NSE7 Troubleshooting and Diagnostics Practice Test 8 — 15 Questions

Question 1

You execute 'diagnose sys session filter dport 443' and see output: 'proto=6 proto_state=01 duration=3600 expire=3599'. What does 'proto_state=01' indicate about this session?

Accepted Answer

The session is in the SYN_SENT state, waiting for SYN-ACK. In Fortinet's FortiOS, the 'proto_state' field in session diagnostic output represents the TCP state machine. A value of '01' corresponds to the SYN_SENT state (TCP state 1), indicating that the session has sent a SYN packet and is waiting for a SYN-ACK response. This is consistent with the initial phase of a TCP three-way handshake.

Answer

The session is in the FIN_WAIT state

Answer

The session has completed the three-way handshake

Answer

The session has been terminated with a RST

Question 2

An administrator is configuring SD-WAN with multiple members. When a rule matches, traffic is not being load-balanced as expected. Which command should the admin use to verify the SD-WAN rule selection for a specific flow?

Accepted Answer

diagnose sys sdwan info. 'diagnose sys sdwan info' is the FortiOS command that displays detailed SD-WAN rule selection information, including which rule matched for a specific flow and how traffic is being load-balanced across members. This command provides real-time diagnostics on SD-WAN path selection, rule IDs, and member usage, which directly addresses the administrator's need to verify rule matching and load-balancing behavior.

Answer

diagnose sys session list

Answer

get system sdwan status

Answer

diagnose netlink interface list

Question 3

A BGP peering between two FortiGates is not establishing. The admin runs 'get router info bgp summary' and sees the neighbor state as 'Idle'. What is the most common cause of a BGP session stuck in Idle?

Accepted Answer

The neighbor IP is not reachable or the TCP port 179 is blocked. The Idle state in BGP indicates that the session has not started or has been reset, often because the underlying TCP connection cannot be established. The most common cause is that the neighbor IP is unreachable or TCP port 179 is blocked by a firewall or ACL, preventing the three-way handshake. Without TCP connectivity, BGP cannot transition out of Idle, regardless of other configurations.

Answer

The BGP update timer is set too high

Answer

The remote AS number is misconfigured

Answer

The route advertisement is disabled

Question 4

When troubleshooting an IPsec VPN phase 1 negotiation failure, which debug command should the administrator run to see detailed IKE negotiation messages?

Accepted Answer

diagnose debug application ike -1. The command 'diagnose debug application ike -1' enables detailed IKE (Internet Key Exchange) debug messages in FortiOS, which are essential for troubleshooting Phase 1 negotiation failures. This command captures the full IKE negotiation exchange, including proposals, authentication, and Diffie-Hellman group selection, allowing the administrator to identify where the failure occurs.

Answer

diagnose vpn ike log

Answer

get vpn ipsec tunnel details

Answer

diagnose debug application ipsec -1

Question 5

An administrator is investigating a security incident and needs to determine which firewall policy allowed a specific malicious traffic flow. The traffic is no longer active. Which FortiAnalyzer log type should the admin query?

Accepted Answer

Traffic logs. Traffic logs record every session that passes through the FortiGate, including the source/destination IPs, ports, policy ID, and action taken. Since the traffic is no longer active, the administrator must query historical traffic logs in FortiAnalyzer to identify which firewall policy permitted the malicious flow. Event logs, security logs, and audit logs do not contain the per-session policy mapping needed for this forensic analysis.

Answer

Event logs

Answer

Security logs

Answer

Audit logs

Question 6

An administrator notices high CPU usage on a FortiGate. To identify which process is consuming the most CPU, which command should be used?

Accepted Answer

diagnose sys top. The 'diagnose sys top' command displays a real-time list of running processes on the FortiGate, sorted by CPU usage, allowing the administrator to identify which process is consuming the most CPU. This is the standard diagnostic tool for process-level CPU troubleshooting in FortiOS.

Answer

diagnose sys session stat

Answer

get system performance status

Answer

diagnose hardware sysinfo

Question 7

An administrator needs to verify if a FortiGate is receiving BGP routes from a peer. Which command should the admin run to see the BGP routing table?

Accepted Answer

get router info bgp table. 'get router info bgp table' is the exact FortiOS CLI command to display the BGP routing table, showing all BGP-learned routes and their attributes. This command is specific to FortiGate's proprietary CLI syntax, which differs from Cisco IOS or generic Linux networking commands. The administrator needs this output to verify received BGP prefixes from a peer.

Answer

get router info routing-table bgp

Answer

show ip bgp

Answer

diagnose ip router bgp table

Question 8

When troubleshooting a FortiGate that is not synchronizing configuration to its HA peer, which command should be used to check the HA synchronization status?

Accepted Answer

get system ha status. 'get system ha status' is the standard operational command on FortiGate to display the current HA synchronization status, including whether the configuration is synchronized, the HA mode, and the peer status. This command provides a clear, human-readable output that directly indicates if the configuration is in sync or out of sync, which is essential for troubleshooting synchronization issues.

