NSE7 Troubleshooting and Diagnostics Practice Test 8 — 15 Questions

Question 1

An administrator configures an ALG for SIP traffic but notices that some SIP calls are failing. The admin suspects the ALG is modifying SIP headers incorrectly. Which debug command can help verify the ALG's actions on SIP packets?

Accepted Answer

diagnose debug application sip -1. 'diagnose debug application sip -1' enables SIP ALG debugging, showing how the ALG processes SIP messages.

Answer

diagnose debug application alg -1

Answer

get system performance status

Answer

diagnose sys session filter proto 17

Question 2

An administrator wants to see the current number of active sessions on a FortiGate. Which command should the admin use?

Accepted Answer

diagnose sys session stat. 'diagnose sys session stat' displays session statistics including total active sessions.

Answer

diagnose sys session list

Answer

get system performance status

Answer

get system ha status

Question 3

An administrator is troubleshooting an IPsec VPN where phase 1 is up but phase 2 fails. Which two debug commands would be MOST helpful in diagnosing the phase 2 issue? (Choose TWO.)

Accepted Answer

diagnose vpn ipsec phase2-config. Phase 2 uses IPsec SA negotiation, which is logged by IKE debug. Additionally, checking the phase 2 configuration can reveal mismatches. The correct commands are A and D.

Answer

diagnose sys session list

Answer

diagnose debug application ipsec -1

Answer

get vpn ipsec tunnel details

Question 4

During a BGP troubleshooting session, an administrator sees that the BGP neighbor state is 'Active'. Which three conditions could cause this state? (Choose THREE.)

Accepted Answer

The remote AS number is misconfigured. Active state means BGP is trying to initiate a TCP connection but hasn't succeeded. Common causes include incorrect neighbor IP, ASN mismatch, or TCP port blocking.

Answer

The BGP update timer is too short

Answer

The maximum-prefix limit has been exceeded

Question 5

An administrator is configuring SD-WAN and wants to ensure that voice traffic uses the lowest latency link. Which two configurations are required to achieve this? (Choose TWO.)

Accepted Answer

Configure a performance SLA with latency threshold. To steer traffic based on latency, you need a performance SLA with latency measurement and an SD-WAN rule that matches the voice traffic and uses the lowest latency strategy.

Answer

Configure a static route for the voice subnet

Answer

Set the SD-WAN rule to use 'manual' strategy

Answer

Enable NAT on the SD-WAN interface

Question 6

A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?

Accepted Answer

SSL/TLS deep inspection is not enabled on the firewall policy. Option B is correct because HTTPS uses TLS encryption. Without SSL deep inspection enabled on the policy, FortiGate cannot decrypt and inspect the content of HTTPS traffic. The antivirus profile will only scan unencrypted traffic or traffic where deep inspection has decrypted it first.

Answer

The web server's certificate is self-signed and FortiGate is rejecting the connection

Answer

The FortiGuard antivirus subscription has expired

Answer

The antivirus profile is configured for flow-based inspection instead of proxy-based

Question 7

An administrator runs 'diagnose sys session filter dport 443' and sees output indicating sessions with state 'proto=6 proto_state=01 duration=3600 expire=3598'. What does this output indicate about the session?

Accepted Answer

The session is an established TCP session to port 443, lasting 3600 seconds with 3598 seconds remaining. Option A is correct. The output shows a TCP session (proto=6) with state 01 (TCP session established). Duration and expire values are in seconds. This indicates an active TCP session that has been established for 3600 seconds (1 hour) and will expire in 3598 seconds.

Answer

The session is an expired TCP session that is being removed

Answer

The session is a UDP session to port 443 that has been idle for 3600 seconds

Answer

The session is blocked by a firewall policy and has been logged

Question 8

An HA cluster of two FortiGates is experiencing split-brain. Which command should the administrator use to check the current HA status and identify which unit is the primary?

Accepted Answer

get system ha status. Option B is correct. The 'get system ha status' command displays detailed HA information including the cluster status, primary/secondary roles, and synchronization state. It helps identify split-brain when both units show themselves as primary.

Answer

diagnose debug application had 0

Answer

diagnose sys ha dump

Answer

show system ha

Question 9

An administrator is testing failover in an HA cluster. They unplug the primary FortiGate's port1 (the heartbeat interface) but the secondary does not take over. The heartbeat is configured on port1. What is the MOST likely cause?

