NSE7 Advanced Networking and SD-WAN Practice Question
A FortiGate with FortiExtender is using LTE as a backup WAN link. When the primary link fails, the LTE link does not take over. What could be the cause?
⚠ Common exam trap
It's easy for candidates to assume any working backup interface will automatically take over when the primary fails, but FortiGate SD-WAN requires explicit membership in the SD-WAN zone for failover to occur.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The LTE interface is not added as an SD-WAN member.
For an LTE interface to be used as a backup WAN link in an SD-WAN setup, it must be explicitly added as an SD-WAN member. Without this, the FortiGate will not consider the LTE interface for traffic steering or failover, even if the primary link fails. The SD-WAN rules and performance SLA are only evaluated against interfaces that are members of the SD-WAN zone.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The primary link's performance SLA is still passing.
Why it's wrong here
A passing performance SLA keeps the primary route in the routing table, so the LTE backup is never activated. This is tempting because the SLA genuinely controls failover, but the stem asks what could cause the failure; a healthy SLA is the normal, correct state, not a fault, so it cannot be the cause.
- ✗
The FortiExtender is not configured in pass-through mode.
Why it's wrong here
Pass-through mode concerns how the FortiExtender presents its modem to the FortiGate; it is not the trigger for backup-link activation. Pass-through is chosen when the FortiGate must manage the LTE interface directly, yet failover still hinges on the primary link's monitored status, so this does not explain the LTE link staying idle.
- ✗
The FortiExtender firmware is out of date.
Why it's wrong here
Firmware version does not govern whether a FortiGate activates a backup LTE interface; link failover depends on the primary interface's link-health or performance-SLA state. Updating FortiExtender firmware is tempting because stale firmware can cause modem instability or registration faults, but that scenario presents as a persistently down LTE link, not a failure to take over.
- ✓
The LTE interface is not added as an SD-WAN member.
Why this is correct
SD-WAN only steers traffic across members of the virtual WAN link. If the LTE interface is not added as an SD-WAN member, the failover rule cannot select it, so the backup link never activates when the primary fails.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 718-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.