NSE7 Troubleshooting and Diagnostics Practice Test 3 — 15 Questions

Question 1

When troubleshooting an IPsec VPN phase 1 failure, you run 'diagnose vpn ike config' and see that the remote gateway IP address is incorrect. Which command is used to correct the peer IP configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

config vpn ipsec phase1-interface edit set remote-gw . The 'config vpn ipsec phase1-interface' command allows you to edit the phase1 configuration, and the 'set remote-gw ' command directly corrects the peer IP address. This is the standard FortiGate CLI method to update the remote gateway IP for an IPsec VPN phase1 interface, which is essential for establishing the IKE session.

Answer

set psksecret <secret>

Answer

execute vpn tunnel down <tunnel>

Answer

set certificate <name>

Question 2

In an HA cluster, after a failover, some established sessions are not being synchronized to the new primary unit. Which setting must be enabled to ensure session synchronization?

Accepted Answer

set session-pickup enable. Session-pickup is the FortiGate HA feature that synchronizes the state of established sessions from the primary unit to the backup unit. When a failover occurs, the new primary unit can continue forwarding traffic for those sessions without interruption only if session-pickup is enabled. Without it, all existing sessions are dropped and must be re-established by the clients.

Answer

set override enable

Answer

set sync-sessions enable

Answer

set priority <value>

Question 3

You are troubleshooting an SD-WAN rule where traffic is not matching the expected SLA. The FortiGate shows 'SLA mismatch' in logs. What is the MOST likely cause?

Accepted Answer

The measured SLA values exceed the configured thresholds. The 'SLA mismatch' log indicates that the measured SLA values (e.g., jitter, latency, packet loss) for the traffic have exceeded the configured thresholds in the SD-WAN rule. This causes the FortiGate to consider the link as not meeting the SLA, even though the interface is up and the probe server is reachable. The SD-WAN rule itself is enabled, but the traffic is steered away from the preferred member because the SLA is not satisfied.

Answer

The interface is down

Answer

The SLA probe server is unreachable

Answer

The SD-WAN rule is not enabled

Question 4

You receive an alert that FortiAnalyzer log disk usage is at 95%. Which action should you take to immediately free up space without losing important logs?

Accepted Answer

Configure log archiving to an external storage. Configuring log archiving to an external storage immediately offloads logs from the FortiAnalyzer local disk to a remote location (e.g., NFS, FTP, or SCP), freeing up disk space without deleting any logs. This preserves all historical log data for compliance and forensic analysis while resolving the high disk usage alert.

Answer

Delete all logs older than 30 days

Answer

Enable log compression

Answer

Increase log disk quota

Question 5

A FortiGate admin runs 'diagnose debug application authd -1' but sees no output for LDAP authentication attempts. What is the MOST likely reason?

Accepted Answer

The FortiGate is in FIPS mode. The 'diagnose debug application authd -1' command enables verbose debug logging for the authentication daemon. However, on a FortiGate running in FIPS mode, many debug commands are restricted or produce no output to comply with security requirements. This is the most likely reason for observing no LDAP authentication debug output. Other possible reasons include running the command after authentication attempts have completed, but FIPS mode is a definitive system-level constraint.

Answer

The LDAP server is unreachable

Answer

The LDAP server timed out

Answer

Debug flow is not enabled

Question 6

You run 'diagnose sys session filter dport 443' and see sessions with a duration of 7200 seconds and expire time of 3600 seconds. What does this indicate?

Accepted Answer

The session has been alive for 7200 seconds and will expire in 3600 seconds. The 'duration' field in the 'diagnose sys session filter' output shows how long the session has been active (7200 seconds), while the 'expire' field indicates the remaining time before the session times out (3600 seconds). Option C correctly interprets both values. This is standard FortiGate session table behavior, where each session has a configurable timeout (e.g., default TCP timeout is 3600 seconds for established sessions).

Answer

The session has been idle for 7200 seconds

Answer

The session helper is interfering with the session

Answer

The session has already expired

Question 7

An administrator wants to monitor CPU usage of specific processes on a FortiGate. Which command should be used?

Accepted Answer

diagnose sys top. The 'diagnose sys top' command is the correct tool for monitoring CPU usage of specific processes on a FortiGate because it provides a real-time, interactive view of process-level CPU and memory utilization, allowing the administrator to identify which processes are consuming resources. Unlike the other options, this diagnostic command is specifically designed for granular process monitoring in FortiOS.

Answer

get system performance status

Answer

get system performance

Answer

top

Question 8

When testing HA failover, you manually switch the primary unit to standby. The secondary unit becomes primary but does not take over the IP address of the virtual cluster. What is the MOST likely cause?

Accepted Answer

The HA mode is set to 'load-balance' without a virtual cluster IP. In an HA cluster configured in load-balance mode, the virtual cluster IP address is not automatically transferred during failover unless a virtual cluster IP is explicitly configured. When the primary unit is manually switched to standby, the secondary unit becomes primary but lacks the virtual cluster IP assignment, so it cannot take over that address. This is the most likely cause because the virtual cluster IP is essential for client traffic to reach the active unit in load-balance mode.

