NSE7 Troubleshooting and Diagnostics Practice Test 2 — 15 Questions

Question 1

Based on the debug flow output, what is the reason the packet is dropped?

Accepted Answer

There is no firewall policy that matches the traffic.. The debug flow output indicates that the packet was dropped because no firewall policy matched the traffic. In FortiGate, even if a valid route exists, the packet must be evaluated against firewall policies; if no policy permits the traffic based on source, destination, service, and interface, the packet is silently dropped. The debug flow will show a message like 'no matching policy' or 'deny by policy' in such cases.

Answer

The route to the destination is missing.

Answer

The packet has an invalid source IP address.

Answer

The session table is full.

Question 2

An administrator applies the above policy but users from 10.0.1.0/24 cannot access web servers at 10.0.2.0/24. However, they can ping the servers. What is the most likely cause?

Accepted Answer

The service 'HTTP' does not include port 443 or the web application is using HTTPS.. The policy allows HTTP traffic (port 80), but the web servers are likely using HTTPS (port 443). Since the service object 'HTTP' in FortiGate typically only includes TCP/80, HTTPS traffic is denied by default. The administrator can ping the servers because ICMP is permitted by an implicit or explicit policy, confirming that routing and connectivity are functional.

Answer

The destination address is incorrect.

Answer

The schedule 'always' is not correctly configured.

Answer

The source interface is incorrect.

Question 3

A FortiGate is experiencing high latency on traffic passing through it. The administrator suspects that asymmetric routing is occurring. Which TWO symptoms are indicative of asymmetric routing?

Accepted Answer

Traffic from the same source IP arrives on different interfaces for different sessions.. Asymmetric routing occurs when traffic from the same source IP takes different paths through the network, causing packets to arrive on different FortiGate interfaces for different sessions. This breaks stateful inspection because the firewall expects all packets of a session to traverse the same interface; when they don't, it can lead to session timeouts or dropped packets, manifesting as high latency.

Answer

The routing table shows multiple equal-cost paths to the same destination.

Answer

Traffic matching a policy is logged as allowed but the application does not work.

Answer

CPU usage is consistently above 90% during peak hours.

Question 4

A FortiGate cluster (A-P) has a session that is not synchronizing to the secondary unit. The administrator runs 'diagnose sys ha session-sync status' and sees that the session count is different between primary and secondary. Which is the most likely cause?

Accepted Answer

The session was created by a local-in traffic (e.g., management traffic) which is not synchronized.. FortiGate A-P clusters synchronize sessions via the HA heartbeat interface, but local-in traffic (e.g., management sessions like HTTPS, SSH, or SNMP) is never synchronized because it is destined to the cluster IP itself and is inherently unit-specific. The 'diagnose sys ha session-sync status' command shows a session count mismatch because the primary unit has local-in sessions that the secondary does not replicate, making D the correct answer.

Answer

The session is using a custom application control profile that prevents synchronization.

Answer

The HA heartbeat interface is down.

Answer

The secondary unit has insufficient memory to accept new sessions.

Question 5

A customer reports intermittent connectivity issues between two internal subnets separated by a FortiGate firewall. The traffic is allowed by the policy, but users experience timeouts during peak hours. Which troubleshooting step should you take first?

Accepted Answer

Check the session table for session limits and session congestion.. Intermittent connectivity during peak hours strongly suggests session table exhaustion or session congestion. The FortiGate's session table has a finite capacity, and when it fills up, new sessions are dropped, causing timeouts. Checking the session table for limits and congestion is the fastest, least intrusive first step to confirm whether the firewall is running out of session resources before performing more complex diagnostics.

Answer

Run a packet sniffer on the FortiGate to capture traffic between the subnets.

Answer

Disable hardware acceleration on the FortiGate.

Answer

Configure SNAT on the policy to translate the source IP.

Question 6

An administrator is troubleshooting a scenario where IPSec VPN tunnels between two FortiGates are flapping. The logs show Phase 1 is up but Phase 2 fails with 'no proposal chosen'. The remote FortiGate has multiple Phase 2 selectors configured. What is the most likely cause?

