NSE7 Troubleshooting and Diagnostics Practice Test 10 — 15 Questions

Question 1

An administrator runs 'diagnose debug application fnbam -1' and sees messages like 'LB_SELECT: selected server 10.0.0.2:80' but the client connection fails. The FortiGate is configured with server load balancing. What could be the issue?

Accepted Answer

The real server is not reachable or is down. The debug shows the load balancer selected a server, but the connection fails. This indicates the server is not responding or the health check is failing. The administrator should check the server's health and ensure the real server is up.

Answer

The load balancing algorithm is set to least-connection

Answer

The persistence setting is misconfigured

Answer

The virtual server IP is overlapping with a physical interface

Question 2

An administrator wants to view the current number of active sessions on a FortiGate. Which CLI command should be used?

Accepted Answer

get system performance status. The command 'get system performance status' provides a snapshot of system performance including session count. Alternatively, 'diagnose sys session stat' can be used.

Answer

exec system session count

Answer

show system session count

Answer

diagnose sys session list

Question 3

An administrator is troubleshooting an IPsec VPN tunnel that fails to establish. Phase 1 seems to complete, but Phase 2 fails with 'no proposal chosen'. The administrator checks the Phase 2 configuration and sees the following settings: 'Local address: 10.0.0.0/24, Remote address: 192.168.0.0/24, Proposal: aes256-sha1, Enable Perfect Forward Secrecy (PFS): Disabled'. Which TWO changes would most likely resolve the issue? (Choose two.)

Accepted Answer

Enable PFS on FortiGate. Phase 2 failure with 'no proposal chosen' indicates a mismatch in proposal or selectors. Common causes: PFS mismatch (if remote requires PFS) or selector mismatch (subnets).

Answer

Change the local address to 10.0.0.0/8

Answer

Add aes256-sha256 to the Phase 2 proposal

Answer

Increase the Phase 2 lifetime

Question 4

A FortiGate is experiencing high memory usage due to a large number of UDP sessions. The administrator wants to reduce memory consumption without dropping legitimate traffic. Which THREE actions could help? (Choose three.)

Accepted Answer

Enable session-ttl to enforce idle timeout. High session memory can be mitigated by reducing session timeouts, enabling session-ttl, or using session helper timeouts. Also, increasing memory is not practical. Filtering sessions may drop legitimate traffic.

Answer

Increase the maximum session limit

Answer

Upgrade the FortiGate hardware

Question 5

An administrator is investigating a security incident using FortiAnalyzer logs. The admin needs to identify all connections from a specific internal IP (10.0.0.100) to external servers on TCP port 443 during the last hour. Which TWO log fields should be used to filter the logs? (Choose two.)

Accepted Answer

dstport. To filter traffic from a source IP and destination port, the administrator should use the source IP field and the destination port field. The service field may also show port but is less precise.

Answer

dstip

Answer

action

Answer

policyid

Question 6

A network administrator runs 'get system ha status' on a FortiGate HA cluster and sees that only one unit shows as primary. The secondary unit shows as 'standalone' with no HA peer detected. What is the MOST likely cause of this issue?

Accepted Answer

The heartbeat interface is down or misconfigured. When the HA heartbeat link is down, the secondary unit cannot detect the primary and will operate as standalone. The serial number mismatch or priority settings would cause different behavior (e.g., split-brain or both primary).

Answer

The cluster serial numbers do not match

Answer

The HA group ID is different on each unit

Answer

The HA priority on the secondary unit is set to 0

Question 7

An administrator is troubleshooting an SD-WAN scenario where traffic from a branch office to a critical SaaS application is experiencing high latency. The SD-WAN rule uses the best quality SLA strategy. The administrator runs 'diagnose sys sdwan neighbor' and sees that both WAN links have SLA compliance above 90%. However, traffic still uses the slower link. The administrator then runs 'diagnose sys sdwan health-check list' and notices that the health-check server IP is different from the SaaS application's server IP. What is the MOST likely reason the traffic is not using the best-performing link?

Accepted Answer

The health-check server's IP does not match the application's destination IP, so SLA measurements are not representative. SD-WAN SLA health checks measure performance to a specific server (e.g., a public DNS or internet IP). If the actual application traffic goes to a different server, the measured SLA may not reflect the real path performance to that destination. The route selection logic uses SLA results only for the configured health-check server.

Answer

The SD-WAN rule is configured with 'set load-balance-mode' instead of 'best-quality'

Answer

The health-check server is not reachable from the faster link

Answer

The SD-WAN rule has a manual routing override configured

Question 8

A FortiGate administrator is troubleshooting a BGP session that fails to establish with a neighbor at 10.0.1.1. Running 'diagnose ip router bgp all' shows the neighbor state as 'Idle'. Which TWO commands should the administrator run NEXT to diagnose the issue?

