NSE7 Troubleshooting and Diagnostics Practice Test 4 — 15 Questions

Question 1

An administrator wants to monitor real-time CPU usage per process on a FortiGate. Which command should be used?

Accepted Answer

diagnose sys top. The 'diagnose sys top' command on FortiGate displays real-time CPU usage per process, similar to the Linux 'top' command. This is the standard diagnostic tool for monitoring per-process CPU and memory consumption in real time, which directly meets the administrator's requirement.

Answer

diagnose hardware sysinfo cpu

Answer

get system performance status

Answer

show system performance monitor

Question 2

A BGP session between FortiGate and a neighbor is in 'Active' state. The administrator has verified IP connectivity and that the neighbor IP is reachable. What is the MOST likely cause?

Accepted Answer

The remote AS number is misconfigured on either side. The BGP 'Active' state indicates that the router is actively trying to initiate a TCP connection to the neighbor but has not yet received a successful response. Since IP connectivity is verified, the most likely cause is a mismatch in the remote AS number configuration. BGP uses the AS number in the OPEN message to validate the peer; if the configured remote AS on one side does not match the local AS on the other, the neighbor will reject the connection, causing the session to remain in Active state.

Answer

The firewall policy is blocking BGP port 179

Answer

The BGP hold timer is set too high

Answer

The BGP network statement is missing

Question 3

An SD-WAN rule has two members: port1 (SLA target latency < 10ms) and port2 (SLA target latency < 20ms). The administrator runs 'diagnose sys sdwan sla-check' and sees that both members meet SLA. However, all traffic is going through port2. What is the MOST likely reason?

Accepted Answer

The SD-WAN rule is configured with 'set service' that does not match the traffic. If the SD-WAN rule has a 'set service' filter that does not match the traffic being tested (e.g., it only applies to HTTP traffic while the test traffic is ICMP or UDP), the rule will not be used for that traffic, causing the traffic to fall through to a default route or another rule that uses port2. Even though both members meet SLA, the traffic is not matched by the rule, so the SD-WAN load-balancing or strategy logic never applies.

Answer

The SD-WAN strategy is set to 'load balancing' and the load balancing algorithm is 'spillover'

Answer

The SD-WAN strategy is set to 'manual'

Answer

The 'update-static-route' is disabled on the SD-WAN

Question 4

A user reports that they cannot connect to a remote office via IPsec VPN. Phase 1 is up, but Phase 2 fails to establish. The administrator runs 'diagnose vpn ike log' and sees 'no matching phase2 proposal'. What should be checked?

Accepted Answer

The Phase 2 proposal settings (encryption, authentication, PFS) match on both peers. The error 'no matching phase2 proposal' indicates that the IPsec peers cannot agree on the Phase 2 parameters (encryption, authentication, PFS group, lifetime). Since Phase 1 is up, IKE negotiation for the secure channel succeeded, but the subsequent IPsec SA negotiation fails because the proposed transforms do not match. Option D directly addresses this mismatch by requiring verification of the Phase 2 proposal settings on both peers.

Answer

The firewall policies allow IKE traffic

Answer

The local and remote subnet definitions are correct

Answer

The pre-shared key is correct

Question 5

A FortiGate administrator uses FortiAnalyzer for log analysis and wants to identify all sessions that were blocked by a specific firewall policy ID 10. Which log filter should be applied?

Accepted Answer

Filter by 'policyid eq 10'. The correct filter to identify sessions from a specific policy in FortiAnalyzer is 'policyid eq 10'. This uses the proper field name 'policyid' and the 'eq' operator. Option B uses '==' which is invalid, and option C uses the incorrect field name 'policy_id'.

Answer

Filter by 'action eq block' and then manually look for policy 10

Answer

Filter by 'policyid == 10'

Answer

Filter by 'devid contains 10'

Question 6

An administrator configures a session helper for FTP but notices that active FTP data connections are not being allowed through the firewall. The FTP control session establishes fine. What is the MOST likely cause?

Accepted Answer

The FTP session helper is not enabled on the firewall policy. The session helper for FTP is a feature that must be explicitly enabled on the firewall policy to inspect and dynamically create pinholes for active FTP data connections. If the session helper is not enabled on the policy, the firewall will only allow the control session (port 21) but will not open the necessary high ports for the data channel, causing active FTP to fail while passive mode (which uses the control session for data negotiation) may still work.

Answer

The FTP server is using passive mode

Answer

The ALG is configured to use proxy-based inspection instead of flow-based

Answer

The firewall policy has NAT enabled

Question 7

A FortiGate administrator wants to see the current number of active sessions. Which command provides this information?

Accepted Answer

diagnose sys session stat. The 'diagnose sys session stat' command displays a summary of the current session table, including the total number of active sessions, which is exactly what the administrator needs. This command is part of FortiGate's diagnostic tools and provides a quick statistical overview without listing individual session details.

Answer

show system session-info

Answer

diagnose sys session list

Answer

get system performance status

Question 8

An HA cluster (active-passive) is configured. The administrator wants to perform a failover test without causing service disruption. Which command should be used?

