Advanced Networking and SD-WAN practice questions

Study all Advanced Networking and SD-WAN common traps →

A network administrator is configuring SD-WAN on a FortiGate. The organization has two internet links: MPLS (primary) and broadband (backup). The administrator wants all traffic to use the MPLS link unless it fails, in which case traffic should fail over to the broadband link. Which SD-WAN configuration best achieves this requirement?

Trap 1: Enable 'set role' on the MPLS link as 'primary' and on the…

FortiGate SD-WAN does not have a 'role' setting or 'redundant' strategy; these are not valid options.

Trap 2: Configure both links in the SD-WAN zone with equal priority and use…

Equal priority would not enforce active/passive behavior; traffic might be load-balanced. The 'lowest cost' strategy is not the primary method for failover.

Trap 3: Create two static routes: one with higher distance for MPLS and one…

Static route distance is not used for SD-WAN member selection; SD-WAN rules use priorities and strategies.

A
Set the MPLS link priority to 10 and the broadband link priority to 5, then configure an SD-WAN rule with the 'best quality' strategy.
Higher priority for MPLS ensures it is preferred. The 'best quality' strategy selects the member with the highest priority when available, providing failover.
B
Enable 'set role' on the MPLS link as 'primary' and on the broadband link as 'standby' with the 'redundant' strategy.
Why wrong: FortiGate SD-WAN does not have a 'role' setting or 'redundant' strategy; these are not valid options.
C
Configure both links in the SD-WAN zone with equal priority and use the 'lowest cost' strategy.
Why wrong: Equal priority would not enforce active/passive behavior; traffic might be load-balanced. The 'lowest cost' strategy is not the primary method for failover.
D
Create two static routes: one with higher distance for MPLS and one with lower distance for broadband.
Why wrong: Static route distance is not used for SD-WAN member selection; SD-WAN rules use priorities and strategies.

Question 2mediummultiple choice

Study all Advanced Networking and SD-WAN common traps →

A FortiGate is configured with SD-WAN and has two WAN members: Member1 (ISP1) with priority 10, and Member2 (ISP2) with priority 5. The SD-WAN rule for traffic from the internal network uses the 'best quality' strategy. During normal operation, traffic flows through Member1. After a link failure on Member1, traffic correctly fails over to Member2. However, when Member1 is restored, traffic does not fail back. What is the most likely cause?

Trap 1: The static route for Member1 has a higher administrative distance…

SD-WAN member selection does not rely on static route distance; it uses SD-WAN rules and health-check status.

Trap 2: The SD-WAN rule is configured with 'set fallback' disabled.

There is no 'fallback' setting in SD-WAN rules; fallback is controlled by health-check and route updates.

Trap 3: The priority of Member2 is higher than Member1.

Member1 has higher priority (10 > 5), so it should be preferred when available; this is not the cause.

A
The static route for Member1 has a higher administrative distance than Member2.
Why wrong: SD-WAN member selection does not rely on static route distance; it uses SD-WAN rules and health-check status.
B
The health-check for Member1 is configured with 'set probe-mode passive' and 'set update-static-route disable'.
Passive monitoring does not trigger fallback; update-static-route must be enabled for the route to be reinstated when the link recovers.
C
The SD-WAN rule is configured with 'set fallback' disabled.
Why wrong: There is no 'fallback' setting in SD-WAN rules; fallback is controlled by health-check and route updates.
D
The priority of Member2 is higher than Member1.
Why wrong: Member1 has higher priority (10 > 5), so it should be preferred when available; this is not the cause.

Question 3hardmultiple choice

Study all Advanced Networking and SD-WAN common traps →

An enterprise uses FortiGate as an SD-WAN edge device with three WAN links: Link A (MPLS), Link B (broadband), and Link C (LTE). The SD-WAN rule for VoIP traffic uses the 'best quality' strategy with link-quality-measurement enabled. The VoIP traffic is routed via Link A. During peak hours, users report poor voice quality. The administrator checks the SD-WAN performance SLA logs and sees that Link A's jitter and latency are within acceptable thresholds, but packet loss is slightly elevated. Which action would most likely improve VoIP quality without manual intervention?

