NSE7 Advanced Networking and SD-WAN Practice Question
An administrator has configured an SD-WAN zone named 'virtual-wan' containing two members: port1 and port2. They want to apply different SD-WAN rules based on the destination IP address. Which FortiGate configuration object should they use to define the destination IP address for matching traffic in an SD-WAN rule?
⚠ Common exam trap
It's easy for candidates to confuse SD-WAN rule destination matching with policy routes or ISDB entries, which serve different purposes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Address object referenced in the SD-WAN rule's destination field
SD-WAN rules on FortiGate use firewall address objects to define destination criteria. These objects can represent IP subnets, FQDNs, or geographic locations. When configuring an SD-WAN rule, the destination field expects an address object, which is then used to match traffic. This allows flexible and granular control over which traffic is routed through which SD-WAN member.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Policy route with destination address and outgoing interface
Why it's wrong here
Policy routes are a separate mechanism for overriding the routing table based on criteria like source/destination. They are not used within SD-WAN rules to define destination matching. SD-WAN rules themselves use address objects, not policy routes, for destination matching.
- ✓
Address object referenced in the SD-WAN rule's destination field
Why this is correct
In FortiOS SD-WAN rules, the destination is specified by referencing a firewall address object. This allows granular matching based on IP subnet, FQDN, or geography. The address object is created under Firewall Objects > Addresses and then selected in the SD-WAN rule configuration. This is the correct method to match traffic by destination IP.
- ✗
Internet Service Database (ISDB) entry selected in the SD-WAN rule
Why it's wrong here
ISDB entries are used to match traffic by internet service (e.g., Microsoft 365, AWS) rather than specific destination IP addresses. While ISDB can be used in SD-WAN rules, the question asks for destination IP address matching, which is done via address objects. ISDB is not the correct object for this scenario.
- ✗
Application control signature referenced in the SD-WAN rule
Why it's wrong here
Application control signatures are used to match traffic by application (e.g., Facebook, YouTube). They are not used to match by destination IP address. While application-based SD-WAN rules are possible, the requirement is to match based on destination IP, so this is incorrect.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 718 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.