Accepted Answer

Mismatched Phase 2 proxy IDs (local/remote subnets).. The 'no proposal chosen' error during Phase 2, despite Phase 1 being up, indicates a mismatch in the IPsec security association (SA) parameters. Since the remote FortiGate has multiple Phase 2 selectors configured, the most likely cause is that the local and remote proxy IDs (local and remote subnets) do not match any of the configured selectors. Phase 2 negotiation uses these proxy IDs to define which traffic should be encrypted; if they don't align, the IKE SA cannot be established.

Answer

Mismatched pre-shared keys.

Answer

Dead Peer Detection (DPD) settings are too aggressive.

Answer

Certificate validation failure.

Question 7

A FortiGate is set up in a high availability (HA) cluster. The administrator notices that the primary unit is not synchronizing configuration changes to the secondary unit. The HA status shows 'synchronization failed'. What is the most likely cause?

Accepted Answer

The configuration has not been saved on the primary unit.. FortiGate HA requires the configuration to be saved (via 'execute backup config' or 'write memory') on the primary unit before it can be synchronized to the secondary unit. If the configuration is not saved, the primary unit does not have a committed configuration to push, leading to a 'synchronization failed' status even though the HA cluster is otherwise healthy.

Answer

The firmware versions are different on the two units.

Answer

The HA heartbeat interface is down.

Answer

NAT policies are misconfigured.

Question 8

Based on the exhibit, what can be concluded about the session?

Accepted Answer

The session is offloaded to the NPU for hardware acceleration.. The session state 'npu' indicates that the session has been offloaded to the Network Processor Unit (NPU) for hardware acceleration. This is a normal and expected state for traffic that matches hardware-offloadable profiles, allowing the NPU to process packets at wire speed without CPU intervention.

Answer

The session is a one-way session with only outbound traffic.

Answer

The session is not being logged.

Answer

The session is in the 'npu' state, meaning it is being processed by the CPU.

Question 9

A company runs a FortiGate 600E in NAT/Route mode. They have a site-to-site VPN to a partner using route-based VPN with BGP. Recently, they added a new subnet 192.168.50.0/24 behind the FortiGate. The BGP session is up, and the route is being advertised to the partner. However, traffic from the partner to the new subnet fails. The FortiGate's routing table shows the route to 192.168.50.0/24 is present via the VPN interface. Firewall policies allow the traffic. A packet capture on the FortiGate's internal interface shows the partner's traffic arriving but no SYN-ACK being sent back. The FortiGate's session table shows sessions in 'SYN_RECV' state for the new subnet. What is the most likely cause?

Accepted Answer

The Phase 2 selector for the VPN does not include the new subnet, so the FortiGate does not encrypt the reply traffic.. In a route-based VPN, the Phase 2 selectors define which traffic is allowed to be encrypted and decrypted. Even though BGP advertises the new subnet 192.168.50.0/24, if the Phase 2 selector on either side does not include this subnet, the FortiGate will not encrypt the reply traffic. The packet capture shows the SYN arriving, but no SYN-ACK is sent because the FortiGate cannot find a matching Phase 2 proposal to encrypt the response, causing the session to remain in SYN_RECV state.

Answer

The reverse path forwarding (RPF) check is dropping the incoming SYN.

Answer

The firewall policy is not configured with the correct source interface.

Answer

The BGP route advertisement is being filtered by a route map on the partner side.

Question 10

An administrator is troubleshooting a scenario where traffic from VLAN 100 to a server at 10.1.2.100 is being blocked. The FortiGate has an active security policy allowing the traffic and the routing table shows a correct route. Which TWO diagnostic commands should the administrator run to identify the cause of the blockage?

Accepted Answer

diagnose sniffer packet any 'host 10.1.2.100' 4. 'diagnose sniffer packet any host 10.1.2.100 4' captures packets to/from the server at the interface level, allowing the administrator to see if traffic from VLAN 100 is actually arriving at the FortiGate and whether it is being dropped or forwarded. This command helps identify if the issue is at Layer 2 (e.g., VLAN misconfiguration) or Layer 3 (e.g., routing or firewall drops).

