the purpose of the feature. Option B is wrong because an SLA failure is a normal, expected event that triggers failover logic — the FortiGate does not enter any error state. Option C is wrong because load balancing across all remaining members is the behavior of the 'Load Balance' or 'Maximize Bandwidth' strategies, not 'Priority', which uses ordered selection.

Practice this question →
24
Multi-Selecthard

Which TWO of the following steps are required to correctly configure a Performance SLA?

Select 2 answers
A.Configure a firewall address object for the probe.
B.Enable BGP on the interface.
C.Select the probe protocol.
D.Define the destination IP address.
E.Assign the probe to a VPN tunnel.
AnswersC, D

A Performance SLA must specify how FortiGate measures link health, so selecting the probe protocol (Ping, HTTP, or DNS) is mandatory. Without it, no probes are sent and SLA members cannot be evaluated, so the rule cannot steer traffic by measured latency, jitter, or packet loss.

Why this answer

Option C is correct because a Performance SLA health-check must specify the probe protocol (e.g., Ping, HTTP, TCP-echo, or UDP-echo) that FortiGate uses to send the probe packets and measure latency, jitter, and packet loss. Option D is correct because the SLA monitor requires a destination IP address (the server or target being probed) so the FortiGate knows where to send the probes and can evaluate link health against that endpoint. Options A, B, and E are not required: a firewall address object is not needed since the destination is entered directly in the SLA configuration, BGP is an unrelated routing protocol and not part of SLA setup, and assigning the probe to a VPN tunnel is optional (the SLA is typically bound to an SD-WAN member interface, not a tunnel).

Exam trap

FORTINET-NSE7-SPECIALTY often tests the specific steps for Performance SLA configuration, and candidates may overcomplicate it by thinking firewall address objects or BGP are required, when only the probe protocol and destination are essential.

Practice this question →
25
MCQhard

You need to ensure that VoIP traffic stays on the interface with the lowest jitter. Which strategy should you use?

A.Load Balance
B.Lowest Cost (SLA)
C.SLA Target
D.Manual
AnswerC

SLA targets measure link quality metrics including jitter, latency and packet loss, then dynamically steer traffic to the member interface meeting the defined threshold. This directly satisfies the requirement to keep VoIP on the lowest-jitter interface, since the SLA probe continuously evaluates each WAN link and withdraws failing ones from routing.

Why this answer

FortiGate SD-WAN's SLA Target strategy selects the member link that best meets a defined SLA target (latency, jitter, packet loss) for the specified traffic, making it the correct choice for keeping VoIP on the lowest-jitter interface. Unlike Lowest Cost, SLA Target prioritizes SLA compliance over cost, which is exactly what latency-sensitive VoIP requires.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the distinction between Lowest Cost (SLA) and SLA Target — candidates incorrectly assume 'SLA' in Lowest Cost means best performance, when it actually means cheapest link that merely satisfies the SLA.

How to eliminate wrong answers

Option A is wrong because Load Balance distributes sessions across links without regard to per-link jitter or SLA, so VoIP could land on a high-jitter link. Option B is wrong because Lowest Cost (SLA) selects the cheapest link that still meets the SLA, which may not be the lowest-jitter link — cost is the primary criterion, not jitter. Option D is wrong because Manual selection pins traffic to a fixed interface and cannot dynamically adapt to changing jitter conditions.

Practice this question →
26
Multi-Selecthard

Which TWO of the following can cause an SD-WAN member to be marked as 'down' in an SLA?

Select 2 answers
A.The probe times out.
B.The system clock is updated.
C.The packet loss exceeds the threshold.
D.The firewall policy is disabled.
E.The interface IP address is changed.
AnswersA, C

SLA probes send periodic health checks to configured targets. If replies stop arriving before the timeout expires, the probe is marked as timed out, the member fails its SLA check, and FortiGate transitions that member to the down state, removing it from eligible routing.

Why this answer

In SD-WAN SLA monitoring, a member is marked down when an SLA probe fails to receive a response within the configured timeout, so option A (the probe times out) directly triggers the down state. Option C (packet loss exceeds the threshold) is also correct because SLA criteria include metrics such as packet loss, latency, and jitter, and exceeding the configured loss threshold causes the member to fail the SLA and be marked down. Options B, D, and E do not by themselves cause an SLA member to be marked down: a system clock update does not affect probe reachability, disabling a firewall policy is a configuration change rather than an SLA metric violation, and changing an interface IP address would typically break connectivity or require reconfiguration but is not itself an SLA threshold breach that marks the member down.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the distinction between SLA health-check triggers (probe timeout, packet loss, latency, jitter) and unrelated administrative changes like clock updates or policy edits, which candidates mistakenly associate with link state.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Nse7 SD Wan System Configuration And Setup questions.

Start 20-question session