The SD-WAN 7.6 Enterprise Administrator Study Guide explicitly states: “Firewall policies for SD-WAN traffic must reference SD-WAN zones and not individual members.”

In the exhibit, HUB1-VPN1 is an individual member of the HUB1 SD-WAN zone. However, policy 3 incorrectly uses HUB1-VPN1 as its outgoing interface. FortiManager cannot compile and commit that policy because an SD-WAN member cannot be referenced directly by an SD-WAN firewall policy. The administrator must change the policy’s To interface from HUB1-VPN1 to its parent zone, HUB1.

Option C is incorrect because the guide specifically explains that an IPsec interface does not require normalization when it is used as an SD-WAN member: “SD-WAN members don’t use normalized interfaces.” The normalized LAN interface shown in the policy is appropriate because it maps the local interface for each managed FortiGate, but the overlay side must reference the HUB1 zone.

Option D remains invalid because it still references individual SD-WAN members. Option A does not correct the invalid outgoing-interface reference; policy 3 already uses the policy package installation targets.