NSE7 Advanced Networking and SD-WAN Practice Question
An administrator is configuring SD-WAN on a FortiGate. They want traffic from the internal network to a specific SaaS application to use the MPLS link unless the latency exceeds 50 ms, in which case traffic should failover to the broadband link. Which configuration elements are required?
⚠ Common exam trap
Candidates often confuse jitter and latency thresholds or think that a static route with a higher distance can provide dynamic failover, but FortiGate SD-WAN requires explicit SLA monitoring and failover enablement to react to latency degradation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an SD-WAN member for each link, configure a performance SLA with latency threshold 50 ms, and add an SD-WAN rule matching the SaaS traffic with the MPLS member as preferred and enable 'set failover enable'.
It uses SD-WAN members for each link, a performance SLA with a latency threshold of 50 ms to monitor link quality, and an SD-WAN rule that matches SaaS traffic with the MPLS member as preferred and failover enabled. This configuration ensures that traffic uses the MPLS link as long as latency stays below 50 ms, and automatically fails over to the broadband link when the SLA is violated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure policy-based routing to direct SaaS traffic to the MPLS link and rely on default routing for failover.
Why it's wrong here
PBR does not automatically failover based on link quality metrics; SD-WAN with performance SLA is required.
- ✗
Add a static route for the SaaS IP with the MPLS interface as the gateway and a higher distance than the default route via broadband.
Why it's wrong here
Static routes do not provide dynamic failover based on latency; SD-WAN rules are needed.
- ✗
Create an SD-WAN member for each link, configure a performance SLA with jitter threshold 50 ms, and add an SD-WAN rule matching the SaaS traffic using the 'best-quality' strategy with the MPLS member.
Why it's wrong here
The threshold should be on latency, not jitter, and the failover behavior requires a specific rule with failover, not best-quality strategy.
- ✓
Create an SD-WAN member for each link, configure a performance SLA with latency threshold 50 ms, and add an SD-WAN rule matching the SaaS traffic with the MPLS member as preferred and enable 'set failover enable'.
Why this is correct
This correctly defines members, an SLA to measure latency, and a rule that uses the MPLS link with failover to the broadband when the SLA is not met.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.