I85PREP
⌘ K
FCSS SD-WAN 7.4 Architect study materials
FCSS SD-WAN 7.4 Architect study resources

FCSS SD-WAN 7.4 Architect practice questions

One question at a time. Build your FCSS SD-WAN 7.4 Architect understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Secure SD-WAN Deployment

In a FortiGate SD-WAN deployment, which configuration object defines the set of WAN links that participate in SD-WAN steering decisions?

  1. Firewall address objects for each WAN gateway
  2. SD-WAN members, one per participating interface Correct answer.
  3. IPsec phase 1 proposals
  4. Static routes with equal distance

Explanation

SD-WAN members are declared under the SD-WAN interface configuration, each binding a physical or logical interface to the SD-WAN overlay. Only interfaces listed as members are eligible for rule-based steering and SLA health checks. Static routes and address objects do not enroll an interface as an SD-WAN member.

Question 2Secure SD-WAN Deployment

A FortiGate SD-WAN rule uses the 'lowest cost' strategy with two members that both meet their SLA. What determines which member carries the traffic?

  1. The member with the lowest latency measurement
  2. The member with the lowest configured priority value Correct answer.
  3. The member with the highest measured bandwidth
  4. The member listed first in the SD-WAN member table

Explanation

In the lowest-cost strategy, FortiGate compares the configured cost (priority) of members that satisfy the SLA and selects the lowest value. Latency and bandwidth are SLA criteria, not the tie-breaker for lowest cost. Order in the member table does not override configured cost.

Question 3Secure SD-WAN Deployment

Which FortiGate feature must be enabled for SD-WAN rules to steer traffic based on application signatures rather than only address and port?

  1. Application control on the matching firewall policy Correct answer.
  2. Virtual clustering on the HA pair
  3. DNS filter on the SD-WAN zone
  4. Explicit web proxy on each WAN interface

Explanation

Application-based SD-WAN rules depend on application control inspection to identify the application. The firewall policy referencing the SD-WAN zone must include an application control profile so sessions can be classified. Proxy, DNS filter, and HA virtual clustering do not provide application identification for steering.

Question 4Secure SD-WAN Deployment

What is the purpose of an SD-WAN zone?

  1. To group member interfaces so policies and rules can reference them as one logical object Correct answer.
  2. To encrypt traffic between SD-WAN members
  3. To assign DHCP scopes to WAN interfaces
  4. To define the IPsec phase 2 selectors

Explanation

An SD-WAN zone groups multiple member interfaces under a single named object. Firewall policies and SD-WAN rules can then reference the zone instead of individual interfaces, simplifying configuration changes. Zones do not perform encryption, DHCP assignment, or phase 2 selector definition.

Question 5Secure SD-WAN Deployment

An administrator wants SD-WAN to fail over from a primary link to a backup link when the primary link's latency exceeds 150 ms. Which configuration element expresses this requirement?

  1. A health check with an SLA target of 150 ms latency referenced by the SD-WAN rule Correct answer.
  2. A traffic shaper with a guaranteed bandwidth of 150 kbps
  3. A DoS policy with a threshold of 150 packets per second
  4. A static route with a distance of 150

Explanation

SLA targets are defined in a performance SLA (health check) object, such as latency, jitter, and packet loss thresholds. The SD-WAN rule references that health check to decide which members are eligible. Route distance, traffic shaping, and DoS thresholds do not measure link latency.

Question 6Secure SD-WAN Deployment

Which protocol can a FortiGate performance SLA health check use to probe a target server?

  1. Only BGP keepalives
  2. Only ICMP echo
  3. Only DNS queries
  4. ICMP echo, TCP connect, HTTP, or UDP echo Correct answer.

Explanation

FortiGate performance SLA health checks support several probe types, including ping (ICMP), TCP connect, HTTP/HTTPS, UDP echo, and DNS. This lets the administrator choose a probe that reflects the actual application path. Restricting to a single protocol would not cover typical SD-WAN monitoring needs.

Question 7Secure SD-WAN Deployment

A FortiGate has two SD-WAN members and the administrator wants traffic to use both links simultaneously for a single application flow. Which SD-WAN rule configuration accomplishes this?