Accepted Answer

show full-configuration router bgp. To diagnose BGP neighbor establishment issues, the administrator should check both the BGP configuration (including neighbor settings) and the network connectivity (e.g., TCP port 179) between peers.

Answer

diagnose ip router bgp all

Answer

diagnose sys session filter dport 179

Answer

get router info bgp summary

Question 9

An administrator is troubleshooting a VPN tunnel between two FortiGates. The phase 1 fails to come up. The administrator runs 'diagnose vpn ike log' and sees the error 'no proposal chosen'. Which THREE configuration mismatches could cause this error?

Accepted Answer

Different Diffie-Hellman groups (e.g., DH5 vs DH14). The 'no proposal chosen' error in IKE phase 1 indicates that the two peers cannot agree on the IKE SA parameters. Common mismatches include encryption algorithm, authentication method, and Diffie-Hellman group.

Answer

Mismatched local and remote gateway IPs

Answer

Mismatched pre-shared keys

Question 10

A network admin is investigating a high CPU usage issue on a FortiGate firewall. The admin runs 'diagnose sys top' and sees that the 'ipsengine' process is consuming 70% CPU. Which THREE actions should the admin take to reduce CPU load?

Accepted Answer

Review and optimize IPS signatures; disable unnecessary signatures. High CPU usage from ipsengine can be mitigated by tuning IPS profiles, offloading inspection to NPU, or raising thresholds to reduce load from less important traffic.

Answer

Increase the IPS engine process priority

Answer

Increase the IPS engine process priority

Answer

Disable IPS on all policies

Question 11

An administrator is investigating a security incident using FortiAnalyzer logs. The admin wants to identify all traffic that matched a specific firewall policy. Which TWO log fields should the admin use to filter the logs?

Accepted Answer

policyid. In FortiAnalyzer logs, the policy ID (usually 'policyid' or 'policy_id') and source interface (e.g., 'srcintf') are key fields to identify which firewall policy matched the traffic. Other fields like destination IP or user name are not directly tied to the policy ID.

Answer

user

Answer

appid

Answer

dstip

Question 12

A FortiGate in an HA cluster is experiencing intermittent session synchronization failures. The administrator runs 'diagnose sys ha dump sync-status' and sees that sessions are not being synchronized properly. Which TWO potential causes should the administrator investigate?

Accepted Answer

Excessive number of sessions exceeding the session sync limit. Session sync failures in HA can be caused by network issues on the heartbeat link or session table overload. Authentication or routing issues are less direct causes.

Answer

Mismatched HA group IDs

Answer

Incorrect BGP route advertisements

Answer

Mismatched HA passwords

Question 13

An administrator is troubleshooting a scenario where VoIP traffic is not being properly handled by the FortiGate. The SIP ALG is enabled. Which THREE commands should the administrator run to diagnose the SIP traffic flow?

Accepted Answer

diagnose sys session filter dport 5060. To diagnose SIP ALG issues, the administrator should check SIP-specific debug, session table for UDP 5060, and application control logs. Viewing general traffic logs is less specific, and checking the routing table is not directly relevant to ALG processing.

Answer

get router info routing-table all

Answer

diagnose debug application sip -1

Question 14

An administrator notices that after upgrading FortiOS, some traffic that was previously inspected by the antivirus profile is now bypassing scanning. The administrator suspects the session helper configuration may be interfering. Which TWO session helper protocols are known to potentially affect traffic inspection if improperly configured?

Accepted Answer

FTP. Session helpers like SIP and FTP can alter sessions (e.g., opening dynamic ports) which can cause traffic to bypass security profiles if not handled correctly. TFTP and HTTP helpers are less likely to cause such issues; PPTP is less common.

Answer

TFTP

Answer

PPTP

Answer

HTTP

Question 15

An administrator is troubleshooting an IPsec VPN tunnel that establishes phase 1 but fails to establish phase 2. The phase 2 configuration shows 'set proposal aes128-sha256' on both sides. Which TWO configuration items should the administrator verify?

Accepted Answer

PFS (Perfect Forward Secrecy) settings. Even if phase 1 succeeds, phase 2 can fail due to mismatched proxy IDs (local/remote subnets) or mismatched PFS settings. Authentication method and encryption algorithm are phase 1 parameters.

Answer

The local authentication method (certificate vs pre-shared key)

Answer

The encryption algorithm for phase 2

Answer

The pre-shared key