NSE7 Troubleshooting and Diagnostics Practice Test 9 — 15 Questions

Question 1

A FortiGate is configured to send logs to FortiAnalyzer. The administrator notices that logs are not appearing on FortiAnalyzer. Running 'diagnose log device show' shows 'connected=no'. What is the most likely cause?

Accepted Answer

The FortiGate cannot reach the FortiAnalyzer due to a network issue. Option B is correct. 'connected=no' indicates that the FortiGate is not successfully establishing a connection to the FortiAnalyzer. This is commonly due to network connectivity issues between the two devices or incorrect IP/port configuration.

Answer

The log rate is too high and logs are being dropped

Answer

The FortiGate's log buffer is full

Answer

The FortiAnalyzer license has expired

Question 2

An administrator wants to verify that a BGP route is being advertised to a neighbor. Which command displays the routes that FortiGate is advertising to a specific BGP neighbor?

Accepted Answer

get router info bgp neighbor advertised-routes. Option A is correct. 'get router info bgp neighbor advertised-routes' shows all routes that the FortiGate is advertising to that specific BGP neighbor. This is the standard command for verifying outbound route advertisement.

Answer

get router info bgp network

Answer

diagnose ip router bgp routes

Answer

show ip bgp summary

Question 3

An administrator is troubleshooting an IPsec VPN tunnel that establishes phase 1 but fails phase 2. Which TWO commands are MOST useful to diagnose the phase 2 failure? (Choose two.)

Accepted Answer

diagnose vpn ike config. Options A and D are correct. 'diagnose vpn ike config' shows the IKE configuration including phase 2 proposals and selectors. 'diagnose debug application ike 255' enables detailed IKE debug, which will show the negotiation details including phase 2 failure reasons.

Answer

diagnose sys session list

Answer

show vpn ipsec phase2-interface

Answer

get system performance status

Question 4

A FortiGate HA cluster is experiencing persistent split-brain even after both units are rebooted. Which THREE actions should the administrator take to resolve this issue? (Choose three.)

Accepted Answer

Verify that the heartbeat interfaces are properly connected and configured. Options A, B, and E are correct. Changing the HA mode to active-passive ensures no concurrent primaries. Increasing the failover threshold (hold time) can prevent flapping. Verifying heartbeat interface connectivity ensures proper communication. Option C (disabling HA) is not a resolution; option D (reducing priority) does not fix split-brain root cause.

Answer

Reduce the priority on the secondary unit

Answer

Disable HA on both units and re-enable

Question 5

An administrator is configuring SD-WAN and wants to ensure that traffic matching a specific SLA rule uses the best-performing member. Which TWO commands can be used to verify the SLA performance and route selection? (Choose two.)

Accepted Answer

diagnose sys sdwan health-check. Options B and D are correct. 'diagnose sys sdwan info' shows detailed SD-WAN information including SLA performance and routing decisions. 'diagnose sys sdwan health-check' shows the health-check results for each member, which is essential for SLA verification.

Answer

diagnose sys session list

Answer

get router info routing-table

Answer

show system sdwan

Question 6

A network administrator is troubleshooting an IPsec VPN tunnel that fails to establish. The remote gateway logs show a proposal mismatch. On FortiGate, the administrator runs 'diagnose vpn ike config' and sees 'proposal: aes128-sha1, aes256-sha256'. The remote side expects 'aes256-sha1'. What is the most likely cause?

Accepted Answer

The Phase 1 proposal list does not include the algorithm combination the remote gateway requires. The proposal mismatch occurs because the FortiGate's IKE proposal includes aes256-sha256 but not aes256-sha1, and the remote gateway expects aes256-sha1. The correct action is to add aes256-sha1 to the proposal list.

Answer

The pre-shared key is incorrect

Answer

The Phase 2 selectors are misconfigured

Answer

The IKE version is set to 1 but remote uses 2

Question 7

An administrator observes that after a failover in an HA cluster, some established sessions are dropped. The cluster is configured with session pickup enabled. What is the most likely reason for the dropped sessions?

Accepted Answer

Session pickup only synchronizes TCP sessions, and the dropped sessions are UDP. Session pickup synchronizes sessions between HA members, but if the session was established before the cluster was fully synchronized, or if the session table is full, sessions may be dropped. However, the most common reason is that session pickup only works for TCP sessions, not UDP or other protocols.

Answer

The failover occurred during a configuration synchronization

Answer

The HA uptime is less than the session TTL

Answer

The session helper for the protocol is not enabled

Question 8

An administrator runs 'diagnose debug application sslvpn -1' and sees repeated 'SSL_ERROR_SSL: error:1417C0C7:SSL routines:tls_process_client_certificate:peer did not return a certificate'. The SSL-VPN is configured to require client certificates. What is the cause?

