NSE7_SSE_AR-26 Sample Questions Answers

FortiOS ADVPN 2.0 incorporates edge discovery and path management to establish dynamic spoke-to-spoke shortcuts while considering network transport compatibility and SD-WAN performance information.

Option C is the best-supported answer, provided the corresponding Branch-B interface TA belongs to transport group 1 and is enabled for compatible ADVPN shortcut establishment.

The visible Branch-A configuration establishes that T1 belongs to the overlay SD-WAN zone and uses transport-group 1 . The overlay zone also has advpn-select enable , allowing FortiOS to perform ADVPN-aware path selection.

The transport-group parameter identifies interconnected WAN transport networks. FortiOS exchanges transport-group information during ADVPN edge discovery and uses it to avoid establishing shortcuts across incompatible underlay networks.

Option A is incorrect because membership in an overlay zone does not make every interface pairing eligible for ADVPN shortcuts.

Option B is not supported by the transport and overlay conditions shown. Option D is incorrect because zone membership alone does not establish underlay compatibility or satisfy shortcut-selection requirements.

The defining principle is that ADVPN shortcut candidates must use compatible transport groups, with link health and path-selection criteria governing the final choice.

The video does not expose Branch-B ' s configuration, so option C remains a technically supported determination rather than a fully exhibit-verified result.

Comprehensive and Detailed Explanation From Fortinet SD-WAN 7.6 Architect / Course Guide:

FortiManager SD-WAN provisioning templates allow administrators to define installation targets for individual SD-WAN members. This enables a common template to accommodate branch devices with different WAN interfaces or overlay tunnel configurations.

Option B is correct because the diagnostic output corresponds to branch1_fgt, based on the configured installation targets and the absence of SD-WAN member ID 6.

The HUB1 zone configuration shows:

HUB1-VPN1 (ID 4): No installation target restriction; deployed to all assigned devices.

HUB1-VPN2 (ID 5): Assigned to branch1_fgt, branch2_fgt, and branch3_fgt.

HUB1-VPN3 (ID 6): Assigned only to branch2_fgt and branch3_fgt.

The diagnostic output lists members 4, 5, 7, 8, and 9, but member 6 is absent.

This matches branch1_fgt because HUB1-VPN3 is not included in that device ' s installation targets.

Option A is incorrect because branch2_fgt should have member 6 installed.

Option C is incorrect because the absence of a member from the diagnostic output does not establish that it is dead; it may not be configured on that device.

Option D is incorrect because the output is consistent with the template ' s device-specific configuration.

The determining principle is that FortiManager installs SD-WAN members according to their installation targets, and an empty installation target applies the member to all devices assigned to the template.

The WAN1 custom zone has no expansion indicator or visible subordinate member in the configuration screenshot, so it is the intended empty zone. WAN2 and HUB1 display expansion controls, indicating collapsed membership rather than a verified absence of members. The default virtual-wan-link zone is system-defined and cannot be treated like an ordinary removable custom zone. A zone can be deleted only when member assignments and other referencing configurations permit deletion. The candidate answer C reflects the intended screenshot interpretation, although the other statements must be assessed against the full configuration. Reference: FortiOS 7.6 — SD-WAN Members and Zones. A deployment should preserve the distinction between the physical or logical WAN underlay, the IPsec overlay and the SD-WAN zone that groups forwarding members. These layers can have different routing and security-policy requirements. The configured architecture must also allow the required traffic paths and failover behavior rather than assuming every available interface is interchangeable.

Verification qualification: The empty-zone interpretation has a second technically possible action, so the item is ambiguous.

The IKE debug shows processing notify type SHORTCUT_QUERY, recv shortcut-query and forward shortcut-query. These commands identify a hub receiving ADVPN shortcut discovery signaling from a spoke and forwarding it toward another spoke. A spoke that merely receives a shortcut query would not be characterized by the explicit forwarding record in the same manner. The output does not establish a two-region topology or a completed direct shortcut. The candidate key identifying a spoke contradicts the forwarded-shortcut-query diagnostic evidence. Reference: FortiOS 7.6 — ADVPN Shortcut Establishment and IKE Debugging. FortiManager templates reduce repetitive work but must resolve to valid, device-specific configurations at installation time. Device assignments, metadata mappings, ADOM scope, policy-package interfaces and provisioning order should be inspected together rather than troubleshooting any one object in isolation. A successful management connection does not guarantee a successful configuration installation. Review the installation preview and task log, then validate the resulting device configuration and operational diagnostics. This separates a deployment-time validation failure from a live tunnel, routing or SLA fault.

