The zone setting advpn-select enable activates SD-WAN-aware ADVPN shortcut selection. The assigned advpn-health-check provides link metrics for evaluating available shortcut paths. The minimum-sla-meet-members value applies to zone-level SLA-compliant forwarding eligibility; it does not categorically mean shortcut negotiation is prohibited unless two members pass an SLA. Likewise, merely naming a health check does not impose a universal rule that every established shortcut must currently pass that health check. The candidate answer C confuses forwarding eligibility with IPsec ADVPN shortcut establishment. Reference: FortiOS 7.6 — ADVPN 2.0, advpn-select and minimum-sla-meet-members. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow. When troubleshooting, correlate the configured SD-WAN service with diagnose sys sdwan service4, the live session entry and the routing table. An application signature, an IP route and a health-check result describe different decision stages; treating them as interchangeable can produce incorrect conclusions about the egress interface.