NSE7 Troubleshooting and Diagnostics Practice Test 9 — 15 Questions

Question 1

An administrator is testing failover in an HA cluster. They unplug the primary FortiGate's port1 (the heartbeat interface) but the secondary does not take over. The heartbeat is configured on port1. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The primary unit still has a heartbeat path through other interfaces. In a FortiGate HA cluster, the heartbeat interface is used to monitor the health of the primary unit. When the primary's port1 (heartbeat interface) is unplugged, the cluster can still maintain communication if the primary has an alternative heartbeat path through other interfaces (e.g., a dedicated HA management interface or a secondary heartbeat link). This prevents the secondary from detecting a complete failure, so it does not initiate a failover.

Answer

The HA uptime is less than the failover hold time

Answer

The secondary unit's priority is higher than the primary's

Answer

The secondary unit has a faulty power supply

Question 2

An SD-WAN rule is configured to steer traffic based on SLA metrics. The administrator notices that traffic is not using the expected member interface even though the SLA is meeting thresholds. What should the administrator check FIRST?

Accepted Answer

Run 'diagnose sys sdwan info' to verify the rule and member status. 'diagnose sys sdwan info' provides a real-time view of SD-WAN rule status, member interface health, and SLA compliance. This command directly shows whether the rule is matching traffic and if the expected member is active or has been deprioritized due to implicit factors like session stickiness or load-balancing algorithm, which are not visible in the SLA thresholds alone.

Answer

Check the firewall policy to ensure SD-WAN is enabled

Answer

Verify the BGP configuration to ensure routes are being advertised

Answer

Restart the FortiGate to clear any stale sessions

Question 3

A site-to-site IPsec VPN tunnel is failing. The administrator runs 'diagnose vpn ike config' and sees that phase 1 parameters are correct. However, phase 2 negotiation fails with 'no proposal chosen'. What is the MOST likely cause?

Accepted Answer

The phase 2 encryption/authentication algorithms do not match between peers. The 'no proposal chosen' error in phase 2 indicates that the IPsec security association (SA) parameters—specifically the encryption algorithm, authentication algorithm, or Diffie-Hellman group—do not match between the two peers. Since the administrator confirmed phase 1 is correct via 'diagnose vpn ike config', the issue is isolated to phase 2 proposal mismatch, making option B the most likely cause.

Answer

The pre-shared key is incorrect

Answer

The firewall policy allowing IKE traffic is missing

Answer

The remote gateway IP address is wrong

Question 4

A BGP peering between two FortiGates is not establishing. The administrator runs 'get router info bgp neighbor' and sees that the neighbor state is 'Idle' and the BGP configuration appears correct. What should the administrator check next?

Accepted Answer

Verify that the BGP neighbor IP is reachable via the routing table. When a BGP neighbor is stuck in the 'Idle' state, it typically indicates that BGP cannot initiate the TCP connection to the neighbor. The most common cause is that the neighbor IP address is not reachable via the routing table. Even if the BGP configuration (AS number, neighbor IP) is correct, BGP will remain Idle until it can successfully open a TCP session on port 179. Therefore, verifying IP reachability (e.g., with 'ping' or checking the routing table) is the logical next step.

Answer

Run 'diagnose ip router bgp all enable' to enable debug

Answer

Check the BGP AS number configuration

Answer

Increase the BGP timers

Question 5

A FortiGate administrator wants to check if the device is experiencing high CPU usage due to a specific process. Which command should they use to display real-time process CPU usage?

Accepted Answer

diagnose sys top. The 'diagnose sys top' command provides a real-time, top-like view of FortiGate processes, showing CPU and memory usage per process. This allows the administrator to identify which specific process is consuming high CPU, making it the correct choice for this diagnostic task.

Answer

show system resource

Answer

get system performance status

Answer

diagnose debug application crashlog read

Question 6

An administrator configures a session helper for FTP on FortiGate. After enabling the helper, FTP clients can establish control connections but data transfers fail. What is the most likely cause?