In FortiOS (including FortiOS 7.6), FortiGate follows a strict and well-defined route lookup order when determining how to forward traffic. This order is critical for understanding SD-WAN behavior and is explicitly referenced in the FCSS SD-WAN curriculum. The correct lookup sequence is: Among the options provided, only Option D correctly reflects the beginning of this sequence by placing policy routes first, followed by ISDB routes, then SD-WAN rules, and finally static routes (representing the routing table). Therefore, the correct answer is D. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow. When troubleshooting, correlate the configured SD-WAN service with diagnose sys sdwan service4, the live session entry and the routing table. An application signature, an IP route and a health-check result describe different decision stages; treating them as interchangeable can produce incorrect conclusions about the egress interface.

Fortinet ' s unified SASE architecture supports multiple methods of securing private application access, including identity-based Zero Trust Network Access and connectivity through Secure SD-WAN.

Option B is correct because ZTNA provides an application-centric alternative to traditional remote-access VPN architectures. Instead of providing broad network connectivity, ZTNA authenticates users, evaluates device security posture, and grants access only to explicitly authorized applications.

Fortinet ZTNA integrates identity verification, endpoint posture assessment, and application-specific security policies to reduce implicit trust.

Option C is correct because Secure SD-WAN enables encrypted and centrally managed connectivity between enterprise locations, cloud environments, and private resources. When integrated with FortiSASE, existing SD-WAN hubs can provide secure private application access through cloud security points of presence.

Option A is incorrect in this scenario because SD-WAN Branch On-ramp is primarily an ingress method for connecting branch networks to FortiSASE. Although it can participate in a broader private-access architecture, it is not the general VPN-replacement technology being tested.

Option D is incorrect because SWG and CASB primarily address internet and SaaS application security rather than providing the private network connectivity and application-specific access control required here.

ZTNA delivers granular access enforcement, while Secure SD-WAN supplies resilient and secure enterprise connectivity.

One SD-WAN rule is defined with application categories as the destination → The diagnose output shows application control matches such as Microsoft.Portal, Operational.Technology, and Social.Media, confirming that SD-WAN rules are using application categories as destinations. UDP traffic destined to the subnet 10.22.0.0/24 matches a policy route → The first entry (id=1) shows protocol=17 (UDP) with destination 10.22.0.0/24, confirming this traffic is handled by a policy route instead of an SD-WAN rule. FortiManager templates reduce repetitive work but must resolve to valid, device-specific configurations at installation time. Device assignments, metadata mappings, ADOM scope, policy-package interfaces and provisioning order should be inspected together rather than troubleshooting any one object in isolation. A successful management connection does not guarantee a successful configuration installation. Review the installation preview and task log, then validate the resulting device configuration and operational diagnostics. This separates a deployment-time validation failure from a live tunnel, routing or SLA fault.

The exhibits identify a source at 10.0.1.101 generating an ICMP echo toward a public destination. They show multiple Internet-facing SD-WAN members, but not a session-table record or packet capture tying this exact ICMP exchange to port2. The corporate service requires a private destination, so it is not the controlling match for the Facebook public IP address. Application classification must also be distinguished from a basic ICMP ping: a Facebook application signature associated with HTTPS traffic does not establish that an ICMP exchange has been recognized as the Facebook application. Although D (port2) is the supplied key, the displayed service definition and application-cache information alone do not prove it. To determine the correct egress, capture the specific ICMP flow or apply a source/destination session filter and inspect the selected SD-WAN member and outgoing device. Port1, port2, and port4 remain potential candidates until the relevant interface and route-selection evidence is supplied. Accordingly this is not an exhibit-verified single-answer item, and it should not be sold as conclusively solved solely from the provided screenshot. The FortiOS Application Steering guide documents why application detection and rule eligibility must be examined separately.

Verification qualification: The available exhibits do not uniquely prove port2 as the ICMP egress interface.