  1. Enable asymmetric routing on both interfaces
  2. Set the rule strategy to lowest cost with one member
  3. Disable health checks on both members
  4. Enable forwarding of the rule to multiple members with a load-balance strategy Correct answer.

Explanation

Selecting multiple members in an SD-WAN rule with a load-balancing strategy allows per-session distribution across the links. Lowest cost with a single member pins traffic to one link. Asymmetric routing and disabled health checks do not create load balancing.

Question 8Secure SD-WAN Deployment

What does the 'implicit' SD-WAN rule do when no explicit SD-WAN rule matches a session?

  1. It forces all traffic to the first member
  2. It bypasses SD-WAN and uses only static routes
  3. It applies the default load-balancing behavior defined by the implicit rule Correct answer.
  4. It drops all unmatched sessions

Explanation

The implicit rule is the fallback for traffic that matches no explicit rule. Its default behavior load-balances across members according to its configured strategy, and it can be edited but not deleted. It does not silently drop traffic or force a single member unless configured that way.

Question 9Secure SD-WAN Deployment

Which statement describes how FortiGate SD-WAN integrates with ADVPN?

  1. ADVPN replaces SD-WAN rules entirely
  2. SD-WAN can select among ADVPN shortcuts as members to steer traffic over the best tunnel path Correct answer.
  3. SD-WAN disables IPsec offload on all shortcuts
  4. ADVPN shortcuts are only usable with static routes

Explanation

ADVPN establishes dynamic shortcuts between spokes, and SD-WAN can treat those shortcuts as members so rules choose the best path. ADVPN complements rather than replaces SD-WAN steering. Shortcuts are usable through normal routing and SD-WAN, and SD-WAN does not inherently disable IPsec offload.

Question 10Secure SD-WAN Deployment

In a hub-and-spoke SD-WAN design, which capability lets the hub advertise overlay routes to spokes so that SD-WAN can steer traffic across the overlay?

  1. LLDP neighbor discovery
  2. NetFlow export
  3. DHCP relay
  4. BGP peering over the IPsec overlay tunnels Correct answer.

Explanation

Overlay routing is typically achieved with BGP sessions running over the IPsec tunnels, allowing the hub to advertise prefixes and next hops to spokes. SD-WAN rules then select among overlay members. LLDP, NetFlow, and DHCP relay do not exchange overlay routing information.

Question 11Secure SD-WAN Deployment

Which FortiGate SD-WAN rule action sends matching traffic out through a specific IPsec tunnel member regardless of SLA status?

  1. Configuring a blackhole route
  2. Selecting that member as the sole member with a manual strategy Correct answer.
  3. Setting the rule to 'maximize bandwidth' with all members
  4. Enabling the implicit rule

Explanation

Pinning traffic to a specific member is done by selecting only that member in the rule, typically with a manual or lowest-cost strategy where it is the only candidate. The implicit rule is a fallback, blackhole routes discard traffic, and maximize-bandwidth considers all members.

Question 12Secure SD-WAN Deployment

What is the role of the 'passive' measurement mode in a FortiGate performance SLA?

  1. It sends probes only when the link is idle
  2. It converts active probes to ICMP only
  3. It measures SLA using existing session traffic instead of active probes Correct answer.
  4. It disables all SLA measurement

Explanation

Passive mode derives SLA metrics from live traffic rather than generating probe packets. This reduces probe overhead and reflects real application experience. It does not disable measurement, restrict probing to idle periods, or force ICMP.

Question 13Secure SD-WAN Deployment

Which SD-WAN member setting determines the order in which members are preferred under the lowest-cost strategy?

  1. The cost value configured on the member Correct answer.
  2. The MAC address of the gateway
  3. The DHCP lease time
  4. The interface MTU

Explanation

Each member has a configurable cost, and the lowest-cost strategy prefers members with lower cost values among those meeting SLA. MTU, gateway MAC address, and DHCP lease time do not influence member preference.

Question 14Secure SD-WAN Deployment

An administrator needs SD-WAN to prefer a member only when packet loss is below 1 percent and latency below 80 ms. Where are these thresholds configured?

  1. In the global system settings
  2. In the interface's DHCP settings
  3. In the firewall policy's security profiles
  4. In the performance SLA object referenced by the SD-WAN rule Correct answer.