Trap 1: Increase the priority of Link A to ensure it remains the preferred…

Increasing priority would not address the performance degradation; it would keep traffic on Link A despite poor quality.

Trap 2: Disable link-quality-measurement to reduce overhead on Link A.

Disabling link-quality-measurement would remove the ability to monitor performance, not improve it.

Trap 3: Add a new SD-WAN rule with 'lowest cost' strategy for VoIP traffic.

Lowest cost strategy does not consider quality; it would not improve voice quality.

A
Increase the priority of Link A to ensure it remains the preferred link.
Why wrong: Increasing priority would not address the performance degradation; it would keep traffic on Link A despite poor quality.
B
Configure a performance SLA for VoIP traffic with jitter < 10ms, latency < 100ms, and packet-loss < 0.5% and apply it to the SD-WAN rule.
Applying a performance SLA with strict thresholds will cause the SD-WAN rule to select a link that meets the criteria, switching away from Link A if it fails the SLA.
C
Disable link-quality-measurement to reduce overhead on Link A.
Why wrong: Disabling link-quality-measurement would remove the ability to monitor performance, not improve it.
D
Add a new SD-WAN rule with 'lowest cost' strategy for VoIP traffic.
Why wrong: Lowest cost strategy does not consider quality; it would not improve voice quality.

Question 4mediummulti select

Study all Advanced Networking and SD-WAN common traps →

Which THREE statements are true about FortiGate SD-WAN health-check configuration?

Trap 1: Health-check probes can be sent from any interface, including…

Health-check probes are sent from the SD-WAN member interfaces themselves, not from loopback.

Trap 2: Health-check can only be configured on physical interfaces, not…

Health-check can be configured on any SD-WAN member, including VLANs and subinterfaces.

A
Health-check probes can be sent from any interface, including loopback.
Why wrong: Health-check probes are sent from the SD-WAN member interfaces themselves, not from loopback.
B
Health-check can only be configured on physical interfaces, not VLANs or subinterfaces.
Why wrong: Health-check can be configured on any SD-WAN member, including VLANs and subinterfaces.
C
Health-check can be configured with multiple thresholds for jitter, latency, and packet loss.
Performance SLA thresholds can be defined for jitter, latency, and packet loss.
D
Health-check can update the routing table by setting 'update-static-route' to enable fallback.
When enabled, health-check failure can remove the static route, and recovery can re-add it.
E
Health-check can be configured to use HTTP or DNS protocols to verify link health.
HTTP and DNS are valid protocol options for health-check probes.

Question 5hardmulti select

Study all Advanced Networking and SD-WAN common traps →

Which TWO statements correctly describe the behavior of SD-WAN rules when using the 'maximize-bandwidth' strategy?

Trap 1: The strategy ensures that all traffic uses the member with the…

Maximize-bandwidth spreads traffic across all eligible members to utilize total bandwidth, not just the highest bandwidth.

Trap 2: Traffic from a single session can be split across multiple members…

Session traffic is not split; each session is assigned to a single member.

Trap 3: Traffic is distributed based on session count to keep each link…

Maximize-bandwidth uses weight or volume-based load balancing, not session count.

A
The strategy ensures that all traffic uses the member with the highest bandwidth.
Why wrong: Maximize-bandwidth spreads traffic across all eligible members to utilize total bandwidth, not just the highest bandwidth.
B
The administrator can assign different weights to members to influence the proportion of traffic each handles.
Weights can be set per member to control the load-balancing ratio.
C
If a member fails its health-check, it is removed from the set of eligible members for the rule.
Health-check failure marks the member as dead, and it is not considered for traffic distribution.
D
Traffic from a single session can be split across multiple members for better performance.
Why wrong: Session traffic is not split; each session is assigned to a single member.
E
Traffic is distributed based on session count to keep each link equally utilized.
Why wrong: Maximize-bandwidth uses weight or volume-based load balancing, not session count.

Review the full OSPF breakdown →

Question 6hardmultiple choice

A FortiGate is deployed with two ISPs and SD-WAN. The organization uses OSPF to exchange routes with a remote branch. The administrator notices that the FortiGate is not installing OSPF-learned routes into the routing table. The OSPF configuration is verified to be correct, and neighbors are established. Which configuration could be causing the issue?

