NSE7 Troubleshooting and Diagnostics Practice Test 10 — 15 Questions

Question 1

An administrator runs 'diagnose sys top' and sees process 'httpsd' consuming 95% CPU. What is the best immediate action to alleviate the issue?

Accepted Answer

Change the administration HTTPS port and restrict access to trusted hosts. The 'httpsd' process handles HTTPS administration traffic. A CPU spike to 95% indicates a possible DoS attack or excessive management connections. Changing the HTTPS port and restricting access to trusted hosts immediately mitigates the attack surface without disrupting other services, as it limits the source of the malicious traffic.

Answer

Kill the httpsd process

Answer

Disable HTTPS administration access

Answer

Reboot the FortiGate

Question 2

Two FortiGates in an HA cluster are experiencing a split-brain scenario where both units become primary. The administrator checks the HA configuration and sees that the heartbeat interfaces are configured correctly but the link status is 'down' on both units. What could cause this?

Accepted Answer

The physical cable connecting the heartbeat interfaces is faulty. A split-brain occurs when heartbeat communication is lost. If the heartbeat interfaces show link down, it indicates a physical or layer-1 issue, such as a faulty cable or switch port.

Answer

The heartbeat interface has been administratively disabled

Answer

The HA group ID is different on each unit

Answer

The HA priority values are the same on both units

Question 3

An administrator is troubleshooting BGP and runs 'get router info bgp neighbors 10.0.0.1' and sees 'BGP state = Active'. The neighbor IP is reachable via ping. What is the most likely cause?

Accepted Answer

The BGP neighbor's remote-as is misconfigured. The BGP state 'Active' indicates that the router is actively trying to establish a TCP connection to the neighbor but is failing. Since the neighbor IP is reachable via ping (Layer 3 connectivity is fine), the most likely cause is a misconfiguration of the remote-as on one side, causing a BGP OPEN message mismatch (the received AS number does not match the expected remote-as). This prevents the TCP session from completing the BGP peering process.

Answer

The BGP update-source interface is missing

Answer

The BGP network statement is missing

Answer

The BGP router-id is not configured

Question 4

An administrator needs to monitor FortiGate session count and CPU usage over time using FortiAnalyzer. Which log type should be configured for this?

Accepted Answer

Performance logs. Performance logs are specifically designed to capture system resource utilization metrics such as CPU usage, memory consumption, and session counts over time. FortiAnalyzer uses these logs to generate historical performance graphs and reports, enabling administrators to monitor trends and identify resource bottlenecks. Security logs, event logs, and traffic logs do not contain the periodic, time-series resource data required for this monitoring purpose.

Answer

Security logs

Answer

Event logs

Answer

Traffic logs

Question 5

An administrator configured a firewall policy to inspect SMTP traffic using an antivirus profile. However, email attachments are not being scanned. The FortiGate is operating in proxy-based inspection mode. What is the most likely cause?

Accepted Answer

The SMTP session helper is not enabled. In proxy-based inspection mode, the FortiGate must reassemble the SMTP session to scan attachments. The SMTP session helper is required to parse the SMTP commands and data stream so the antivirus engine can access the attachments. Without the helper enabled, the FortiGate treats the traffic as raw TCP and cannot extract MIME parts for scanning.

Answer

The policy is set to 'accept' instead of 'deny'

Answer

The email is sent over TLS encryption

Answer

The antivirus profile is set to flow-based inspection

Question 6

A FortiGate is receiving BGP routes from a neighbor but not advertising them to other peers. The administrator runs 'get router info bgp network' and sees the routes are in the BGP table but not advertised. What is the most likely cause?

Accepted Answer

An outbound route map is applied that filters these routes. An outbound route map can explicitly filter which routes are advertised to BGP peers. Even though routes are present in the BGP table (as shown by 'get router info bgp network'), an outbound route map applied to the neighbor configuration can deny or modify those routes before they are sent, preventing their advertisement.

Answer

BGP synchronization is enabled and the routes are not in the IGP

Answer

The next hop is unreachable

Answer

The router-id is the same as the peer

Question 7

An administrator runs 'diagnose debug application fnbam -1' and sees messages like 'LB_SELECT: selected server 10.0.0.2:80' but the client connection fails. The FortiGate is configured with server load balancing. What could be the issue?

Accepted Answer

The real server is not reachable or is down. The 'LB_SELECT: selected server 10.0.0.2:80' message indicates that the FortiGate's load-balancing process has chosen a real server for the connection. However, the client connection fails, which points to a problem with the selected server itself. The most common cause is that the real server is unreachable or down, preventing the TCP handshake or HTTP response from completing, even though the load-balancing decision was made successfully.

Answer

The load balancing algorithm is set to least-connection

Answer

The persistence setting is misconfigured

Answer

The virtual server IP is overlapping with a physical interface

Question 8

An administrator wants to view the current number of active sessions on a FortiGate. Which CLI command should be used?

Accepted Answer

get system performance status. The command 'get system performance status' displays real-time system performance metrics, including the current number of active sessions (sessions in the session table). This is the correct CLI command for an administrator to view the active session count on a FortiGate.

Answer

exec system session count

Answer

show system session count

Answer

diagnose sys session list

Question 9

An administrator is troubleshooting an IPsec VPN tunnel that fails to establish. Phase 1 seems to complete, but Phase 2 fails with 'no proposal chosen'. The administrator checks the Phase 2 configuration and sees the following settings: 'Local address: 10.0.0.0/24, Remote address: 192.168.0.0/24, Proposal: aes256-sha1, Enable Perfect Forward Secrecy (PFS): Disabled'. Which TWO changes would most likely resolve the issue? (Choose two.)