Explanation

Latency, jitter, and packet loss thresholds are defined in the performance SLA (health check) object. The SD-WAN rule references this SLA to determine member eligibility. Security profiles, DHCP settings, and global settings do not define link-quality thresholds.

Question 15Secure SD-WAN Deployment

Which statement about SD-WAN and static routes on a FortiGate is accurate?

  1. Static routes must be deleted before SD-WAN can be enabled
  2. SD-WAN rules select the member, and the resulting route must still resolve for the selected interface Correct answer.
  3. SD-WAN members cannot have default routes
  4. SD-WAN rules replace the routing table entirely

Explanation

SD-WAN steering chooses an egress member, but the FortiGate still needs a route that resolves through that member's interface for the destination. SD-WAN does not eliminate the routing table, and static routes need not be removed. Members can carry default routes.

Question 16Secure SD-WAN Deployment

What does the SD-WAN 'SLA target' evaluation produce for a member that fails its health check?

  1. The member is converted to a backup static route
  2. The member's IP address is released
  3. The member is marked out of SLA and excluded from rules that require SLA compliance Correct answer.
  4. The member is administratively disabled

Explanation

When a member fails the SLA thresholds, it is flagged as out of SLA and rules that require SLA compliance stop selecting it, enabling failover. The interface is not disabled, its address is not released, and no static route conversion occurs.

Question 17Secure SD-WAN Deployment

Which FortiGate SD-WAN rule strategy is best suited to distributing sessions across members in proportion to their measured quality?

  1. Lowest cost
  2. Session-based round robin without SLA
  3. Maximize bandwidth (SLA) Correct answer.
  4. Manual

Explanation

The maximize-bandwidth strategy distributes traffic across SLA-compliant members using their measured bandwidth, favoring higher-quality links. Lowest cost prefers configured cost order, manual pins to chosen members, and round robin ignores quality.

Question 18Secure SD-WAN Deployment

Which object must an SD-WAN rule reference so that its traffic is matched to a firewall policy for inspection?

  1. An IP pool for NAT
  2. A schedule object
  3. A VIP object on the WAN interface
  4. The SD-WAN zone in the firewall policy's incoming interface Correct answer.

Explanation

Firewall policies reference the SD-WAN zone as the incoming interface so that traffic steered by SD-WAN rules is matched and inspected. VIPs, IP pools, and schedules serve other purposes and do not bind SD-WAN traffic to a policy.

Question 19Secure SD-WAN Deployment

A customer wants voice traffic to prefer the MPLS link but fail over to broadband when MPLS latency exceeds the SLA. Which configuration approach fits best?

  1. A traffic shaper on the broadband interface
  2. A static route to the voice server via MPLS only
  3. An SD-WAN rule matching voice with MPLS and broadband members, lowest cost, and a latency SLA Correct answer.
  4. A firewall policy with no SD-WAN rule

Explanation

An SD-WAN rule that matches voice traffic, includes both members, and references a latency SLA lets the MPLS link be preferred while broadband takes over when MPLS fails the SLA. A static route cannot fail over on latency, and a policy without a rule or a shaper does not provide SLA-based steering.

Question 20Secure SD-WAN Deployment

Which statement describes the relationship between SD-WAN members and IPsec tunnels in an overlay design?

  1. Only physical interfaces can be SD-WAN members
  2. Each overlay IPsec tunnel interface can be added as an SD-WAN member Correct answer.
  3. IPsec tunnels cannot be SD-WAN members
  4. SD-WAN members must use public IP addresses

Explanation

Logical interfaces such as IPsec tunnel interfaces can be enrolled as SD-WAN members, allowing rules to steer traffic across overlay tunnels. Physical interfaces are not the only option, and members do not require public addresses.

Question 21Secure SD-WAN Deployment

What is the effect of enabling 'update-static-route' on a FortiGate performance SLA?

  1. It updates the interface IP address when the SLA fails
  2. It refreshes DHCP leases on SLA failure
  3. The FortiGate adjusts the distance of associated static routes based on SLA status Correct answer.
  4. It converts dynamic routes to static routes

Explanation

With update-static-route enabled, the FortiGate modifies the distance of linked static routes so that routes through out-of-SLA members are deprioritized. This supports failover for traffic not handled by SD-WAN rules. It does not convert route types, change IP addresses, or renew DHCP leases.