Trap 1: The SD-WAN health-check is configured with 'update-static-route'…

Health-check updates static routes, not OSPF routes.

Trap 2: The administrative distance of OSPF is set to 200, which is higher…

Even if distance is 200, OSPF routes would still be installed unless there is a conflict with another route of lower distance. Since no other route exists, they should be installed.

Trap 3: The OSPF interface is configured as 'passive', which prevents route…

A passive interface does not send or receive OSPF packets; neighbors would not form, but the question states neighbors are established.

Study all Advanced Networking and SD-WAN common traps →

A
The SD-WAN health-check is configured with 'update-static-route' and is overriding OSPF routes.
Why wrong: Health-check updates static routes, not OSPF routes.
B
The administrative distance of OSPF is set to 200, which is higher than the default 110.
Why wrong: Even if distance is 200, OSPF routes would still be installed unless there is a conflict with another route of lower distance. Since no other route exists, they should be installed.
C
A distribute-list configured under OSPF is filtering the routes from being installed.
A distribute-list in OSPF can filter which routes are installed into the routing table, even if neighbors are up.
D
The OSPF interface is configured as 'passive', which prevents route exchange.
Why wrong: A passive interface does not send or receive OSPF packets; neighbors would not form, but the question states neighbors are established.

Question 7mediummultiple choice

Study all Advanced Networking and SD-WAN common traps →

An organization is deploying SD-WAN across multiple sites with two internet links (MPLS and broadband) at the main branch. They want voice traffic to use the MPLS link unless it fails, in which case failover to broadband should occur. Which SD-WAN rule configuration achieves this?

Trap 1: Configure an SD-WAN rule for voice with strategy 'maximize…

Maximize bandwidth spreads traffic, not failover.

Trap 2: Configure an SD-WAN rule for voice with strategy 'lowest cost' and…

Lowest cost may route voice to broadband if cheaper, not preferred.

Trap 3: Configure an SD-WAN rule for voice with strategy 'manual' and…

Manual strategy requires manual link selection.

A
Configure an SD-WAN rule for voice with strategy 'maximize bandwidth' and members MPLS and broadband.
Why wrong: Maximize bandwidth spreads traffic, not failover.
B
Configure an SD-WAN rule for voice with strategy 'lowest cost' and members MPLS and broadband.
Why wrong: Lowest cost may route voice to broadband if cheaper, not preferred.
C
Configure an SD-WAN rule for voice with strategy 'best quality', set MPLS as preferred member, and define SLA targets for MPLS.
Best quality with preferred member and SLA ensures MPLS used unless SLA fails.
D
Configure an SD-WAN rule for voice with strategy 'manual' and members MPLS and broadband.
Why wrong: Manual strategy requires manual link selection.

Question 8hardmultiple choice

Study all Advanced Networking and SD-WAN common traps →

A network engineer is troubleshooting an SD-WAN setup where traffic from a specific subnet is not being load-balanced as expected. The SD-WAN rule uses 'source IP' hashing. The engineer notices that the traffic originates from multiple hosts in the same /24 subnet. What is the most likely cause of poor load distribution?

Trap 1: The SD-WAN rule is not matching the traffic.

If rule not matching, traffic wouldn't be load-balanced at all.

Trap 2: The SD-WAN members have different bandwidths.

Bandwidth differences affect load but not distribution by hash.

Trap 3: Traffic is using a single destination IP and port.

Source IP hashing ignores destination/port; source IP alone determines.

A
The SD-WAN rule is not matching the traffic.
Why wrong: If rule not matching, traffic wouldn't be load-balanced at all.
B
The SD-WAN members have different bandwidths.
Why wrong: Bandwidth differences affect load but not distribution by hash.
C
Traffic is using a single destination IP and port.
Why wrong: Source IP hashing ignores destination/port; source IP alone determines.
D
The source IP hashing algorithm causes multiple hosts in the same subnet to map to the same member.
Source IP hashing can lead to poor distribution for similar IPs.

Question 9easymultiple choice

Study all Advanced Networking and SD-WAN common traps →

A FortiGate is configured with two static routes to the same destination 0.0.0.0/0 with equal distance but different priorities. The priority values are 10 and 20. Which route will be used for traffic matching the default route?