Accepted Answer

Enable PFS on FortiGate. When PFS is enabled on one side but disabled on the other, Phase 2 will fail with 'no proposal chosen'. PFS requires both peers to agree on the Diffie-Hellman (DH) group used for generating new keying material. If the remote peer requires PFS and the FortiGate has it disabled, the proposal mismatch causes the failure.

Answer

Change the local address to 10.0.0.0/8

Answer

Add aes256-sha256 to the Phase 2 proposal

Answer

Increase the Phase 2 lifetime

Question 10

A network administrator runs 'get system ha status' on a FortiGate HA cluster and sees that only one unit shows as primary. The secondary unit shows as 'standalone' with no HA peer detected. What is the MOST likely cause of this issue?

Accepted Answer

The heartbeat interface is down or misconfigured. When a secondary unit shows as 'standalone' with no HA peer detected, it indicates that the heartbeat communication between the two FortiGate units has failed. The most common cause is that the heartbeat interface is down, misconfigured, or not physically connected, preventing the units from discovering each other as HA peers. Without a functioning heartbeat link, the secondary unit cannot join the cluster and remains in standalone mode.

Answer

The cluster serial numbers do not match

Answer

The HA group ID is different on each unit

Answer

The HA priority on the secondary unit is set to 0

Question 11

An administrator is troubleshooting an SD-WAN scenario where traffic from a branch office to a critical SaaS application is experiencing high latency. The SD-WAN rule uses the best quality SLA strategy. The administrator runs 'diagnose sys sdwan neighbor' and sees that both WAN links have SLA compliance above 90%. However, traffic still uses the slower link. The administrator then runs 'diagnose sys sdwan health-check list' and notices that the health-check server IP is different from the SaaS application's server IP. What is the MOST likely reason the traffic is not using the best-performing link?

Accepted Answer

The health-check server's IP does not match the application's destination IP, so SLA measurements are not representative. The SD-WAN rule uses the best quality SLA strategy, which selects the link with the best SLA metrics (latency, jitter, packet loss) for the traffic. However, if the health-check server IP does not match the SaaS application's destination IP, the SLA measurements are not representative of the actual path to the application. The SD-WAN device measures performance to the health-check server, not the application server, so the link that appears best for the health-check may be worse for the actual application traffic, causing the slower link to be selected.

Answer

The SD-WAN rule is configured with 'set load-balance-mode' instead of 'best-quality'

Answer

The health-check server is not reachable from the faster link

Answer

The SD-WAN rule has a manual routing override configured

Question 12

A FortiGate administrator is troubleshooting a BGP session that fails to establish with a neighbor at 10.0.1.1. Running 'diagnose ip router bgp all' shows the neighbor state as 'Idle'. Which TWO commands should the administrator run NEXT to diagnose the issue?

Accepted Answer

show full-configuration router bgp. 'show full-configuration router bgp' displays the complete BGP configuration, including all neighbor settings, network statements, and route-maps. This allows the administrator to verify that the neighbor at 10.0.1.1 is correctly configured with the proper remote-as, update-source, and any optional parameters that might prevent the session from leaving the Idle state. Option B is correct because a BGP session stuck in Idle often indicates a Layer 3 connectivity issue; pinging the neighbor confirms whether the destination is reachable, which is a fundamental prerequisite for TCP port 179 to establish.

Answer

diagnose ip router bgp all

Answer

diagnose sys session filter dport 179

Answer

get router info bgp summary

Question 13

An administrator is troubleshooting a scenario where VoIP traffic is not being properly handled by the FortiGate. The SIP ALG is enabled. Which THREE commands should the administrator run to diagnose the SIP traffic flow?

Accepted Answer

get router info routing-table all. To diagnose SIP traffic flow with SIP ALG enabled on FortiGate, the administrator should use three key commands. Option A: `get router info routing-table all` checks the routing table to ensure that SIP packets have a valid path to their destination. Option B: `diagnose sys session filter dport 5060` filters the session table to display only sessions using destination port 5060 (default SIP signaling port), allowing verification that SIP sessions are being tracked. Option C: `diagnose debug application sip -1` enables verbose debug logging for the SIP application, providing detailed information about how the SIP ALG processes each SIP packet, including parsing, rewriting, and errors. Together, these commands help identify routing issues, session tracking, and SIP ALG processing problems.

Answer

diagnose debug application sip -1

Question 14

An administrator notices that after upgrading FortiOS, some traffic that was previously inspected by the antivirus profile is now bypassing scanning. The administrator suspects the session helper configuration may be interfering. Which TWO session helper protocols are known to potentially affect traffic inspection if improperly configured?

Accepted Answer

FTP. FTP (File Transfer Protocol) uses separate control and data channels, and FortiGate's session helper dynamically opens pinholes for the data channel. If the FTP session helper is improperly configured or disabled, the antivirus scanner may not inspect the data channel traffic, allowing it to bypass scanning. This is a known issue when upgrading FortiOS if the session helper configuration is not migrated correctly.

Answer

TFTP

Answer

PPTP

Answer

HTTP

Question 15

An administrator is troubleshooting an IPsec VPN tunnel that establishes phase 1 but fails to establish phase 2. The phase 2 configuration shows 'set proposal aes128-sha256' on both sides. Which TWO configuration items should the administrator verify?

Accepted Answer

PFS (Perfect Forward Secrecy) settings. PFS ensures that if one session key is compromised, previous and future session keys remain secure by using a Diffie-Hellman exchange in phase 2. If PFS is enabled on one side but not the other, or if the DH groups do not match, phase 2 will fail even when the encryption and authentication proposals are identical. Since the phase 2 proposal 'aes128-sha256' matches on both sides, the mismatch likely lies in PFS settings.

Answer

The local authentication method (certificate vs pre-shared key)

Answer

The encryption algorithm for phase 2

Answer

The pre-shared key