NSE7 Advanced Networking and SD-WAN Practice Question
A FortiGate has an SD-WAN configuration with two members (wan1, wan2). The performance SLA monitors latency to 8.8.8.8. The admin notices that even when the SLA is satisfied on both members, all traffic uses wan1. The SD-WAN rule is configured with 'strategy = best quality'. What is the most likely cause?
⚠ Common exam trap
Watch out — candidates often assume 'best quality' always selects the best-performing link, but they overlook the implicit tie-breaking rule that defaults to the first configured member when SLA metrics are equal.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The best quality strategy selects the member with the best SLA metric, which is wan1 by default when both meet SLA
When the SD-WAN rule uses 'best quality' strategy and both members meet the performance SLA, FortiGate selects the member with the best (lowest) latency metric. By default, if both members have equal SLA satisfaction, the first member in the SD-WAN configuration (wan1) is chosen as the tie-breaker. This explains why all traffic uses wan1 even though both links are healthy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A firewall policy is overriding the SD-WAN rule
Why it's wrong here
Firewall policies do not override SD-WAN rules; SD-WAN rules determine interface selection.
- ✓
The best quality strategy selects the member with the best SLA metric, which is wan1 by default when both meet SLA
Why this is correct
Best quality uses a tie-breaking order; it does not load balance equally.
- ✗
The performance SLA is incorrectly configured, causing wan2 to be ignored
Why it's wrong here
If both meet SLA, both are candidates; wan1 is chosen due to ordering.
- ✗
The SD-WAN rule has 'set match-vip disable' which forces all traffic to wan1
Why it's wrong here
Match-vip is for matching destination VIPs, not for selecting members.
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.