Accepted Answer

The session helper is not applied to the correct firewall policy or the traffic is not matching the helper. The session helper for FTP must be explicitly applied to the firewall policy that handles the FTP traffic. If the helper is enabled globally but not associated with the correct policy, or if the traffic does not match the policy (e.g., due to incorrect source/destination or service), the FortiGate will not inspect the control channel to dynamically open data ports. This results in successful control connections (TCP port 21) but failure of data transfers (active or passive), as the helper is not present to create the necessary pinholes for data sessions.

Answer

The firewall policy is configured to deny all FTP traffic

Answer

The FTP server's certificate is invalid

Answer

The FTP server is using active mode, which is not supported by the session helper

Question 7

An administrator is troubleshooting a split-brain situation in an HA cluster. They run 'get system ha status' and see that both FortiGates report themselves as primary. Which command should they run to force the secondary unit to take over as primary?

Accepted Answer

diagnose sys ha reset-uptime. 'diagnose sys ha reset-uptime' resets the HA uptime counter on the local unit. In Fortinet HA, during a split-brain, both units have the same priority and uptime may be a tiebreaker. To force the secondary to become primary, the administrator should run this command on the current primary to reset its uptime counter to zero. This makes the secondary's uptime higher, so when the next HA election occurs (e.g., after a link flap or manual trigger), the secondary will be elected as the new primary, resolving the split-brain condition.

Answer

execute ha failover

Answer

reboot the primary unit

Answer

diagnose sys ha stop

Question 8

A FortiGate is configured to send logs to FortiAnalyzer. The administrator notices that logs are not appearing on FortiAnalyzer. Running 'diagnose log device show' shows 'connected=no'. What is the most likely cause?

Accepted Answer

The FortiGate cannot reach the FortiAnalyzer due to a network issue. The 'diagnose log device show' output showing 'connected=no' indicates that the TCP connection between the FortiGate and FortiAnalyzer (typically on port 514 for syslog or port 514/3000 for FortiAnalyzer protocol) is not established. The most likely cause is a network issue preventing the FortiGate from reaching the FortiAnalyzer, as the connection status is directly tied to Layer 3 reachability and TCP handshake completion.

Answer

The log rate is too high and logs are being dropped

Answer

The FortiGate's log buffer is full

Answer

The FortiAnalyzer license has expired

Question 9

An administrator wants to verify that a BGP route is being advertised to a neighbor. Which command displays the routes that FortiGate is advertising to a specific BGP neighbor?

Accepted Answer

get router info bgp neighbor advertised-routes. The command 'get router info bgp neighbor advertised-routes' is the specific FortiOS CLI command that displays the BGP routes that the FortiGate has advertised to a particular BGP neighbor. This command queries the BGP table for routes that have been sent to the neighbor and are in the Adj-RIB-Out, which is exactly what the administrator needs to verify outbound route advertisement.

Answer

get router info bgp network

Answer

diagnose ip router bgp routes

Answer

show ip bgp summary

Question 10

An administrator is troubleshooting an IPsec VPN tunnel that establishes phase 1 but fails phase 2. Which TWO commands are MOST useful to diagnose the phase 2 failure? (Choose two.)

Accepted Answer

diagnose vpn ike config. The 'diagnose vpn ike config' command (D) displays the IKE configuration that the FortiGate is actually using for phase 2 negotiations, including proxy IDs, encryption algorithms, and lifetimes. This helps identify mismatches between the local and peer configurations that cause phase 2 to fail. The 'diagnose debug application ike 255' command (E) enables verbose IKE debugging, which logs every phase 2 exchange, including error messages like 'no proposal chosen' or 'mismatched proxy ID', directly pinpointing the failure reason.

Answer

diagnose sys session list

Answer

show vpn ipsec phase2-interface

Answer

get system performance status

Question 11

An administrator is configuring SD-WAN and wants to ensure that traffic matching a specific SLA rule uses the best-performing member. Which TWO commands can be used to verify the SLA performance and route selection? (Choose two.)

