NSE7 Practice Test 24 — 15 Questions

Question 1

An administrator notices that an application-based SD-WAN rule is not steering traffic as expected. The SLA targets are configured correctly. Which TWO debug commands should the administrator use to diagnose the issue? (Choose two.)

Accepted Answer

diagnose sys sdwan info. Options A and C are correct. 'diagnose sys sdwan info' shows SD-WAN configuration and SLA status. 'diagnose sys session list' with filters shows the session details including SD-WAN member selection. Option B is invalid, D shows overall status but not per-rule, E is unrelated.

Answer

diagnose debug application sslvpn -1

Answer

get system performance status

Answer

diagnose sys sdwan rule list

Question 2

An administrator is investigating a security incident and needs to determine which firewall policy allowed a specific malicious traffic flow. The traffic is no longer active. Which FortiAnalyzer log type should the admin query?

Accepted Answer

Traffic logs. Traffic logs record all allowed/denied sessions, including source/destination, policy ID, and action, making them ideal for identifying which policy allowed a flow.

Answer

Event logs

Answer

Security logs

Answer

Audit logs

Question 3

During a BGP troubleshooting session, an administrator sees that the BGP neighbor state is 'Active'. Which three conditions could cause this state? (Choose THREE.)

Accepted Answer

The remote AS number is misconfigured. Active state means BGP is trying to initiate a TCP connection but hasn't succeeded. Common causes include incorrect neighbor IP, ASN mismatch, or TCP port blocking.

Answer

The BGP update timer is too short

Answer

The maximum-prefix limit has been exceeded

Question 4

An HA cluster of two FortiGates is experiencing split-brain. Which command should the administrator use to check the current HA status and identify which unit is the primary?

Accepted Answer

get system ha status. Option B is correct. The 'get system ha status' command displays detailed HA information including the cluster status, primary/secondary roles, and synchronization state. It helps identify split-brain when both units show themselves as primary.

Answer

diagnose debug application had 0

Answer

diagnose sys ha dump

Answer

show system ha

Question 5

An administrator observes that traffic from a specific subnet is being dropped by the FortiGate. The session table shows the sessions with 'proto_state=01' and 'expire=0'. What does this indicate?

Accepted Answer

The sessions have expired and are being cleaned up. Option A is correct. 'expire=0' and 'proto_state=01' indicate that the session has expired and is in a cleanup state. The traffic is being dropped because the session is no longer valid.

Answer

The antivirus scanning is causing a delay

Answer

The sessions are being offloaded to the NPU

Answer

The firewall policy is blocking the traffic

Question 6

An administrator is configuring SD-WAN with multiple members. When a rule matches, traffic is not being load-balanced as expected. Which command should the admin use to verify the SD-WAN rule selection for a specific flow?

Accepted Answer

diagnose sys sdwan info. The command 'diagnose sys sdwan info' shows SD-WAN configuration and rule mapping, helping verify which rule is applied.

Answer

diagnose sys session list

Answer

get system sdwan status

Answer

diagnose netlink interface list

Question 7

An administrator configures an ALG for SIP traffic but notices that some SIP calls are failing. The admin suspects the ALG is modifying SIP headers incorrectly. Which debug command can help verify the ALG's actions on SIP packets?

Accepted Answer

diagnose debug application sip -1. 'diagnose debug application sip -1' enables SIP ALG debugging, showing how the ALG processes SIP messages.

Answer

diagnose debug application alg -1

Answer

get system performance status

Answer

diagnose sys session filter proto 17

Question 8

An administrator is troubleshooting a split-brain situation in an HA cluster. They run 'get system ha status' and see that both FortiGates report themselves as primary. Which command should they run to force the secondary unit to take over as primary?

Accepted Answer

diagnose sys ha reset-uptime. Option D is correct. The 'diagnose sys ha reset-uptime' command resets the HA uptime on the unit, causing it to recalculate priority. If the other unit has a higher priority, this can force a failover. Alternatively, 'execute ha failover' is not a valid command. The correct command to force a failover is 'execute ha failover set'? Actually, FortiGate does not have a direct failover command. The standard method is to reboot the primary or use 'diagnose sys ha reset-uptime'. Option D is the most appropriate.