Trap 1: The route with priority 20 will be used.

Higher priority number is lower preference.

Trap 2: The route with lower distance will be used.

Distance is equal, so not a factor.

Trap 3: Both routes will be used for load balancing.

Equal distance but different priority; only the higher priority route is used.

A
The route with priority 20 will be used.
Why wrong: Higher priority number is lower preference.
B
The route with lower distance will be used.
Why wrong: Distance is equal, so not a factor.
C
The route with priority 10 will be used.
Priority 10 is higher preference than 20.
D
Both routes will be used for load balancing.
Why wrong: Equal distance but different priority; only the higher priority route is used.

Open the full BGP breakdown →

Question 10hardmulti select

Which TWO statements are true regarding BGP path selection in a FortiGate SD-WAN environment?

Trap 1: SD-WAN cannot be applied to routes learned via BGP.

SD-WAN can be applied to any route.

Trap 2: SD-WAN can modify BGP MED values to influence path selection.

SD-WAN does not modify BGP attributes.

Trap 3: SD-WAN rules always follow the BGP best path selection.

SD-WAN rules can override BGP best path.

Study all Advanced Networking and SD-WAN common traps →

A
BGP best path selection is independent of SD-WAN rules unless explicitly overridden.
BGP selects best path; SD-WAN can apply rules after.
B
SD-WAN cannot be applied to routes learned via BGP.
Why wrong: SD-WAN can be applied to any route.
C
SD-WAN can modify BGP MED values to influence path selection.
Why wrong: SD-WAN does not modify BGP attributes.
D
SD-WAN rules always follow the BGP best path selection.
Why wrong: SD-WAN rules can override BGP best path.
E
SD-WAN can use BGP community values as match criteria in SD-WAN rules.
BGP communities can be matched in SD-WAN rules.

Question 11mediummultiple choice

Study all Advanced Networking and SD-WAN common traps →

A company with a hub-and-spoke SD-WAN topology uses FortiGates at each site. The hub has two WAN links: MPLS (10 Mbps) and broadband (100 Mbps). The spokes connect only via MPLS. The company deploys a new real-time application that requires low latency and low jitter. The network administrator creates an SD-WAN rule for this application with 'best quality' strategy and both MPLS and broadband as members. The SLA for MPLS is configured with latency < 10 ms and jitter < 5 ms. The SLA for broadband is configured with latency < 50 ms and jitter < 20 ms. The actual measured latency on MPLS is 12 ms, and jitter is 4 ms. The broadband latency is 25 ms, jitter 10 ms. Which path will the application traffic take?

Trap 1: The traffic will be load-balanced between MPLS and broadband.

Best quality strategy does not load balance.

Trap 2: The traffic will use the MPLS link because it is the preferred…

Preferred member only applies if SLA is met; here it fails.

Trap 3: The traffic will be dropped because no link meets the SLA.

Broadband meets its SLA.

A
The traffic will use the broadband link because MPLS SLA fails and broadband SLA is met.
SD-WAN failover to broadband.
B
The traffic will be load-balanced between MPLS and broadband.
Why wrong: Best quality strategy does not load balance.
C
The traffic will use the MPLS link because it is the preferred member.
Why wrong: Preferred member only applies if SLA is met; here it fails.
D
The traffic will be dropped because no link meets the SLA.
Why wrong: Broadband meets its SLA.

Question 12mediummulti select

Study all Advanced Networking and SD-WAN common traps →

An administrator is configuring SD-WAN on a FortiGate to route traffic between two internet connections (ISP1 and ISP2). The SD-WAN rules use performance SLA to measure latency. Which TWO statements are true about SD-WAN rule matching and failover?

Trap 1: SD-WAN automatically fails over all sessions to the backup member…

Incorrect. SD-WAN failover affects only new sessions; existing sessions are not automatically moved unless the session is part of a persistent session or a static route is used.

Trap 2: If multiple SD-WAN rules match, the rule with the highest bandwidth…

Incorrect. SD-WAN rules are evaluated in order; the first matching rule is used, not the one with highest bandwidth.

Trap 3: When the SD-WAN rule action is set to 'lowest cost' and no member…

Incorrect. With 'lowest cost' and no SLA met, the FortiGate still forwards traffic using the member with the lowest cost, but it logs a warning.