The implicit SD-WAN rule serves as the final catch-all. In FortiOS operation: " Sessions matching the implicit SD-WAN rule do not have an SD-WAN service id, as they are not associated with any specific user-defined SD-WAN rule. Additionally, this occurs only when traffic fails to match any entry in the policy route table. This default handling guarantees connectivity while minimizing the risk of blackholed traffic. " Administrators can observe this in diagnostic outputs for troubleshooting. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow. When troubleshooting, correlate the configured SD-WAN service with diagnose sys sdwan service4, the live session entry and the routing table. An application signature, an IP route and a health-check result describe different decision stages; treating them as interchangeable can produce incorrect conclusions about the egress interface.

According to the FortiSASE 25 Enterprise Administrator Study Guide, page 25, branch on-ramp deployment enables organizations to secure outbound internet traffic from branch locations by connecting their existing network infrastructure to FortiSASE.

Option A is correct: Branch on-ramp allows remote offices and branch locations to establish secure IPsec VPN tunnels between their FortiGate or supported third-party network devices and FortiSASE points of presence (PoPs). Traffic is forwarded through these tunnels, allowing FortiSASE to deliver cloud-based security inspection and enforcement.

The study guide explains that connected branches can benefit from Secure Internet Access (SIA), Secure SaaS Access (SSA), and Secure Private Access (SPA).

Option B is incorrect: Although branch on-ramp supports secure private application access, providing access through a bookmark portal is not its primary deployment benefit.

Option C is incorrect: Branch on-ramp provides secure network connectivity and traffic inspection. It is not designed primarily for endpoint inventory, administration, or lifecycle management.

Option D is incorrect: The study guide explicitly states that FortiClient installation is not required for branch edge-device deployments and that ZTNA tags are not supported in this configuration.

Therefore, branch on-ramp primarily enables organizations to extend FortiSASE cloud security services to branch offices and secure their internet-bound traffic.

Exact Source References:

FortiSASE 25 Enterprise Administrator Study Guide, page 25 — Thick Edge Use Case, including secure branch outbound traffic and branch on-ramp.

FortiSASE 25 Enterprise Administrator Study Guide, page 26 — FortiSASE Branch On-Ramp Configuration.

FortiSASE 25 Enterprise Administrator Study Guide, page 27 — Edge-Device Policies, explaining the lack of ZTNA tag support.

FortiGate SD-WAN can distribute traffic over multiple WAN links while applying performance-based eligibility checks. These checks measure network conditions such as latency, jitter, and packet loss against defined service-level agreement thresholds.

Option A is correct because FortiGate can load balance sessions across available SD-WAN members that satisfy the configured SLA target. An interface that fails the required performance criteria is excluded from the eligible load-balancing set under normal SLA-compliant operation.

Option B is correct because current FortiOS versions support load balancing within the Lowest Cost (SLA) strategy. The configuration uses set mode sla together with set load-balance enable under the relevant SD-WAN service rule. Importantly, the load-balancing algorithm does not use interface cost to select individual links once SLA-based load balancing is enabled.

Option C is incorrect because Best Quality is a separate strategy that selects preferred members based on measured link-quality metrics. It is not the supported SLA-based multi-link load-balancing configuration described in the question.

Option D is incorrect because the legacy session, spillover, and volume terminology does not describe supported Best Quality load-balancing algorithms in this context.

FortiOS 7.4.1 and later integrated the former Maximize Bandwidth strategy into the current load-balancing configuration model.

From the SD-WAN rule configuration (service ID 3, name " Corp " ), the rule is configured as: In the diagnose firewall proute list output for service=3 (Corp), FortiGate shows the actual members considered for this rule and their SLA pass status: Because the rule is SLA-based, FortiGate selects only members that meet the SLA requirements for the rule. The output indicates that HUB1-VPN1 and HUB1-VPN2 pass both SLA checks (num_pass=2), while HUB1-VPN3 passes only one (num_pass=1) and therefore is not selected as an eligible forwarding interface for this rule. Since load-balance is enabled and the rule uses hash-mode source-ip-based, FortiGate will consistently choose an eligible member based on the source IP hash. For traffic sourced from 10.0.1.101, the session can be steered through either HUB1-VPN1 or HUB1-VPN2 (whichever the hash selects), but not HUB1-VPN3. Therefore, the correct answer is B. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow.

Verification qualification: A specific hash-selected interface cannot be predicted from the supplied configuration without the full evaluation.