Question 22Secure SD-WAN Deployment

Which SD-WAN rule match criterion allows steering based on the destination internet service rather than a fixed IP address?

  1. Internet service database (ISDB) objects Correct answer.
  2. FQDN address objects only
  3. Schedule objects
  4. Geographic address groups

Explanation

ISDB objects represent known internet services by IP ranges maintained in the FortiGuard database, allowing rules to match destinations without listing addresses. FQDN objects match names, geographic groups match regions, and schedules match time.

Question 23Secure SD-WAN Deployment

Which FortiGate feature allows an SD-WAN member to be temporarily removed from steering when its health check fails, without deleting the member?

  1. SLA status marking the member out of SLA Correct answer.
  2. Deleting the member from the zone
  3. Removing the member's static route
  4. Disabling the interface permanently

Explanation

Health check results mark a member as in or out of SLA, and rules requiring SLA compliance skip out-of-SLA members automatically. The member configuration stays intact and can return to service when the SLA recovers. Deleting or disabling is destructive and unnecessary.

Question 24Secure SD-WAN Deployment

Which consideration applies when SD-WAN members sit behind NAT devices on the internet?

  1. SD-WAN members must be placed in the same zone as the NAT device
  2. Health checks must use probes that traverse NAT, and overlay tunnels may require NAT traversal settings Correct answer.
  3. NAT automatically disables SD-WAN rules
  4. SLA thresholds cannot be configured behind NAT

Explanation

When members are behind NAT, probe traffic must be able to pass through the NAT device, and IPsec overlays often need NAT traversal enabled. SD-WAN rules and SLA thresholds remain configurable, and zone placement is independent of NAT.

Question 25Secure SD-WAN Deployment

Which statement best describes how FortiGate SD-WAN supports a hybrid WAN design with MPLS, broadband, and LTE?

  1. Only MPLS can be an SD-WAN member
  2. All three links are members of an SD-WAN zone, and rules steer traffic per application and SLA Correct answer.
  3. LTE must be configured as a backup static route only
  4. Hybrid designs require disabling health checks

Explanation

Hybrid WAN designs enroll MPLS, broadband, and LTE links as SD-WAN members in a zone, and rules select members per application using SLA results. Any supported interface type can be a member, LTE can participate directly, and health checks are essential rather than disabled.

Question 26Secure SD-WAN Deployment

In a FortiGate SD-WAN deployment, which interface role is assigned to a WAN link that should be eligible for SD-WAN member selection?

  1. dmz
  2. wan Correct answer.
  3. lan
  4. loopback

Explanation

SD-WAN members are physical or logical interfaces whose role is set to WAN, which makes them selectable in SD-WAN rules and zone membership. LAN, DMZ, and loopback roles are not used as SD-WAN members because they are not treated as outbound internet or WAN paths.

Question 27Secure SD-WAN Deployment

Which SD-WAN component groups multiple member interfaces so that a single firewall policy can reference them together?

  1. redundant interface
  2. hardware switch
  3. SD-WAN zone Correct answer.
  4. virtual wire pair

Explanation

An SD-WAN zone is a logical container holding one or more SD-WAN members, allowing firewall policies and rules to reference the zone rather than each interface. Virtual wire pairs, hardware switches, and redundant interfaces provide different L2 functions and are not SD-WAN steering containers.

Question 28Secure SD-WAN Deployment

Which SD-WAN rule strategy chooses a single member based on the lowest measured cost among members that meet the SLA target?

  1. lowest-cost (SLA) Correct answer.
  2. priority
  3. manual
  4. maximize-bandwidth

Explanation

The lowest-cost strategy ranks members by a computed cost derived from latency, jitter, and packet loss, and only members that satisfy the SLA target are eligible. Manual, priority, and maximize-bandwidth use different selection logic that does not rank by measured SLA cost.

Question 29Secure SD-WAN Deployment

What is the primary purpose of an SD-WAN performance SLA health check in a FortiGate configuration?