Answer

get system performance status

Answer

diagnose ip arp list

Answer

diagnose sys session list

Question 11

A FortiGate is blocking HTTP traffic from 10.0.1.5 to 10.0.2.100, despite an explicit allow policy. The exhibit shows the configuration and debug flow output. What is the most likely cause?

Accepted Answer

TCP SYN flood protection is dropping the incomplete session.. The debug flow output shows the session is in a 'SYN_RECV' state and never transitions to 'ESTABLISHED', which is characteristic of TCP SYN flood protection. When the FortiGate's SYN flood protection threshold is exceeded, it drops incomplete sessions before they can be fully established, even if an explicit allow policy exists. This explains why HTTP traffic from 10.0.1.5 to 10.0.2.100 is blocked despite the policy being correctly configured.

Answer

The policy is applied to the wrong source interface.

Answer

The policy action is set to deny.

Answer

The source address object does not include 10.0.1.5.

Question 12

A FortiGate is deployed as the edge firewall for a medium-sized enterprise. The network has three internal zones: Trust (10.10.0.0/16), DMZ (172.16.0.0/24), and Guest (192.168.0.0/24). The FortiGate has an IPSec VPN to a branch office (10.20.0.0/16). Users in the Trust zone report intermittent connectivity to a web server in the DMZ (172.16.0.10, TCP port 443). The FortiGate logs show occasional 'session denied' messages for traffic from Trust to DMZ with reason 'denied by forward policy check'. The security policy has an explicit allow rule for Trust to DMZ HTTPS. The administrator has verified routing is correct and there are no address overlaps. When the issue occurs, the administrator runs 'diag debug flow' and sees that the packet matches the correct policy but still gets denied. The debug output also shows 'forward policy check: denied'. What is the most likely cause and recommended action?

Accepted Answer

A traffic shaping policy or application control profile is blocking the traffic; review and adjust the traffic shaping policy or application control profile applied to the policy.. The debug flow output shows the packet matches the correct security policy but is still denied by 'forward policy check'. This indicates that a secondary policy component, such as a traffic shaping policy or application control profile, is blocking the traffic. These features can override the security policy action if they are configured to deny or drop matching traffic, even when the security policy itself is set to allow.

Answer

The route to the DMZ is intermittently flapping; add a static route with a higher distance.

Answer

The security profiles (AV, IPS) are blocking the traffic; temporarily disable all security profiles on the policy.

Answer

The session helper for HTTPS is interfering; disable the HTTPS session helper.

Question 13

Drag and drop the steps to perform a firmware upgrade on a FortiGate device into the correct order.

Accepted Answer

Backup configuration, then Upload firmware image, then Confirm upgrade, then Verify upgrade. The correct sequence for a FortiGate firmware upgrade is to first back up the configuration, then upload the new firmware image, confirm the upgrade to start the process, and finally verify the upgrade after the device reboots. This ensures configuration safety and successful upgrade completion.

Answer

Upload firmware image, then Backup configuration, then Confirm upgrade, then Verify upgrade

Answer

Backup configuration, then Confirm upgrade, then Upload firmware image, then Verify upgrade

Answer

Backup configuration, then Upload firmware image, then Verify upgrade, then Confirm upgrade

Question 14

Match each high availability (HA) mode to its characteristic.

Accepted Answer

Active-Passive: One unit is active, others are standby.. The correct matches are A and B. Common confusions involve swapping the characteristics: Active-Passive uses a single active unit with standby, while Active-Active uses all units to handle traffic.

Answer

Active-Passive: All units are active and load balance.

Answer

Active-Active: Only one unit processes traffic, others monitor.

Question 15

A network administrator runs 'diagnose sys top' and sees that the 'ipsengine' process is consistently using 99% CPU. What is the BEST immediate action to reduce CPU load?

Accepted Answer

Disable IPS inspection on policies that don't require it. The 'ipsengine' process consuming 99% CPU indicates that IPS inspection is being applied to traffic that may not require it, causing excessive processing overhead. Disabling IPS on policies that do not need it (Option C) directly reduces the workload on the IPS engine without affecting other security functions or requiring a reboot. This is the most immediate and targeted action to alleviate CPU pressure.

Answer

Reboot the FortiGate

Answer

Increase the session limit

Answer

Change IPS engine to flow-based mode