For FortiGate to steer traffic using SD-WAN rules, two foundational elements must be in place: available WAN paths (underlay links) and firewall policies that allow traffic to reach the SD-WAN interface. Underlay links (Option B) are mandatory because SD-WAN operates by selecting among multiple WAN transports (for example, broadband, MPLS, LTE, or IPsec tunnels). These links are configured as SD-WAN members and form the physical or logical paths over which traffic can be steered. Without underlay links, SD-WAN has no paths to evaluate or select. Firewall policies (Option E) are also mandatory because FortiGate only processes and forwards traffic that is explicitly permitted by a firewall policy. When SD-WAN is enabled, firewall policies must reference the SD-WAN interface or SD-WAN zone as the outgoing interface. If no such policy exists, traffic will not be forwarded and SD-WAN rules will never be evaluated. Why the other options are incorrect: Therefore, the two required features that must be configured before FortiGate can steer traffic according to SD-WAN rules are underlay links and firewall policies, which correspond to B and E.

Application-based SD-WAN rules enable intelligent traffic steering. The FortiOS behavior is: " If a flow is identified as belonging to a defined application category (such as social media), FortiGate will match it to the corresponding service rule (rule 2) and route it through the specified interface, such as port2. However, if the application is not recognized during the session setup, the system defaults to load balancing the traffic using the available tunnels according to the policy for unclassified traffic, ensuring continuous connectivity while waiting for application classification. " This guarantees both performance and resilience. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow. When troubleshooting, correlate the configured SD-WAN service with diagnose sys sdwan service4, the live session entry and the routing table. An application signature, an IP route and a health-check result describe different decision stages; treating them as interchangeable can produce incorrect conclusions about the egress interface.

ADVPN enables dynamic spoke-to-spoke IPsec shortcuts that eliminate unnecessary transit through hub devices after the initial discovery and negotiation process. In this scenario, spokes A1 and B2 belong to separate hub-and-spoke groups, interconnected through redundant IPsec tunnels.

Option A is correct because spoke devices use auto-discovery-receiver on their hub-facing IPsec Phase 1 interfaces. This enables the spokes to receive ADVPN shortcut discovery information needed to establish a direct tunnel to another spoke. Fortinet ' s ADVPN configuration examples explicitly demonstrate this receiver role.

Option D is correct because the interconnected hubs must forward the relevant ADVPN discovery messages across their inter-hub IPsec tunnels. Enabling auto-discovery-forwarder allows discovery signaling to traverse the hub-to-hub connections so that spokes belonging to different regions can discover one another.

Option B reverses the standard spoke and hub discovery roles. The hub normally performs the sender role on its spoke-facing tunnels, whereas the spoke uses the receiver role.

Option C similarly assigns the receiver role to the wrong side of the hub-to-spoke relationship.

The essential distinction is between receiving shortcut discovery at the spokes and forwarding discovery information between the hubs.

The spoke enables ' embed-measured-health ' in its health-check configuration, allowing SLA-related measurements or status to travel in the probe stream sent to the hub. On the hub, FortiOS supports remote SLA processing, notably ' set detect-mode remote ' , an appropriate ' sla-id-redistribute ' value, and a remote link-cost factor. The parameters ' priority-in-sla ' and ' priority-out-sla ' can control preference when the remote spoke reports a pass or fail state. Consequently, option A can be a useful configuration check if hub-to-spoke priority is not being applied. Option C, however, is not a universal requirement: the hub may consume the spoke ' s remote SLA status rather than independently testing identical performance criteria. The candidate option D gives ' set embedded-measure accept ' , which is not the documented FortiOS 7.6 remote health-check syntax. Option B is not necessary because hub and spoke member numbering need not match. The prior A,C answer is the closest available pair, but a fully verified two-answer key requires a more precise statement of the particular remote health-check mechanism. The official 7.6 Embedded SD-WAN SLA Status guide provides the authoritative hub-side CLI example.

Verification qualification: The hub-side remote-SLA feature requires detect-mode remote; the listed criteria are not universally mandated.

The SD-WAN overlay template defines a zone for each underlay interface and moves the interfaces into those zones. This statement perfectly describes the likely sequence of events. The template, when applied, re-organizes the interfaces and zones, causing the existing firewall policy that relies on the old zone configuration to fail. This is the most plausible root cause. A deployment should preserve the distinction between the physical or logical WAN underlay, the IPsec overlay and the SD-WAN zone that groups forwarding members. These layers can have different routing and security-policy requirements. The configured architecture must also allow the required traffic paths and failover behavior rather than assuming every available interface is interchangeable. Before applying a topology change, review the interface dependencies, static and dynamic routing, security policies and provisioning templates. FortiGate can support multiple transport types, but routing and tunnel compatibility still determine whether the intended member is operationally eligible. In checking this outcome, an administrator should distinguish what the displayed exhibit proves from configuration prerequisites not visible in the screenshot. Routing eligibility, device role, rule matching, and software-version details should be verified before using the selected answer in a production decision. The referenced Fortinet documentation identifies the underlying feature and its supported configuration context.