  1. To continuously measure member quality and mark members as in or out of SLA Correct answer.
  2. To allocate DHCP addresses to SD-WAN member interfaces
  3. To authenticate IPsec peers before tunnel establishment
  4. To enforce application control signatures on member traffic

Explanation

A performance SLA health check periodically probes a target and compares results against configured latency, jitter, and packet-loss thresholds, marking each member as meeting or failing the SLA. It does not perform IPsec authentication, application control, or DHCP addressing.

Question 30Secure SD-WAN Deployment

Which FortiGate feature lets an administrator forward a copy of SD-WAN traffic to a monitoring appliance without affecting the primary forwarding path?

  1. SD-WAN member priority
  2. SD-WAN rule logging
  3. SD-WAN zone NAT
  4. SD-WAN duplication to a monitor interface Correct answer.

Explanation

SD-WAN duplication can copy matching traffic to a designated monitor interface for analysis while the original traffic continues along its normal path. Zone NAT, rule logging, and member priority change addressing or selection behavior and do not duplicate packets.

Question 31Secure SD-WAN Deployment

Which SD-WAN rule match field would an administrator use to steer traffic based on the application detected by the FortiGate?

  1. Protocol number
  2. Destination port
  3. Application Correct answer.
  4. Source interface

Explanation

SD-WAN rules can match on the application identified by application control, allowing steering of specific applications such as Teams or O365. Source interface, destination port, and protocol number are coarser match criteria that do not identify the application.

Question 32Secure SD-WAN Deployment

Which FortiGate CLI command displays the current SD-WAN health check status of each member?

  1. diagnose netlink interface list
  2. diagnose firewall iprope list
  3. diagnose ip router table
  4. diagnose sys sdwan health-check Correct answer.

Explanation

The diagnose sys sdwan health-check command shows each performance SLA and the per-member status including latency, jitter, and packet loss. The other commands display routing, firewall policy, and interface information unrelated to SD-WAN health checks.

Question 33Secure SD-WAN Deployment

Which statement describes how SD-WAN steering interacts with a firewall policy on a FortiGate?

  1. The firewall policy must reference each member interface individually
  2. The SD-WAN rule replaces the need for a firewall policy
  3. The firewall policy references the SD-WAN zone and permits traffic that the SD-WAN rule then steers Correct answer.
  4. The firewall policy is evaluated after the SD-WAN rule selects the member

Explanation

A firewall policy permits the traffic and references the SD-WAN zone as its destination interface; the SD-WAN rule then determines which member within the zone is used. SD-WAN rules do not replace firewall policy, and individual member references are unnecessary when the zone is used.

Question 34Secure SD-WAN Deployment

An administrator wants SD-WAN to steer Microsoft 365 traffic to the internet link with the best measured quality while keeping other traffic on MPLS. Which pair of configuration elements provides this?

  1. An SD-WAN rule matching the O365 application with lowest-cost strategy, plus a default rule for other traffic Correct answer.
  2. A performance SLA only, with no SD-WAN rules
  3. A single SD-WAN rule with manual strategy for all traffic
  4. A static route for O365 and a policy route for other traffic

Explanation

An application-matched rule with the lowest-cost strategy steers O365 based on measured member quality, and a lower-priority rule or the implicit rule handles remaining traffic. Static routes, policy routes, and a standalone SLA do not provide application-based quality steering.

Question 35Secure SD-WAN Deployment

A FortiGate SD-WAN rule uses the lowest-cost strategy with an SLA target. What happens to a member that exceeds the configured latency threshold?

  1. It is permanently removed from the SD-WAN zone
  2. It is excluded from selection until it meets the SLA again Correct answer.
  3. It is selected only if all other members also fail
  4. It causes the SD-WAN rule to be disabled

Explanation

When a member fails the SLA target it is treated as out of SLA and is not selected by lowest-cost rules while other members satisfy the target; it returns to eligibility once measurements recover. The member remains in the zone and the rule stays enabled.

Question 36Secure SD-WAN Deployment

An administrator wants voice traffic to use the MPLS member and only move to broadband when MPLS fails the SLA. Which configuration achieves this?

  1. A rule with no SLA target and no strategy
  2. A rule with maximize-bandwidth strategy
  3. A rule with lowest-cost strategy and an SLA target, with MPLS and broadband as members Correct answer.
  4. A rule with manual strategy listing broadband first

Explanation

Lowest-cost with an SLA target keeps traffic on the member that best meets the SLA and moves it when the preferred member fails, matching the voice failover requirement. Manual strategy would not react to SLA failure, and maximize-bandwidth ignores the preference for MPLS.

