NSE7 Advanced Networking and SD-WAN Practice Question
A FortiGate administrator wants to use BFD to quickly detect link failures in an SD-WAN deployment. Which statement about BFD configuration on FortiGate is correct?
⚠ Common exam trap
Test-takers frequently confuse BFD with performance SLA probes or assume BFD is automatically enabled with routing protocols, but FortiGate requires explicit BFD configuration and BFD does not measure link quality metrics like jitter or packet loss.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
BFD can be configured under the interface or routing protocol to detect forwarding path failures
BFD (Bidirectional Forwarding Detection) on FortiGate can be configured either directly on an interface or under a dynamic routing protocol (such as OSPF or BGP). When configured under the interface, BFD monitors the forwarding path to that specific neighbor; when configured under the routing protocol, it provides sub-second failure detection for routes learned via that protocol. This flexibility allows the administrator to tailor BFD to the SD-WAN deployment's needs, ensuring rapid link failure detection without relying on routing protocol timers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
BFD is enabled by default on all FortiGate interfaces
Why it's wrong here
BFD is disabled by default on FortiGate interfaces and must be enabled per interface or per routing-protocol neighbour. Enabling it by default would generate unnecessary control traffic; default enablement is not FortiGate behaviour, so the administrator must configure it explicitly for SD-WAN link failure detection.
- ✓
BFD can be configured under the interface or routing protocol to detect forwarding path failures
Why this is correct
BFD operates as a lightweight, protocol-independent hello mechanism that can be bound either directly to an interface or to a routing protocol such as BGP or OSPF. This dual placement lets it detect forwarding-path failures at sub-second intervals, satisfying the SD-WAN requirement for rapid link-failure detection.
- ✗
BFD sessions are established automatically when OSPF neighbors form
Why it's wrong here
BFD sessions are not established automatically by OSPF neighbour formation; BFD must be explicitly configured on the interface and enabled within the routing protocol. Automatic establishment applies when BFD is already configured and the routing protocol is set to use it, not as a default behaviour.
- ✗
BFD uses performance SLA probes to determine link health
Why it's wrong here
BFD is a standalone neighbour-liveness protocol with its own hello and detection timers; SD-WAN performance SLA probes are separate link-quality monitors measuring latency, jitter and packet loss. Performance SLA probes are the correct mechanism when the requirement is application-quality measurement rather than sub-second link failure detection.
Visual reference
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 718-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.