The SD-WAN rule (config service edit 1) is configured with set mode priority. This means the rule selects the best interface based on a defined performance metric, as opposed to a simple static priority or SLA. The event log (image_41cfb5.png) shows Metric latency and Message Service prioritized by performance metric will be redirected in sequence order. This indicates that the rule is using latency to determine the preferred member. Given that the log message is about a change, and the most logical reason for a change in a priority mode is that a different member is now the best performer, it implies that the latency on port2 has become lower than that on port1. The log message Service prioritized by performance metric will be redirected in sequence order confirms that FortiGate is changing the member being used for this service. Because the mode is priority, FortiGate dynamically selects the member that currently meets the best performance criteria, which in this case is latency. The log implies a new member has been selected as the most optimal, and with the default configuration, the members are sorted based on their performance, so the outgoing interface list is effectively updated to prefer the new best-performing member (port2).

An SD-WAN member may be removed using the FortiGate GUI once its configuration dependencies are cleared. Option A is the intended answer: FortiOS updates the member configuration and its associated forwarding entries as needed. Removal does not require the CLI, does not enforce a minimum of two members per user-defined zone, and does not automatically move the interface into the default virtual-wan-link zone. Those facts eliminate B, C and D. A working deployment can lose connectivity after this change if other services depended on routes through the deleted member; therefore an administrator should check static routing and member reachability, not simply the SD-WAN Rules or Performance SLAs tabs. FortiOS describes an SD-WAN member as a reference to an underlying physical or logical interface. Deleting the SD-WAN membership does not necessarily delete that underlying interface or its addressing. Before removing it, examine SD-WAN member references, health checks, firewall policies, SD-WAN zones and configured static routes. After the change, compare the active routing table and the available SD-WAN forwarding members. The answer assumes no outstanding dependency blocks the delete operation.

The rule is in SLA mode with two SLAs. From the status, HUB1-VPN2 and HUB1-VPN3 meet the SLA (sla(0x2) and sla(0x3)), while HUB1-VPN1 does not (sla(0x0)). Among members that meet SLA, FortiGate uses the configured order (priority-members 4 5 6) to pick the first eligible one—HUB1-VPN2—so traffic is routed over HUB1-VPN2. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow. When troubleshooting, correlate the configured SD-WAN service with diagnose sys sdwan service4, the live session entry and the routing table. An application signature, an IP route and a health-check result describe different decision stages; treating them as interchangeable can produce incorrect conclusions about the egress interface.

FortiGate supports Active, Passive, and Prefer Passive performance SLA monitoring modes. Passive monitoring measures actual network traffic rather than generating synthetic probes.

Option B is correct in the conventional preferred-link scenario because passive measurement depends on traffic traversing an SD-WAN member. When traffic is forwarded exclusively through the preferred link, FortiGate cannot measure the performance of unused alternative links. This is a limitation of passive monitoring.

Option D is correct because FortiGate uses TCP session information to measure latency, jitter, and packet loss. Latency measurements are derived from TCP connection behavior, while packet loss and jitter are determined using TCP header information.

Option A is incorrect because passive measurement relies on TCP session characteristics rather than ICMP traffic.

Option C is incorrect because enabling passive WAN health measurement disables automatic ASIC offloading on the affected firewall policies, allowing FortiGate to inspect the required TCP session information.

Option E is incorrect because the three-minute fallback to active probing belongs to Prefer Passive, not Passive mode. In Prefer Passive mode, FortiGate activates probes after three minutes without qualifying TCP traffic.

Fortinet Secure SD-WAN uses underlay and overlay networks to separate transport connectivity from logical routing and secure communication between enterprise locations.

The underlay network provides the underlying IP transport, including broadband internet, MPLS, leased lines, and wireless connectivity such as 4G/5G LTE. The overlay network provides logical connectivity through tunnels established over those transport networks.

Option A is correct because wireless connections can serve as the underlying transport for overlay tunnels. For example, a FortiGate with FortiExtender can establish an IPsec VPN overlay over a 5G cellular WAN connection.