Accepted Answer

The primary unit still has a heartbeat path through other interfaces. Option C is correct. In HA, failover is triggered by loss of heartbeat plus loss of monitored ports or a dead gateway. Simply unplugging the heartbeat interface may cause split-brain, not failover, because the primary is still operational and the secondary still sees the primary's heartbeat? Actually, unplugging the heartbeat interface on the primary means the secondary loses heartbeat. But if the primary still has other monitored ports up, it will remain primary. However, the secondary should detect loss of heartbeat and become primary after a timeout. But if the primary still has heartbeat on another path? The question says heartbeat is configured on port1 and that port was unplugged. The likely cause is that the primary still has another heartbeat interface or the failover threshold is not met. Option C is the most plausible.

Answer

The HA uptime is less than the failover hold time

Answer

The secondary unit's priority is higher than the primary's

Answer

The secondary unit has a faulty power supply

Question 10

An SD-WAN rule is configured to steer traffic based on SLA metrics. The administrator notices that traffic is not using the expected member interface even though the SLA is meeting thresholds. What should the administrator check FIRST?

Accepted Answer

Run 'diagnose sys sdwan info' to verify the rule and member status. Option A is correct. The 'diagnose sys sdwan info' command provides real-time information about SD-WAN rules, member status, SLA performance, and route selection. It is the first step to troubleshoot why traffic is not following the expected path.

Answer

Check the firewall policy to ensure SD-WAN is enabled

Answer

Verify the BGP configuration to ensure routes are being advertised

Answer

Restart the FortiGate to clear any stale sessions

Question 11

A site-to-site IPsec VPN tunnel is failing. The administrator runs 'diagnose vpn ike config' and sees that phase 1 parameters are correct. However, phase 2 negotiation fails with 'no proposal chosen'. What is the MOST likely cause?

Accepted Answer

The phase 2 encryption/authentication algorithms do not match between peers. Option A is correct. The 'no proposal chosen' error in phase 2 indicates a mismatch in the phase 2 parameters (encryption, authentication, PFS, etc.) between the two peers. The administrator should verify that the phase 2 selectors and proposals match on both ends.

Answer

The pre-shared key is incorrect

Answer

The firewall policy allowing IKE traffic is missing

Answer

The remote gateway IP address is wrong

Question 12

A BGP peering between two FortiGates is not establishing. The administrator runs 'get router info bgp neighbor' and sees that the neighbor state is 'Idle' and the BGP configuration appears correct. What should the administrator check next?

Accepted Answer

Verify that the BGP neighbor IP is reachable via the routing table. Option D is correct. A neighbor state of 'Idle' often indicates that BGP is administratively disabled or there is a problem with the underlying connectivity. The most common cause is that the BGP neighbor is not reachable via a valid route or the interface is down. Checking the routing table and connectivity is the next step.

Answer

Run 'diagnose ip router bgp all enable' to enable debug

Answer

Check the BGP AS number configuration

Answer

Increase the BGP timers

Question 13

A FortiGate administrator wants to check if the device is experiencing high CPU usage due to a specific process. Which command should they use to display real-time process CPU usage?

Accepted Answer

diagnose sys top. Option A is correct. 'diagnose sys top' shows real-time CPU and memory usage per process, similar to the Linux 'top' command. It helps identify which process is consuming CPU.

Answer

show system resource

Answer

get system performance status

Answer

diagnose debug application crashlog read

Question 14

An administrator configures a session helper for FTP on FortiGate. After enabling the helper, FTP clients can establish control connections but data transfers fail. What is the most likely cause?

Accepted Answer

The session helper is not applied to the correct firewall policy or the traffic is not matching the helper. Option C is correct. FTP uses separate control and data connections. The session helper dynamically opens pinholes for data connections. If the ALG/session helper is not correctly inspecting the control channel, it may not open the required data ports, causing transfers to fail. However, the question implies the helper is enabled but not working. Often this is due to asymmetric routing or the helper not seeing both directions. But the most common cause is that the FTP ALG is not inspecting the traffic because the policy does not match the helper's expected traffic. Option C is the best fit.

Answer

The firewall policy is configured to deny all FTP traffic

Answer

The FTP server's certificate is invalid

Answer

The FTP server is using active mode, which is not supported by the session helper

Question 15

An administrator is troubleshooting a split-brain situation in an HA cluster. They run 'get system ha status' and see that both FortiGates report themselves as primary. Which command should they run to force the secondary unit to take over as primary?

Accepted Answer

diagnose sys ha reset-uptime. Option D is correct. The 'diagnose sys ha reset-uptime' command resets the HA uptime on the unit, causing it to recalculate priority. If the other unit has a higher priority, this can force a failover. Alternatively, 'execute ha failover' is not a valid command. The correct command to force a failover is 'execute ha failover set'? Actually, FortiGate does not have a direct failover command. The standard method is to reboot the primary or use 'diagnose sys ha reset-uptime'. Option D is the most appropriate.

Answer

execute ha failover

Answer

reboot the primary unit

Answer

diagnose sys ha stop