NSE7 Advanced Networking and SD-WAN Practice Question
An administrator has deployed a FortiGate at a branch with two WAN links: port1 (primary) and port2 (backup). They create an SD-WAN zone and a performance SLA named 'ISP-Health' that monitors 8.8.8.8 using ping. The SLA is configured with link-cost-factor latency and a threshold of 50 ms. After a week, they notice that the primary link is still being used for all traffic even though its latency frequently exceeds 150 ms. The backup link has 20 ms latency. What is the most likely reason the SD-WAN rule is not failing over?
⚠ Common exam trap
The trap here is assuming that creating a performance SLA automatically makes all SD-WAN rules SLA-aware, when each rule must explicitly reference the SLA.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The performance SLA is not referenced in the SD-WAN rule, so the rule cannot use the SLA status to make decisions.
The SD-WAN rule must explicitly reference the performance SLA for the FortiGate to use SLA results in path selection. Without that association, the rule falls back to static criteria such as interface priority or link cost, so the primary link continues to be used even when its latency exceeds the threshold. The administrator needs to edit the rule and select the SLA as a target.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The SD-WAN rule is using the 'lowest-cost' algorithm, which ignores SLA status and only uses link cost.
Why it's wrong here
'Lowest-cost' is an SD-WAN load balancing algorithm that selects the member with the lowest cost based on the configured link-cost-factor. It does consider SLA status because the cost is derived from the SLA metrics. If the SLA is referenced in the rule, the algorithm would react to latency changes. The problem is the missing SLA reference, not the algorithm choice.
- ✓
The performance SLA is not referenced in the SD-WAN rule, so the rule cannot use the SLA status to make decisions.
Why this is correct
For an SD-WAN rule to react to SLA status, the rule must explicitly reference the performance SLA in its configuration. Without that reference, the FortiGate only uses static criteria like interface priority, ignoring the SLA results. This matches the symptom of the primary link remaining in use despite high latency. The administrator must edit the SD-WAN rule and select 'ISP-Health' as the SLA target.
- ✗
The SLA monitor uses ping, which is not supported for latency measurement; only HTTP and TCP echo are valid.
Why it's wrong here
FortiGate performance SLAs support multiple probe protocols, including ping, HTTP, TCP echo, and UDP echo. Ping is commonly used for latency and jitter measurements. The issue is not the protocol; the SLA is functioning and detecting high latency. Changing the protocol might alter detection characteristics but would not resolve the failover problem described.
- ✗
The link-cost-factor is set to latency, but the backup link must also have an SLA configured to be eligible for failover.
Why it's wrong here
FortiGate SD-WAN does not require the backup link to have its own performance SLA. The same SLA can monitor multiple members; if the primary fails the SLA, the rule can select another member that meets the SLA or is the best available. Configuring an SLA on the backup is optional and not the cause of the failover failure.
Go deeper
Related to this question
About these practice questions
One of 718 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.