NSE7 Advanced Networking and SD-WAN Practice Question
An administrator is troubleshooting an SD-WAN setup where a specific application's traffic is not being steered according to the configured SD-WAN rule. The rule uses a performance SLA and the 'lowest-cost' strategy. The administrator runs 'diagnose sys sdwan health-check' and sees that both members are alive and meeting the SLA. However, traffic still goes over the higher-cost member. What is the most likely cause?
⚠ Common exam trap
The trap here is assuming that healthy members guarantee rule enforcement, overlooking that the rule must first match the traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SD-WAN rule is not matching the traffic because the source or destination criteria are incorrect.
When traffic does not follow the SD-WAN rule despite healthy members, the most likely cause is that the rule is not matching the traffic. This can happen if the source, destination, application, or other match criteria are misconfigured. Without a match, the FortiGate falls back to the routing table or other rules, potentially using the higher-cost member. Administrators should verify rule match criteria and session details.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The SD-WAN rule is not matching the traffic because the source or destination criteria are incorrect.
Why this is correct
If the SD-WAN rule does not match the traffic, the default routing or another rule will be used, which may select the higher-cost member. Even though the health-check shows both members alive, the rule must match the traffic to enforce the 'lowest-cost' selection. Incorrect match criteria are a common cause of unexpected routing.
- ✗
The higher-cost member is configured with a lower priority value, causing it to be preferred.
Why it's wrong here
In 'lowest-cost' strategy, priority is determined by cost, not a separate priority value. There is no separate priority configuration for members in this context. The higher-cost member would not be preferred unless the rule is not matching or the lower-cost member is considered dead, but the health-check shows both alive.
- ✗
The performance SLA is not assigned to the SD-WAN zone.
Why it's wrong here
If the performance SLA is not assigned to the zone, the health-check command would not show SLA results for the members. The administrator sees that both members are alive and meeting the SLA, indicating the SLA is properly assigned and functioning. Therefore, this is not the cause.
- ✗
The 'lowest-cost' strategy is not supported for application-based rules.
Why it's wrong here
The 'lowest-cost' strategy is supported for application-based rules. The issue is not the strategy's support but likely the rule matching. If the rule matched, the strategy would select the lower-cost member. So this statement is false.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 718 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.