A private /24 has its best route through a dedicated non-SD-WAN VPN interface. An internet SD-WAN rule matches all destinations. Under default routing integration, why can the private flow still use that dedicated tunnel?

Choose the single best answer.

A.An all-destination selector always overrides a more-specific non-SD-WAN route.
B.Lowest member cost replaces the destination routing result independently.
C.The best route points outside SD-WAN, so the broad rule does not automatically override it.
D.An alive SLA probe automatically adds the dedicated VPN interface to the SD-WAN zone.

Show the answer and explanation

✓ Correct answer

The best route points outside SD-WAN, so the broad rule does not automatically override it.

Default integration considers SD-WAN steering when the best path points to SD-WAN. Neither a broad selector nor a member cost automatically replaces a best route outside SD-WAN. Health probing does not change zone membership.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.