FCP-FGT-AD - Routing (20% of the exam) - Section 4.2

Configure SD-WAN to load balance traffic between multiple WAN links effectively using performance SLAs and rules.

Configure SD-WAN by adding multiple WAN interfaces, defining performance SLAs to measure link health, and creating SD-WAN rules that steer traffic based on quality metrics or application type. Distinguish how WAN link health monitoring probes detect link degradation and trigger rule-based failover.

SD-WANperformance SLASD-WAN rulesWAN link health monitoring

Practice question for this objective

Free sampleRoutinghard

A performance SLA monitors port2 with both a link-status check and a service SLA target for latency. port2 keeps physical link, its static route stays in the routing table, and it can still browse the internet, but the SLA reports it as not meeting the SLA target. How does this state affect SD-WAN rules and ordinary routing for port2?

Aport2 is removed from both the routing table and every SD-WAN rule, so neither SD-WAN traffic nor independently routed traffic can use it until the target is met again.
Bport2 remains fully eligible for SD-WAN rules because only a dead link-status result excludes a member, and a missed latency target is recorded for reporting but never changes selection.
Cport2 stays in the routing table and can still carry independently routed traffic, but it is treated as not meeting SLA, so SLA-aware SD-WAN rules exclude it from member selection. Correct
Dport2 is declared dead immediately, which both removes its route and triggers an HA failover of the whole device to its cluster peer.

Service SLA status is independent of link state: a member failing its SLA target stays routable but is excluded from SLA-aware SD-WAN rules. Performance SLA evaluates link status (is the member alive) separately from service SLA targets (does it meet latency, jitter, and loss thresholds). A member can be alive with its route installed yet fail the service target. SLA-aware rules exclude it from selection, but its static route stays in the table, so traffic routed outside SD-WAN rule logic can still use it.

Why A is wrong: Tempting because failover feels total, but failing the service SLA target does not withdraw the route. Independently routed traffic can still use port2; only SD-WAN rule eligibility is affected.

Why B is wrong: Tempting because link status is the harder failure, but a missed service SLA target does change selection in SLA-aware rules. It is not merely cosmetic; it makes the member ineligible for Lowest Cost (SLA) and SLA-mode rules.

Why C is correct: Correct. Service SLA status and link status are distinct. A member that keeps link and route but misses the latency target is alive yet not meeting SLA. SLA-aware rules drop it from the eligible set, while normal routing over that interface is unaffected because the route remains installed.

Why D is wrong: Tempting because it chains failover ideas together, but missing a service SLA target neither makes the member dead nor triggers HA failover. Link-status detection, service SLA detection, and HA are independent mechanisms.

See more FCP-FGT-AD practice questions, answers explained.

Exam traps in Routing

Answers that look right on this material and are not. Each one is a distractor from a different question in the FCP-FGT-AD bank for this domain.

Exceeding the SLA target for latency, which alone forces the member out of all rules until the latency recovers below the configured threshold.
Why it is wrong: Breaching a latency SLA target only makes the member out of SLA for rules that require that SLA; it does not declare the link dead. This is tempting because it sounds severe, but it does not remove the member from rules that do not depend on the SLA.
Unmatched traffic bypasses SD-WAN entirely and is forwarded using only the static default route with the lowest administrative distance, ignoring the second member.
Why it is wrong: Tempting because plain routing would pick one default route, but once interfaces are SD-WAN members the zone governs egress. Unmatched traffic is still processed by the implicit SD-WAN rule rather than dropping back to a single default route.
A member that keeps answering probes but breaches the latency, jitter or packet-loss thresholds is declared dead by the link-status detection and removed from the routing table.
Why it is wrong: Tempting because breaching the target sounds fatal, but missing the quality SLA target is separate from link-status death; the member stays alive with its route and is only avoided by SLA-aware strategies, not pulled from routing.

Examworthy is not affiliated with or endorsed by Fortinet. Original, blueprint-aligned practice material only.