Answer

diagnose sys ha sync-status

Answer

diagnose sys ha status

Answer

show system ha

Question 9

An administrator configures an ALG for SIP traffic but notices that some SIP calls are failing. The admin suspects the ALG is modifying SIP headers incorrectly. Which debug command can help verify the ALG's actions on SIP packets?

Accepted Answer

diagnose debug application sip -1. The command 'diagnose debug application sip -1' enables detailed debugging of the SIP ALG process on FortiGate, showing how the ALG inspects and modifies SIP headers (e.g., Via, Contact, SDP). This allows the admin to verify if the ALG is incorrectly rewriting IP addresses or ports, which is a common cause of call failures. The '-1' flag sets the debug level to maximum verbosity, capturing all ALG-related SIP transactions.

Answer

diagnose debug application alg -1

Answer

get system performance status

Answer

diagnose sys session filter proto 17

Question 10

An administrator wants to see the current number of active sessions on a FortiGate. Which command should the admin use?

Accepted Answer

diagnose sys session stat. The command 'diagnose sys session stat' displays a summary of session statistics, including the total number of active sessions currently tracked by the FortiGate's session table. This is the correct way to quickly see the current active session count without listing every individual session, which would be overwhelming and resource-intensive.

Answer

diagnose sys session list

Answer

get system performance status

Answer

get system ha status

Question 11

An administrator is troubleshooting an IPsec VPN where phase 1 is up but phase 2 fails. Which two debug commands would be MOST helpful in diagnosing the phase 2 issue? (Choose TWO.)

Accepted Answer

diagnose vpn ipsec phase2-config. 'diagnose vpn ipsec phase2-config' displays the phase 2 configuration parameters (e.g., proxy IDs, encryption/authentication algorithms, and SA lifetimes) that must match between peers. Option E is correct because 'diagnose debug application ike -1' enables real-time IKEv1/IKEv2 debugging, which shows the exact phase 2 negotiation messages (e.g., Quick Mode exchanges) and any error codes or mismatches. Together, they allow you to identify configuration mismatches or negotiation failures that prevent phase 2 from establishing.

Answer

diagnose sys session list

Answer

diagnose debug application ipsec -1

Answer

get vpn ipsec tunnel details

Question 12

During a BGP troubleshooting session, an administrator sees that the BGP neighbor state is 'Active'. Which three conditions could cause this state? (Choose THREE.)

Accepted Answer

The remote AS number is misconfigured. A misconfigured remote AS number causes the BGP neighbor to remain in the 'Active' state. BGP uses the remote AS number to validate the OPEN message; if the AS number in the OPEN message does not match the configured remote AS, the session is rejected, and the neighbor stays in Active, repeatedly attempting to establish a TCP connection.

Answer

The BGP update timer is too short

Answer

The maximum-prefix limit has been exceeded

Question 13

An administrator is configuring SD-WAN and wants to ensure that voice traffic uses the lowest latency link. Which two configurations are required to achieve this? (Choose TWO.)

Accepted Answer

Configure a performance SLA with latency threshold. A performance SLA with a latency threshold allows FortiGate to measure real-time latency to a target server and mark the link quality. Option D is correct because an SD-WAN rule using the 'best quality' strategy will dynamically select the link with the lowest latency (as determined by the SLA) for voice traffic, ensuring optimal voice quality.

Answer

Configure a static route for the voice subnet

Answer

Set the SD-WAN rule to use 'manual' strategy

Answer

Enable NAT on the SD-WAN interface

Question 14

A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?

Accepted Answer

SSL/TLS deep inspection is not enabled on the firewall policy. When HTTPS traffic is not scanned by an antivirus profile despite the policy being correct and antivirus enabled, the most likely cause is that SSL/TLS deep inspection is not enabled on the firewall policy. Without deep inspection, FortiGate cannot decrypt the encrypted HTTPS payload, so the antivirus engine sees only encrypted data and cannot scan for malware. Enabling deep inspection with a valid CA certificate allows FortiGate to perform man-in-the-middle decryption and then apply antivirus scanning to the decrypted content.

Answer

The web server's certificate is self-signed and FortiGate is rejecting the connection

Answer

The FortiGuard antivirus subscription has expired

Answer

The antivirus profile is configured for flow-based inspection instead of proxy-based

Question 15

An HA cluster of two FortiGates is experiencing split-brain. Which command should the administrator use to check the current HA status and identify which unit is the primary?

Accepted Answer

get system ha status. The correct command to check the current HA status and identify the primary unit is 'get system ha status'. This command displays the HA mode, cluster state, role (primary/secondary), and peer status in a clear, human-readable format. In a split-brain scenario, the administrator needs to quickly confirm which unit believes it is the primary, and this command provides that information directly without debug-level verbosity.

Answer

diagnose debug application had 0

Answer

diagnose sys ha dump

Answer

show system ha