Answer

execute ha failover

Answer

reboot the primary unit

Answer

diagnose sys ha stop

Question 9

An administrator observes that after a failover in an HA cluster, some established sessions are dropped. The cluster is configured with session pickup enabled. What is the most likely reason for the dropped sessions?

Accepted Answer

Session pickup only synchronizes TCP sessions, and the dropped sessions are UDP. Session pickup synchronizes sessions between HA members, but if the session was established before the cluster was fully synchronized, or if the session table is full, sessions may be dropped. However, the most common reason is that session pickup only works for TCP sessions, not UDP or other protocols.

Answer

The failover occurred during a configuration synchronization

Answer

The HA uptime is less than the session TTL

Answer

The session helper for the protocol is not enabled

Question 10

An administrator runs 'diagnose sys top' and sees process 'httpsd' consuming 95% CPU. What is the best immediate action to alleviate the issue?

Accepted Answer

Change the administration HTTPS port and restrict access to trusted hosts. The httpsd process handles HTTPS administrative access. High CPU could be due to brute-force attacks or excessive GUI logins. The best action is to change the administrative access port or limit access via trusted hosts.

Answer

Kill the httpsd process

Answer

Disable HTTPS administration access

Answer

Reboot the FortiGate

Question 11

An administrator runs 'diagnose debug application fnbam -1' and sees messages like 'LB_SELECT: selected server 10.0.0.2:80' but the client connection fails. The FortiGate is configured with server load balancing. What could be the issue?

Accepted Answer

The real server is not reachable or is down. The debug shows the load balancer selected a server, but the connection fails. This indicates the server is not responding or the health check is failing. The administrator should check the server's health and ensure the real server is up.

Answer

The load balancing algorithm is set to least-connection

Answer

The persistence setting is misconfigured

Answer

The virtual server IP is overlapping with a physical interface

Question 12

A FortiGate administrator runs 'diagnose debug application sslvpn -1' and sees repeated messages: 'SSL VPN tunnel error: no response from client'. What is the most likely cause?

Accepted Answer

The client cannot reach the FortiGate's SSL VPN IP or port. This error typically indicates the SSL VPN client is not responding during tunnel setup, often due to network connectivity issues or a firewall blocking the required ports.

Answer

The authentication server is unreachable

Answer

The tunnel mode is configured for web mode instead of tunnel mode

Answer

The SSL VPN certificate has expired

Question 13

An administrator needs to verify if a FortiGate is receiving BGP routes from a peer. Which command should the admin run to see the BGP routing table?

Accepted Answer

get router info bgp table. 'get router info bgp table' displays the BGP routing table, showing learned and advertised routes.

Answer

get router info routing-table bgp

Answer

show ip bgp

Answer

diagnose ip router bgp table

Question 14

A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?

Accepted Answer

SSL/TLS deep inspection is not enabled on the firewall policy. Option B is correct because HTTPS uses TLS encryption. Without SSL deep inspection enabled on the policy, FortiGate cannot decrypt and inspect the content of HTTPS traffic. The antivirus profile will only scan unencrypted traffic or traffic where deep inspection has decrypted it first.

Answer

The web server's certificate is self-signed and FortiGate is rejecting the connection

Answer

The FortiGuard antivirus subscription has expired

Answer

The antivirus profile is configured for flow-based inspection instead of proxy-based

Question 15

A site-to-site IPsec VPN tunnel is failing. The administrator runs 'diagnose vpn ike config' and sees that phase 1 parameters are correct. However, phase 2 negotiation fails with 'no proposal chosen'. What is the MOST likely cause?

Accepted Answer

The phase 2 encryption/authentication algorithms do not match between peers. Option A is correct. The 'no proposal chosen' error in phase 2 indicates a mismatch in the phase 2 parameters (encryption, authentication, PFS, etc.) between the two peers. The administrator should verify that the phase 2 selectors and proposals match on both ends.

Answer

The pre-shared key is incorrect

Answer

The firewall policy allowing IKE traffic is missing

Answer

The remote gateway IP address is wrong