NSE7 Troubleshooting and Diagnostics Practice Test 7 — 15 Questions

Question 1

An administrator is troubleshooting an IPsec VPN tunnel that fails to establish. The Phase 1 status shows 'init' and the debug output indicates 'no suitable proposal found'. The remote peer is a third-party VPN device. Which of the following is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The IKE version or encryption algorithm does not match between the peers. The 'no suitable proposal found' error in Phase 1 indicates that the IKE proposal parameters (such as encryption algorithm, hash algorithm, Diffie-Hellman group, or IKE version) do not match between the FortiGate and the third-party peer. Since the status is 'init', the peers have exchanged initial packets but cannot agree on a common proposal, which is a classic proposal mismatch issue. A pre-shared key mismatch would typically cause an authentication failure later in Phase 1, not a 'no suitable proposal' error.

Answer

The pre-shared key is incorrect on one side

Answer

The remote peer's IP address is not reachable

Answer

The firewall policy allowing the VPN traffic is missing

Question 2

A FortiGate administrator wants to verify whether a specific session is being offloaded to the NP6 processor. Which CLI command should the administrator use?

Accepted Answer

diagnose sys session filter src 10.0.0.1 ; diagnose sys session list. The 'diagnose sys session filter src 10.0.0.1' command sets a filter to isolate sessions from a specific source IP, and 'diagnose sys session list' then displays the session details, including the 'offload' field. This field explicitly indicates whether the session is offloaded to the NP6 processor (e.g., 'offload yes' or 'np6 offload'). This is the standard method to verify NP6 offloading for a specific session.

Answer

get system performance status

Answer

diagnose hardware sysinfo memory

Answer

diagnose npu np6 session list

Question 3

During a failover test in an active-passive HA cluster, the administrator notices that the secondary unit does not take over the primary role after a link failure on the primary. The 'get system ha status' shows both units in 'standalone' mode. What is the MOST likely cause?

Accepted Answer

The HA heartbeat interface is down or misconfigured on one unit. When both units show 'standalone' mode in 'get system ha status', it indicates that the HA cluster has lost communication between the primary and secondary units, causing them to operate independently. The most common cause is a failure or misconfiguration of the HA heartbeat interface, which is the dedicated link used for cluster synchronization and health monitoring. Without a functional heartbeat, the secondary cannot detect the primary's link failure and will not initiate a failover.

Answer

The session pickup feature is disabled

Answer

The cluster is running in active-active mode

Answer

The HA override feature is disabled

Question 4

An administrator configures SD-WAN with multiple members. The SD-WAN rule uses the 'latency' strategy. The administrator notices that traffic is not switching to the best-performing member even when latency exceeds the threshold. What could be the issue?

Accepted Answer

The SLA target is not configured or not applied to the SD-WAN rule. The latency-based SD-WAN rule requires an SLA target to define acceptable performance thresholds. Without an SLA target configured and applied to the rule, the FortiGate has no baseline to compare against, so it will never trigger a member switch even if latency exceeds the threshold. The SLA target must be linked to the SD-WAN rule via the 'set sla' command in the rule configuration.

Answer

The load balancing algorithm is set to 'source-ip-based'

Answer

The threshold is set too low

Answer

The SD-WAN members are in different VDOMs

Question 5

A FortiGate administrator is troubleshooting a VPN tunnel that is up but no traffic passes through. The Phase 2 selectors match. The administrator runs 'diagnose vpn tunnel list' and sees that the tunnel has '0 bytes' in both directions. What is the MOST likely cause?

Accepted Answer

The static route for the remote subnet does not point to the VPN tunnel interface. When a VPN tunnel is up but shows 0 bytes in both directions, it indicates that the control plane (IKE/IPsec SA negotiation) succeeded, but the data plane has no traffic. The most likely cause is that the static route for the remote subnet does not point to the VPN tunnel interface (e.g., 'tunnel.1'), so the FortiGate does not know to send traffic into the tunnel. Without a correct route, packets destined for the remote subnet are dropped or sent out the wrong interface, resulting in zero bytes on the tunnel.

Answer

The firewall policy is not configured to allow traffic through the tunnel

Answer

The IPsec SA rekey interval is too short

Answer

The NAT traversal is not enabled

Question 6

Which FortiGate command is used to view the current CPU usage of individual processes in real time?

Accepted Answer

diagnose sys top. The 'diagnose sys top' command on FortiGate provides a real-time, top-like display of CPU and memory usage for individual processes, allowing administrators to identify which specific daemons or tasks are consuming resources. This command is essential for troubleshooting performance issues at the process level, unlike other commands that show aggregate or different diagnostic data.

Answer

diagnose sys session stat

Answer

get system performance status

Answer

diagnose hardware sysinfo memory

Question 7

An administrator runs 'diagnose debug application ipsmonitor -1' and sees repeated messages: 'IPS engine restarting'. What is the MOST likely cause of this behavior?

Accepted Answer

The IPS engine is running out of memory. The 'IPS engine restarting' message in the output of 'diagnose debug application ipsmonitor -1' indicates that the IPS engine process is crashing and being automatically restarted by the FortiGate's watchdog. The most common cause of IPS engine crashes is memory exhaustion, as the engine requires a dedicated memory heap to process signatures and sessions; when this heap is depleted, the engine terminates to prevent system instability.

Answer

The FortiGate is overloaded with too many concurrent sessions

Answer

The firewall policy is configured for flow-based inspection

Answer

The IPS signatures are outdated and need updating

Question 8

Two FortiGate units in an HA cluster are experiencing synchronization issues. The administrator runs 'diagnose sys ha checksum cluster' and sees different checksum values for the 'system' and 'router' objects. What is the FIRST step to resolve the mismatch?