Answer

Session pickup is not enabled

Answer

The HA interface monitoring is disabled

Answer

The HA cluster is in split-brain

Question 9

You are troubleshooting a VPN phase 2 negotiation failure. The logs show 'no proposal chosen'. What is the MOST likely cause?

Accepted Answer

The phase 2 proposal settings differ between the peers. The 'no proposal chosen' error in VPN phase 2 indicates that the IPsec peers could not agree on a common set of phase 2 parameters (such as encryption algorithm, authentication algorithm, or PFS group). Since phase 2 negotiation occurs after IKE phase 1 has successfully completed, the issue is specifically with the IPsec SA proposal settings, not with pre-shared keys or IKE version. Therefore, differing phase 2 proposals between the peers are the most likely cause.

Answer

The remote gateway IP is incorrect

Answer

The pre-shared key mismatch

Answer

The IKE version mismatch

Question 10

An administrator wants to troubleshoot why specific traffic is not matching a configured firewall policy. Which debug command should be used?

Accepted Answer

diagnose debug flow. The 'diagnose debug flow' command is the correct tool for tracing traffic through the firewall policy engine in FortiOS. It captures the packet flow in real time, showing which policy is evaluated, why a match or no-match occurs, and any drop reasons. This directly addresses the administrator's need to troubleshoot why specific traffic is not matching a configured firewall policy.

Answer

diagnose sys session list

Answer

get firewall policy <id>

Answer

diagnose netlink interface list

Question 11

A network administrator is troubleshooting a split-brain scenario in an HA cluster. Which TWO conditions can cause split-brain? (Choose two.)

Accepted Answer

Loss of heartbeat link between HA members. Options A and D are correct. Loss of HA heartbeat communication (A) causes both units to think they are primary. Mismatched HA configuration (D) can also cause split-brain. Option B causes failover but not split-brain. Option C is irrelevant.

Answer

One unit has a higher priority

Answer

Firmware version mismatch

Answer

Session pickup is disabled

Question 12

You are troubleshooting BGP route advertisement issues. Which THREE debug commands would be useful to identify why a route is not being advertised to a neighbor? (Choose three.)

Accepted Answer

diagnose debug router bgp . The 'diagnose debug router bgp ' command enables real-time debugging of BGP events for a specific neighbor, allowing you to see why a route is being filtered or not advertised (e.g., due to prefix-list, AS-path, or next-hop unreachable issues). This is a Fortinet-specific debug command that provides granular insight into the BGP decision process for that neighbor.

Answer

get router info bgp neighbors <neighbor> received-routes

Answer

get router info bgp summary

Question 13

An administrator notices that some traffic through the FortiGate is not being inspected by the application control profile. Which TWO reasons could explain this? (Choose two.)

Accepted Answer

The application control profile is disabled. The two valid reasons are that traffic may match a different policy without the application control profile (E), and that the application control profile may be disabled on the policy the traffic hits (D). Option A is incorrect because proxy-based inspection is required for application control; setting it to proxy-based enables inspection. Option B is incorrect because outdated signatures still allow inspection, albeit with reduced effectiveness. Option C is incorrect because high memory usage may impact performance but does not entirely prevent inspection.

Answer

The inspection mode is set to proxy-based

Answer

The application control signatures are outdated

Answer

The FortiGate has high memory usage

Question 14

A network administrator runs the command 'diagnose debug application ssl -1' and sees the following output: 'ssl_generate_proxy_cert: cannot find CA certificate for issuer CN=www.example.com'. What is the MOST likely cause?

Accepted Answer

The SSL/SSH inspection profile is configured with an incorrect CA certificate. The error 'cannot find CA certificate for issuer CN=www.example.com' indicates that the FortiGate's SSL/SSH inspection profile is configured to use a specific CA certificate to re-sign the web server's certificate, but that CA certificate is not present in the FortiGate's certificate store. This occurs when the inspection profile references a CA certificate that has been deleted, not imported, or misconfigured, preventing the generation of a proxy certificate for SSL inspection.

Answer

The FortiGate does not have an internet connection to reach the CA certificate authority

Answer

The firewall policy does not have SSL inspection enabled

Answer

The web server's certificate has expired

Question 15

An administrator is troubleshooting an HA cluster (active-passive) where both units show 'primary' in 'get system ha status'. The cluster is not synchronizing configurations. What is the MOST likely cause?

Accepted Answer

The HA heartbeat interface is disconnected or misconfigured. In an active-passive HA cluster, both units showing 'primary' indicates a failure in heartbeat communication. The HA heartbeat interface is used to exchange cluster state and session information; if it is disconnected or misconfigured, each unit assumes the other is down and transitions to primary, leading to a split-brain scenario. This prevents configuration synchronization because the units cannot agree on a primary-secondary role.

Answer

The HA password is incorrect

Answer

The HA group ID is mismatched

Answer

The HA priority values are equal for both units