Question 37Secure SD-WAN Deployment

What is the effect of configuring multiple performance SLA entries and referencing them in a single SD-WAN rule?

  1. The rule ignores SLA entries and uses static metrics
  2. The member must satisfy all referenced SLA targets to be considered in SLA Correct answer.
  3. The member satisfies the rule if any one SLA target is met
  4. Only the first SLA entry is evaluated

Explanation

When a rule references multiple performance SLA entries, a member must meet every referenced target to be considered in SLA for that rule. It is not sufficient to satisfy only one, and all entries are evaluated rather than just the first.

Question 38Secure SD-WAN Deployment

Which SD-WAN member configuration is required for the FortiGate to use an IPsec tunnel as an SD-WAN member in an overlay design?

  1. The tunnel interface must be added as an SD-WAN member and assigned the WAN role Correct answer.
  2. The tunnel must use IKEv1 aggressive mode
  3. The tunnel must be converted to a VLAN subinterface
  4. The tunnel must be placed in a hardware switch

Explanation

An IPsec tunnel interface becomes an SD-WAN member when it is added to the SD-WAN configuration with the WAN role, allowing rules and health checks to use it. Converting to VLAN, placing it in a hardware switch, or forcing IKEv1 aggressive mode is not required.

Question 39Secure SD-WAN Deployment

An administrator needs SD-WAN to prefer members based on measured latency, jitter, and packet loss combined. Which strategy directly provides this?

  1. lowest-cost Correct answer.
  2. priority
  3. manual
  4. round-robin

Explanation

The lowest-cost strategy computes a cost from measured latency, jitter, and packet loss and selects the member with the best combined result among those in SLA. Manual, priority, and round-robin do not combine measured quality metrics into a selection cost.

Question 40Secure SD-WAN Deployment

Which SD-WAN rule action should be used when traffic must be dropped if no member meets the SLA target?

  1. Configure the rule to use only in-SLA members and add a deny policy for the zone Correct answer.
  2. Configure the rule with the implicit action
  3. Configure the rule with manual strategy
  4. Configure the rule without an SLA target

Explanation

Restricting the rule to in-SLA members means traffic is not forwarded when no member satisfies the SLA, and a deny policy can enforce the drop. Manual strategy, the implicit action, or removing the SLA target would allow forwarding over failing members.

Question 41Secure SD-WAN Deployment

A FortiGate has SD-WAN members on two ISPs and an administrator wants each new session to alternate between them regardless of quality. Which strategy fits?

  1. priority
  2. round-robin Correct answer.
  3. lowest-cost
  4. manual

Explanation

The round-robin strategy distributes new sessions across eligible members in rotation without regard to measured quality. Lowest-cost, manual, and priority select members based on cost, configured order, or priority rather than alternating sessions.

Question 42Secure SD-WAN Deployment

Which SD-WAN design consideration applies when members are behind NAT devices and health checks target public servers?

  1. NAT prevents SD-WAN members from being configured
  2. NAT requires all members to use the same public address
  3. NAT disables performance SLA measurement
  4. Health check traffic must be able to traverse NAT and return to the correct member Correct answer.

Explanation

When members sit behind NAT, health check probes must traverse the NAT device and responses must return so the FortiGate can measure each member correctly. NAT does not prevent member configuration, require a shared address, or disable SLA measurement.

Question 43Secure SD-WAN Deployment

An administrator wants a specific business application to use a dedicated SD-WAN member unless that member's packet loss exceeds 2 percent. Which combination is most appropriate?

  1. An SD-WAN rule matching the application with lowest-cost strategy and a performance SLA using a 2 percent loss threshold Correct answer.
  2. A performance SLA with no rule referencing it
  3. A firewall policy with no SD-WAN rule
  4. A static route pointing the application subnet to the dedicated member

Explanation

An application-matched rule with lowest-cost and an SLA threshold of 2 percent loss keeps traffic on the dedicated member while it meets the threshold and moves it when loss exceeds the limit. Static routes, policies without rules, and unreferenced SLAs do not provide conditional steering.

