NSE7 Advanced Networking and SD-WAN Practice Question
A FortiGate has two WAN interfaces (port1, port2) as SD-WAN members. The performance SLA monitor is configured for both with a latency threshold of 50 ms. The measured latency on port1 is 45 ms and on port2 is 55 ms. An SD-WAN rule uses 'lowest-cost' algorithm. Which interface will be selected for new sessions?
⚠ Common exam trap
Many candidates assume the 'lowest-cost' algorithm compares raw latency values directly, but it actually first filters out interfaces that fail the SLA threshold, so port2 is excluded despite having a lower cost or being otherwise functional.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
port1 because its latency is within threshold and lower than port2
The SD-WAN rule uses the 'lowest-cost' algorithm, which selects the interface with the lowest cost among those that meet the performance SLA threshold. Here, port1 has a measured latency of 45 ms, which is below the 50 ms threshold, while port2's latency of 55 ms exceeds the threshold, making port2 ineligible. Therefore, port1 is the only qualifying interface and is selected for new sessions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
port1 because its latency is within threshold and lower than port2
Why this is correct
The lowest-cost algorithm selects the member with the best measured performance among those meeting the SLA. port1's 45 ms latency is within the 50 ms threshold and lower than port2's 55 ms, which breaches it, so port1 satisfies both the threshold and lowest-latency constraints.
- ✗
port2 because port1's latency is close to threshold
Why it's wrong here
Lowest-cost selects the member with the lowest measured cost; port1 at 45 ms is within the 50 ms SLA threshold and port2 at 55 ms is not, so port1 wins. Proximity to a threshold is not a selection criterion. This option confuses SLA compliance with cost ranking.
- ✗
The session is dropped
Why it's wrong here
A failed SLA monitor marks a member out of the rule, but the rule still has port1 within threshold, so traffic is forwarded rather than dropped. Dropping occurs only when no member satisfies the SLA. This option mistakes member exclusion for total rule failure.
- ✗
Both interfaces are used equally
Why it's wrong here
Lowest-cost selects the single member with the lowest cost, so one interface carries new sessions rather than both sharing them. Equal distribution is tempting because load balancing across members is a valid SD-WAN behaviour, but it applies to weighted or volume-based algorithms, not lowest-cost.
Go deeper
Related to this question
About these practice questions
One of 718 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.