Question 951 of 1,000

Advanced Networking and SD-WAN →mediumMultiple ChoiceObjective-mapped

Quick Answer

The answer is a health-check configuration using 'set probe-mode passive' combined with 'set update-static-route disable'. This is the most likely cause because passive probe mode means the FortiGate only monitors the link without actively sending probe traffic, so it never detects the restored link as healthy enough to trigger failback. Additionally, disabling static route updates prevents the route for Member1 from being re-enabled after the link comes back, leaving it inactive in the routing table even though the physical interface is up. On the Fortinet NSE 7 Advanced Security NSE7 exam, this scenario tests your understanding of how SD-WAN failback behavior depends on both active probing and route re-activation, not just link status. A common trap is assuming failback happens automatically when the link is restored, but without active probes and route updates, the SD-WAN rule using 'best quality' strategy will never see Member1 as a viable candidate. Memory tip: "Passive probes, passive routes—no failback, no doubt."

NSE7 Advanced Networking and SD-WAN Practice Question

This NSE7 practice question tests your understanding of advanced networking and sd-wan. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A FortiGate is configured with SD-WAN and has two WAN members: Member1 (ISP1) with priority 10, and Member2 (ISP2) with priority 5. The SD-WAN rule for traffic from the internal network uses the 'best quality' strategy. During normal operation, traffic flows through Member1. After a link failure on Member1, traffic correctly fails over to Member2. However, when Member1 is restored, traffic does not fail back. What is the most likely cause?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.

Question 1mediummultiple choice

Study the full SD-WAN breakdown →

A
The static route for Member1 has a higher administrative distance than Member2.
Why wrong: SD-WAN member selection does not rely on static route distance; it uses SD-WAN rules and health-check status.
B
The health-check for Member1 is configured with 'set probe-mode passive' and 'set update-static-route disable'.
Passive monitoring does not trigger fallback; update-static-route must be enabled for the route to be reinstated when the link recovers.
C
The SD-WAN rule is configured with 'set fallback' disabled.
Why wrong: There is no 'fallback' setting in SD-WAN rules; fallback is controlled by health-check and route updates.
D
The priority of Member2 is higher than Member1.
Why wrong: Member1 has higher priority (10 > 5), so it should be preferred when available; this is not the cause.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The health-check for Member1 is configured with 'set probe-mode passive' and 'set update-static-route disable'.

Option B is correct because when 'set probe-mode passive' is configured, the health-check server only monitors the link without actively generating probe traffic, and 'set update-static-route disable' prevents the static route associated with Member1 from being re-enabled after the link is restored. This means the route remains inactive, so SD-WAN cannot fail back to Member1 even though the physical link is up.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The static route for Member1 has a higher administrative distance than Member2.
Why it's wrong here
SD-WAN member selection does not rely on static route distance; it uses SD-WAN rules and health-check status.
✓
The health-check for Member1 is configured with 'set probe-mode passive' and 'set update-static-route disable'.
Why this is correct
Passive monitoring does not trigger fallback; update-static-route must be enabled for the route to be reinstated when the link recovers.
Clue confirmation
The clue words "best", "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
The SD-WAN rule is configured with 'set fallback' disabled.
Why it's wrong here
There is no 'fallback' setting in SD-WAN rules; fallback is controlled by health-check and route updates.
✗
The priority of Member2 is higher than Member1.
Why it's wrong here
Member1 has higher priority (10 > 5), so it should be preferred when available; this is not the cause.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates assume failback is automatic with SD-WAN, but FortiGate requires explicit configuration of route updates or probe modes to re-enable a restored link; the 'best quality' strategy alone does not handle failback without proper health-check settings.

Detailed technical explanation

How to think about this question

In FortiGate SD-WAN, the 'best quality' strategy uses SLA metrics from health-check probes to select the best member. When 'set probe-mode passive' is used, the health-check relies on existing traffic to measure quality, and 'set update-static-route disable' ensures the static route is not dynamically added/removed based on link status. This combination is often used to avoid route flapping, but it prevents automatic failback unless the administrator manually re-enables the route or changes the configuration.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A practitioner preparing for the NSE7 exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related NSE7 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Advanced Networking and SD-WAN practice questions

Practise NSE7 questions linked to Advanced Networking and SD-WAN.

Advanced VPN and Zero Trust practice questions

Practise NSE7 questions linked to Advanced VPN and Zero Trust.

Enterprise Firewall and VDOMs practice questions

Practise NSE7 questions linked to Enterprise Firewall and VDOMs.

Advanced Threat Protection practice questions

Practise NSE7 questions linked to Advanced Threat Protection.

Troubleshooting and Diagnostics practice questions

Practise NSE7 questions linked to Troubleshooting and Diagnostics.

NSE7 fundamentals practice questions

Practise NSE7 questions linked to NSE7 fundamentals.

NSE7 scenario practice questions

Practise NSE7 questions linked to NSE7 scenario.

NSE7 troubleshooting practice questions

Practise NSE7 questions linked to NSE7 troubleshooting.

Practice this exam

Start a free NSE7 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

NSE7 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this NSE7 question test?

Advanced Networking and SD-WAN — This question tests Advanced Networking and SD-WAN — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: The health-check for Member1 is configured with 'set probe-mode passive' and 'set update-static-route disable'. — Option B is correct because when 'set probe-mode passive' is configured, the health-check server only monitors the link without actively generating probe traffic, and 'set update-static-route disable' prevents the static route associated with Member1 from being re-enabled after the link is restored. This means the route remains inactive, so SD-WAN cannot fail back to Member1 even though the physical link is up.

What should I do if I get this NSE7 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Are there clue words in this question I should notice?

Yes — watch for: "best", "most likely". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more ways this is tested on NSE7

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A FortiGate is configured with two WAN members in an SD-WAN zone. The performance SLA monitors latency to a probe server. The rule uses 'best quality' strategy. After some time, one member fails the SLA. Which action does the FortiGate take for existing sessions that were using that member?

hard

A.All sessions are dropped and the member is removed from the zone
B.Existing sessions are re-evaluated and may be moved based on policy
C.Existing sessions are immediately moved to another member
✓ D.Existing sessions continue on the failed member until they timeout

Why D: When a member fails the SLA, only new sessions are redirected to other members that meet the SLA. Existing sessions continue on the failed member until they expire or are terminated. The 'best quality' strategy does not preemptively move existing sessions.

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.