Question 44Secure SD-WAN Deployment

Which statement about SD-WAN rules and the implicit rule is accurate when an explicit rule does not match a session?

  1. The implicit rule applies default member selection to unmatched sessions Correct answer.
  2. Unmatched sessions use only the first member in the zone
  3. Unmatched sessions are always dropped
  4. Unmatched sessions bypass the SD-WAN zone

Explanation

When no explicit SD-WAN rule matches, the implicit rule provides default selection across the SD-WAN members so traffic is still forwarded. Unmatched sessions are not automatically dropped, do not bypass the zone, and are not limited to the first member.

Question 45Secure SD-WAN Deployment

A design requires SD-WAN to steer traffic to the closest internet service for a set of SaaS destinations. Which SD-WAN rule match criterion supports this?

  1. Internet service Correct answer.
  2. Source port
  3. DSCP value
  4. Ingress interface

Explanation

Matching on internet service allows steering based on destination IP addresses associated with a named internet service database entry such as a SaaS provider. Source port, DSCP, and ingress interface do not identify the destination service.

Question 46Secure SD-WAN Deployment

Which design element allows SD-WAN in a hub-and-spoke topology to dynamically learn spoke overlay routes so spokes can be reached over the overlay?

  1. Static routes on each spoke only
  2. Policy routes on the hub only
  3. BGP peering over the IPsec overlay combined with SD-WAN members Correct answer.
  4. OSPF on the underlay only

Explanation

Running BGP over the IPsec overlay lets the hub advertise and learn spoke overlay prefixes so SD-WAN can steer traffic across overlay members. Static routes on spokes, hub-only policy routes, or underlay-only OSPF do not provide dynamic overlay route exchange.

Question 47Secure SD-WAN Deployment

An administrator observes that SD-WAN traffic fails over to a backup member but does not return to the primary after the primary recovers. Which behavior should be examined?

  1. Whether the primary member returns to in-SLA status and whether the rule strategy allows reselection Correct answer.
  2. Whether the firewall policy references the backup interface
  3. Whether the backup member has a lower priority value
  4. Whether the SD-WAN zone contains only one member

Explanation

Failback depends on the primary member being measured as in SLA again and the rule strategy permitting reselection of the better member. Backup priority, zone membership, or policy interface references do not by themselves explain the lack of failback.

Question 48Secure SD-WAN Deployment

A FortiGate SD-WAN rule references an SLA target, but the administrator notices the rule never selects the preferred member even though its latency is low. Which condition most likely explains this?

  1. The firewall policy does not log traffic
  2. The SD-WAN zone contains too many members
  3. The health check server is unreachable from that member, so the member is treated as out of SLA Correct answer.
  4. The preferred member has the highest priority value

Explanation

If the health check target cannot be reached from a member, the member is considered out of SLA regardless of its latency, so lowest-cost rules avoid it. Priority value, zone size, and logging do not cause a low-latency member to be excluded.

Question 49Secure SD-WAN Deployment

Which approach best supports SD-WAN steering for encrypted SaaS applications where the FortiGate cannot see the inner application payload?

  1. Match on internet service or destination IP and port rather than application signature Correct answer.
  2. Disable SD-WAN for that traffic
  3. Force all traffic through a single member
  4. Rely on DSCP marking only

Explanation

When payload inspection is not possible, steering can be based on internet service database entries or destination IP and port rather than application signatures. Disabling SD-WAN, forcing a single member, or relying only on DSCP does not provide the required granular steering.

Question 50Secure SD-WAN Deployment

A design uses SD-WAN with ADVPN shortcuts between spokes. Which consideration is most important for keeping SD-WAN steering consistent when a shortcut is established?

  1. The shortcut must use a different SD-WAN zone than the primary tunnels
  2. The shortcut must be excluded from BGP advertisements
  3. The shortcut tunnel interface must be included in the SD-WAN configuration so steering can use it Correct answer.
  4. The shortcut must disable performance SLA health checks

Explanation

For SD-WAN to steer traffic over an ADVPN shortcut, the shortcut tunnel interface must be part of the SD-WAN configuration and its members. Using a different zone, disabling health checks, or excluding the shortcut from BGP would undermine consistent steering and reachability.