Accepted Answer

Execute 'execute ha synchronize start' from the primary unit. The 'diagnose sys ha checksum cluster' command reveals checksum mismatches for 'system' and 'router' objects, indicating that the HA cluster's configuration synchronization is incomplete or out of sync. The first step is to initiate a manual synchronization using 'execute ha synchronize start' from the primary unit, which forces the primary to push its full configuration database to the secondary unit, resolving the mismatch without disrupting services. This command is designed to trigger a full sync of all configuration objects, including system and router settings, without requiring a reboot or HA restart.

Answer

Upgrade the firmware on both units to the same version

Answer

Reboot both units to force a full sync

Answer

Disable and re-enable HA on both units

Question 9

Which of the following is a valid command to check the status of all BGP neighbors on a FortiGate?

Accepted Answer

get router info bgp summary. 'get router info bgp summary' is the standard FortiGate CLI command to display the status of all BGP neighbors, including their state, uptime, and prefixes received. This command retrieves the BGP routing table summary from the FortiGate's routing daemon, which is essential for verifying neighbor relationships and troubleshooting BGP peering issues.

Answer

diagnose router bgp summary

Answer

show bgp neighbors

Answer

diagnose ip router bgp all

Question 10

An administrator observes that traffic from a specific subnet is being dropped by the FortiGate. The session table shows the sessions with 'proto_state=01' and 'expire=0'. What does this indicate?

Accepted Answer

The sessions have expired and are being cleaned up. In FortiGate session tables, 'proto_state=01' indicates a TCP session in the SYN-SENT state (the first step of the three-way handshake), and 'expire=0' means the session has no remaining time-to-live. This combination typically occurs when the session timed out or was reset before completing the handshake, and the entry is now being cleaned up by the session table garbage collector. Option A is correct because these are stale sessions that have expired and are in the process of removal.

Answer

The antivirus scanning is causing a delay

Answer

The sessions are being offloaded to the NPU

Answer

The firewall policy is blocking the traffic

Question 11

An administrator is troubleshooting an IPsec VPN Phase 2 negotiation failure. The debug shows 'no matching phase 2 proposal' from the remote peer. Which TWO of the following are likely causes? (Choose two.)

Accepted Answer

The local and remote proxy IDs (subnets) are not matching. IPsec Phase 2 negotiation requires the proxy IDs (local and remote subnets) to match exactly between peers. The 'no matching phase 2 proposal' debug message indicates the remote peer received a proposal with a subnet or traffic selector that does not match its configured proxy ID. This is a common misconfiguration when defining which traffic should be encrypted over the VPN tunnel.

Answer

The pre-shared key is incorrect

Answer

The firewall policy does not allow UDP port 500

Answer

The IKE version (IKEv1 vs IKEv2) is different

Question 12

A FortiGate administrator is investigating a security incident and needs to identify which user initiated a specific outbound connection to a malicious IP address. The company uses FSSO for authentication. Which THREE pieces of information from FortiAnalyzer logs would be MOST useful? (Choose three.)

Accepted Answer

Username from the FortiGate authentication log. FSSO (Fortinet Single Sign-On) maps network sessions to Active Directory usernames via the FortiGate authentication log. When investigating which user initiated an outbound connection to a malicious IP, the username from this log directly ties the session to a specific identity, enabling attribution beyond just IP addresses.

Answer

Destination IP address

Answer

Event type (e.g., traffic, event, attack)

Question 13

An administrator notices that an application-based SD-WAN rule is not steering traffic as expected. The SLA targets are configured correctly. Which TWO debug commands should the administrator use to diagnose the issue? (Choose two.)

Accepted Answer

diagnose sys sdwan info. 'diagnose sys sdwan info' displays the current SD-WAN configuration and status, including SLA targets, interface metrics, and rule assignments, which helps verify if the SD-WAN rule is correctly applied. Option E is correct because filtering session entries by destination port 443 (HTTPS) and listing them shows active traffic flows, allowing the administrator to confirm whether the application traffic is being steered according to the SD-WAN rule or taking an unexpected path.

Answer

diagnose debug application sslvpn -1

Answer

get system performance status

Answer

diagnose sys sdwan rule list

Question 14

An administrator is troubleshooting an HA cluster where both units show as primary after a link failure. What is the most likely cause of this split-brain scenario?

Accepted Answer

The HA heartbeat interface is down or misconfigured. In a Fortinet HA cluster, the heartbeat interface is responsible for exchanging health and synchronization information between units. If this interface goes down or is misconfigured, the units lose communication and each assumes the other is dead, causing both to transition to the primary state (split-brain). This is the most common cause of split-brain scenarios in FortiGate HA clusters.

Answer

The priority values are set identically

Answer

The HA uptime is mismatched between the two units

Answer

The session pickup feature is disabled

Question 15

A FortiGate administrator runs 'diagnose debug application sslvpn -1' and sees repeated messages: 'SSL VPN tunnel error: no response from client'. What is the most likely cause?

Accepted Answer

The client cannot reach the FortiGate's SSL VPN IP or port. The 'no response from client' error in the SSL VPN debug output indicates that the FortiGate sent a tunnel setup request to the client but did not receive the expected reply. This typically happens when the client cannot reach the FortiGate's SSL VPN IP or port (default 443), often due to network connectivity issues, firewall rules blocking the port, or NAT problems. The error is specific to the transport layer between client and FortiGate, not authentication or configuration mismatches.

Answer

The authentication server is unreachable

Answer

The tunnel mode is configured for web mode instead of tunnel mode

Answer

The SSL VPN certificate has expired