Option E is correct because overlay networks provide routing flexibility independently of the physical transport infrastructure. IPsec VPN and ADVPN overlays enable dynamic route exchange, secure branch connectivity, path selection, and shortcut establishment.

Option B is incorrect because underlay connectivity is not restricted to wired interfaces. Cellular WAN connectivity is fully supported.

Option C is incorrect in the Fortinet SD-WAN terminology used here. A VLAN provides Layer 2 logical segmentation and is not inherently an SD-WAN overlay tunnel.

Option D is incorrect because FortiLink primarily provides management and connectivity between FortiGate and FortiSwitch devices. It is not classified as an SD-WAN transport underlay solely because it is a network interface.

FortiSASE geofencing provides geographical access control by permitting or denying connections to FortiSASE security points of presence (POPs) according to the originating country or region of the connecting user or edge device.

Option D is correct because FortiSASE identifies the source country using the connection ' s public IP address and evaluates it against configured regional access restrictions.

Administrators configure this functionality under Network > Geofencing > Regional access to FortiSASE.

FortiSASE supports three geographical access modes:

Allow all: Permits connections from all countries and regions. This is the default configuration.

Allow specified: Permits connections only from explicitly authorized countries or regions.

Deny specified: Blocks connections originating from selected countries or regions while permitting other locations.

Option A is incorrect because geofencing does not primarily enforce time-based application access restrictions.

Option B is incorrect because content inspection and web filtering are separate security functions.

Option C is incorrect because endpoint data encryption is unrelated to geographical connection restrictions.

Additionally, FortiSASE supports regional compliance rules that prioritize permitted POPs or on-premises gateways for users originating from specified regions. These routing preferences are distinct from geofencing ' s connection admission controls.

For SD-WAN deployments that span multiple regions—where most traffic is intra-region and there is no requirement for inter-region ADVPN—the best practice is to use IBGP with BGP on loopback interfaces for routing within each region and EBGP between the regions. This approach ensures robust and scalable routing, isolates regional routing domains, and enables policy control at region boundaries. BGP on loopback is preferred for its reliability and flexibility, as it enables peering that is not tied to specific physical interfaces. EBGP between regions allows each region to maintain independent routing policies and summarization, optimizing performance and manageability. By separating IBGP (intra-region) and EBGP (inter-region), you create a modular architecture that scales easily and simplifies fault isolation and troubleshooting.References: A deployment should preserve the distinction between the physical or logical WAN underlay, the IPsec overlay and the SD-WAN zone that groups forwarding members. These layers can have different routing and security-policy requirements. The configured architecture must also allow the required traffic paths and failover behavior rather than assuming every available interface is interchangeable.

The exhibit demonstrates the SD-WAN cascade interface functionality, which propagates a failure detected on monitored WAN links to a designated physical interface.

The configuration includes:

config system sdwan

set fail-detect enable

set fail-alert-interfaces " port5 "

Both configured performance SLAs also enable update-cascade-interface , allowing the SD-WAN health-monitoring subsystem to control the state of the designated alert interface.

Option B is correct because FortiGate restores port5 when at least one monitored SD-WAN member is alive. When all monitored members fail, FortiGate administratively brings port5 down. Once an eligible member recovers, FortiGate brings the interface back up.

This behavior allows downstream network equipment to detect a loss of WAN connectivity even when the local Ethernet link would otherwise remain operational.

Option A is incorrect because the configuration does not specify sending notification messages through port5 whenever an individual member fails.

Option C reverses the expected behavior. Port5 is brought down, not up, when all monitored SD-WAN members fail.

Option D is incorrect because fail-alert-interfaces controls interface state rather than functioning as a dedicated notification transport.

The cascade interface mechanism is particularly useful when an alternative network device must assume traffic forwarding following a complete SD-WAN connectivity failure.