Accepted Answer

execute ha failover. The 'execute ha failover' command triggers a controlled failover in an active-passive HA cluster, forcing the standby unit to become active without physically shutting down or rebooting the primary unit. This allows the administrator to test failover behavior while minimizing service disruption, as the cluster transitions gracefully and sessions are synchronized if session-pickup is enabled.

Answer

diagnose ha reset-uptime

Answer

execute shutdown on the primary

Answer

execute ha synchronize

Question 9

An administrator configures BGP route advertisement but the routes are not being sent to the neighbor. The BGP session is established. What is the MOST likely cause?

Accepted Answer

The 'network' statement is missing for the desired prefix. The BGP session is established, so Layer 3 connectivity and TCP port 179 are working. The most common reason for routes not being advertised to a neighbor is that the 'network' statement is missing for the desired prefix. In BGP, the 'network' command does not advertise the prefix unless it matches an exact route in the IP routing table; without it, BGP has no prefix to send, even if the session is up.

Answer

The BGP administrative distance is set too high

Answer

The BGP neighbor has the wrong update-source interface

Answer

The route is filtered by a route-map

Question 10

A FortiGate administrator needs to identify which process is consuming the most memory. Which command should be used?

Accepted Answer

diagnose sys top. The 'diagnose sys top' command displays a real-time list of running processes sorted by CPU and memory usage, allowing the administrator to identify which process is consuming the most memory. This is the standard FortiGate CLI command for process-level resource monitoring, similar to 'top' on Linux systems.

Answer

show system resource usage

Answer

diagnose hardware sysinfo memory

Answer

get system performance status

Question 11

An administrator is troubleshooting an IPsec VPN tunnel that fails to establish Phase 1. The debug output shows 'no acceptable proposal'. Which TWO configuration parameters should be checked to resolve this issue?

Accepted Answer

Encryption algorithm. The 'no acceptable proposal' error indicates that the two IPsec peers cannot agree on a Phase 1 proposal. The encryption algorithm and Diffie-Hellman group are both mandatory parameters in the IKE proposal that must match exactly between peers. If either parameter differs, the negotiation fails with this error.

Answer

IKE version

Answer

Pre-shared key

Answer

Local and remote subnets

Question 12

A FortiGate administrator is investigating a slow network issue. The 'diagnose sys session stat' shows a high number of sessions. Which THREE commands can help identify the source of the high session count?

Accepted Answer

diagnose sys session list | grep . 'diagnose sys session list | grep ' filters the session list to show only sessions matching a specific firewall policy ID. This allows the administrator to identify which policy is handling the most sessions, helping to pinpoint the source of high session counts by correlating traffic patterns with policy usage.

Answer

diagnose sys session stat

Answer

diagnose netlink interface list

Question 13

An administrator needs to troubleshoot an HA synchronization issue. Which TWO commands provide information about the HA synchronization status?

Accepted Answer

diagnose ha dump. The 'diagnose ha dump' command (C) provides detailed internal HA state information, including synchronization status, heartbeat details, and failover counters, which is essential for deep troubleshooting. The 'get system ha status' command (D) displays the current HA operational status, including synchronization state (e.g., 'synchronized' or 'out of sync'), making it a direct tool for checking sync health.

Answer

diagnose hardware sysinfo

Answer

show system ha

Answer

diagnose sys session stat

Question 14

A FortiGate admin runs 'diagnose debug application sslvpn -1' and sees repeated messages: 'SSL VPN tunnel establishment failed: no response from client.' The remote user reports that the FortiClient VPN connects but no traffic passes. What is the MOST likely cause?

Accepted Answer

A firewall on the remote user's network is blocking UDP port 4500 or TCP port 443. The 'no response from client' message indicates the FortiGate is not receiving the expected reply from the client during SSL VPN tunnel establishment. This typically occurs when a firewall on the remote user's network blocks UDP port 4500 (IPsec NAT traversal) or TCP port 443 (HTTPS control channel), preventing the FortiClient from completing the tunnel negotiation. The fact that the client 'connects' but no traffic passes suggests the initial SSL handshake succeeds, but the subsequent tunnel setup fails due to packet loss or filtering.

Answer

The SSL VPN realm is misconfigured

Answer

The SSL VPN certificate has expired

Answer

The remote user's FortiClient version is incompatible

Question 15

You are troubleshooting a BGP session between FortiGate and an ISP router. The FortiGate shows BGP state 'Active' and the debug output shows 'No route to peer'. The ISP router's loopback IP is 203.0.113.1, and the next-hop interface is port1 (10.0.0.1/30). The FortiGate has a static route to 203.0.113.1 via port1. What is the MOST likely cause?

Accepted Answer

The static route's outgoing interface (port1) is administratively down. The 'Active' BGP state combined with 'No route to peer' indicates that the FortiGate cannot reach the BGP neighbor IP (203.0.113.1) via the routing table. Even though a static route exists, if the outgoing interface (port1) is administratively down, the route is not installed in the FIB, making the peer unreachable. This directly matches option C.

Answer

The BGP neighbor IP is not reachable due to an ACL on the ISP router

Answer

The BGP update-source is set to a different interface

Answer

The BGP configuration has 'next-hop-self' disabled