NSE7 Advanced Networking and SD-WAN Practice Question
A FortiGate has two equal-cost paths to a destination network. ECMP is enabled. The administrator notices that all traffic uses the first path. What is the most likely cause?
⚠ Common exam trap
Candidates often assume ECMP always distributes traffic evenly across all paths, but they overlook that the hash algorithm's behavior depends on the diversity of source-destination pairs; when all sessions share the same IP pair, the hash produces the same result, causing all traffic to follow one path.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ECMP is configured to use 'source-dest-ip' hash and all sessions are from same source to same destination
When ECMP is configured with the 'source-dest-ip' hash algorithm, traffic is load-balanced based on a hash of both source and destination IP addresses. If all sessions originate from the same source IP and go to the same destination IP, the hash value is identical for every session, causing all traffic to be forwarded over the same path. This is the most likely cause because the administrator sees all traffic using the first path despite ECMP being enabled.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ECMP is configured with 'spillover' mode
Why it's wrong here
Spillover mode deliberately sends traffic down one path until its bandwidth is exhausted, then overflows to the second, so all traffic on the first path is expected behaviour rather than a fault. It would be the correct choice when the design intent is primary/backup usage rather than per-flow load distribution.
- ✗
The second path is administratively down
Why it's wrong here
An administratively down interface would remove that route from the routing table entirely, so ECMP would not list two equal-cost paths at all. This distractor tempts because link failure is a common cause of one-path traffic, but the stem's equal-cost premise rules it out.
- ✓
ECMP is configured to use 'source-dest-ip' hash and all sessions are from same source to same destination
Why this is correct
With the source-dest-ip hash, FortiGate selects a path from the source and destination IP pair. Identical pairs always hash to the same interface, so every session between the same endpoints traverses one path, leaving the second equal-cost link idle.
- ✗
The route metric is not equal
Why it's wrong here
Unequal metrics would prevent ECMP installing both routes as equal-cost entries, but the stem already states the paths are equal-cost, so this contradicts the premise. Metric manipulation is the tool when deliberately preferring one path, not when diagnosing why equal-cost paths are not load-balanced.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 718-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.