NSE7 Troubleshooting and Diagnostics Practice Test 5 — 15 Questions

Question 1

An administrator needs to monitor the FortiGate's CPU usage in real-time from the CLI. Which command should be used?

Accepted Answer

diagnose sys top. 'diagnose sys top' is the FortiGate CLI command that provides a real-time, top-like display of CPU usage per process, including process IDs and CPU consumption percentages. This command is specifically designed for live performance monitoring and troubleshooting from the CLI, unlike static snapshots or debug outputs.

Answer

diagnose debug application httpsd

Answer

diagnose hardware sysinfo memory

Answer

get system performance status

Question 2

After upgrading FortiGate firmware, an admin notices that several sessions using SIP are failing. The SIP ALG was enabled before the upgrade. What is the MOST likely cause?

Accepted Answer

The SIP ALG configuration was reset to default, affecting session handling. Upgrading FortiGate firmware can reset the SIP ALG configuration to its default settings, which may alter session handling parameters such as timeouts, port ranges, or application-layer gateway (ALG) behavior. This default reset often causes previously working SIP sessions to fail, especially if custom SIP ALG settings were used to accommodate specific VoIP environments. The SIP ALG remains enabled after the upgrade, but its default configuration may not match the pre-upgrade customizations, leading to session failures.

Answer

The SIP session helper is now deprecated

Answer

The SIP service port changed

Answer

The FortiGate's SIP inspection profile was removed

Question 3

An HA cluster of two FortiGates is experiencing split-brain. After investigation, you find that the heartbeat link is down on the primary unit. Which action will resolve the split-brain condition?

Accepted Answer

Restore the heartbeat link by checking cables, interfaces, and VLAN configuration. Split-brain occurs when HA peers lose heartbeat communication and both assume the primary role. Since the root cause is a failed heartbeat link on the primary unit, restoring that link (checking cables, interfaces, VLAN configuration) re-establishes the control channel, allowing the cluster to negotiate roles and resolve the split-brain condition without disrupting services or requiring a full HA reset.

Answer

Disable HA on both units and re-enable

Answer

Increase the HA priority on the primary unit

Answer

Reboot the secondary unit

Question 4

An administrator wants to see the current sessions for a specific source IP address 192.168.1.10. Which CLI command should be used?

Accepted Answer

diagnose sys session filter src 192.168.1.10; diagnose sys session list. The `diagnose sys session filter src` command sets a filter for the source IP address, and `diagnose sys session list` then displays only the sessions matching that filter. This two-step process is the standard FortiGate CLI method for viewing active sessions for a specific source IP, as it leverages the session table directly without triggering debug overhead.

Answer

get system session list src 192.168.1.10

Answer

diagnose debug flow src-addr 192.168.1.10

Answer

execute session list source 192.168.1.10

Question 5

A FortiGate VPN tunnel shows 'phase1 negotiation failed' in the logs. The remote gateway is a third-party device. The debug command 'diagnose vpn ike config' shows mismatched proposals. Which setting is MOST likely incorrect on the FortiGate?

Accepted Answer

The encryption algorithm (e.g., AES256 vs 3DES). The 'diagnose vpn ike config' command displays the IKE proposal parameters (encryption, authentication, DH group) that the FortiGate is configured to offer. When the log shows 'phase1 negotiation failed' and the debug output indicates 'mismatched proposals', it means the FortiGate's configured encryption algorithm (e.g., AES256) does not match any algorithm supported by the remote third-party device (e.g., 3DES). This is the most direct cause of proposal mismatch, as IKE phase 1 requires both sides to agree on a common transform set.

Answer

The pre-shared key

Answer

The local ID type

Answer

The DPD configuration

Question 6

Which two commands display the current session count on a FortiGate?

Accepted Answer

get system performance status. Both 'get system performance status' and 'diagnose sys session stat' display the current session count on a FortiGate. 'get system performance status' provides a real-time snapshot including active sessions, while 'diagnose sys session stat' shows session table statistics such as total and used sessions. Therefore, both commands are valid answers to the question.

Answer

show system session

Answer

diagnose hardware sysinfo session

Question 7

An SD-WAN rule uses a performance SLA to steer traffic to the best-quality link. Traffic is consistently using the backup link even though the primary link meets SLA thresholds. The admin runs 'diagnose sys sdwan sla-check' and sees the primary link SLA status is 'pass'. What is the MOST likely cause?

Accepted Answer

The SD-WAN rule's strategy is not set to 'Best Quality' or 'SLA'. The SD-WAN rule's strategy determines how traffic is steered. If the strategy is not set to 'Best Quality' or 'SLA', the rule will not use the performance SLA results to select the best link, even if the SLA status shows 'pass'. The primary link may be passing SLA thresholds, but without the correct strategy, the rule will ignore SLA status and may use a different selection method (e.g., lowest cost or load balancing), causing traffic to use the backup link.

Answer

The primary link's interface is administratively down

Answer

The primary link's cost is set higher than the backup

Answer

The backup link has a higher bandwidth

Question 8

A FortiGate admin notices that sessions to a particular server are not being logged in FortiAnalyzer. The firewall policy has logging enabled. What is the MOST likely reason?

Accepted Answer

The FortiGate is not configured to send logs to FortiAnalyzer. The most likely reason is that the FortiGate is not configured to send logs to FortiAnalyzer. Even if the firewall policy has logging enabled, logs are only generated locally on the FortiGate; they must be explicitly forwarded to FortiAnalyzer via the 'config log fortianalyzer setting' CLI or GUI configuration. Without this configuration, no logs reach FortiAnalyzer regardless of policy settings.

