NSE7 Troubleshooting and Diagnostics Practice Test 2 — 15 Questions

Question 1

An administrator is troubleshooting a scenario where traffic from VLAN 100 to a server at 10.1.2.100 is being blocked. The FortiGate has an active security policy allowing the traffic and the routing table shows a correct route. Which TWO diagnostic commands should the administrator run to identify the cause of the blockage?

Accepted Answer

diagnose sniffer packet any 'host 10.1.2.100' 4. Option A is correct because 'diagnose sniffer packet any host 10.1.2.100 4' captures packets to/from the server at the interface level, allowing the administrator to see if traffic from VLAN 100 is actually arriving at the FortiGate and whether it is being dropped or forwarded. This command helps identify if the issue is at Layer 2 (e.g., VLAN misconfiguration) or Layer 3 (e.g., routing or firewall drops).

Answer

get system performance status

Answer

diagnose ip arp list

Answer

diagnose sys session list

Question 2

A FortiGate is blocking HTTP traffic from 10.0.1.5 to 10.0.2.100, despite an explicit allow policy. The exhibit shows the configuration and debug flow output. What is the most likely cause?

Accepted Answer

TCP SYN flood protection is dropping the incomplete session.. The debug flow output shows the session is in a 'SYN_RECV' state and never transitions to 'ESTABLISHED', which is characteristic of TCP SYN flood protection. When the FortiGate's SYN flood protection threshold is exceeded, it drops incomplete sessions before they can be fully established, even if an explicit allow policy exists. This explains why HTTP traffic from 10.0.1.5 to 10.0.2.100 is blocked despite the policy being correctly configured.

Answer

The policy is applied to the wrong source interface.

Answer

The policy action is set to deny.

Answer

The source address object does not include 10.0.1.5.

Question 3

A FortiGate is deployed as the edge firewall for a medium-sized enterprise. The network has three internal zones: Trust (10.10.0.0/16), DMZ (172.16.0.0/24), and Guest (192.168.0.0/24). The FortiGate has an IPSec VPN to a branch office (10.20.0.0/16). Users in the Trust zone report intermittent connectivity to a web server in the DMZ (172.16.0.10, TCP port 443). The FortiGate logs show occasional 'session denied' messages for traffic from Trust to DMZ with reason 'denied by forward policy check'. The security policy has an explicit allow rule for Trust to DMZ HTTPS. The administrator has verified routing is correct and there are no address overlaps. When the issue occurs, the administrator runs 'diag debug flow' and sees that the packet matches the correct policy but still gets denied. The debug output also shows 'forward policy check: denied'. What is the most likely cause and recommended action?

Accepted Answer

A traffic shaping policy or application control profile is blocking the traffic; review and adjust the traffic shaping policy or application control profile applied to the policy.. The debug flow output shows the packet matches the correct security policy but is still denied by 'forward policy check'. This indicates that a secondary policy component, such as a traffic shaping policy or application control profile, is blocking the traffic. These features can override the security policy action if they are configured to deny or drop matching traffic, even when the security policy itself is set to allow.

Answer

The route to the DMZ is intermittently flapping; add a static route with a higher distance.

Answer

The security profiles (AV, IPS) are blocking the traffic; temporarily disable all security profiles on the policy.

Answer

The session helper for HTTPS is interfering; disable the HTTPS session helper.

Question 4

Drag and drop the steps to perform a firmware upgrade on a FortiGate device into the correct order.

Question 5

Match each high availability (HA) mode to its characteristic.

Question 6

A network administrator runs 'diagnose sys top' and sees that the 'ipsengine' process is consistently using 99% CPU. What is the BEST immediate action to reduce CPU load?

Accepted Answer

Disable IPS inspection on policies that don't require it. Option B is correct because disabling IPS inspection will stop the IPS engine from processing traffic, thus reducing CPU load. Option A would not help if the issue is CPU load. Option C might help but is less direct. Option D is not relevant.

Answer

Reboot the FortiGate

Answer

Increase the session limit

Answer

Change IPS engine to flow-based mode

Question 7

When troubleshooting an IPsec VPN phase 1 failure, you run 'diagnose vpn ike config' and see that the remote gateway IP address is incorrect. Which command is used to correct the peer IP configuration?

Accepted Answer

config vpn ipsec phase1-interface edit set remote-gw . Option A is correct because the peer IP is configured under the phase1-interface settings using the 'set remote-gw' command. Option B is for PSK. Option C is for certificate. Option D is a diagnose command, not configuration.