A
When the SD-WAN rule action is set to 'best quality' and no member meets the SLA, the FortiGate will still forward traffic using the member with the best SLA status.
Correct. If no member meets the SLA, the FortiGate uses the member with the best SLA status (least bad) to forward traffic.
B
SD-WAN rules can use multiple members and the best member is selected based on performance SLA measurements.
Correct. SD-WAN rules can have multiple members and the best member is chosen based on the configured strategy (e.g., best quality, lowest cost) and SLA status.
C
SD-WAN automatically fails over all sessions to the backup member if the primary member exceeds the SLA threshold.
Why wrong: Incorrect. SD-WAN failover affects only new sessions; existing sessions are not automatically moved unless the session is part of a persistent session or a static route is used.
D
If multiple SD-WAN rules match, the rule with the highest bandwidth member is used.
Why wrong: Incorrect. SD-WAN rules are evaluated in order; the first matching rule is used, not the one with highest bandwidth.
E
When the SD-WAN rule action is set to 'lowest cost' and no member meets the SLA, the FortiGate drops the traffic.
Why wrong: Incorrect. With 'lowest cost' and no SLA met, the FortiGate still forwards traffic using the member with the lowest cost, but it logs a warning.

Question 13easymultiple choice

Study all Advanced Networking and SD-WAN common traps →

A company has two internet connections: a primary fiber link (port1, 100 Mbps) and a backup DSL link (port2, 20 Mbps). They are using SD-WAN to load balance traffic based on volume, with a rule that sends 70% of traffic to port1 and 30% to port2. Recently, users report that video conferencing applications are experiencing high latency and jitter. The network team finds that the SD-WAN performance SLA for the fiber link shows 80% packet loss and high latency. The SD-WAN rule action is set to 'best quality' with a latency threshold of 150 ms. The current latency on port1 is 200 ms, and on port2 is 40 ms. What should the administrator do to ensure that video conferencing traffic uses the DSL link while the fiber link is degraded?

Trap 1: Increase the SLA latency threshold to 250 ms so that the fiber link…

Incorrect. This would allow the degraded link to be used, which would not solve the performance issue.

Trap 2: Change the SD-WAN rule action to 'lowest cost' to favor the DSL…

Incorrect. 'Lowest cost' ignores SLA status and uses cost-based selection, which would still prefer the fiber link if its cost is lower.

Trap 3: Adjust the volume ratio to send 100% of traffic to port2 until the…

Incorrect. This is a manual workaround but not necessary; the SLA mechanism already redirects traffic based on performance.

A
Increase the SLA latency threshold to 250 ms so that the fiber link is considered acceptable.
Why wrong: Incorrect. This would allow the degraded link to be used, which would not solve the performance issue.
B
Change the SD-WAN rule action to 'lowest cost' to favor the DSL link.
Why wrong: Incorrect. 'Lowest cost' ignores SLA status and uses cost-based selection, which would still prefer the fiber link if its cost is lower.
C
Adjust the volume ratio to send 100% of traffic to port2 until the fiber link recovers.
Why wrong: Incorrect. This is a manual workaround but not necessary; the SLA mechanism already redirects traffic based on performance.
D
No changes are needed; the SD-WAN rule with 'best quality' will automatically use port2 for new sessions because port1 does not meet the SLA.
Correct. With 'best quality' action, if a member fails SLA, new sessions will be directed to the best performing member.

Read the full VPN explanation →

Question 14mediumdrag order

Drag and drop the steps to troubleshoot a FortiGate SSL VPN connection failure into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 15mediumdrag order

Read the full VPN explanation →

Drag and drop the steps to configure a FortiGate to use an external authentication server (e.g., RADIUS) for admin login into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 16mediummatching

Match each IPsec VPN term to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Internet Key Exchange version 1

Internet Key Exchange version 2

Encapsulating Security Payload

Authentication Header

Perfect Forward Secrecy

Question 17mediummatching

Match each FortiGate interface type to its usage.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Hardware network port

Virtual LAN subinterface

Virtual interface for management or routing

Combines multiple physical links for redundancy

Link aggregation (LAG) for increased bandwidth

Question 18mediummultiple choice

Study all Advanced Networking and SD-WAN common traps →

A network engineer is configuring SD-WAN on a FortiGate. They have three WAN interfaces (wan1, wan2, lte) and want traffic to the primary datacenter (10.10.10.0/24) to use wan1 unless its latency exceeds 50 ms, in which case failover to wan2. The engineer created an SD-WAN rule with a strategy of 'Manual' and selected 'wan1' as the preferred member. What additional configuration is required to achieve automatic failover based on latency?

