NSE7 Troubleshooting and Diagnostics Practice Test 6 — 15 Questions

Question 1

An administrator is troubleshooting an IPsec VPN tunnel that fails to establish. The administrator runs 'diagnose vpn ike log' and sees the message 'no matching proposal found'. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Phase 1 parameters (encryption, authentication, DH group) do not match between peers. The 'no matching proposal found' message in the IKE log indicates that the FortiGate received a proposal from the remote peer during Phase 1 negotiation, but none of the offered combinations of encryption, authentication, and Diffie-Hellman group matched its own configured Phase 1 parameters. Since IKE uses a proposal/response exchange, a mismatch in any of these attributes causes the negotiation to fail before any further steps, such as authentication or policy lookup, can occur.

Answer

The remote gateway's IP address is unreachable

Answer

The firewall policy allowing the VPN traffic is missing or has the wrong interface

Answer

The pre-shared key is incorrect on one side

Question 2

A FortiGate administrator wants to quickly identify which process is consuming the most CPU on the device. Which CLI command should be used?

Accepted Answer

diagnose sys top. 'diagnose sys top' displays a real-time list of running processes sorted by CPU usage, allowing the administrator to quickly identify the most CPU-intensive process. This command is the standard FortiGate CLI tool for live process-level CPU monitoring, similar to the Linux 'top' command.

Answer

diagnose hardware sysinfo memory

Answer

diagnose debug application crashlog read

Answer

get system performance status

Question 3

An administrator notices that SD-WAN rule-based traffic is not failing over as expected when the primary link goes down. The SLA targets are configured correctly, and the interface health check is showing 'dead' for the primary link. What is the MOST likely reason for the failover not occurring?

Accepted Answer

The SD-WAN rule's 'set strategy' is 'manual' and the preferred member is still set to the primary interface. When an SD-WAN rule's strategy is set to 'manual', the rule uses a static preferred member list and will not automatically fail over to another member, even if the primary link's SLA health check status is 'dead'. The SLA targets are correctly configured and the health check is detecting the failure, but the manual strategy overrides dynamic path selection, so traffic continues to be sent to the dead primary interface. To enable failover, the strategy must be set to 'optimal' or 'maximize-bandwidth' (or similar dynamic strategy), or the preferred member must be manually updated.

Answer

The SD-WAN rule's 'set status' is set to 'disable'

Answer

The secondary interface has a higher cost than the primary interface

Answer

The 'set update-static-route' is not enabled on the SD-WAN

Question 4

A FortiGate is configured with multiple BGP peers. One of the peers is not receiving the expected routes. The administrator runs 'get router info bgp neighbors <IP>' and sees that the 'State/PfxRcd' field is 'Active'. What does this indicate?

Accepted Answer

The BGP session is in the Active state, meaning the FortiGate is trying to establish a TCP connection to the peer. The 'Active' state in BGP indicates that the FortiGate has sent an OPEN message and is waiting for a TCP connection from the peer, or is actively retrying the TCP connection. This means the session has not yet reached the Established state, so no routes are being exchanged. Option C correctly identifies that the FortiGate is attempting to establish a TCP connection to the peer.

Answer

The BGP peer has reached the maximum prefix limit

Answer

The BGP peer has been administratively shut down

Answer

The BGP session has been established and routes are being exchanged

Question 5

An administrator is investigating a security incident and needs to view raw logs from a FortiAnalyzer for a specific time range. The administrator wants to ensure the logs are not aggregated or summarized. Which type of log view should be used?

Accepted Answer

Log View. The Log View in FortiAnalyzer displays raw, unaggregated logs exactly as received from FortiGate devices, making it the correct choice for viewing logs without summarization. Unlike other views that pre-process or summarize data, Log View provides direct access to the original log entries for a specified time range, which is essential for detailed incident investigation.

Answer

Event Management

Answer

FortiView

Answer

Reports

Question 6

An administrator wants to monitor the session count on a FortiGate in real time. Which CLI command provides this information?

Accepted Answer

diagnose sys session stat. 'diagnose sys session stat' is the specific FortiGate CLI command that displays real-time session statistics, including the total number of sessions currently tracked by the firewall. This command provides a live count of active sessions, which is exactly what the administrator needs for real-time monitoring.

Answer

diagnose sys top

Answer

get system performance status

Answer

diagnose debug enable

Question 7

A FortiGate administrator observes that traffic from an internal user to the internet is being blocked. The firewall policy allows the traffic, and the user can ping external hosts. The administrator runs 'diagnose debug flow' for the user's IP and sees 'session denied by forward policy check'. What is the MOST likely cause?

Accepted Answer

There is an implicit deny policy blocking the traffic. The 'session denied by forward policy check' message in a debug flow output indicates that the session was explicitly denied by a firewall policy check, not by a security profile or rate-limiting mechanism. Since the firewall policy allows the traffic, the most likely cause is the implicit deny policy at the end of the policy list, which blocks any traffic that does not match an explicit allow policy. The ability to ping external hosts suggests ICMP is allowed by a separate policy, while TCP/UDP traffic for other services is hitting the implicit deny.

Answer

The antivirus profile has detected a threat and is blocking the session

Answer

The user's traffic is being rate-limited by a traffic shaper

Answer

The user's source IP is in a local-in policy that denies the traffic

Question 8

A FortiGate in an HA cluster shows the message 'split-brain detected' in the event log. The administrator checks the HA status and sees both units are in 'standalone' mode. What is the MOST likely cause of this split-brain scenario?

