NSE7 Advanced Networking and SD-WAN Practice Question
An administrator wants to use policy-based routing to forward traffic from subnet 192.168.1.0/24 to a specific next-hop via port2. Which TWO configuration elements are needed?
⚠ Common exam trap
It's easy for candidates to confuse PBR with static routing or SD-WAN rules, mistakenly thinking a static route with higher administrative distance or an SD-WAN rule can achieve the same next-hop override, but PBR requires explicit route-map and prefix-list configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A route-map that matches the source subnet and sets the next-hop.
Policy-based routing (PBR) on FortiGate uses a route-map to override the normal routing table lookup. Option B is correct because the route-map must match the source subnet (e.g., via a prefix-list or access-list) and set the next-hop to the desired gateway. Option D is also correct because a prefix-list is the standard method to define the subnet match condition within the route-map.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An SD-WAN rule overriding the routing decision.
Why it's wrong here
SD-WAN rules are separate from PBR.
- ✓
A route-map that matches the source subnet and sets the next-hop.
Why this is correct
PBR uses route-maps to match and set next-hop.
- ✗
A static route with a higher administrative distance.
Why it's wrong here
PBR overrides static routes; this is not needed.
- ✓
A prefix-list matching 192.168.1.0/24.
Why this is correct
The route-map typically uses a prefix-list to match the source.
- ✗
A firewall policy matching the traffic with action 'accept'.
Why it's wrong here
Policy-based routing is applied on the policy; but the policy must be configured to use PBR.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.