FortiManager SD-WAN Monitor Template View uses per-branch health indicators and hover details. Orange icons indicate partial degradation or an SLA failure on at least one monitored interface. The branch1 tooltip specifically identifies HUB2-VPN1, HUB2-VPN2 and HUB2-VPN3 as problematic. The map is consistent with other overlays toward the alternate hub, supporting the six-overlay/three-down interpretation, although the full six-interface list is not directly visible in the hover box. Branch3’s exact configured tunnel count cannot be inferred from an orange indicator alone. This is why A and D are stronger than claims about hub counts or branch3’s exact overlay count. Reference: FortiManager 7.6 — SD-WAN Monitor Template View. FortiManager templates reduce repetitive work but must resolve to valid, device-specific configurations at installation time. Device assignments, metadata mappings, ADOM scope, policy-package interfaces and provisioning order should be inspected together rather than troubleshooting any one object in isolation. A successful management connection does not guarantee a successful configuration installation. Review the installation preview and task log, then validate the resulting device configuration and operational diagnostics. This separates a deployment-time validation failure from a live tunnel, routing or SLA fault.

Verification qualification: The tooltip alone does not explicitly confirm the inferred total tunnel count.

FortiGate SD-WAN zones are logical containers that group interfaces for traffic steering, route selection, and security-policy enforcement. The exhibit distinguishes zones from their underlying SD-WAN members through a hierarchical display.

Option C is correct. WAN1 is an empty, user-created zone and can be deleted because it has no SD-WAN member associations. The other zones must be evaluated according to their membership and whether they are system-defined.

WAN2 has an expansion indicator, showing that the zone contains member entries even though those entries are currently collapsed. Consequently, option A is incorrect: the absence of visible subordinate interfaces does not prove that a zone has no members.

HUB1 also has an expansion indicator. Its members are hidden by the collapsed view, so option D is incorrect.

The red icon is not a universal deletion indicator. In particular, the built-in virtual-wan-link zone must not be treated as an ordinary removable custom zone. An administrator must distinguish interface or zone operational status from configuration eligibility for deletion.

Before removing a custom zone, its members and any references in firewall policies or SD-WAN rules must be examined.

The IKE debug shows a receiving SHORTCUT_QUERY event and NAT hole punching, without an explicit forward shortcut-query record. This is consistent with a spoke receiving the shortcut-discovery query relayed by its hub over the existing spoke-to-hub tunnel. A hub-forwarder log would ordinarily include forwarding messages; the exhibit does not prove that a final spoke-to-spoke shortcut is already established. NAT hole punching is part of preparing connectivity when at least one endpoint is behind address translation, not proof that two established peers have completed negotiation. Therefore, the supported role is the destination spoke receiving a query via its hub. Reference: FortiOS 7.6 — ADVPN Shortcut Discovery and NAT Traversal. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow.

FortiGate SD-WAN traffic steering depends on both service-rule matching and routing-table reachability. A matching SD-WAN rule identifies eligible interfaces, but the selected member must also have a usable route toward the destination.

Option A is correct because service rule 3 matches the specified source and destination address ranges, and the routing table identifies HUB1-VPN3 as the route toward the corporate server subnet.

The source address 10.0.1.0/24 falls within the source range 10.0.0.0/8 , while destination 10.2.5.254 also falls within the configured destination range.

The exhibit identifies service rule 3 as an SLA-based service with multiple available overlay members. However, the route to 10.2.5.0/24 identifies HUB1-VPN3 as the reachable next-hop interface.

Although HUB1-VPN2 appears in the service ' s eligible member list, it does not provide the matching destination route shown in the routing table. Therefore, option B is incorrect.

Options C and D reference service rule 4 and physical WAN interfaces. They do not represent the selected corporate overlay path for the stated source and destination.

This demonstrates a fundamental SD-WAN behavior: matching a service rule does not eliminate the requirement for valid route resolution through its forwarding member.

The exhibit shows the runtime details of two SD-WAN services (rules): Service(2) Service(3) Traffic from 10.0.1.124 to 10.0.0.254 matches Service(3) because the destination IP 10.0.0.254 falls within the destination range 10.0.0.0– 10.255.255.255. Within Service(3), the member list shows SLA results per interface: This indicates that, for Service(3), only HUB1-VPN2 and HUB2-VPN2 are currently meeting the SLA requirements (passing), and because the rule uses hash-mode=round-robin, FortiGate load-balances sessions across the passing members. Therefore, FortiGate will steer the traffic using HUB1-VPN2 or HUB2-VPN2, which corresponds to Option B. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow. When troubleshooting, correlate the configured SD-WAN service with diagnose sys sdwan service4, the live session entry and the routing table. An application signature, an IP route and a health-check result describe different decision stages; treating them as interchangeable can produce incorrect conclusions about the egress interface.

Verification qualification: SLA eligibility and routing-table reachability need confirmation; the two-member outcome depends on those conditions.