Answer

set psksecret <secret>

Answer

execute vpn tunnel down <tunnel>

Answer

set certificate <name>

Question 8

In an HA cluster, after a failover, some established sessions are not being synchronized to the new primary unit. Which setting must be enabled to ensure session synchronization?

Accepted Answer

set session-pickup enable. Option B is correct because 'set session-pickup enable' under config system ha enables session synchronization between HA members. Option A controls failover order. Option C is for priority. Option D is not a valid setting.

Answer

set override enable

Answer

set sync-sessions enable

Answer

set priority <value>

Question 9

You are troubleshooting an SD-WAN rule where traffic is not matching the expected SLA. The FortiGate shows 'SLA mismatch' in logs. What is the MOST likely cause?

Accepted Answer

The measured SLA values exceed the configured thresholds. Option C is correct because an SLA mismatch typically indicates the interface's measured SLA parameters (latency, jitter, packet loss) do not meet the thresholds defined in the SLA rule. Option A would prevent rule matching entirely. Option B would not directly cause SLA mismatch. Option D is not relevant.

Answer

The interface is down

Answer

The SLA probe server is unreachable

Answer

The SD-WAN rule is not enabled

Question 10

You receive an alert that FortiAnalyzer log disk usage is at 95%. Which action should you take to immediately free up space without losing important logs?

Accepted Answer

Configure log archiving to an external storage. Option C is correct because archiving old logs to external storage is the best practice to free space while preserving logs. Option A would lose logs. Option B is not a standard feature. Option D is temporary.

Answer

Delete all logs older than 30 days

Answer

Enable log compression

Answer

Increase log disk quota

Question 11

A FortiGate admin runs 'diagnose debug application authd -1' but sees no output for LDAP authentication attempts. What is the MOST likely reason?

Accepted Answer

Debug flow is not enabled. Option B is correct because without enabling debug flow or setting debug level, authd may not output debug messages. Option A is not specific to authd. Option C would cause connection errors, not silent. Option D is unlikely.

Answer

The LDAP server is unreachable

Answer

The FortiGate is in FIPS mode

Answer

The LDAP server timed out

Question 12

You are troubleshooting a BGP neighbor flapping. The neighbor state shows 'Active'. Which command will help you see the reason for the state change?

Accepted Answer

get router info bgp neighbors rejected-routes. Option D is correct because 'get router info bgp neighbors rejected-routes' shows routes that were rejected and the reason. Option A shows established neighbors. Option B shows summary. Option C shows received routes but not rejection reasons.

Answer

get router info bgp neighbors

Answer

get router info bgp neighbors <neighbor> received-routes

Answer

get router info bgp summary

Question 13

You run 'diagnose sys session filter dport 443' and see sessions with a duration of 7200 seconds and expire time of 3600 seconds. What does this indicate?

Accepted Answer

The session has been alive for 7200 seconds and will expire in 3600 seconds. Option C is correct because expire time being less than duration indicates the session has been alive longer than its remaining lifetime, which could mean the session is about to expire or there is a timing issue. Option A is incorrect because the expire is less than duration. Option B is incorrect because the session is still active. Option D is not supported by data.

Answer

The session has been idle for 7200 seconds

Answer

The session helper is interfering with the session

Answer

The session has already expired

Question 14

An administrator wants to monitor CPU usage of specific processes on a FortiGate. Which command should be used?

Accepted Answer

diagnose sys top. Option C is correct because 'diagnose sys top' shows real-time process CPU usage. Option A shows system resources summary. Option B shows system performance statistics. Option D is a Linux command not available on FortiOS.

Answer

get system performance status

Answer

get system performance

Answer

top

Question 15

When testing HA failover, you manually switch the primary unit to standby. The secondary unit becomes primary but does not take over the IP address of the virtual cluster. What is the MOST likely cause?

Accepted Answer

The HA mode is set to 'load-balance' without a virtual cluster IP. Option A is correct because if the HA mode is configured as 'standalone' (load balance without virtual IP) or if the virtual cluster configuration is missing, the IP might not be taken over. Option B is not a typical cause. Option C would affect sessions, not IP takeover. Option D is not relevant.

Answer

Session pickup is not enabled

Answer

The HA interface monitoring is disabled

Answer

The HA cluster is in split-brain