Accepted Answer

The heartbeat interface is down on both units, causing them to assume they are the primary. When the heartbeat interface fails on both units, each FortiGate loses communication with its peer and assumes it is the sole surviving unit. This causes both to transition to 'standalone' mode and operate independently, which is the classic split-brain scenario. The event log message 'split-brain detected' confirms that the cluster has lost heartbeat connectivity, leading to each unit believing it must take over as primary.

Answer

The HA priority is set to the same value on both units

Answer

The HA mode is set to 'active-active' instead of 'active-passive'

Answer

The HA cluster is using a unicast heartbeat and the configuration is incorrect

Question 9

An administrator needs to check the health of an SD-WAN link by viewing the last SLA probe results. Which command should be used?

Accepted Answer

diagnose sys virtual-wan-link health-check. The command `diagnose sys virtual-wan-link health-check` displays the last SLA probe results for SD-WAN links, including metrics like latency, jitter, and packet loss. This command is specifically designed for FortiGate SD-WAN (formerly virtual-wan-link) to verify real-time health-check status, which is essential for troubleshooting link performance.

Answer

diagnose sys sdwan sla-log

Answer

get system interface physical

Answer

diagnose debug application sdwan -1

Question 10

A FortiGate administrator is troubleshooting a VPN tunnel that connects to a remote site. The tunnel is up, but traffic is not passing. The administrator checks the Phase 2 settings and sees that the local and remote subnets are correctly defined. What is the next step to diagnose the issue?

Accepted Answer

Check the firewall policies that reference the VPN interface. When the VPN tunnel is up (Phase 1 and Phase 2 are established) but traffic is not passing, the most common cause is that a firewall policy referencing the VPN interface is either missing or misconfigured. Even with correct Phase 2 selectors and routing, the FortiGate will drop traffic if no policy explicitly permits it from the source to the destination over the VPN interface. Therefore, checking the firewall policies is the logical next step.

Answer

Check the routing table for the remote subnet

Answer

Run 'diagnose vpn ike log' to check for Phase 1 errors

Answer

Restart the VPN tunnel

Question 11

An administrator is troubleshooting a BGP session that is not establishing between two FortiGates. The administrator has verified that the neighbor IP is reachable. Which TWO commands should be used to further diagnose the issue? (Choose two.)

Accepted Answer

get router info bgp neighbor . 'get router info bgp neighbor ' displays detailed BGP session state information, including the current state (e.g., Idle, Connect, Active, OpenSent, OpenConfirm, Established), hold timer, keepalive interval, and any error codes or notifications. This command directly reveals why the session is not establishing, such as a mismatch in BGP capabilities, AS numbers, or authentication.

Answer

diagnose debug flow filter daddr <IP>

Answer

get router info routing-table bgp

Answer

diagnose sys session filter dport 179

Question 12

A FortiGate administrator is investigating a slow network performance issue. The administrator suspects that session table limits are being reached. Which TWO metrics should be monitored to confirm this? (Choose two.)

Accepted Answer

Session fail rate. The session fail rate (B) directly indicates when the FortiGate is unable to establish new sessions because the session table is full, which is a clear symptom of hitting session table limits. The current session count (C) shows how many sessions are active; when this approaches the maximum session limit (e.g., 2 million on a FortiGate-600E), it confirms the table is near capacity. Monitoring both metrics together provides definitive evidence of session table exhaustion.

Answer

Interface bandwidth utilization

Answer

CPU usage

Answer

Memory usage

Question 13

An administrator is configuring a FortiGate to inspect SMTP traffic for spam and viruses. The traffic must be decrypted to inspect the content. Which THREE elements are required for this configuration? (Choose three.)

Accepted Answer

A spam filter profile applied to the firewall policy. A spam filter profile is required to inspect SMTP traffic for spam. FortiGate uses this profile to apply anti-spam techniques such as DNSBL, SURBL, and heuristic analysis on the email content after decryption. Without it, spam detection cannot occur.

Answer

A web filter profile applied to the firewall policy

Answer

An application control profile applied to the firewall policy

Question 14

A FortiGate administrator notices that after upgrading the firmware, some BGP sessions to a service provider are flapping. The administrator runs 'diagnose ip router bgp all' and sees that the BGP neighbor state is Active. What is the MOST likely cause of this issue?

Accepted Answer

A configuration checksum mismatch between the two peers. After a firmware upgrade, a BGP session stuck in the Active state is most commonly caused by a configuration checksum mismatch between the two peers. FortiGate uses a BGP configuration checksum to ensure that both sides have identical BGP configurations; if the checksums do not match after an upgrade (e.g., due to a change in default parameters or a new feature), the session will not establish and will remain in Active. This is a known behavior in FortiOS where the checksum is compared during the BGP open message exchange, and a mismatch prevents the session from moving to Established.

Answer

The BGP hold timer has expired

Answer

The BGP neighbor is not reachable due to a routing issue

Answer

The BGP password is incorrect

Question 15

A network admin runs 'diagnose sys top' on a FortiGate and sees that the process 'httpsd' is consistently using 95% CPU. Which of the following actions is MOST appropriate to troubleshoot this issue?

Accepted Answer

Check the number of active admin sessions and consider stopping the web GUI service temporarily. The httpsd process handles the FortiGate web GUI (HTTPS) and API requests. High CPU usage by httpsd typically indicates excessive admin sessions or web GUI activity. Option D is correct because checking active admin sessions and temporarily stopping the web GUI service (e.g., via 'config system global set admin-https-redirect disable' or stopping the service) directly addresses the likely cause without disrupting firewall processing or requiring policy changes.

Answer

Restart the FortiGate firewall engine with 'diagnose test application fgwbd 255'

Answer

Disable the antivirus profile on all policies to reduce processing load

Answer

Increase the log rate to capture more details about the httpsd process