Accepted Answer

The client is not sending a client certificate. The error indicates that the SSL-VPN server expects a client certificate (mutual authentication) but the client did not provide one. The administrator should check the client certificate configuration on the user's machine.

Answer

The SSL-VPN server certificate is expired

Answer

The SSL-VPN tunnel mode is misconfigured

Answer

The CA certificate is not imported on FortiGate

Question 9

A FortiGate is configured with SD-WAN and multiple members. The administrator notices that traffic to a critical application is consistently routed over a low-quality link, even though a better link is available. The SD-WAN rule uses the 'Best Quality' strategy with a performance SLA. What is the most likely reason?

Accepted Answer

The better link is failing its SLA probes. The 'Best Quality' strategy selects the best link based on measured performance. If the better link is not meeting the SLA, it will not be selected. The administrator should check the SLA thresholds and ensure the link is passing.

Answer

The better link is in 'standby' mode

Answer

The SD-WAN rule is using source-based routing

Answer

The application traffic is not matching the SD-WAN rule

Question 10

An administrator runs 'diagnose sys top' and sees process 'httpsd' consuming 95% CPU. What is the best immediate action to alleviate the issue?

Accepted Answer

Change the administration HTTPS port and restrict access to trusted hosts. The httpsd process handles HTTPS administrative access. High CPU could be due to brute-force attacks or excessive GUI logins. The best action is to change the administrative access port or limit access via trusted hosts.

Answer

Kill the httpsd process

Answer

Disable HTTPS administration access

Answer

Reboot the FortiGate

Question 11

Two FortiGates in an HA cluster are experiencing a split-brain scenario where both units become primary. The administrator checks the HA configuration and sees that the heartbeat interfaces are configured correctly but the link status is 'down' on both units. What could cause this?

Accepted Answer

The physical cable connecting the heartbeat interfaces is faulty. A split-brain occurs when heartbeat communication is lost. If the heartbeat interfaces show link down, it indicates a physical or layer-1 issue, such as a faulty cable or switch port.

Answer

The heartbeat interface has been administratively disabled

Answer

The HA group ID is different on each unit

Answer

The HA priority values are the same on both units

Question 12

An administrator is troubleshooting BGP and runs 'get router info bgp neighbors 10.0.0.1' and sees 'BGP state = Active'. The neighbor IP is reachable via ping. What is the most likely cause?

Accepted Answer

The BGP neighbor's remote-as is misconfigured. BGP state Active indicates the router is trying to initiate a TCP connection but has not received a response. Since ping works, the issue is likely a TCP port 179 issue, such as a firewall blocking the port or BGP misconfiguration (e.g., wrong remote AS).

Answer

The BGP update-source interface is missing

Answer

The BGP network statement is missing

Answer

The BGP router-id is not configured

Question 13

An administrator needs to monitor FortiGate session count and CPU usage over time using FortiAnalyzer. Which log type should be configured for this?

Accepted Answer

Performance logs. Performance monitoring logs contain periodic samples of system resource usage, including session count and CPU. The administrator should enable performance logging on FortiGate and send it to FortiAnalyzer.

Answer

Security logs

Answer

Event logs

Answer

Traffic logs

Question 14

An administrator configured a firewall policy to inspect SMTP traffic using an antivirus profile. However, email attachments are not being scanned. The FortiGate is operating in proxy-based inspection mode. What is the most likely cause?

Accepted Answer

The SMTP session helper is not enabled. SMTP traffic requires a specific session helper to be enabled for FortiGate to properly parse and scan email traffic. If the SMTP session helper is disabled, the antivirus profile may not scan the attachments correctly.

Answer

The policy is set to 'accept' instead of 'deny'

Answer

The email is sent over TLS encryption

Answer

The antivirus profile is set to flow-based inspection

Question 15

A FortiGate is receiving BGP routes from a neighbor but not advertising them to other peers. The administrator runs 'get router info bgp network' and sees the routes are in the BGP table but not advertised. What is the most likely cause?

Accepted Answer

An outbound route map is applied that filters these routes. BGP routes are not advertised unless they pass outbound filtering (prefix lists, route maps) or are not the best path. Additionally, if synchronization is enabled, routes must be in the IGP routing table. The most common cause is a missing or restrictive outbound route map.

Answer

BGP synchronization is enabled and the routes are not in the IGP

Answer

The next hop is unreachable

Answer

The router-id is the same as the peer