Trap 1: Create a route map to prefer wan1 and apply it to the SD-WAN rule.

Route maps are for routing policy, not for SD-WAN failover based on SLA metrics.

Trap 2: Set the SD-WAN rule strategy to 'Best Quality' and select latency…

Best Quality strategy would automatically select the best member based on SLA metrics, but the engineer wants a manual preference with SLA-based failover.

Trap 3: Enable BFD on wan1 and wan2 with a minimum interval of 50 ms.

BFD detects link failures but does not measure latency; it is used for fast convergence, not for SLA-based failover.

A
Create a route map to prefer wan1 and apply it to the SD-WAN rule.
Why wrong: Route maps are for routing policy, not for SD-WAN failover based on SLA metrics.
B
Set the SD-WAN rule strategy to 'Best Quality' and select latency as the metric.
Why wrong: Best Quality strategy would automatically select the best member based on SLA metrics, but the engineer wants a manual preference with SLA-based failover.
C
Enable BFD on wan1 and wan2 with a minimum interval of 50 ms.
Why wrong: BFD detects link failures but does not measure latency; it is used for fast convergence, not for SLA-based failover.
D
Configure a performance SLA for wan1 with a latency threshold of 50 ms and associate it with the SD-WAN rule.
The performance SLA measures latency and triggers failover when the threshold is exceeded.

Review the full OSPF breakdown →

Question 19hardmultiple choice

A FortiGate is running OSPF with multiple areas. The admin wants to redistribute a static route for 192.168.100.0/24 into OSPF. After configuring 'config router ospf' with 'redistribute static' enabled, the route appears in the OSPF database but is not being advertised to other areas. What is the most likely cause?

Trap 1: The 'redistribute static' command needs a route map to filter the…

A route map is optional; the route appears in the database, so filtering is not the issue.

Trap 2: The static route's administrative distance is too high for OSPF.

Administrative distance does not affect redistribution into OSPF.

Trap 3: OSPF must be configured with 'default-information originate' to…

That command is for originating a default route, not for redistributing specific static routes.

Study all Advanced Networking and SD-WAN common traps →

A
The 'redistribute static' command needs a route map to filter the route correctly.
Why wrong: A route map is optional; the route appears in the database, so filtering is not the issue.
B
The static route's administrative distance is too high for OSPF.
Why wrong: Administrative distance does not affect redistribution into OSPF.
C
The router is an ABR and the static route is being redistributed as a type 5 LSA, which is not flooded into stub areas.
Type 5 LSAs are blocked in stub areas. To redistribute into stub areas, the route must be advertised as a type 7 LSA.
D
OSPF must be configured with 'default-information originate' to allow redistribution.
Why wrong: That command is for originating a default route, not for redistributing specific static routes.

Question 20easymultiple choice

Study all Advanced Networking and SD-WAN common traps →

An administrator wants to load balance traffic across two ISP links using SD-WAN. The requirement is that sessions from the same source IP address must always use the same ISP link. Which SD-WAN load balancing algorithm should be used?

Trap 1: Sessions

Sessions algorithm distributes sessions evenly, but does not guarantee source IP stickiness.

Trap 2: Volume

Volume algorithm balances based on actual traffic volume, not session persistence.

Trap 3: Spillover

Spillover sends traffic to a secondary link when the primary exceeds a threshold.

A
Source-destination IP
This algorithm hashes source and destination IP to consistently select the same member for flows between the same two hosts.
B
Sessions
Why wrong: Sessions algorithm distributes sessions evenly, but does not guarantee source IP stickiness.
C
Volume
Why wrong: Volume algorithm balances based on actual traffic volume, not session persistence.
D
Spillover
Why wrong: Spillover sends traffic to a secondary link when the primary exceeds a threshold.