Accepted Answer

diagnose sys sdwan health-check. The 'diagnose sys sdwan health-check' command displays real-time SLA performance metrics for each SD-WAN member, including latency, jitter, and packet loss. Option D is correct because 'diagnose sys sdwan info' provides detailed information about SD-WAN zones, rules, and the current best-performing member selected for each SLA rule. Both commands are essential for verifying SLA compliance and route selection in FortiGate SD-WAN.

Answer

diagnose sys session list

Answer

get router info routing-table

Answer

show system sdwan

Question 12

A network administrator is troubleshooting an IPsec VPN tunnel that fails to establish. The remote gateway logs show a proposal mismatch. On FortiGate, the administrator runs 'diagnose vpn ike config' and sees 'proposal: aes128-sha1, aes256-sha256'. The remote side expects 'aes256-sha1'. What is the most likely cause?

Accepted Answer

The Phase 1 proposal list does not include the algorithm combination the remote gateway requires. The 'diagnose vpn ike config' output shows the FortiGate's Phase 1 proposal list includes 'aes128-sha1' and 'aes256-sha256', but the remote gateway expects 'aes256-sha1'. Since neither of the local proposals matches the remote's required combination, the IKE negotiation fails with a 'proposal mismatch' error. The administrator must add 'aes256-sha1' to the Phase 1 proposal list on the FortiGate to align with the remote gateway's expectation.

Answer

The pre-shared key is incorrect

Answer

The Phase 2 selectors are misconfigured

Answer

The IKE version is set to 1 but remote uses 2

Question 13

An administrator observes that after a failover in an HA cluster, some established sessions are dropped. The cluster is configured with session pickup enabled. What is the most likely reason for the dropped sessions?

Accepted Answer

Session pickup only synchronizes TCP sessions, and the dropped sessions are UDP. Session pickup in FortiGate HA synchronizes state information for TCP sessions by default, but UDP sessions are not synchronized because they are connectionless and do not have a stateful handshake. When a failover occurs, the new primary unit does not have the UDP session state, causing those sessions to be dropped. This is a known limitation of session pickup, which only covers TCP sessions unless specifically configured for UDP via session-ttl or other mechanisms.

Answer

The failover occurred during a configuration synchronization

Answer

The HA uptime is less than the session TTL

Answer

The session helper for the protocol is not enabled

Question 14

An administrator runs 'diagnose debug application sslvpn -1' and sees repeated 'SSL_ERROR_SSL: error:1417C0C7:SSL routines:tls_process_client_certificate:peer did not return a certificate'. The SSL-VPN is configured to require client certificates. What is the cause?

Accepted Answer

The client is not sending a client certificate. The error 'SSL_ERROR_SSL: error:1417C0C7:SSL routines:tls_process_client_certificate:peer did not return a certificate' occurs during the TLS handshake when the server requests a client certificate and the client fails to provide one. Since the SSL-VPN is configured to require client certificates, the FortiGate expects the client to present a valid certificate; if none is sent, the handshake fails with this specific OpenSSL error. This directly indicates that the client is not sending a client certificate, making option A correct.

Answer

The SSL-VPN server certificate is expired

Answer

The SSL-VPN tunnel mode is misconfigured

Answer

The CA certificate is not imported on FortiGate

Question 15

A FortiGate is configured with SD-WAN and multiple members. The administrator notices that traffic to a critical application is consistently routed over a low-quality link, even though a better link is available. The SD-WAN rule uses the 'Best Quality' strategy with a performance SLA. What is the most likely reason?

Accepted Answer

The better link is failing its SLA probes. When an SD-WAN rule uses the 'Best Quality' strategy with a performance SLA, the FortiGate selects the member link that best meets the SLA targets (e.g., jitter, latency, packet loss). If the better link is failing its SLA probes, it is considered out of compliance and will not be selected, even if it is physically available and has higher bandwidth. This causes traffic to be routed over the lower-quality link that still passes the SLA.

Answer

The better link is in 'standby' mode

Answer

The SD-WAN rule is using source-based routing

Answer

The application traffic is not matching the SD-WAN rule