Answer

The FortiAnalyzer's device registration is incorrect

Answer

The log queue on FortiGate is full

Answer

The FortiAnalyzer is out of disk space

Question 9

During a failover test in an HA cluster, the primary FortiGate fails over to the secondary. After failover, some existing TCP sessions are dropped. What is the MOST likely reason?

Accepted Answer

Session pickup is not enabled on the HA cluster. In an HA cluster, session pickup (also known as session synchronization) is responsible for replicating session tables from the primary FortiGate to the secondary. When failover occurs, if session pickup is not enabled, the secondary FortiGate has no knowledge of existing TCP sessions, causing them to be dropped. This is the most likely reason because the secondary device cannot forward traffic for sessions it does not recognize, even if the network topology remains unchanged.

Answer

The failover caused a routing change

Answer

The session TTL expired during failover

Answer

The HA mode is active-passive

Question 10

A BGP route from an ISP is not appearing in the FortiGate's routing table. The BGP session is established and 'show ip bgp' shows the route as valid but not best. Which command should the admin use to investigate why the route is not selected as best?

Accepted Answer

diagnose ip router bgp routes. 'diagnose ip router bgp routes' is the FortiGate command that displays detailed BGP route information, including the reason a route is not selected as best (e.g., higher local preference, longer AS path, or lower MED). Since the BGP session is up and the route is valid but not best, this command reveals the tie-breaking criteria that caused the route to lose the best-path selection process.

Answer

execute router bgp show

Answer

get router info bgp summary

Answer

diagnose ip router bgp network

Question 11

An admin is troubleshooting an IPsec VPN tunnel that is failing phase 2. The IKE debug shows 'no matching proposal'. Which TWO settings should the admin verify on both sides? (Choose two.)

Accepted Answer

Encryption algorithm (e.g., AES128, AES256). In IPsec phase 2, the IKE debug message 'no matching proposal' indicates a mismatch in the security association (SA) parameters used to establish the IPsec SA. The encryption algorithm (option B) is a core component of the IPsec proposal that must match exactly on both peers. Perfect Forward Secrecy (PFS) using a Diffie-Hellman group (option C) is also negotiated during phase 2; if one side requires PFS and the other does not, or if the DH groups differ, phase 2 will fail with this error.

Answer

Dead Peer Detection interval

Answer

Pre-shared key

Answer

Local and remote gateway IP addresses

Question 12

An admin needs to verify that a new firewall policy is performing SSL inspection. Which THREE CLI commands or steps should the admin use to confirm? (Choose three.)

Accepted Answer

Use 'diagnose wad filter' to check if traffic is being processed by the web proxy for SSL inspection. 'diagnose wad filter' is used to verify that traffic is being processed by the web proxy (WAD) for SSL inspection. When SSL inspection is enabled, traffic on port 443 is intercepted by the FortiGate's proxy, and this command filters and displays relevant proxy sessions, confirming that decryption is occurring.

Answer

Run 'diagnose debug flow' to check if traffic is hitting the policy

Answer

Run 'get system performance status' to see SSL inspection statistics

Question 13

A FortiGate is experiencing high CPU usage due to a large number of sessions. Which TWO actions can the admin take to mitigate the issue? (Choose two.)

Accepted Answer

Set a shorter session TTL for idle sessions to free up resources. Setting a shorter session TTL for idle sessions (Option A) reduces the time inactive sessions remain in the session table, freeing up memory and CPU resources used for session maintenance. This directly addresses high CPU caused by a large number of sessions by accelerating the cleanup of stale entries.

Answer

Increase the session table size

Answer

Upgrade the firmware to the latest version

Answer

Disable all security profiles

Question 14

An administrator runs 'diagnose debug application ssl-helper -1' and sees that sessions to certain HTTPS sites are being terminated by the FortiGate. What is the MOST likely cause?

Accepted Answer

The FortiGate is performing TCP RST injection due to a mismatch in the SSL/TLS handshake as part of deep inspection. The 'diagnose debug application ssl-helper -1' command shows SSL helper events, including TCP RST injection. When deep inspection is enabled and the FortiGate cannot complete the SSL/TLS handshake with the server (e.g., due to cipher mismatch, certificate validation failure, or unsupported protocol version), it sends a TCP RST to both the client and server to terminate the session. This is the most direct cause of sessions being terminated as observed in the debug output.

Answer

The FortiGate's certificate authority (CA) certificate has expired, causing SSL inspection to fail

Answer

The antivirus profile is blocking the HTTPS connections due to a virus signature match

Answer

The SSL deep inspection policy is set to 'certificate-inspection' which blocks sessions with mismatched certificates

Question 15

An administrator configures an HA cluster with two FortiGates using an FGCP active-passive configuration. After a failover, the new primary FortiGate shows all sessions are lost. The administrator has 'sync session' enabled in the HA configuration. What is the MOST likely reason sessions were not synchronized?

Accepted Answer

The HA heartbeat interface is overloaded, causing session synchronization packets to be dropped. In an FGCP active-passive cluster, session synchronization relies on the heartbeat interface to transmit session-pickup packets from the active unit to the passive unit. If the heartbeat interface is overloaded (e.g., due to excessive traffic or misconfigured bandwidth), these packets can be dropped, causing the passive unit to lack the session table after a failover. The fact that 'sync session' is enabled but sessions are still lost points directly to a transport issue on the heartbeat link, not a configuration or policy problem.

Answer

The passive unit's 'session-pickup' setting is disabled

Answer

The 'failover-monitor' interface is down on the active unit, preventing session sync

Answer

The 'session-ttl' setting is set to zero on the active unit