NSE7_SSE_AR-26 Exam Dumps - Fortinet NSE 7 Network Security Architect Questions and Answers

When an SD-WAN member is deleted, FortiGate can also remove static routes that were tied to that interface. If those routes are needed for destinations not covered by SD-WAN rules, traffic to those networks becomes unreachable. This explains why flows not matching SD-WAN rules are interrupted after the member was removed. A deployment should preserve the distinction between the physical or logical WAN underlay, the IPsec overlay and the SD-WAN zone that groups forwarding members. These layers can have different routing and security-policy requirements. The configured architecture must also allow the required traffic paths and failover behavior rather than assuming every available interface is interchangeable. Before applying a topology change, review the interface dependencies, static and dynamic routing, security policies and provisioning templates. FortiGate can support multiple transport types, but routing and tunnel compatibility still determine whether the intended member is operationally eligible. In the relevant Fortinet FortiOS documentation, the applicable feature should be verified against the deployed software version, the selected configuration mode and the live operational state before the answer is treated as a definitive implementation requirement.

FortiGate SD-WAN can distribute traffic over multiple WAN links while applying performance-based eligibility checks. These checks measure network conditions such as latency, jitter, and packet loss against defined service-level agreement thresholds.

Option A is correct because FortiGate can load balance sessions across available SD-WAN members that satisfy the configured SLA target. An interface that fails the required performance criteria is excluded from the eligible load-balancing set under normal SLA-compliant operation.

Option B is correct because current FortiOS versions support load balancing within the Lowest Cost (SLA) strategy. The configuration uses set mode sla together with set load-balance enable under the relevant SD-WAN service rule. Importantly, the load-balancing algorithm does not use interface cost to select individual links once SLA-based load balancing is enabled.

Option C is incorrect because Best Quality is a separate strategy that selects preferred members based on measured link-quality metrics. It is not the supported SLA-based multi-link load-balancing configuration described in the question.

Option D is incorrect because the legacy session, spillover, and volume terminology does not describe supported Best Quality load-balancing algorithms in this context.

FortiOS 7.4.1 and later integrated the former Maximize Bandwidth strategy into the current load-balancing configuration model.

According to the Fortinet SD-WAN 7.6 Core Administrator Study Guide, Routing and Sessions, page 193, FortiOS supports static routes referencing SD-WAN zones and individual member interfaces. However, duplicate destination routes cannot simultaneously reference a zone and one of its individual member interfaces.

Option A is correct: FortiOS requires the two static routes to have different destination prefixes. When a static route references an SD-WAN zone, FortiGate creates forwarding entries for the members belonging to that zone. Configuring an additional route with the identical destination prefix through an individual member creates a conflicting route definition.

Overlapping destination networks are permitted when their prefixes differ. For example, a zone-based route could reference 10.0.0.0/8, while a member-specific route references 10.2.0.0/16.

Option B is incorrect: Equal administrative distance does not resolve the duplicate-route restriction. ECMP is not a substitute for valid route configuration.

Option C is incorrect: FortiOS supports default static routes (0.0.0.0/0) referencing SD-WAN zones.

Option D is incorrect: SD-WAN members can include physical interfaces, VLAN interfaces, IPsec tunnels, and other supported interface types.

Therefore, the two static routes must have different destination prefixes, although overlapping networks are allowed.

Exact Source References:

Fortinet SD-WAN 7.6 Core Administrator Study Guide, pages 192–193 — Routing and Sessions.

FortiOS 7.6 Administration Guide — Adding a Static Route and SD-WAN Members and Zones.